94075eb593e0b0d18a8d45ed16a58abe20ade26fa1c53642f6a6ea35e2ad89a4

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/10/2026, 12:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
94075eb593e0b0d18a8d45ed16a58abe20ade26fa1c53642f6a6ea35e2ad89a4.exe
Size 7.6MB
Sample261003-pryrjaydpf
SHA256 94075eb593e0b0d18a8d45ed16a58abe20ade26fa1c53642f6a6ea35e2ad89a4
MD5 b34d6ab5d47b67ab429dd6f8a4811c0e
SHA1 6d02eef477105a663033bd078985362b21187e18
SHA512 aff01fcccce0e480ed8782eb50aada36192002d09c909414f37dea805b9794d0802b3190a72ce62e5e451c65590057a1c69be09bba2dd233a0411f9e792aaaa9
SSDEEP 98304:WO3nQ4IirB4FyWEEA5FM4M2TuAu+ReZ/ItQWz4nfE+k:hQ4B5luhACc+k
TLSH
T1B2867C03F19A11E8C05DD179875A9232AA71BC594B3176EF0B9077222F7AFE06B3D760
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
388	alg.exe
1312	DiagnosticsHub.StandardCollector.Service.exe
3700	fxssvc.exe
4836	elevation_service.exe
1684	elevation_service.exe
2988	maintenanceservice.exe
3260	msdtc.exe
656	OSE.EXE
4792	PerceptionSimulationService.exe
3892	perfhost.exe
3972	locator.exe
4980	SensorDataService.exe
3800	snmptrap.exe
916	spectrum.exe
532	ssh-agent.exe
3452	TieringEngineService.exe
4576	AgentService.exe
3804	vds.exe
3288	vssvc.exe
4956	wbengine.exe
1644	WmiApSrv.exe
1632	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	94075eb593e0b0d18a8d45ed16a58abe20ade26fa1c53642f6a6ea35e2ad89a4.exe
\??\F:\	DiagnosticsHub.StandardCollector.Service.exe

Drops file in System32 directory 31 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\SensorDataService.exe	94075eb593e0b0d18a8d45ed16a58abe20ade26fa1c53642f6a6ea35e2ad89a4.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\locator.exe	94075eb593e0b0d18a8d45ed16a58abe20ade26fa1c53642f6a6ea35e2ad89a4.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	94075eb593e0b0d18a8d45ed16a58abe20ade26fa1c53642f6a6ea35e2ad89a4.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	94075eb593e0b0d18a8d45ed16a58abe20ade26fa1c53642f6a6ea35e2ad89a4.exe
File opened for modification	C:\Windows\system32\wbengine.exe	94075eb593e0b0d18a8d45ed16a58abe20ade26fa1c53642f6a6ea35e2ad89a4.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	94075eb593e0b0d18a8d45ed16a58abe20ade26fa1c53642f6a6ea35e2ad89a4.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\d4bcb1c19b11239b.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	94075eb593e0b0d18a8d45ed16a58abe20ade26fa1c53642f6a6ea35e2ad89a4.exe
File opened for modification	C:\Windows\system32\AgentService.exe	94075eb593e0b0d18a8d45ed16a58abe20ade26fa1c53642f6a6ea35e2ad89a4.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\alg.exe	94075eb593e0b0d18a8d45ed16a58abe20ade26fa1c53642f6a6ea35e2ad89a4.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	94075eb593e0b0d18a8d45ed16a58abe20ade26fa1c53642f6a6ea35e2ad89a4.exe
File opened for modification	C:\Windows\system32\dllhost.exe	94075eb593e0b0d18a8d45ed16a58abe20ade26fa1c53642f6a6ea35e2ad89a4.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	94075eb593e0b0d18a8d45ed16a58abe20ade26fa1c53642f6a6ea35e2ad89a4.exe
File opened for modification	C:\Windows\system32\spectrum.exe	94075eb593e0b0d18a8d45ed16a58abe20ade26fa1c53642f6a6ea35e2ad89a4.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	94075eb593e0b0d18a8d45ed16a58abe20ade26fa1c53642f6a6ea35e2ad89a4.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	94075eb593e0b0d18a8d45ed16a58abe20ade26fa1c53642f6a6ea35e2ad89a4.exe
File opened for modification	C:\Windows\system32\msiexec.exe	94075eb593e0b0d18a8d45ed16a58abe20ade26fa1c53642f6a6ea35e2ad89a4.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	94075eb593e0b0d18a8d45ed16a58abe20ade26fa1c53642f6a6ea35e2ad89a4.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	94075eb593e0b0d18a8d45ed16a58abe20ade26fa1c53642f6a6ea35e2ad89a4.exe
File opened for modification	C:\Windows\System32\vds.exe	94075eb593e0b0d18a8d45ed16a58abe20ade26fa1c53642f6a6ea35e2ad89a4.exe
File opened for modification	C:\Windows\system32\vssvc.exe	94075eb593e0b0d18a8d45ed16a58abe20ade26fa1c53642f6a6ea35e2ad89a4.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	94075eb593e0b0d18a8d45ed16a58abe20ade26fa1c53642f6a6ea35e2ad89a4.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	94075eb593e0b0d18a8d45ed16a58abe20ade26fa1c53642f6a6ea35e2ad89a4.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	94075eb593e0b0d18a8d45ed16a58abe20ade26fa1c53642f6a6ea35e2ad89a4.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	94075eb593e0b0d18a8d45ed16a58abe20ade26fa1c53642f6a6ea35e2ad89a4.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	94075eb593e0b0d18a8d45ed16a58abe20ade26fa1c53642f6a6ea35e2ad89a4.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	94075eb593e0b0d18a8d45ed16a58abe20ade26fa1c53642f6a6ea35e2ad89a4.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	94075eb593e0b0d18a8d45ed16a58abe20ade26fa1c53642f6a6ea35e2ad89a4.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_126703\javaw.exe	94075eb593e0b0d18a8d45ed16a58abe20ade26fa1c53642f6a6ea35e2ad89a4.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	94075eb593e0b0d18a8d45ed16a58abe20ade26fa1c53642f6a6ea35e2ad89a4.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	94075eb593e0b0d18a8d45ed16a58abe20ade26fa1c53642f6a6ea35e2ad89a4.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	94075eb593e0b0d18a8d45ed16a58abe20ade26fa1c53642f6a6ea35e2ad89a4.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	94075eb593e0b0d18a8d45ed16a58abe20ade26fa1c53642f6a6ea35e2ad89a4.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	94075eb593e0b0d18a8d45ed16a58abe20ade26fa1c53642f6a6ea35e2ad89a4.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	94075eb593e0b0d18a8d45ed16a58abe20ade26fa1c53642f6a6ea35e2ad89a4.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	94075eb593e0b0d18a8d45ed16a58abe20ade26fa1c53642f6a6ea35e2ad89a4.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	94075eb593e0b0d18a8d45ed16a58abe20ade26fa1c53642f6a6ea35e2ad89a4.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	94075eb593e0b0d18a8d45ed16a58abe20ade26fa1c53642f6a6ea35e2ad89a4.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	94075eb593e0b0d18a8d45ed16a58abe20ade26fa1c53642f6a6ea35e2ad89a4.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	94075eb593e0b0d18a8d45ed16a58abe20ade26fa1c53642f6a6ea35e2ad89a4.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	94075eb593e0b0d18a8d45ed16a58abe20ade26fa1c53642f6a6ea35e2ad89a4.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	94075eb593e0b0d18a8d45ed16a58abe20ade26fa1c53642f6a6ea35e2ad89a4.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	94075eb593e0b0d18a8d45ed16a58abe20ade26fa1c53642f6a6ea35e2ad89a4.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	94075eb593e0b0d18a8d45ed16a58abe20ade26fa1c53642f6a6ea35e2ad89a4.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	94075eb593e0b0d18a8d45ed16a58abe20ade26fa1c53642f6a6ea35e2ad89a4.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	94075eb593e0b0d18a8d45ed16a58abe20ade26fa1c53642f6a6ea35e2ad89a4.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	94075eb593e0b0d18a8d45ed16a58abe20ade26fa1c53642f6a6ea35e2ad89a4.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	94075eb593e0b0d18a8d45ed16a58abe20ade26fa1c53642f6a6ea35e2ad89a4.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	94075eb593e0b0d18a8d45ed16a58abe20ade26fa1c53642f6a6ea35e2ad89a4.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	94075eb593e0b0d18a8d45ed16a58abe20ade26fa1c53642f6a6ea35e2ad89a4.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	94075eb593e0b0d18a8d45ed16a58abe20ade26fa1c53642f6a6ea35e2ad89a4.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	94075eb593e0b0d18a8d45ed16a58abe20ade26fa1c53642f6a6ea35e2ad89a4.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	94075eb593e0b0d18a8d45ed16a58abe20ade26fa1c53642f6a6ea35e2ad89a4.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	94075eb593e0b0d18a8d45ed16a58abe20ade26fa1c53642f6a6ea35e2ad89a4.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	94075eb593e0b0d18a8d45ed16a58abe20ade26fa1c53642f6a6ea35e2ad89a4.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe

Direct Volume Access: Opens a physical disk for reading 1 TTPs 1 IoCs

Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

defense_evasion

Direct Volume Access

T1006

description	ioc	Process
File opened (read-only)	\??\PhysicalDrive0	SearchIndexer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	94075eb593e0b0d18a8d45ed16a58abe20ade26fa1c53642f6a6ea35e2ad89a4.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	DiagnosticsHub.StandardCollector.Service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	DiagnosticsHub.StandardCollector.Service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	94075eb593e0b0d18a8d45ed16a58abe20ade26fa1c53642f6a6ea35e2ad89a4.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	94075eb593e0b0d18a8d45ed16a58abe20ade26fa1c53642f6a6ea35e2ad89a4.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	94075eb593e0b0d18a8d45ed16a58abe20ade26fa1c53642f6a6ea35e2ad89a4.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008fb88d943353dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008a80b19c3353dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e490e39c3353dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000832a00953353dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007952c9943353dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003a53269d3353dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9926 = "M3U file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000008b5cb943353dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000017c51c953353dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9908 = "Wave Sound"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ec3dd5943353dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006d398f9d3353dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 42 IoCs

pid	Process
4488	94075eb593e0b0d18a8d45ed16a58abe20ade26fa1c53642f6a6ea35e2ad89a4.exe
4488	94075eb593e0b0d18a8d45ed16a58abe20ade26fa1c53642f6a6ea35e2ad89a4.exe
4488	94075eb593e0b0d18a8d45ed16a58abe20ade26fa1c53642f6a6ea35e2ad89a4.exe
4488	94075eb593e0b0d18a8d45ed16a58abe20ade26fa1c53642f6a6ea35e2ad89a4.exe
4488	94075eb593e0b0d18a8d45ed16a58abe20ade26fa1c53642f6a6ea35e2ad89a4.exe
4488	94075eb593e0b0d18a8d45ed16a58abe20ade26fa1c53642f6a6ea35e2ad89a4.exe
4488	94075eb593e0b0d18a8d45ed16a58abe20ade26fa1c53642f6a6ea35e2ad89a4.exe
4488	94075eb593e0b0d18a8d45ed16a58abe20ade26fa1c53642f6a6ea35e2ad89a4.exe
4488	94075eb593e0b0d18a8d45ed16a58abe20ade26fa1c53642f6a6ea35e2ad89a4.exe
4488	94075eb593e0b0d18a8d45ed16a58abe20ade26fa1c53642f6a6ea35e2ad89a4.exe
4488	94075eb593e0b0d18a8d45ed16a58abe20ade26fa1c53642f6a6ea35e2ad89a4.exe
4488	94075eb593e0b0d18a8d45ed16a58abe20ade26fa1c53642f6a6ea35e2ad89a4.exe
4488	94075eb593e0b0d18a8d45ed16a58abe20ade26fa1c53642f6a6ea35e2ad89a4.exe
4488	94075eb593e0b0d18a8d45ed16a58abe20ade26fa1c53642f6a6ea35e2ad89a4.exe
4488	94075eb593e0b0d18a8d45ed16a58abe20ade26fa1c53642f6a6ea35e2ad89a4.exe
4488	94075eb593e0b0d18a8d45ed16a58abe20ade26fa1c53642f6a6ea35e2ad89a4.exe
4488	94075eb593e0b0d18a8d45ed16a58abe20ade26fa1c53642f6a6ea35e2ad89a4.exe
4488	94075eb593e0b0d18a8d45ed16a58abe20ade26fa1c53642f6a6ea35e2ad89a4.exe
4488	94075eb593e0b0d18a8d45ed16a58abe20ade26fa1c53642f6a6ea35e2ad89a4.exe
4488	94075eb593e0b0d18a8d45ed16a58abe20ade26fa1c53642f6a6ea35e2ad89a4.exe
4488	94075eb593e0b0d18a8d45ed16a58abe20ade26fa1c53642f6a6ea35e2ad89a4.exe
4488	94075eb593e0b0d18a8d45ed16a58abe20ade26fa1c53642f6a6ea35e2ad89a4.exe
4488	94075eb593e0b0d18a8d45ed16a58abe20ade26fa1c53642f6a6ea35e2ad89a4.exe
4488	94075eb593e0b0d18a8d45ed16a58abe20ade26fa1c53642f6a6ea35e2ad89a4.exe
4488	94075eb593e0b0d18a8d45ed16a58abe20ade26fa1c53642f6a6ea35e2ad89a4.exe
4488	94075eb593e0b0d18a8d45ed16a58abe20ade26fa1c53642f6a6ea35e2ad89a4.exe
4488	94075eb593e0b0d18a8d45ed16a58abe20ade26fa1c53642f6a6ea35e2ad89a4.exe
4488	94075eb593e0b0d18a8d45ed16a58abe20ade26fa1c53642f6a6ea35e2ad89a4.exe
4488	94075eb593e0b0d18a8d45ed16a58abe20ade26fa1c53642f6a6ea35e2ad89a4.exe
4488	94075eb593e0b0d18a8d45ed16a58abe20ade26fa1c53642f6a6ea35e2ad89a4.exe
4488	94075eb593e0b0d18a8d45ed16a58abe20ade26fa1c53642f6a6ea35e2ad89a4.exe
4488	94075eb593e0b0d18a8d45ed16a58abe20ade26fa1c53642f6a6ea35e2ad89a4.exe
4488	94075eb593e0b0d18a8d45ed16a58abe20ade26fa1c53642f6a6ea35e2ad89a4.exe
4488	94075eb593e0b0d18a8d45ed16a58abe20ade26fa1c53642f6a6ea35e2ad89a4.exe
4488	94075eb593e0b0d18a8d45ed16a58abe20ade26fa1c53642f6a6ea35e2ad89a4.exe
1312	DiagnosticsHub.StandardCollector.Service.exe
1312	DiagnosticsHub.StandardCollector.Service.exe
1312	DiagnosticsHub.StandardCollector.Service.exe
1312	DiagnosticsHub.StandardCollector.Service.exe
1312	DiagnosticsHub.StandardCollector.Service.exe
1312	DiagnosticsHub.StandardCollector.Service.exe
1312	DiagnosticsHub.StandardCollector.Service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
660	Process not Found
660	Process not Found

Suspicious use of AdjustPrivilegeToken 43 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3132	94075eb593e0b0d18a8d45ed16a58abe20ade26fa1c53642f6a6ea35e2ad89a4.exe
Token: SeAuditPrivilege	3700	fxssvc.exe
Token: SeRestorePrivilege	3452	TieringEngineService.exe
Token: SeManageVolumePrivilege	3452	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	4576	AgentService.exe
Token: SeBackupPrivilege	3288	vssvc.exe
Token: SeRestorePrivilege	3288	vssvc.exe
Token: SeAuditPrivilege	3288	vssvc.exe
Token: SeBackupPrivilege	4956	wbengine.exe
Token: SeRestorePrivilege	4956	wbengine.exe
Token: SeSecurityPrivilege	4956	wbengine.exe
Token: 33	1632	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1632	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1632	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1632	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1632	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1632	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1632	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1632	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1632	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1632	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1632	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1632	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1632	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1632	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1632	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1632	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1632	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1632	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1632	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1632	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1632	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1632	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1632	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1632	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1632	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1632	SearchIndexer.exe
Token: SeDebugPrivilege	4488	94075eb593e0b0d18a8d45ed16a58abe20ade26fa1c53642f6a6ea35e2ad89a4.exe
Token: SeDebugPrivilege	4488	94075eb593e0b0d18a8d45ed16a58abe20ade26fa1c53642f6a6ea35e2ad89a4.exe
Token: SeDebugPrivilege	4488	94075eb593e0b0d18a8d45ed16a58abe20ade26fa1c53642f6a6ea35e2ad89a4.exe
Token: SeDebugPrivilege	4488	94075eb593e0b0d18a8d45ed16a58abe20ade26fa1c53642f6a6ea35e2ad89a4.exe
Token: SeDebugPrivilege	4488	94075eb593e0b0d18a8d45ed16a58abe20ade26fa1c53642f6a6ea35e2ad89a4.exe
Token: SeDebugPrivilege	1312	DiagnosticsHub.StandardCollector.Service.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3132 wrote to memory of 4488	3132	94075eb593e0b0d18a8d45ed16a58abe20ade26fa1c53642f6a6ea35e2ad89a4.exe	85
PID 1632 wrote to memory of 4932	1632	SearchIndexer.exe	111
PID 1632 wrote to memory of 1812	1632	SearchIndexer.exe	112

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\94075eb593e0b0d18a8d45ed16a58abe20ade26fa1c53642f6a6ea35e2ad89a4.exe
"C:\Users\Admin\AppData\Local\Temp\94075eb593e0b0d18a8d45ed16a58abe20ade26fa1c53642f6a6ea35e2ad89a4.exe"
1⤵
- Drops file in System32 directory
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3132
- C:\Users\Admin\AppData\Local\Temp\94075eb593e0b0d18a8d45ed16a58abe20ade26fa1c53642f6a6ea35e2ad89a4.exe
  C:\Users\Admin\AppData\Local\Temp\94075eb593e0b0d18a8d45ed16a58abe20ade26fa1c53642f6a6ea35e2ad89a4.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=131.0.5877.116 --initial-client-data=0x284,0x288,0x28c,0x234,0x290,0x1406f3eb8,0x1406f3ec4,0x1406f3ed0
  2⤵
  - Enumerates connected drives
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4488

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:388

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1312

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:1088

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3700

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4836

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1684

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2988

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:3260

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:656

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4792

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3892

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:3972

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4980

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:3800

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:916

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:532

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:3956

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3452

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4576

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:3804

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3288

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4956

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:1644

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Direct Volume Access: Opens a physical disk for reading
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1632
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4932
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:1812

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Direct Volume Access

T1006

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 49c539d7c612c15acc24edb9941ea608c5ebcc38bf7a72c5d1160bf1533944e0
MD5 98e35e9c2804195bf03e57329ead39ec
SHA1 011224b50180b353514cbadaa5aa99781c1cd213
SHA512 d8af7fb434e9c890b49835de6b08e5e5f135a147eed908cb51670c96473a439a7420cb041ba39cb10fd98f250deaabf99829218a42bd5736e254af9287687333
SSDEEP 49152:1b+632BuPkFKRrdE6ohQstBhuXjfS4LWxncB+kn3Hnx:L3q6tjBb+k
TLSH
T164D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 e237d20e2ec3828992da31483fba1a218e735cb7f9037600fbab55ff420e13ba
MD5 7b209ff576e5a9a8e1f028cdde45ff20
SHA1 89bb22e73d8f2f6461ed2e25372cd9e6ef1e444e
SHA512 79ddfa49b2f463a029c802af8e4f7f9da28dd46699d4c548ab71b2b9e0c2fd79b3914bf221089fba703bd7e5bdf3dac99f7541aa6440370c60f39bb77eb5d855
SSDEEP 12288:f1XLsswWkxy2lRq2czAtLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTQ:dXYfDtczAyNyBo4kx929bL3Hnx
TLSH
T1B965012967D409F9ED6B927CC8A28511DA33BC4547A0E7CB03A489761F337D85E3EB42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 3119baaa7b03db6f5794e15ad802626a0f31abfe55dc75ff95283d21ef82ec53
MD5 a1c5a44f7a4afc0d8179855b1fd3b854
SHA1 f0ec92965fbc0bcb702c30015564f294d8d697bd
SHA512 d54ddae429bb9192e8274ddb1dded171a252d3f9d389134471f463c7317f69cd86a8907384c1541655f0d4663aea5440e2bcdbf48ed313f095e90987cac96da2
SSDEEP 12288:JXZNYVLeyUji0h90ZD0wxpyZIVuKrHsELDAptNyvUgXZ32dT4ePc7N29Cxs5+j2i:f0Le5ji0hmxxrMbNyBo4kx929bL3Hnx
TLSH
T1EA859E16F6788335D073C0B9C5D2A69EED7130861B308ACB4286D77C7E67AE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 e8f459275711e6e00e18f0e3b057ae5e26536402b9290895d29119956701af65
MD5 d435671c618b39694624f724e664a9b9
SHA1 71e407beb086def5d2f9b25c0a91083f0e00c8c6
SHA512 ec4ee46be6b4fe3753eb746817ee7abb6722e100c4c54c553e95cfbe9c11360bf8133d19fc30719f5cd88d09dff26b986c1891282e1e707879c995f5473a3ff8
SSDEEP 24576:ba7/ezSC6vUyDZaqgrvWx6q8wyuBNyBo4kx929bL3Hnx:2/ezSC6vURPvMHjyTB+kn3Hnx
TLSH
T14A755C25F5788323D0B2D0BAC5D6AA99FE3230465B3089DB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 549052d44c39df6d8330eacd4611392801692868d2d7453c8e0ea67c899edc85
MD5 98b5e5553d80c428c318e254e51c33ce
SHA1 8e1bbc76667c81be704765ab5d78c313c842c144
SHA512 c5e6531a47002630d4b559e39d72d6d8174c4a77936e34662d7259ba5b4dac051a7d1aa5b533481d2e529d17f2a95764fae901c7255f75209bfa5bff9e73f7b6
SSDEEP 12288:lVJjBq33vb5O8M+l1D0hwsEBoW/l84Zf0Im985LDAptNyvUgXZ32dT4ePc7N29CD:lVbqPb88hv/lV7mNyBo4kx929bL3Hnx
TLSH
T106559E66F5748331D073C0B9C4D2AA9AEE3234425B31CACB1246D76C2E67BE6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 1fe1d5274f03b81f5a27f2af4b5437ed8dc11c4b066204a8c86f209582463db0
MD5 308a6ae9fb7b28d1002cfab14bc57f64
SHA1 2dbe7cf79d1a91c1aef66edc75703799fc5f0c8a
SHA512 60a61b7f1c5bbcb4fc252ee66f001fe9dff9dba2414e7bb37292d939af3c741f56868a6296a30aa4e57864857fede92e3935c35eb28bbdf252047860e7e031e6
SSDEEP 12288:4ZgLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:4ZfNyBo4kx929bL3Hnx
TLSH
T18C452313470C627AFBBD3E70749E8454CC35BC8D0D95DB98DE62ACBB58BC9A2DA21107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 d1e1df71c4d31546cd20c526a7c052fee04bdd6e1af12066fce7ec174e9a0bf9
MD5 faaabebe7d081fa415643ea9955d3838
SHA1 0aa27114dcff6810f661bfaead7cdc37fe819973
SHA512 36dfa0fd1b3a9c5527d28e837f2d6dec824d17363a050418cf5e0dd104cc19da6c8d6e4434a05832e1bbefc3c2c3c2b541aef01e91a123eb20502c6c55c090d2
SSDEEP 12288:keBNUbTVO86URLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:kJIUuNyBo4kx929bL3Hnx
TLSH
T11765CF3BEE28FCE2C27E5DB85A918600D77278304F62A3CBD165821EDE235E15E79C15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 45355191d86119c4530d10eee41d835d15437a6ccef45d19ad2031af2dfbb41c
MD5 f1b76fdd80fee4541c0a3ab98fa4694f
SHA1 457394a3eed9394b025946f640ca45db389afe42
SHA512 8708c564a4d41ee8db0f3bad10d7efd3d260c9e9f7a9f663134a901ffe048d48d20c15399f58320130ddf04f4f5c8b0966289ebe19b0544bb2446d228b2af059
SSDEEP 49152:aQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJp9DN5J8NRV3THT:aQvGAdlCEL8c/pRNw5C2+k
TLSH
T1C3266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 0e8dfe1d5cf7dd0ea3bda12568f26a4155b755f8f23b525088e5025c71f3d15a
MD5 11481017ccc98bcb28e9b5daff9e8a5d
SHA1 efb4615c31e56fe494de8a15a0295180e0b4f5ef
SHA512 1d972ca6c809593ea0cf94307b1dcd77a6e78f744480256fadbbb53d8d7d8b9bf12903e8a54e49133243fd762cc65fb3d6235fa5e0590cdcfdcc385974e79814
SSDEEP 12288:2AwSfxL/2Dc3vDLLmt0LDQewsAjfLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxB:LyewsAjkNyBo4kx929bL3Hnx
TLSH
T10875E031FA74E036D7BF0DB11B26C716583CB9204F611AC3E3A88DAE59742D22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 21ebadd527916d3314e66834c04133d8e45b0753969ab7a09d64fb554025d9df
MD5 bad8d565d8aaf84f9f3c6e1bee9c710d
SHA1 6e17d5d4beeb988b3869b4ada1f46b52f16d41b5
SHA512 bd302daba28531bf9720e2d116153909669525d36a7712995ccab629b264ef3bc7ea1440136ac1cfaef9efb0579c82d725afcc78156c70a20695c350058566ef
SSDEEP 196608:+UEtQeTbvf2zlO12sJTv6Ja1cpVLy9IldPlbuJHB+k:+UEtQevvqc2W1cpV29I32B
TLSH
T18C474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 58870b32eddd0da941b23db29d3828b5e8426315fb69ada54189a7a2e5172ea1
MD5 7bf69ca56aa9332b8d4f2ef5cf209aba
SHA1 91cdc99909ceb6e1f8d3d5d1d4b4faaf57dcc492
SHA512 552df8dbdc849755a7e38aaf4fee4b682af9f23677a08cfb6a6e725b6f8b5c3757b0d909ec1b9a63c7c24c1238462c23879c4c985dc61caced7425a3a312fff1
SSDEEP 49152:GCbRquA/m2yL5zLfFiV+XenmE3/z/B+kn3Hnx:roq2Vjnmy+k
TLSH
T19FD58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 cbe0135bf8523138211b216de82a52c8bc8a99b0837b057220fa487bed791a75
MD5 1848e49df51d970b3cb9266f90376e9a
SHA1 e6eb28ef61d4b6c9653b5a8465c3ea523baed913
SHA512 b114cc0439317b7a5c584614e2654c918001c4ca16c8ea85166ab3a3cd5affa5686c199a4f0228d5b54afc9d875d7318e187f5b09d64f199fa935557c2402aa9
SSDEEP 24576:RAhGLmIFoiwtA5l7S539NyBo4kx929bL3Hnx:RAM1Foiq5KB+kn3Hnx
TLSH
T15F35AE81E7F955D4F5B3AAB899B68170E976BCAA5E31C20F2160D11F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 382bc3b2157725c52fcecd5f64731c27a41f893627dda0b95fffe2dd1c944e8a
MD5 d9ec6d07f0f27e9ce389645800aeadec
SHA1 a2503e2fb05b3d5cb39217acb33130af8bb81b25
SHA512 448cf2aa529b408d5f02b3d0802d4fc2e627ad3ad1f7c09df7cead5f6cd2baaaf4ee8e91f2c00017566b148432debf06025290780ffb84bc3c8e2969cf383b10
SSDEEP 12288:tmw5HEjsChNEBFgl0WDm+CqLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHz:IwuJOWANyBo4kx929bL3Hnx
TLSH
T13C65010677A81CF9F96756388587C136EBB2BC022A21DB1F4760C66B5F37361AE2D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 e412b8200a23d652679083d1d38d16de05893354c2adf982c0f9e5766ea75b4c
MD5 194e9e7994a6b29ff8337e0274fdc607
SHA1 888bed53ab056a6f6fedef260cd9c0e45b88f383
SHA512 9ce8622634655e6f28e92e6bf284e6e62234bd14c6c02f312ece1d0467e7aeb9c0a8c545def2b8e4d54e3638952b66e312df85726116f10591c16079d5f7e86a
SSDEEP 12288:OhZ1IyPLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:kZuDNyBo4kx929bL3Hnx
TLSH
T1A0551216239831FAF2AB2678D8E58505CB32BC461B7183CF5A2146BA1F77ED25E35313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 dadc1e42823c249f1669ec9bab370949b3025d5961dbb83984c92eaa28d790cc
MD5 0afe061c960607c13791113183c165b7
SHA1 4d4be00692f2058571af9bce71bfb02b55bd316f
SHA512 bab3ed04d4fd3000ac0a8ab0597c98aa1aebe5407e99e70ce16fb844824eb02b33172798df9a88a91347f8f0fead1e7b1d64ce8f64304180b9d07743325812f5
SSDEEP 49152:Jj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeaAaLSF259ruMHwpXMi4FqJLd23Uv:wQRQyi36YOcPuLvw2gAf+PN3/+k
TLSH
T132666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 6100e9f04bc58a29964dd9f2ccb286f79696fecd495df42f75ef40017b87e223
MD5 156f54dff08695313f504a34e507fbcc
SHA1 0592d16fada35f7b209a75ec3df7203c8bf91914
SHA512 143483b6c012046c81f6bfb9b7c780f5d3e5b9983ee0ac9213de7c364a91b20fb0b991bd94966b8495739b00f95a086d343f277890e6abffccade2623f830d06
SSDEEP 49152:5j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeaAaLSF259ruMHwpXMi4FqJLd23Uv:AQRQyi36YOcPuLvw2gAf+PN3/+k
TLSH
T1AA666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 a8f41667c5dbe81be7a62919bdd80b7315a05d39ff0a479fa497bf86ea8a5397
MD5 af18f22534d68ab9f3e933e28b3e71ce
SHA1 38a87803ce6a5332c8f941f7d3eea71054cc514a
SHA512 17220f4af1a16ec1a494e5b2d3d9ae0758f08e3c988fc9749f44fe4adccf5f4d8f9c4e6e13fd20573bda2f757753688512b67c90090f99ea5e4c8402025d1830
SSDEEP 24576:ewvLof6SRQ+rn/fDboqxN1nnh6C7DaHGTNHu7PNU3/5W/ohL0zNyBo4kx929bL3R:o68Qg55nhxeWu7PNU3/vB+kn3Hnx
TLSH
T16DB55933B2F600A9C44DE1769F4A873196D17C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 1255818443c6b7ed73adf64497692c73f3530dd998e3f045fd0e212fb52d6dad
MD5 e3622071936e6d48759f02772823c0ce
SHA1 267df2558604a8c0bac362f60e438fc97a0e6999
SHA512 d9e94fccc6c7ef634d9c50e3db391464967a7de00cea508850ed193dae14f6219d7ebb6a776a18569b3fc000652772176a5f4866a553f558822375ad9d0c399f
SSDEEP 49152:13aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99N:0y5112gYy5azzVvD69nLKnhZM+k
TLSH
T123167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 a033c03f6fd503296755b3586105bceff2105a573aa79674d6bc33f4d3a3eda9
MD5 9943ae749c491ffe1e2ebe704e631232
SHA1 796ace8cccb7ff8e04a9ac86eed7bf3f40c278d7
SHA512 4e639af7c0431bf105f0e138a65bd817d0fec1e36c7b31dbcd1b96bc8e84756b87802d5f548149f13986521176b5e745b964fb40fda2270ba3497672d5f60d8b
SSDEEP 49152:jB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glhB+kn3Hnx:Vu6JmQxd2dH+k
TLSH
T1C4D5AD13F1DA01E8D06ED578974A9233E962BC490B34B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 33cd42689a12f7770d9c4bcb3c6b27cbb7b9326cac67f5298f9e12dc0657b1e6
MD5 9db01b9e239d7a88ae2d3c11decbfec2
SHA1 7b9fac44c20675068a133dfa08c86a104c3cf9c8
SHA512 b0657a112bfab100babc48f3d542c8d423e42ac5c6db6a94972361955f5cdf58b3acfbb8f1b78455f3618d8dfe390d3987684519c5ed3cb9b38e678687854080
SSDEEP 49152:K1hpsNoJpF1A6yU44CwH7R4xlB+kn3Hnx:KmifPVRy+k
TLSH
T1E1B5BE13F29801E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BFE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 27b92dbeb04e657d110394944bf61de70d24abd043e1d116fa118a6b15af8c58
MD5 2f2c0c1915e52f9e1ad2ce006b35ce37
SHA1 ecec85fb8faffda2095cad08f49a83314e981822
SHA512 cace8411ae35f9cde4fc024474b51786e14fa2bfa2be9b8249a0a3e0514fe2d0e0545862efa50d2c095e6a13149109343580b6970fb572c98a32f3eb01e287bd
SSDEEP 49152:ySuZQIY0Be2KIRVtOnks6NMHqMB+kn3Hnx:s5dKOi61Q+k
TLSH
T12AC5BF03F2E941E8E0BEE67487669232EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 bcf2d1f105c1541d84bb11c7e51279303bae167f5df2b2e447cafbf6de0417d2
MD5 d7fa42dc8d71a61cece60b98dc459de8
SHA1 10627174bc1bd6556dc01efb275bd2decbfd5df0
SHA512 5bf69dd8e516646c8f4faea808e349c10a978a2bc8d43aa04fdc5a71b405b34f645876ddff1a3426e0ca1c190fba4b49e33fd992de2599c2f9ab3fe1de9f818e
SSDEEP 49152:LhtSn8EApI0figGgiDn0AP5wRB+kn3Hnx:KX2i/phO+k
TLSH
T16195BE13F2D901E8D05ED178C7468632E962BC160B35BAEF0A90B6561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 c5c785f6d9d2b90ea8d95b8aec587cbead637b712c5c81978c0cbddfef0a5749
MD5 194c4580de9693a3450c78f1379a5e01
SHA1 3f7cd56a61bcfbe29fc64920c77be6e51142d604
SHA512 5fd223a2bc1c01b6a5bfe8bda10eabd77a47af6b251a8738d59912c069a95a5d738a05946a3ac54cca284faf59a139779af857bdcf140d2bd0d82b218892b466
SSDEEP 12288:EYLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:EHNyBo4kx929bL3Hnx
TLSH
T1724523125A0C627AF76D3FB0644A8598CC34BC8F1E9593D8EF27987759FCEA25B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 e8283e372f75440d019ac2ac9d6bfc9062c26a414459ac5413e6f4321b1605b4
MD5 59d50f5b4f5d88220bd67d1c928429e9
SHA1 d7a270158ea28af034e963afa0558b10d3ab603e
SHA512 301b12a5c400344910ec6d271e578e1dcf1634ecaf7e32136c4efb1503589f213ad4951bc57a33c15cb95aa7b6b85ce571dddbdde3c09d58c293c7e717e78c8d
SSDEEP 12288:r7LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:rYNyBo4kx929bL3Hnx
TLSH
T1294523125A0C627AF76D3FB0644A8498CC34BC8F1E9597D8EF27987759FCEA25B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 903059ee86de1fed4d8c2ae1b5b6954bde2e7e51b49b7ac9114c9c762ec43975
MD5 9aa243cb925a4c2fd0368b976d3246e3
SHA1 8580163edd4339b6f3833d54ea65dc26ca0abe24
SHA512 00aac4367173269b858499f64a3a876e1fb3e9c65af2b29c4e213c4c386568ee0292797a869d583dce6ddb8dfaf6d192897b3113e010d97bda5f22dcacab1a43
SSDEEP 12288:KJLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:KWNyBo4kx929bL3Hnx
TLSH
T1314523125A0C627AF76C3FB0644A8198CC34BC8F1E9597D8EF27987759FCEA24B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 625807449270b4f45036be13727108ca23fddee91198093358e37852e8a6044e
MD5 0c0419938954a09e780a1a56efe28abd
SHA1 379db8231cdacc40271382bb97ff5dccfec1f86c
SHA512 c79c3c34b129ee4d57fcdcc4c1c02c9fcf612e504151d5e24cf600d3170f434b27beef193f1a6d13e0d4ef03677eb9f4d114e05fe2efa352cd7aa147193749cb
SSDEEP 12288:WVuLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:8NyBo4kx929bL3Hnx
TLSH
T13D452312575C12FAFA7E7BB098568054C835BC8A5B7197DFDF1248BB0EB8BA15E30702
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 90cd40d3bb8702b114bcbca5887c6f93e53b0eed437a2f3d92acac036b2c9dde
MD5 222527f5c9f3a40c67f0d9fa48248ad7
SHA1 32f9285ce04dea0f3a7c2de1e9fd45f37f63e57d
SHA512 cdd50f3d667b53d30bd7ce2dd215d6f1c7ed9beab91d7ead9a325bdf543abcef935dd04162951e45506ed5d42cf38733cbc79762492b8a052ee5109f6fd82aed
SSDEEP 12288:XWLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:X1NyBo4kx929bL3Hnx
TLSH
T11E4523125A0C627AF76D3FB0644A8198CC34BC8F1E9597D8EF27987759FCEA24B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 a5d5aead78373801a0d4386c05e8ccba1aa170bfa4988ec76161ccccebd85b75
MD5 687a3d9ce04de1c1a49685a633269aeb
SHA1 6fdb6f24de9ceb68d7c9ffead1c882cc60620664
SHA512 c2d19a402afd9e4feca96cf94be522a27205454107d4e0b638a1fd8dca531183ee7f181219d8e6a533badc1ac51b568f684b06c220f7424bdf8329e7667d7391
SSDEEP 12288:X3LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:XMNyBo4kx929bL3Hnx
TLSH
T1C64523125A0C627AF76D3FB0644A8498CC34BC8F1E9593D8EF27987759FCEA25B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 abeea23b95734fa7fc933bb085cf9950c25b92df8385f62679678cfc45aa36c5
MD5 9353dfced599c7cbb5a11e5bcf5c8457
SHA1 d67e30087a5911d406175ad7f1b14bb8c3d58cb7
SHA512 590208a87bc7ee9d6c932ac4a0586e77f29154eac9ad4dff3db3d4fc19a454c396e0414088cc70ce8ca1432173623be55cf910442835dfcf465fe1df29baa3a5
SSDEEP 12288:ajLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyExA:awNyBo4kx929bL3HnxW
TLSH
T1FB4523129A0C227AF76D3FB065498498CC34BC8F1E9597D8EF27987759FCEA25B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 2d8c31ae10ad03a09cf4635efceb872602d863721bcee995fb25e2372fb9ee4c
MD5 2e50cf60facc76b2d70f57aab43563fe
SHA1 a1088eecdb0332151c01b6de4969a8a25c8beb43
SHA512 f53edb510d23e8fd84cafc75af5b4316907a36a1d3ec8c4f6d0fb4a7ba3fb6a6f2df23e117e454b27cccd3054e4e763f03644da4308f5dc7dad43fd686b03f36
SSDEEP 12288:DiZwbrzzFEoS2cPvybLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyu:uZM/zFVSO4NyBo4kx929bL3Hnx
TLSH
T195650195B39418F8EC67823DC8158906C6B2BC4A0BA0C65F07B4367B5F773A11D3EB96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 22993ea8bab7a6169136260870a26f4667066b55fd670ee5883daa2e9cc5b9c0
MD5 fc20080711fe1d84689a6f0afb8f3e9c
SHA1 59b35de1cc30998b37223cb23ce44803f359b779
SHA512 c2cbfe3a2e60e1f1144979a0687e3ce630c224cc455e390fa4a1482d5370f1ef7e645907469534662866aa984ddcfd87effbe9cd92fdabfc92091389bf07a1c3
SSDEEP 12288:PMLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:PTNyBo4kx929bL3Hnx
TLSH
T17F4523135A0C627AF76D3FB0644A8598CC34BC8F1E9597D8EF27987759BCEA24B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 2c4bdf3b2fd7f1538a5c8234f14458707ba7d474b0b0fc1cff309ab4216d5f3e
MD5 a6928ef0d0bdce53e561b725391a1c7c
SHA1 aece5e34ba3f6517720f152643ca74013c83a40d
SHA512 3fb7155428dff9b2b9dd9179a4135d0c055d85536862cc64576b60510d668eb19478c2156e7453ed81adfd001bd5455eec263f17d4c6a0592fc4d8d9b59659aa
SSDEEP 12288:nQLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:nvNyBo4kx929bL3Hnx
TLSH
T1984523135A0C627AF76D3FB0654A8498CC34BC8F1E9593D8EF27987759BCEA24B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 fc3e9b0ad9c533b73eab994967e45a677965488a651ebde43b57aad6fc4c36de
MD5 09e3e37ac337d187d1a59b41a56fae50
SHA1 2125c4aac266b22767fd215f4f1343f1f0f311f2
SHA512 5ffaf52c02f2bc03ae4ac70bc639cb99f7191ddcdb55a028644731deb51a6e85c3391e2c8ff631b35fc9e898b964b31fd617e9b80c624defad074675e3906067
SSDEEP 12288:XyPz5L8PLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:azy0NyBo4kx929bL3Hnx
TLSH
T1FD55120773A831F9E17A6234C8960A01E731BC760B608BEF576046771F7B6E19E3AB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 41cc0507df5c07fd337c0175d318324fd604d6f32af62ef44dd597a2161670af
MD5 94f6bf50762a7fe55c2b994351b40ddc
SHA1 0dbdc179198350ddefed7bf20ec75f4779ab5d9e
SHA512 c006fe79c4d282ff072cf6647836e337cc1a2e58e0cff9d795417f29764867a29ce18573c05ec02f5e2b46f952dabe59a907424113a57230d0711d260ea52e1c
SSDEEP 12288:0MLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:0TNyBo4kx929bL3Hnx
TLSH
T1E44523135A0C627AF76D3FB0644A8598CC34BC8F1E9597D8EF27987759BCEA24B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 50e077562b587c14ee2e3616b5828e1d3e939a80c660540b2858e45e93c3eac0
MD5 20e752dc564aa2ced55cd81e176946dd
SHA1 ba0ce208fb980f0f661080424ef71b6f79c3cfba
SHA512 d0d8f591ae03cb8dbc86d1d001c23425f27c70c9742fa12faff0a5b1cefd14f71c81a96c254fb754aa3fe13e8c2f7ef1b511079dec5e50f0c6b85799788b0e6a
SSDEEP 12288:ZMLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:ZTNyBo4kx929bL3Hnx
TLSH
T18F4523125A0C227AF76D3FB0644A8598CC34BC8F1E9597D8EF27987759BCEA24B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 9aa1180133e7947f49f98eaac0da1f33cdf1306f28da26cc3ed126fec92d633b
MD5 94297e073bc45be04061bd4049af33a5
SHA1 9546c85d431f62d9860a08f66969588b209c6869
SHA512 40e98ae3a635b7f6743aacb79c4fc835fd746f948dae2ecc20991111735144f43da3ce329b62227cf0e6ff44b9921fe6aec5e90f4dd75ae1bb79d0d66ffb4f10
SSDEEP 24576:JcP4mcvIjkGOxhKP2l71nNKbrh/8KBLNyBo4kx929bL3Hnx:+P4m4IpOO67W8KGB+kn3Hnx
TLSH
T16165AE2DABDC0096D0BA917885658A4AFAB1742E1F3286CB1160933D3F77EE54F35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 f07a1c4953398929c99dc6050e43713b8b6222eeae86505a077afacba5823db6
MD5 1d0f98d524819a0439f9ecb44517b6fc
SHA1 3c17b485dbfbd6f9f5dc722a9f4494682261c505
SHA512 9d0927bd4b014d6ea9954751b307d061e94c67a24600c0124ff87250e7434de9e549324b44599cdf3e1e12d78093fd421f1ff284889749e6336343598054d25d
SSDEEP 12288:22sfcLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:uDNyBo4kx929bL3Hnx
TLSH
T12D55F01AD25812E8D16E2274C7468A40F7337C5A47E1D3CB97D0F87E0F7AA919EE9603
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d4bcb1c19b11239b.bin

Path C:\Users\Admin\AppData\Roaming\d4bcb1c19b11239b.bin
Size 12KB
SHA256 c34a72cccf731c7bc1ac446f738330a5ae4c48a23c270409f43112f39bb5f205
MD5 57f67f12f1b07a3605e8ab8bfaa7a2be
SHA1 1ccdbf8a12a2912952540ee5890f3a8e04be973c
SHA512 9ff5be852251fe41baaf7f590c571b4477565a6395f7f465605eabd662c236faf588d8fee5dd78789ba7b8815459aeb7b606e089ff713d7cb2cdec2185b69750
SSDEEP 384:6rG/jIKD4CQHE1bkO/0tww2lWv5GOSf+Mm:6SL/Z4E1bkO/0ujvLfjm
TLSH
T1BD42C04A8B18C9A710291FDCE5885A51E4A913DE394037E887E49B7C0FACEDC92F5B08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 24c701f81cdd5617f31475f5ecd48e5a2d4013df56d69f60eb85fa4a6efa0f4f
MD5 c66e6038c4c0057d6a05e7465f5023fd
SHA1 72517f1d7e723813c296ac5e3949a55ef61db6f0
SHA512 f56e002aef7ee0c96e0e17b478459f9878152f48e6c4a6b766f40893a093ff24332b895be448b72a62e4e7a43184937ca105b6b3b8acb0337a2be581b9f05ed8
SSDEEP 12288:+8LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:+jNyBo4kx929bL3Hnx
TLSH
T1DF452312974C623AF67D3FB0645AC024CC39BC4D0F55D6DBEE1658BA59BCDA29E30207
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 abca314346a871ffad574c65087602bfdd67e6ecd4251525e54696945e977764
MD5 362def8b2525426daecb3b9a5d625ecd
SHA1 cb144173a299aa2bc830e244b9d0d198a6f47bc7
SHA512 990b1b48f732f2fa7cd996af45b36cec2916ceb85c9cc4b71ca196638d6b417b000b9e913c43050ada91e77f065a6824a350b25727e25b3191ab83ede96ed388
SSDEEP 49152:ia0h2GEkuAe73q3pp46zwwQiB+kn3Hnx:ia0hNYG4JwB+k
TLSH
T1A685AF1E67EC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37DE44E3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 58c935dc0b82f2b16dbb1acb7cf22c22695d29b4adf309e48c0d0eaa31324382
MD5 437d2fb738b73da2d5efbcbb3e47d51d
SHA1 506a5983ee681e48078a9157bda0433c9ab4c92f
SHA512 c93b9e6f0db7544f60cf62755f2f923f090eb7f8498882e3e438ce9768ffe22ad6446f3e9d1f60e800a6b9bae382744eb90bf040551ec87bafe42299efd1c787
SSDEEP 12288:fhbHjfXLLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:fhbHjPINyBo4kx929bL3Hnx
TLSH
T18D55123E16AC21E9F275B67C9546850AC730BC1A0B2193EF6792817E0F3BEE50D34B42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 80fdd9d2c703c6c7b42ec60549c0686976b28e7a0623e31f056e4225b2aff382
MD5 974452837818281555244fd9158397f3
SHA1 eb12a868e15e2455baef1c937c62bf7c33ebd4ee
SHA512 52b5af5e7a5ed284434867e00c1fda64b773e5f433f52e3f3c72cf2c4b09f5d396b70f227309ed8783740db68229563457f3951678a9703cc8127d8e2b0b9515
SSDEEP 24576:33YgnJcRTk4yti+R5dBR/ANyBo4kx929bL3Hnx:3IgnaTk46pBR/zB+kn3Hnx
TLSH
T1D345B02DF2B910B9D8AAD236450147B5FB71782D1F209ACB0170C538AF1AEE85F35F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 5179b7e45fe5e200f0a3dcf191b669b40a7959df5e2309ab3be34bf432fc720e
MD5 4605bc1849518c0384c5458335b41495
SHA1 19269639526421f927ff30956567907cbe8009c3
SHA512 793b908381230e30df0e58c2bf47692d233034fe44f05be3bdaa85f245672bf4288c6f357ad4a81c330c4c2ffdd32700a31e4ddb16249a1a3349bf15f1a83c25
SSDEEP 12288:6ALDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:6/NyBo4kx929bL3Hnx
TLSH
T161452312560C627AF67D3FB0644A8558CC34BC4A0F6597DBEE6698BB59BCEE34E30103
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.5MB
SHA256 2c983bd882db1a99da4a2c8c6d541b726e1ff7acfdbd9450442f4292c7426e93
MD5 b0f42036f7ae58e06ab1706afd385298
SHA1 40feee651662547b0b0b98e2fa0ff501109be55e
SHA512 f75a3a0ae4a8b813195457a1478554ecbcf6e7815487fd689d35a3d87cc423f621f52f4f5660e1a282a08a30b939a4b32f931c58a288e7e61fbb6d8935178f21
SSDEEP 12288:UObzA4LWOsvAYFTtLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:5HL3UTyNyBo4kx929bL3Hnx
TLSH
T1E0750115F79800F9E97B923CC8A68916D672B84D0764E7DF03A84A661F637E24F3E701
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 4b42a5f47f2c38e1b1df1921b7b1530fdba34c42552dfcc8ed2ba4fc8a67d168
MD5 dd8bae8ff4a4a8b9e4c32687792e0719
SHA1 c4a2d18640e5091827ad47704408c46a381e42eb
SHA512 22eb7ffca501a917fe93a27cc3026f4691ef76fcb75a71d94b6f9ef2bde1dffaa8a1768793a02aced5c58311a86a04e69cffb59054e5894402e6e43b9692b19d
SSDEEP 12288:2pFtOOxLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:fOONyBo4kx929bL3Hnx
TLSH
T1E355021A369C20F9E579767C8986820DC731BC560B2257EF46A080BE5FB7FF85C35A42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 3e6c6d2a1108bce2393be940ab21d4f693cc040ee98ecbfee105c8d9d27deb97
MD5 0783f17ed5805b9cd224366035878e94
SHA1 1bbf06ab2a45b252eff8657bc6db552254bf6a33
SHA512 ecae26a160d50f47e5a9d8f7f34047b26604ee33d85300d1cd5c0092049d26137a74c6dd050a82ef9fa3bb469def196c78cb1c6a81719fd181d6476f7a13a477
SSDEEP 24576:H7NM9YqZqmWMUkPjZM48Mv6bEhsTNyBo4kx929bL3Hnx:H7cBWMpPjN8DbEhLB+kn3Hnx
TLSH
T14A65AE2E6BAC81E5D477D13DC9A28205F6B2B4611B318ACF5162833E6F37AF44E35721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 3a4f79212b2f3c26380f94fe1bb835ea9530c9b7c585e2b8d79e251ce32afadc
MD5 75db6b8ff5d4d37de588038a715d030f
SHA1 bf6ebf8a5ff090b56c629b3373dff965a5e2e72b
SHA512 fbfd8595c30fa4f64aae57803b39ba817cedeaf5c53fc8728a07345b9b72b1fe25eacde8e888af8570abf790d4072dccd37aa8ffbe52fc64be8abeaa366827e8
SSDEEP 24576:EW6BApg2YuyuNDYTabvcdvNYf8km1ZNyBo4kx929bL3Hnx:EF2YuHNETovAvNYf8kmcB+kn3Hnx
TLSH
T1B8858E2A27EC80A4E0BBD27D45B7D246FAB2B8511B3056CF4255862E1F33AF44D3D722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 75623945ffc052173d26a078837d1d4db0069a5860a4c569436ffe76007626ab
MD5 bca73e236caf7f409f7241999ea95bff
SHA1 d7c33fe23352b670f278aa9315b324ea666ca3b8
SHA512 afe2659cfc57d2ecc37ddf1d08b634b25aefad1a58e04efe041cc1ac3dd2d2787b4f3d5dd27717acd807b2509f53dc0113d196da2227a71fc88af96fb201e0ea
SSDEEP 24576:BAFs06+Omlf8NXEbToaNyBo4kx929bL3Hnx:WFs060lYXuCB+kn3Hnx
TLSH
T12E65BF2F62AC00D5E07ED17D8997C91AF6B1746707255ACB0260C63E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 c060aaaa4fcc6dc19c61b8841bc6bacc1029e32d3bc0974b259270e05dda34ea
MD5 d995143eb4b99b08317b74dff95be95c
SHA1 63a0023034f7d4951107ca053aff3b1e271bf3b8
SHA512 ef6ed012b246781d5b06478ed9a84d45ded26f5f14eca8d5bfc87e82ea58bab9c483e90c598d79918b85c1647db1d6ecf1a32bb69b72a010132305f9b21a086c
SSDEEP 12288:+CJnJ5D3VkrFzxsLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:PJnJ5D3WNVNyBo4kx929bL3Hnx
TLSH
T1D275D02DD2A810F8E4B7D2B4815A1755FE72386D2F226AC76874D4353F22FE09A79F04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 3102b1b25fae9efe28110db4e06c7c39df6e3a3d0f10b1db0cf15f046f5971b2
MD5 f38396edd35772a0a23fb956fb44772b
SHA1 021478629e7bacce7f0358e51a1d2b1c83620cd3
SHA512 6a471aee68c44dd8a235fd868b42cf6065e62f8ccca443676fb592097fac6515c4fcc143af757ea56732a71089842d5acd00027efb91ec7d4bcba263be60c9aa
SSDEEP 24576:3EPghm6/7IIXdwcXrif7qQncjlP65i3VuANyBo4kx929bL3Hnx:wg06DIKdwc+eQnSt65aVoB+kn3Hnx
TLSH
T121955C16B7EA5294E8B3CAB1C96295169B327C509B34F7DF0AC0C92E1E33BD1D934B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 aadc6e99f65ccca3ed9edddd7dab584119d2a83bf72d9c55447617c6e21dbd1f
MD5 d92bfed9a50aadac834cce31c014338f
SHA1 17e2383c9f48a557f5f70664d0362c5043e498e5
SHA512 c211e39f0c404651468b0c9b6e694cbff326856b2de87db1cfed7a8de886203862b5e65dc7013d1d246a2e74d9f925b7e82edb50e2550ada22fc24f4bbd6a08d
SSDEEP 12288:dEP3RhiLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:+hpNyBo4kx929bL3Hnx
TLSH
T10055122E279C70F9E13A717C94918104C732F4651B5267EF9AA2C17E4E7BEE61E38B01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.3MB
SHA256 6e6cb8045c5038398952366613cbcbc33cd2f53b6b86dd42734e6e28339b3bc0
MD5 64fb060114367906e53145ebcd6c4ecb
SHA1 7789ea25081c49e5d27074f04d83f1e4a077c0ef
SHA512 931c2b0021250924f19a98aa48b3f66f6e72d8e368a5a21629b9e6990078a437b2a65e7f6703a9c70e78006f576975701fd43089bb05d2933412e75a954e10bc
SSDEEP 12288:7jky7LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:7IyYNyBo4kx929bL3Hnx
TLSH
T198551205638C61A9FAB92A3899678194CD34BC101F2193DFA591EA3F5F7AFD16D30B03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 ba6e1ce8f92dbe9b803e38b968f780f123ff2fe68bdcdcd71fa921b3726ca2fb
MD5 7a44831121437d0583f3b5eb6c3e7b57
SHA1 a5573f494e251f72800959255be2ffbd2cca3d08
SHA512 85d7c6856f30ba74f262eea08c0e0080cf3f747bbf98eecd8a68082e82947127c0ef34e9d9accb4d752d499b707da760679d7146295295c9ccb43775869bfb5d
SSDEEP 12288:ElhLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:ueNyBo4kx929bL3Hnx
TLSH
T1E9452316161C327AFA3D3FB0645A8554C830BC4E1F51A6EFEDA2D8778ABDED25A30503
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 ee736780a99860a2fa775bf958f9b2f90877b79c67c8e6eb0863ea176cba02c5
MD5 d003d6a3e9150160e1bd55b7951b9815
SHA1 e8deef60b0075887b70a4a2e04f2fc503b79bc60
SHA512 bdfaf6cefb3d379f6fff1ba5b737749d898d9228cf3a6515faacd65a3505753b02274e39024bbe3831a48cf5421617fd1fd0c215394f2d3901a73bd006e444f7
SSDEEP 12288:OLQZb3C97GYnZMv5zBcKY9dMD3kLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxfJ:oQ9MxZKdcz9dw37NyBo4kx929bL3Hnx
TLSH
T175558C2DABE9059AE177D27595A240C3A633B4311B31D6CF2448D03D4DBBEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 f66229ba1dc7b11b1c8b68493e733d6e37eb43a2f6b056b7a173e87afdb718d8
MD5 225c9601c7db6866486d89e155b76195
SHA1 cee506bfd4b33683825275634a28640e74ad8178
SHA512 56a6945aef8fe5d016784c2578047ffb452f342995dc600460bb5a7026bfdee541b8446a610ce804f58ce59356839909f0d4370bcfa253d1247d0d044f0fd6b2
SSDEEP 12288:ryoKo2XRple9pfLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:ryochApkNyBo4kx929bL3Hnx
TLSH
T16B65E01FBB6D40A2E176923C88858245E773B4341B6253CB6691C73E4F77AE9BD34B02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 39fce4d6bdaf0c1e650385b996ca428dfb0b613a6b7b4d5cf0251de3001288ba
MD5 25900c6f8dec96eebaf6c37539c611b8
SHA1 768b89f1bee1892db130e86e2851707bd5db25aa
SHA512 b9edf327ee62732e70ed67132fb9db36f042389c6be32c76bf8f66f8c8dbe8632b5cd1eebdbef5150cd766d778e8357e47a43cc2783e4899babf5e83e41050ec
SSDEEP 49152:iWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKfB+kn3Hnx:U0zuNIX+k
TLSH
T142A57B3DA2BC00A8D9AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 ba3d7c10a136adf9ad8f8295209e708a58bf6e225e65a0f526e86db074ad39fe
MD5 c7b79b061a79d685d36497b8d8c608d0
SHA1 8ca94f61fb07a71a28bc8ca5744424fee3fa2d53
SHA512 707bc1628e80a4c15d6bc401d268f9991a6a74a2876b893efd4312572c5df5389aecbc6969f089a867cb4ca113588fb769f376e196049e48c49226e16739e28c
SSDEEP 24576:P1QT7EcpfxR+N5AWAz3ooiYqjMqbhNyBo4kx929bL3Hnx:yTDxR+N5YzTEjMFB+kn3Hnx
TLSH
T1A255B02EA7FC15E9D1BE85789A23C512FA727811033193CB42A0C17E1E7B9D85E7AF11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.5MB
SHA256 b874e79e73541f9293ccfe03c2fbab1523cf72b99aa7d6e1d4fb79061ba542b2
MD5 8771733d1df3d5cd0fab26c31a4dc040
SHA1 4d2c101e82da4d8b5a9e20402cc319413636d93a
SHA512 af8830a024422a563af8b06fbbd722c12037fbac6cf0ef551b4ee63365d33e965fa30d3aeb0c155af8d4883de96d2b258cf7abad44b837fcfb0eb69ea7f3146c
SSDEEP 24576:ZTMdOz0FFS+pmSLdNyBo4kx929bL3Hnx:z0K+pmSLaB+kn3Hnx
TLSH
T1BD65F13E636D14F5E57FD27CD6438906E97278660321A6DB0690C07A2F6BFE43A39B40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.2MB
SHA256 3d3b12314b9b6531b2f1dee8c08ae372458a32c5896a1e50ae9a3f2d97aa8d38
MD5 9802975b381b06b0a98de73af7336e1e
SHA1 7edd12b24707526f40719388b4f4c4a1789b2957
SHA512 c34605b34f8714c17c5b2bc868cc4fe568b03de5a3a5ea8315678fd72519b644ed599eac3be4b0f49eff433b2d6a3f221af6aa9bd56c1bdcf9072a5b7e95f9d0
SSDEEP 12288:I4YtLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:syNyBo4kx929bL3Hnx
TLSH
T16755120913DC30A9F57A76749A2A4154C930BC6A1B2167FF79E1C87B4F7AAD18A34B03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/388-368-0x0000000140000000-0x0000000140148000-memory.dmp

Download

memory/388-26-0x0000000140000000-0x0000000140148000-memory.dmp

Download

memory/532-134-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Download

memory/532-280-0x0000000140000000-0x00000001401A1000-memory.dmp

Download

memory/532-140-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Download

memory/656-90-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/656-266-0x0000000140000000-0x000000014016E000-memory.dmp

Download

memory/656-84-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/916-278-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/916-129-0x0000000000550000-0x00000000005B0000-memory.dmp

Download

memory/916-123-0x0000000000550000-0x00000000005B0000-memory.dmp

Download

memory/1312-39-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/1312-38-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/1312-30-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/1632-366-0x000000000B9C0000-0x000000000B9C8000-memory.dmp

Download

memory/1632-300-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/1632-166-0x0000000001770000-0x0000000001780000-memory.dmp

Download

memory/1632-182-0x0000000001A20000-0x0000000001A30000-memory.dmp

Download

memory/1632-199-0x0000000009E60000-0x0000000009E68000-memory.dmp

Download

memory/1632-386-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/1644-385-0x0000000140000000-0x0000000140164000-memory.dmp

Download

memory/1644-290-0x0000000140000000-0x0000000140164000-memory.dmp

Download

memory/1684-265-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1684-56-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1684-62-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1812-407-0x000002984D4C0000-0x000002984D4D0000-memory.dmp

Download

memory/1812-371-0x000002984D4C0000-0x000002984D4D0000-memory.dmp

Download

memory/1812-376-0x000002984D4C0000-0x000002984D4D0000-memory.dmp

Download

memory/1812-377-0x000002984D4C0000-0x000002984D4D0000-memory.dmp

Download

memory/1812-380-0x000002984D4C0000-0x000002984D4D0000-memory.dmp

Download

memory/1812-382-0x000002984D4C0000-0x000002984D4D0000-memory.dmp

Download

memory/1812-383-0x000002984D4C0000-0x000002984D4D0000-memory.dmp

Download

memory/1812-384-0x000002984D4C0000-0x000002984D4D0000-memory.dmp

Download

memory/1812-381-0x000002984D4C0000-0x000002984D4D0000-memory.dmp

Download

memory/1812-378-0x000002984D4C0000-0x000002984D4D0000-memory.dmp

Download

memory/1812-379-0x000002984D4C0000-0x000002984D4D0000-memory.dmp

Download

memory/1812-372-0x000002984D4C0000-0x000002984D4D0000-memory.dmp

Download

memory/1812-373-0x000002984D4C0000-0x000002984D4D0000-memory.dmp

Download

memory/1812-387-0x000002984ADD0000-0x000002984CCA7000-memory.dmp

Download

memory/1812-392-0x000002984D4C0000-0x000002984D4D0000-memory.dmp

Download

memory/1812-391-0x000002984D4C0000-0x000002984D4D0000-memory.dmp

Download

memory/1812-393-0x000002984D4C0000-0x000002984D4D0000-memory.dmp

Download

memory/1812-396-0x000002984D4C0000-0x000002984D4D0000-memory.dmp

Download

memory/1812-395-0x000002984D4C0000-0x000002984D4D0000-memory.dmp

Download

memory/1812-394-0x000002984D4C0000-0x000002984D4D0000-memory.dmp

Download

memory/1812-397-0x000002984D4C0000-0x000002984D4D0000-memory.dmp

Download

memory/1812-398-0x000002984D4C0000-0x000002984D4D0000-memory.dmp

Download

memory/1812-399-0x000002984D4C0000-0x000002984D4D0000-memory.dmp

Download

memory/1812-402-0x000002984D4C0000-0x000002984D4D0000-memory.dmp

Download

memory/1812-401-0x000002984D4C0000-0x000002984D4D0000-memory.dmp

Download

memory/1812-400-0x000002984D4C0000-0x000002984D4D0000-memory.dmp

Download

memory/1812-404-0x000002984D4C0000-0x000002984D4D0000-memory.dmp

Download

memory/1812-406-0x000002984D4C0000-0x000002984D4D0000-memory.dmp

Download

memory/1812-405-0x000002984D4C0000-0x000002984D4D0000-memory.dmp

Download

memory/1812-403-0x000002984D4C0000-0x000002984D4D0000-memory.dmp

Download

memory/1812-369-0x000002984D4C0000-0x000002984D4D0000-memory.dmp

Download

memory/1812-408-0x000002984D4C0000-0x000002984D4D0000-memory.dmp

Download

memory/1812-409-0x000002984D4C0000-0x000002984D4D0000-memory.dmp

Download

memory/1812-410-0x000002984D4C0000-0x000002984D4D0000-memory.dmp

Download

memory/1812-374-0x000002984D4C0000-0x000002984D4D0000-memory.dmp

Download

memory/1812-375-0x000002984D4C0000-0x000002984D4D0000-memory.dmp

Download

memory/1812-370-0x000002984D4C0000-0x000002984D4D0000-memory.dmp

Download

memory/2988-72-0x0000000001A40000-0x0000000001AA0000-memory.dmp

Download

memory/2988-66-0x0000000001A40000-0x0000000001AA0000-memory.dmp

Download

memory/2988-78-0x0000000140000000-0x0000000140174000-memory.dmp

Download

memory/2988-76-0x0000000001A40000-0x0000000001AA0000-memory.dmp

Download

memory/3132-6-0x0000000001FE0000-0x0000000002040000-memory.dmp

Download

memory/3132-330-0x0000000140000000-0x00000001407D4000-memory.dmp

Download

memory/3132-1-0x0000000001FE0000-0x0000000002040000-memory.dmp

Download

memory/3132-10-0x0000000140000000-0x00000001407D4000-memory.dmp

Download

memory/3132-22-0x0000000001FE0000-0x0000000002040000-memory.dmp

Download

memory/3260-301-0x0000000140000000-0x0000000140157000-memory.dmp

Download

memory/3288-285-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/3452-281-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/3700-79-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/3800-274-0x0000000140000000-0x0000000140134000-memory.dmp

Download

memory/3804-282-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/3892-107-0x0000000000800000-0x0000000000867000-memory.dmp

Download

memory/3892-270-0x0000000000400000-0x0000000000535000-memory.dmp

Download

memory/3892-112-0x0000000000800000-0x0000000000867000-memory.dmp

Download

memory/3972-272-0x0000000140000000-0x0000000140133000-memory.dmp

Download

memory/4488-11-0x0000000000440000-0x00000000004A0000-memory.dmp

Download

memory/4488-362-0x0000000140000000-0x00000001407D4000-memory.dmp

Download

memory/4488-17-0x0000000000440000-0x00000000004A0000-memory.dmp

Download

memory/4488-21-0x0000000140000000-0x00000001407D4000-memory.dmp

Download

memory/4576-147-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4792-269-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/4792-100-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/4792-94-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/4836-46-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/4836-52-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/4836-302-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4956-288-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4980-273-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4980-361-0x0000000140000000-0x00000001401D7000-memory.dmp

Download