888455f1108b764eb9fae7f34aa5d61f352b7b200a48f9949cfe8f7f6cd5006d

Analysis

max time kernel
148s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/10/2026, 12:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
888455f1108b764eb9fae7f34aa5d61f352b7b200a48f9949cfe8f7f6cd5006d.exe
Size 6.5MB
Sample261003-pryrjaydpg
SHA256 888455f1108b764eb9fae7f34aa5d61f352b7b200a48f9949cfe8f7f6cd5006d
MD5 bcffd8c59ff7bfe8c1e20144878f6011
SHA1 ea58dc0f4ca00ccb5f3227e84d8244ddbe5bd091
SHA512 3d8f10a39dad9c9c6c08e2c39439c3bc1fefdf04951e866b0bcc9e846bb24a824f13811de49bb26e2101ff2e2e2bc977a89570f36a01264bd949122b916ba063
SSDEEP 49152:6F8p/ChenoS7kbJtcPwHcvdpunzXck3eOyDFGYdPgYcujxtMOxCrlaj1LYE4PEDq:PUmd8I9O/YBWa5rD/3lEeJRsPFmYtH
TLSH
T135666A03F19901D9D059D178CB5A9232EB72BC494BB162EF2A5077E12E76EE0BB3C750
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
5092	alg.exe
2092	DiagnosticsHub.StandardCollector.Service.exe
3264	fxssvc.exe
5108	elevation_service.exe
4364	elevation_service.exe
3988	maintenanceservice.exe
3732	msdtc.exe
1784	OSE.EXE
2400	PerceptionSimulationService.exe
3240	perfhost.exe
1652	locator.exe
4012	SensorDataService.exe
3252	snmptrap.exe
2764	spectrum.exe
4840	ssh-agent.exe
3016	TieringEngineService.exe
464	AgentService.exe
4676	vds.exe
4048	vssvc.exe
4556	wbengine.exe
4324	WmiApSrv.exe
848	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	888455f1108b764eb9fae7f34aa5d61f352b7b200a48f9949cfe8f7f6cd5006d.exe
\??\F:\	DiagnosticsHub.StandardCollector.Service.exe

Drops file in System32 directory 31 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\SearchIndexer.exe	888455f1108b764eb9fae7f34aa5d61f352b7b200a48f9949cfe8f7f6cd5006d.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	888455f1108b764eb9fae7f34aa5d61f352b7b200a48f9949cfe8f7f6cd5006d.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	888455f1108b764eb9fae7f34aa5d61f352b7b200a48f9949cfe8f7f6cd5006d.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	888455f1108b764eb9fae7f34aa5d61f352b7b200a48f9949cfe8f7f6cd5006d.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	888455f1108b764eb9fae7f34aa5d61f352b7b200a48f9949cfe8f7f6cd5006d.exe
File opened for modification	C:\Windows\system32\AgentService.exe	888455f1108b764eb9fae7f34aa5d61f352b7b200a48f9949cfe8f7f6cd5006d.exe
File opened for modification	C:\Windows\System32\alg.exe	888455f1108b764eb9fae7f34aa5d61f352b7b200a48f9949cfe8f7f6cd5006d.exe
File opened for modification	C:\Windows\system32\msiexec.exe	888455f1108b764eb9fae7f34aa5d61f352b7b200a48f9949cfe8f7f6cd5006d.exe
File opened for modification	C:\Windows\system32\locator.exe	888455f1108b764eb9fae7f34aa5d61f352b7b200a48f9949cfe8f7f6cd5006d.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	888455f1108b764eb9fae7f34aa5d61f352b7b200a48f9949cfe8f7f6cd5006d.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	888455f1108b764eb9fae7f34aa5d61f352b7b200a48f9949cfe8f7f6cd5006d.exe
File opened for modification	C:\Windows\system32\spectrum.exe	888455f1108b764eb9fae7f34aa5d61f352b7b200a48f9949cfe8f7f6cd5006d.exe
File opened for modification	C:\Windows\System32\vds.exe	888455f1108b764eb9fae7f34aa5d61f352b7b200a48f9949cfe8f7f6cd5006d.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	888455f1108b764eb9fae7f34aa5d61f352b7b200a48f9949cfe8f7f6cd5006d.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	888455f1108b764eb9fae7f34aa5d61f352b7b200a48f9949cfe8f7f6cd5006d.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	888455f1108b764eb9fae7f34aa5d61f352b7b200a48f9949cfe8f7f6cd5006d.exe
File opened for modification	C:\Windows\system32\vssvc.exe	888455f1108b764eb9fae7f34aa5d61f352b7b200a48f9949cfe8f7f6cd5006d.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	888455f1108b764eb9fae7f34aa5d61f352b7b200a48f9949cfe8f7f6cd5006d.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\wbengine.exe	888455f1108b764eb9fae7f34aa5d61f352b7b200a48f9949cfe8f7f6cd5006d.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\843a040d250d612b.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	888455f1108b764eb9fae7f34aa5d61f352b7b200a48f9949cfe8f7f6cd5006d.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	888455f1108b764eb9fae7f34aa5d61f352b7b200a48f9949cfe8f7f6cd5006d.exe
File opened for modification	C:\Windows\System32\msdtc.exe	888455f1108b764eb9fae7f34aa5d61f352b7b200a48f9949cfe8f7f6cd5006d.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	888455f1108b764eb9fae7f34aa5d61f352b7b200a48f9949cfe8f7f6cd5006d.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	888455f1108b764eb9fae7f34aa5d61f352b7b200a48f9949cfe8f7f6cd5006d.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	888455f1108b764eb9fae7f34aa5d61f352b7b200a48f9949cfe8f7f6cd5006d.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	888455f1108b764eb9fae7f34aa5d61f352b7b200a48f9949cfe8f7f6cd5006d.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	888455f1108b764eb9fae7f34aa5d61f352b7b200a48f9949cfe8f7f6cd5006d.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	888455f1108b764eb9fae7f34aa5d61f352b7b200a48f9949cfe8f7f6cd5006d.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	888455f1108b764eb9fae7f34aa5d61f352b7b200a48f9949cfe8f7f6cd5006d.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	888455f1108b764eb9fae7f34aa5d61f352b7b200a48f9949cfe8f7f6cd5006d.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	888455f1108b764eb9fae7f34aa5d61f352b7b200a48f9949cfe8f7f6cd5006d.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	888455f1108b764eb9fae7f34aa5d61f352b7b200a48f9949cfe8f7f6cd5006d.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	888455f1108b764eb9fae7f34aa5d61f352b7b200a48f9949cfe8f7f6cd5006d.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	888455f1108b764eb9fae7f34aa5d61f352b7b200a48f9949cfe8f7f6cd5006d.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	888455f1108b764eb9fae7f34aa5d61f352b7b200a48f9949cfe8f7f6cd5006d.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	888455f1108b764eb9fae7f34aa5d61f352b7b200a48f9949cfe8f7f6cd5006d.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	888455f1108b764eb9fae7f34aa5d61f352b7b200a48f9949cfe8f7f6cd5006d.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	888455f1108b764eb9fae7f34aa5d61f352b7b200a48f9949cfe8f7f6cd5006d.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	888455f1108b764eb9fae7f34aa5d61f352b7b200a48f9949cfe8f7f6cd5006d.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	888455f1108b764eb9fae7f34aa5d61f352b7b200a48f9949cfe8f7f6cd5006d.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	888455f1108b764eb9fae7f34aa5d61f352b7b200a48f9949cfe8f7f6cd5006d.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	888455f1108b764eb9fae7f34aa5d61f352b7b200a48f9949cfe8f7f6cd5006d.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	888455f1108b764eb9fae7f34aa5d61f352b7b200a48f9949cfe8f7f6cd5006d.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	888455f1108b764eb9fae7f34aa5d61f352b7b200a48f9949cfe8f7f6cd5006d.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	888455f1108b764eb9fae7f34aa5d61f352b7b200a48f9949cfe8f7f6cd5006d.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	888455f1108b764eb9fae7f34aa5d61f352b7b200a48f9949cfe8f7f6cd5006d.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	888455f1108b764eb9fae7f34aa5d61f352b7b200a48f9949cfe8f7f6cd5006d.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	888455f1108b764eb9fae7f34aa5d61f352b7b200a48f9949cfe8f7f6cd5006d.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	888455f1108b764eb9fae7f34aa5d61f352b7b200a48f9949cfe8f7f6cd5006d.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	888455f1108b764eb9fae7f34aa5d61f352b7b200a48f9949cfe8f7f6cd5006d.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_106062\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	888455f1108b764eb9fae7f34aa5d61f352b7b200a48f9949cfe8f7f6cd5006d.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	888455f1108b764eb9fae7f34aa5d61f352b7b200a48f9949cfe8f7f6cd5006d.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	888455f1108b764eb9fae7f34aa5d61f352b7b200a48f9949cfe8f7f6cd5006d.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_106062\java.exe	888455f1108b764eb9fae7f34aa5d61f352b7b200a48f9949cfe8f7f6cd5006d.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	888455f1108b764eb9fae7f34aa5d61f352b7b200a48f9949cfe8f7f6cd5006d.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	888455f1108b764eb9fae7f34aa5d61f352b7b200a48f9949cfe8f7f6cd5006d.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	888455f1108b764eb9fae7f34aa5d61f352b7b200a48f9949cfe8f7f6cd5006d.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	888455f1108b764eb9fae7f34aa5d61f352b7b200a48f9949cfe8f7f6cd5006d.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	888455f1108b764eb9fae7f34aa5d61f352b7b200a48f9949cfe8f7f6cd5006d.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	888455f1108b764eb9fae7f34aa5d61f352b7b200a48f9949cfe8f7f6cd5006d.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	888455f1108b764eb9fae7f34aa5d61f352b7b200a48f9949cfe8f7f6cd5006d.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	888455f1108b764eb9fae7f34aa5d61f352b7b200a48f9949cfe8f7f6cd5006d.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	888455f1108b764eb9fae7f34aa5d61f352b7b200a48f9949cfe8f7f6cd5006d.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe

Direct Volume Access: Opens a physical disk for reading 1 TTPs 1 IoCs

Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

defense_evasion

Direct Volume Access

T1006

description	ioc	Process
File opened (read-only)	\??\PhysicalDrive0	SearchIndexer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	888455f1108b764eb9fae7f34aa5d61f352b7b200a48f9949cfe8f7f6cd5006d.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	888455f1108b764eb9fae7f34aa5d61f352b7b200a48f9949cfe8f7f6cd5006d.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	DiagnosticsHub.StandardCollector.Service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	DiagnosticsHub.StandardCollector.Service.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	888455f1108b764eb9fae7f34aa5d61f352b7b200a48f9949cfe8f7f6cd5006d.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	888455f1108b764eb9fae7f34aa5d61f352b7b200a48f9949cfe8f7f6cd5006d.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000078e6a2923353dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008879d3913353dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000772ae4913353dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000076c8c2913353dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000041eee8913353dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000076e883923353dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000511758933353dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006b29a9933353dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002004be913353dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9926 = "M3U file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 42 IoCs

pid	Process
412	888455f1108b764eb9fae7f34aa5d61f352b7b200a48f9949cfe8f7f6cd5006d.exe
412	888455f1108b764eb9fae7f34aa5d61f352b7b200a48f9949cfe8f7f6cd5006d.exe
412	888455f1108b764eb9fae7f34aa5d61f352b7b200a48f9949cfe8f7f6cd5006d.exe
412	888455f1108b764eb9fae7f34aa5d61f352b7b200a48f9949cfe8f7f6cd5006d.exe
412	888455f1108b764eb9fae7f34aa5d61f352b7b200a48f9949cfe8f7f6cd5006d.exe
412	888455f1108b764eb9fae7f34aa5d61f352b7b200a48f9949cfe8f7f6cd5006d.exe
412	888455f1108b764eb9fae7f34aa5d61f352b7b200a48f9949cfe8f7f6cd5006d.exe
412	888455f1108b764eb9fae7f34aa5d61f352b7b200a48f9949cfe8f7f6cd5006d.exe
412	888455f1108b764eb9fae7f34aa5d61f352b7b200a48f9949cfe8f7f6cd5006d.exe
412	888455f1108b764eb9fae7f34aa5d61f352b7b200a48f9949cfe8f7f6cd5006d.exe
412	888455f1108b764eb9fae7f34aa5d61f352b7b200a48f9949cfe8f7f6cd5006d.exe
412	888455f1108b764eb9fae7f34aa5d61f352b7b200a48f9949cfe8f7f6cd5006d.exe
412	888455f1108b764eb9fae7f34aa5d61f352b7b200a48f9949cfe8f7f6cd5006d.exe
412	888455f1108b764eb9fae7f34aa5d61f352b7b200a48f9949cfe8f7f6cd5006d.exe
412	888455f1108b764eb9fae7f34aa5d61f352b7b200a48f9949cfe8f7f6cd5006d.exe
412	888455f1108b764eb9fae7f34aa5d61f352b7b200a48f9949cfe8f7f6cd5006d.exe
412	888455f1108b764eb9fae7f34aa5d61f352b7b200a48f9949cfe8f7f6cd5006d.exe
412	888455f1108b764eb9fae7f34aa5d61f352b7b200a48f9949cfe8f7f6cd5006d.exe
412	888455f1108b764eb9fae7f34aa5d61f352b7b200a48f9949cfe8f7f6cd5006d.exe
412	888455f1108b764eb9fae7f34aa5d61f352b7b200a48f9949cfe8f7f6cd5006d.exe
412	888455f1108b764eb9fae7f34aa5d61f352b7b200a48f9949cfe8f7f6cd5006d.exe
412	888455f1108b764eb9fae7f34aa5d61f352b7b200a48f9949cfe8f7f6cd5006d.exe
412	888455f1108b764eb9fae7f34aa5d61f352b7b200a48f9949cfe8f7f6cd5006d.exe
412	888455f1108b764eb9fae7f34aa5d61f352b7b200a48f9949cfe8f7f6cd5006d.exe
412	888455f1108b764eb9fae7f34aa5d61f352b7b200a48f9949cfe8f7f6cd5006d.exe
412	888455f1108b764eb9fae7f34aa5d61f352b7b200a48f9949cfe8f7f6cd5006d.exe
412	888455f1108b764eb9fae7f34aa5d61f352b7b200a48f9949cfe8f7f6cd5006d.exe
412	888455f1108b764eb9fae7f34aa5d61f352b7b200a48f9949cfe8f7f6cd5006d.exe
412	888455f1108b764eb9fae7f34aa5d61f352b7b200a48f9949cfe8f7f6cd5006d.exe
412	888455f1108b764eb9fae7f34aa5d61f352b7b200a48f9949cfe8f7f6cd5006d.exe
412	888455f1108b764eb9fae7f34aa5d61f352b7b200a48f9949cfe8f7f6cd5006d.exe
412	888455f1108b764eb9fae7f34aa5d61f352b7b200a48f9949cfe8f7f6cd5006d.exe
412	888455f1108b764eb9fae7f34aa5d61f352b7b200a48f9949cfe8f7f6cd5006d.exe
412	888455f1108b764eb9fae7f34aa5d61f352b7b200a48f9949cfe8f7f6cd5006d.exe
412	888455f1108b764eb9fae7f34aa5d61f352b7b200a48f9949cfe8f7f6cd5006d.exe
2092	DiagnosticsHub.StandardCollector.Service.exe
2092	DiagnosticsHub.StandardCollector.Service.exe
2092	DiagnosticsHub.StandardCollector.Service.exe
2092	DiagnosticsHub.StandardCollector.Service.exe
2092	DiagnosticsHub.StandardCollector.Service.exe
2092	DiagnosticsHub.StandardCollector.Service.exe
2092	DiagnosticsHub.StandardCollector.Service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
668	Process not Found
668	Process not Found

Suspicious use of AdjustPrivilegeToken 44 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5052	888455f1108b764eb9fae7f34aa5d61f352b7b200a48f9949cfe8f7f6cd5006d.exe
Token: SeTakeOwnershipPrivilege	412	888455f1108b764eb9fae7f34aa5d61f352b7b200a48f9949cfe8f7f6cd5006d.exe
Token: SeAuditPrivilege	3264	fxssvc.exe
Token: SeRestorePrivilege	3016	TieringEngineService.exe
Token: SeManageVolumePrivilege	3016	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	464	AgentService.exe
Token: SeBackupPrivilege	4048	vssvc.exe
Token: SeRestorePrivilege	4048	vssvc.exe
Token: SeAuditPrivilege	4048	vssvc.exe
Token: SeBackupPrivilege	4556	wbengine.exe
Token: SeRestorePrivilege	4556	wbengine.exe
Token: SeSecurityPrivilege	4556	wbengine.exe
Token: 33	848	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	848	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	848	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	848	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	848	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	848	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	848	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	848	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	848	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	848	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	848	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	848	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	848	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	848	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	848	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	848	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	848	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	848	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	848	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	848	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	848	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	848	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	848	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	848	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	848	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	848	SearchIndexer.exe
Token: SeDebugPrivilege	412	888455f1108b764eb9fae7f34aa5d61f352b7b200a48f9949cfe8f7f6cd5006d.exe
Token: SeDebugPrivilege	412	888455f1108b764eb9fae7f34aa5d61f352b7b200a48f9949cfe8f7f6cd5006d.exe
Token: SeDebugPrivilege	412	888455f1108b764eb9fae7f34aa5d61f352b7b200a48f9949cfe8f7f6cd5006d.exe
Token: SeDebugPrivilege	412	888455f1108b764eb9fae7f34aa5d61f352b7b200a48f9949cfe8f7f6cd5006d.exe
Token: SeDebugPrivilege	412	888455f1108b764eb9fae7f34aa5d61f352b7b200a48f9949cfe8f7f6cd5006d.exe
Token: SeDebugPrivilege	2092	DiagnosticsHub.StandardCollector.Service.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5052 wrote to memory of 412	5052	888455f1108b764eb9fae7f34aa5d61f352b7b200a48f9949cfe8f7f6cd5006d.exe	87
PID 848 wrote to memory of 4552	848	SearchIndexer.exe	113
PID 848 wrote to memory of 980	848	SearchIndexer.exe	114

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\888455f1108b764eb9fae7f34aa5d61f352b7b200a48f9949cfe8f7f6cd5006d.exe
"C:\Users\Admin\AppData\Local\Temp\888455f1108b764eb9fae7f34aa5d61f352b7b200a48f9949cfe8f7f6cd5006d.exe"
1⤵
- Drops file in System32 directory
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5052
- C:\Users\Admin\AppData\Local\Temp\888455f1108b764eb9fae7f34aa5d61f352b7b200a48f9949cfe8f7f6cd5006d.exe
  C:\Users\Admin\AppData\Local\Temp\888455f1108b764eb9fae7f34aa5d61f352b7b200a48f9949cfe8f7f6cd5006d.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=124.0.5705.61 --initial-client-data=0x218,0x26c,0x270,0x248,0x274,0x1405b0e38,0x1405b0e44,0x1405b0e50
  2⤵
  - Enumerates connected drives
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:412

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:5092

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2092

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:3820

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3264

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5108

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4364

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3988

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:3732

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1784

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2400

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3240

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:1652

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4012

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:3252

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2764

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4840

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3016

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:4768

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:464

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:4676

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4048

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4556

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:4324

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Direct Volume Access: Opens a physical disk for reading
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:848
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4552
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:980

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Direct Volume Access

T1006

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 ff2670d2d828518221a36ac77e2bbb48738b9d7456f6906a9dd5df6c8e6ecf4c
MD5 f42eabab537ea077675adb07b1389e22
SHA1 d9d2f512ca235f5bcc61553721ef80bc0041a27e
SHA512 b73f425736e2650e9282bc70b42aca0b4f99894516bf94223a65b5eab147a825933a0b56480a5b29c9c6363cdb1d6d450ad8db8de3d906e4133b67e5ba5ed95e
SSDEEP 49152:+b+632BuPkFKRrdE6ohdstBhuXjfS4LWxnV4ZPzwFI/wOifnzH:A3q6mjBPYtH
TLSH
T11DD59D03F2D900E9E069D178D7469133EAA2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 4b7b6d15189f814da2859b7b542972bd18c167890a65fa02e5e3922aabe8188d
MD5 e95ab8215617002afead580a32072ce5
SHA1 4c7a6be72df377f3ec26dba998a8fffac9bd9ef2
SHA512 58389d20cf60e1a685ec1930abcb71edd632f4526a849e0a155335e65cc4e932ed37795f7adce6b86caaf498ca045b371cccd156a73ddc6dbf6d26e5ec7b33ad
SSDEEP 12288:V1XLsswWkxy2lRq2czAFcM3tegtociOPyazluRF4KM7GAwOifEWDNRV8q92gnbc:7XYfDtczA6M3tBZPzwFa7/wOifnz20
TLSH
T13F05F128B3D109F9ED67827DC8A28501DB33B8954760E78B03B4953A1F736C85D3EB96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 5822f6e985a49be337b4de3364a742f708372edddb3e12844ca642b9b5da01b6
MD5 026830fae2cb640988e3e880e8f7443e
SHA1 d9bd0f4d7ff2b7ea6dcc8c4887a619cbaaedd59a
SHA512 82e264f8a8de18089e60b27c11a8152f0b144a3e4695b1dbc829026b327fe597edbe7359b514e2191b1f86f051144e62fb5dd763eb5fd65c958178a46d05b944
SSDEEP 24576:h0Le5ji0hmxhrMdM3tBZPzwFa7/wOifnz20:hPji0AzY4ZPzwFI/wOifnzH
TLSH
T11A35AE16F6748371D073C0B9C5D2A68AEE71308657308ACB4296D77C3F67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 017fab96bfebbcaef7116365f1ecc60e76a21b118ea195c0f05eb44ba3e97811
MD5 ecdfc7ae89655f4ca3cfe053287785ff
SHA1 aeff37d7273ef828550161b59968bffdd86a29e9
SHA512 9aac56e7eabffd61e982ad29610169cd2b289a000ac63d10774a44ba2316c290ab5c1244ad5185b2f0258b2b3344581a295c1d621160a15552e159f9b14a940a
SSDEEP 24576:Ta7/ezSC6vUyD/aqgrvWj6q8wyufM3tBZPzwFa7/wOifnz20:+/ezSC6vUzPv+Hjyk4ZPzwFI/wOifnzH
TLSH
T12A755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 4a52e2694994c28751e052ee8c5024c9d4d998d36d117a6c8448ceef1ac78808
MD5 4848f003d981aa4d2b04d7255da2ca70
SHA1 b726e0a849a83a9102e7a9a8841cf2d190c5f04e
SHA512 746d3e08eef0c60128a9e8c90270ec4ffc6aa169f2c0af781da3fa468d8e04bbc35734d35a683b05976a403580f6e126b1089c66ccd63a8e7903b67719fb4348
SSDEEP 24576:FVbqPb88hv/l+B+M3tBZPzwFa7/wOifnz20:FVO88hXl+44ZPzwFI/wOifnzH
TLSH
T1AE559E66F6748331D073C0BAC5D3AA9AEE3234415B318ACB1246D76C2E67BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 073167bbbc2f43c5dfadcd3fc6be5a932e3a40eb4de00347c8ee5845cf74e64f
MD5 b2b66ed3ecdf97cf251aa4762cdb2111
SHA1 08c119b76b0eb358eeae12847d83fecb3d9c0baa
SHA512 911bcd5f421fb079853980c4dadd5286cb8c0453e9d6d2d476dacb0d34b5e481d918099ae9ad55ee7c16ab0e8f823416d25febb75339c6061bb3f993b82a8ab4
SSDEEP 12288:QGgcM3tegtociOPyazluRF4KM7GAwOifEWDNRV8q92gnbc:QGxM3tBZPzwFa7/wOifnz20
TLSH
T16DC42382D79286E1DF521B7621E7E6018B19ACD85610B31F6BB2303F5EFBC46C0165AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 5758e5b6967972e7f0308e3df691babfda961fa783c29586b8d16531c7d09d97
MD5 6bc44a4620cc2601c777d3bf0f417276
SHA1 4a92653031fc47bcfd0c388ea8616fbcebc22778
SHA512 7d5b893faee45f103f6121178db9012d2b671d34e3fdcfeca1f5908a98577c9dfe71adfa2957d7deaa482d2254991d76d071d22adf98ff0f6cc84b4e614d5e00
SSDEEP 12288:beBNUbTVO86UxcM3tegtociOPyazluRF4KM7GAwOifEWDNRV8q92gnbc:bJIUmM3tBZPzwFa7/wOifnz20
TLSH
T11705CF7BEE28FCE2C67A4DB95692C700D77278704B22A3CBD175820E9E235D14D7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 65fa7b0311f73392c25ab448059ef09f37db1ab0086e97305c49b0c8867ff4e9
MD5 63d66f15e8718549429090ffe5a1b9e0
SHA1 ccca9232f9ca324e148dea04c38f33cfc1efc744
SHA512 9bcd4c6f59a1f08a70350aa43a3254ef438e7bd7df3388e777fa39d7d5ffb11118fde429d52ee92db2be9fcac301d69d0e41dece072107519260f4f841ad9f25
SSDEEP 49152:JQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THm:JQvGAdlCEL8c/WRNw5CgYtH
TLSH
T190267C656BF880F5E1A7E138897AC672F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 226a4b9090f9d4c94e10528857c30eb949b3fa855cce4044d37e55a26f0c5751
MD5 afc9a591f3ab8a2924d0b070947979d4
SHA1 752d473b617064256ead0cbb7a99022fb5b49bac
SHA512 d28d08d298b82d6a13eb2f8bd170b47852644775e847f74a9fccc2df87bb6c91f1e9735efd06d095811b155f3febb070605616e10d76386a7ece5e55aaec9fc6
SSDEEP 12288:RAwSfxL/2Dc3mDLLmt0LDQewsAjDcM3tegtociOPyazluRF4KM7GAwOifEWDNRV+:yfewsAjoM3tBZPzwFa7/wOifnz20
TLSH
T1E315E031FF75E032C77B0DB61B66C716142CB9604B612AC3E3F8499E59706C26376A2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 b56cf90d53886ab81cdf72d49ae76e932b73bcdfb601a3cfbc0b69002a59d03f
MD5 a53c00bec4182c47f47a02e9ba10b714
SHA1 2c8c9fe4fa1d0d10f46b507594b857d63236ed71
SHA512 34ee59af06fa45fc48974ff36abd0caf2ab98f0cff003c6f0c5d2ae093b97d87ab712b064a0bec9899852f54d6380b31f82fb5769111915c788eef57cff7c3b2
SSDEEP 196608:9UEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHN:9UEtQevvqc2W1cpV20I32
TLSH
T1A9474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 ffc6418be3443e07ec71d0618848a5c2d589d1d85d306cd59fdd6e6c4c1e2b24
MD5 d39448130bbfc3630c665dafb20de565
SHA1 96dfa82aee8067b9cc1b96f75cee5911d7fe882e
SHA512 90598a42d9fcb5e9d6e4e1d631458d577a3225983cd811a5be520bef30cd0503bd88c83689d4d8d3adfbafe25211b703ce4867a1c5f101c7a3c90eb9fe08b413
SSDEEP 49152:BCbRquA/m2yL5zLfFiV+XenmE3/zI4ZPzwFI/wOifnzH:uoq2VjnmUYtH
TLSH
T179D58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 b17f79a997139f8b08536001233d82d174390075360c6ebcfd3e01d01ab45a2f
MD5 a2eb3ede17770240ec942bfca906761e
SHA1 680e7cc231d4bc8a0c07e8901a3d13af8163409c
SHA512 e7b6a84ca5fb0892bf10ccf4e3ad7bc864c38a657432c1626f41248ebfcd12ba66b9641d1ea029662a9c1bbdb706a514efcaac3070d201a9b7d786be4c1fcc2e
SSDEEP 24576:gAhGL6IFoiwtA5l7S537M3tBZPzwFa7/wOifnz20:gAM5Foiq5r4ZPzwFI/wOifnzH
TLSH
T1F4359D81E7F945D4F5B3AAB899B69171EA76BCA95E31C20F2160D11F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 56881e229875086db0cc057a8805da623534d4193aadb8c5ea42d53449bdc753
MD5 991d60c86111098fff3358585dc4816c
SHA1 4348ffd6b56ebd241afdb3926cb029597da8b809
SHA512 628b109be1563ac2722e1194c590d5e2f5f2ab04d652d1eb266556d56cc905f060f8e7a0ac52a3bb254977b67eb7cafa22fb63f8867ade13b84e4ea38a4c770d
SSDEEP 12288:xmw5HEjsChNEBFgl0WDm+C2cM3tegtociOPyazluRF4KM7GAwOifEWDNRV8q92go:swuROWEM3tBZPzwFa7/wOifnz20
TLSH
T1D605F14673E50CF9EA6786398597C132E7B2BC412A21D71F1770C22B6F77251AD2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 5e9d655412aceeb8a39920e792fa081ae064ebbe23b18b7a028a1dd93fb25513
MD5 077808f83f381be16edde49089ee9fc0
SHA1 a988f5ed3d56fdf503e8c07de6091bbbce9b76de
SHA512 33a5c94cdd36f8e5bbc99179e7f4f99b5024122bbe8770a5b1e43a21c8288b102a4b9af6d8b54225be220d94f1cecd13988cff9c976826b6df2d39421d453530
SSDEEP 12288:hyZ1IyzcM3tegtociOPyazluRF4KM7GAwOifEWDNRV8q92gnbc:oZulM3tBZPzwFa7/wOifnz20
TLSH
T139E4128A23E521F5DBA3563D88E29605C7727896233153CF1A71413A2FB3EC68D39736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 bce80350dc8c124aeb18ccd9163152bd288989c6c08899dd830899aedae7920d
MD5 66fe4eee827f3a9b3feb3a3809167104
SHA1 34501787b8a69d339a3c2bdfd6dd36d3820da1f4
SHA512 f1a3a4e4962a5a45ca6d8fb3b57932c858e65a6627c8af29141b20b8d85834be4e0d176eaab6f135a9dd5e327c32de399d17e20edcb4c4ecf4f2750a91f9f0c3
SSDEEP 49152:uj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23US:dQRQyi36YOcPDLvw2gAf+PN3rYtH
TLSH
T1B4667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 b374da044f6442e74b1619d01aa25b3451f70cbc10d377d4c619860a66826d5c
MD5 5d9d592fe5021a0800d7d18d7f40a84a
SHA1 1a36b4be68ae5b6c02e5492b310028f7f6797390
SHA512 e6b513e6c862537535cbe2c3d80912ee2f067cfa95cf04a017837b0f7d250feb4f9cbf0aa5197ff32098aa744937380399bb0df9afd4debfa9a37279c27f28a9
SSDEEP 49152:zj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23US:iQRQyi36YOcPDLvw2gAf+PN3rYtH
TLSH
T16A667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 558f223f060cd1825350d240538b9ab51ce84d5d2e576f825262b81a35f7a05f
MD5 9da629582e4de7177d4712947fdf46ea
SHA1 754a3330efbd02a09e987a9d3f83177fe4703e30
SHA512 29fb7b9bf696733001ade07fcc0faf77993c78513975fb34d0fc0ed9b2b1cd214279aac9d43ce25f959a109c10d3ab5da2febe98fd4a5d24a4fa5b607963a589
SSDEEP 49152:R68Qg55nhkeWu7PNU3/Y4ZPzwFI/wOifnzH:PthTRc/VYtH
TLSH
T169B54A33B2F200A9C44DE1769F4A972196D17C758FE0E3DB8511721A1FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 d3f575e8846aa3604d3677f8110e1c2c73a2ac5c6cbcaa06644962d1b907d791
MD5 465170546b66eacbbacc54d36afc0bf4
SHA1 9fecf56ea625bae94ace60962706bf4a07543523
SHA512 3e1fca9a9bc830459cc3b482256e89118ece209f295e2dbc68ad8d7ddbaaad3ceb5a89d2c0bb7ccd4dfdf193edb75ce94b382f3da1fc4b74948d3fef7438afbb
SSDEEP 49152:v3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbvN3Oh6tznm2FQ/nho2qkrk99E:Cy5112gYy5azzVvU69nLKnhZeYtH
TLSH
T17D167B13F29901E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 70b8451fed38061f1a13bdb4cb6fd7537503ea6117d98ab2381809d44fc246fa
MD5 0ffaf5ca27ad80f4475516734ee2aafa
SHA1 cbf5539acf483a3ea6a9bd3149969d0977b68e3c
SHA512 0c67c65f945d95b670f50f060a95dbc925fb56ea47e00229ad05e312f8749edf2cee33f5ee761fa84077a86a1855058fd65f0d5c14b303ec218e9590e5086556
SSDEEP 49152:9B+taZ3usBWOBr4tEGa0bqx0z+n217aau1glq4ZPzwFI/wOifnzH:ju6JmIxd2djYtH
TLSH
T190D59D13F1DA01E8D06ED578974A9233EA62BC490B34B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 4e58dfc920e73b3a1df1b44ada7ce3dfde0c29b629a0eba3f69f5db84661c4c5
MD5 b7a05a42642caff8e03db101b1d3a454
SHA1 9fc23b443efe8240f5fdfd1a480cf2891773ea04
SHA512 3fc3d974b3944f8bd3c5bd98b9d7bd49a8c40608eb3b98208b7a7602962358a5513c0497fb71ba48cb5d631cef0acefb995d461437e25193b9b58eb62c15c6c3
SSDEEP 49152:g1hpsNoJpF1A67U44CwH7R4xG4ZPzwFI/wOifnzH:gmifPqRUYtH
TLSH
T1BBB5BE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 8c6f1b8644202361ba977ca02d325839614b9c7b5a47839c07b824e3199c893d
MD5 e4511df82965cc34c9834dd68cad2366
SHA1 c6805003c994968644d689f83e26897f77fbd76d
SHA512 3fee94b1f85d66863971afb72d020dad92f7faa8727f48bc52fcf92feb8982c6bfc8e9ee40e9ea8511feccdef1835ab84c6861215fd429c24b711ff4d42f519f
SSDEEP 49152:CSuZQIY0Be2KkRVtOnks6NMHql4ZPzwFI/wOifnzH:c5dKqi61aYtH
TLSH
T196C5BF03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 aa56c52dffc04027ab9103ed7e806b91cbb333948b4d0887e54286e422bd4306
MD5 00f0d56e03e466f6bd46c64a79867cf1
SHA1 a5912862745bc721ab3170aa164644a1226b34e9
SHA512 68e22cc6e8afc9e30f16aaace0c1c17cbddbff688efa38a84594efe048a04dce15d05cf9f627595a3c0a19de0bcdcbcdb4b61b63ee020ff0f05b72a3da7b7f0d
SSDEEP 49152:dhtSn8EApI0figjgiDn0AP5w64ZPzwFI/wOifnzH:MX2iWphoYtH
TLSH
T10595BE13F2D901E8D05ED178C7468632EA62BC160B35B6EF0A90B6561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 febb51802641963ef4be8c8dfef1120bf4ae2e949ac051cb151209ea3c9f603d
MD5 379ad61f24ddbbae00d9a3b20238b79e
SHA1 45be78a48c0ac095a377aea3feacc530d538be30
SHA512 4c292e6bad2de076a56b94b84a2700473b2ef427b4ff0e8f8fc374be669889648834d99bb2150cdec7d0edee58def811466d295a4291a2edb3f4df2fe721597a
SSDEEP 12288:S4cM3tegtociOPyazluRF4KM7GAwOifEWDNRV8q92gnbc:SZM3tBZPzwFa7/wOifnz20
TLSH
T169C42381E7D38BE2DF015BB651D3A3018B0DACC9A611625F6BB2103B6FF7D4680195EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 4283751270968551b3f99760f8db345c1f6fed03005f01647392b83d9642a13d
MD5 09395619ca6a4f33e6a0ee4b20a57a5f
SHA1 139e50c2838ed6cd478ed5b93f7c6fee07591ab9
SHA512 a22a6606b22156d7c71ca939bac9866db1ac2fc97c0c8ad8f460f3145bfa04917bc9873cdb2d4c2d9c5fbc68db68f8b56576b87d83a5f41048dd54465f2cd7e2
SSDEEP 12288:5ncM3tegtociOPyazluRF4KM7GAwOifEWDNRV8q92gnbc:5cM3tBZPzwFa7/wOifnz20
TLSH
T181C42381E7934BE2DF015B7651D3A3018B1CA8D9A621635F2BB2103B6FF7D4A80195FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 e6ef7e2ae8903c9589a29a6d287f97d90c4aaedb804c54e0ac90b9c92b3106e9
MD5 2781653ab8bd856fba8aece071ab1d46
SHA1 1c9985ef9c4954db1e48e246d62ecb39728333f4
SHA512 c87473f638f9763de70555a18af35b0ab391165e89f4aef6f177f23a7111e41b74b5242e067823786e55bfba04894aba873751bc1b63f6580477b13e09770c58
SSDEEP 12288:UJcM3tegtociOPyazluRF4KM7GAwOifEWDNRV8q92gnbc:UuM3tBZPzwFa7/wOifnz20
TLSH
T17EC42381E7938BD2DF015B7A51D393018B1CA8C9A611635F6FB2103B6FF7D4A80195EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 91bca8abf3d01ad1336927fcc1685fc0d8733d4e0d26ffcee6bf5f086b8e89bb
MD5 01fc84b30fe0b3e671ccabfc31a04f85
SHA1 993fadf74a867cef5a9ab4660652d04c1b685e83
SHA512 35feca81b4bdcac54fb00f85827fa9fdd9d9a9d60b2299a1cd9ffe08dc31f070a7dba6ca21fb111814f81fb70a1bdb41342c055547b5c5a484c36f4b8ec28233
SSDEEP 12288:dVScM3tegtociOPyazluRF4KM7GAwOifEWDNRV8q92gnbc:jM3tBZPzwFa7/wOifnz20
TLSH
T154D42341A7E746D1DF12977981E39201C769BCD8A331639F6B72003F1FF3E858425AAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 6432b8306f22dc469dd45366e7a9a50aa6a850ae7d347b1e51138a85d74e1ec9
MD5 05180d37c28920793731c26f5942d603
SHA1 01a5945ecd3ced5dd18769a57854092f39a1608e
SHA512 572e6f5aedd358f55503388af66e5ce3159d6a0ea0e315ffd70fb513f2939041a3beb1563f7e291b0be8b796b606f7e5eaa8cbe3be25046bfd22b5cd253103b2
SSDEEP 12288:u6cM3tegtociOPyazluRF4KM7GAwOifEWDNRV8q92gnbc:uTM3tBZPzwFa7/wOifnz20
TLSH
T117C42381E7934BE2DF015B7A51D793018B1C68C9A621635F6BB2103B2FF7D4A80195FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 b46dfca8a19fe1bac2f9a942ed02c679bed4c97a6107181895642f4822e7152f
MD5 02b122521a60430bae10a49b4fa5bd67
SHA1 aca8b01e3db90d4f795f2a415729be3db50afd1c
SHA512 53ab77fc831680a7ae9381ced975bf42c950bc34899a957c83ba6d38fa24bcafdbe4d29db8a617ebae28669d6a888167fb175481e50d9871a5cd74fc0bccfbb3
SSDEEP 12288:f7cM3tegtociOPyazluRF4KM7GAwOifEWDNRV8q92gnbc:fwM3tBZPzwFa7/wOifnz20
TLSH
T139C42381E7934BE2DF015B7651D3A3018B1CACD9A621635F2BB2103B6BF7D4A80195FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 2a6242fbcdd7898cf7db3a25890f70ce3df76ebca0d421cc239ada3c697d9a2e
MD5 2b63746a5b26d987e6784f61c0dabf43
SHA1 e8f5f3a3439cbda189f8eae259937ca8b4f651f8
SHA512 c835f790181f7de6191fb6fdf8ce1d55105b4af9827c09a0e9b4c9b82bbe9d7762fdc99df458186b153e2b64d6db4ec5490f4d7f3d349e6916e34c0561c54a6f
SSDEEP 12288:xvcM3tegtociOPyazluRF4KM7GAwOifEWDNRV8q92gnbc:x0M3tBZPzwFa7/wOifnz20
TLSH
T174C42381E7934BE2DF015B7A51D3A3018B1CACD9A621635F6BB2503B2BF7D4680194FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 1f46fe6cc171869867225b26d9efe9019217855b3f58841e158ea3511cfa19db
MD5 69f80c31a5bd81792e3d0589f6cec022
SHA1 41af0c828edc8abb57ccb4cf7bb8d02a1a9d7095
SHA512 db264fcb489425cda72b4b2fe9ba426bcbe3a5e11ffadef1804d78d83134cc96a1756ccdf4da28b89d17d3252d9b98c750e2947be6a633f59fa384fbfc6fc54c
SSDEEP 12288:miZwbDzzFEoS2cPvyHcM3tegtociOPyazluRF4KM7GAwOifEWDNRV8q92gnbc:pZM3zFVSO8M3tBZPzwFa7/wOifnz20
TLSH
T129050195B39118F4ED63823EC9668906D7B2BC590770C21F17B4322B5F737914C2EBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 5ac30b0a529fd3441b339f7f7dfde59af955197b2a1eb16693fef8c9233449ed
MD5 740ba77564bc65f6984f9902a041291f
SHA1 05201aff291fa42baefb931bbf7ea3fd680645f5
SHA512 28fc9207a4d33687631c470d3795a76994835ee0196f31f24e4da1e374842da9a7f574f932a65df169a241cf91f658b1627b6ab6a7dc8fa3d129f90a407cd6d5
SSDEEP 12288:1kcM3tegtociOPyazluRF4KM7GAwOifEWDNRV8q92gnbc:11M3tBZPzwFa7/wOifnz20
TLSH
T1BFC42381E7934BE2DF011B7A51D793018B1CACC9A611635F6BB2103B6FFBD4A80195EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 04125d00e01e11bdf4d324d7b59dfc7281e81ea811f435e805f93eeef08071a6
MD5 acdff2b57339c193f32c9ab8275554b6
SHA1 4b41b4a109b6ba5f80f1bdbbd6721574992cee7f
SHA512 b7e3109c0e81fb077a7579f38b22fc646e1b0a97ecff6e821c70635beedfd43e72008adf592290ac9d8eb14e715f59715e78c6af811a146099c42e16702b618f
SSDEEP 12288:SQcM3tegtociOPyazluRF4KM7GAwOifEWDNRV8q92gnbc:SBM3tBZPzwFa7/wOifnz20
TLSH
T173C42381E7934BE2DF011B7A51D3A3018B1CACD9A611635F6BB2103B6BF7D4A80195FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 3ed2e1b79975083a4cdcf7bc697cdf4e2335877c73761791104265bf6509d2d6
MD5 02aa543c3f33a2edbc9ad39b1ba15b3c
SHA1 23f37fa309fbcba5a846dee71158c25e415b3c4a
SHA512 af3966a7754a0bea1fad45367bed9617b6df8c60eb71e776dfe59b217fe433aee03d7b4c0bc0bb30ab091bc36df1232c7309f5cd7b9da0fb585583fd9ab28374
SSDEEP 12288:4yPz5L8zcM3tegtociOPyazluRF4KM7GAwOifEWDNRV8q92gnbc:Zzy4M3tBZPzwFa7/wOifnz20
TLSH
T11FF4124773A231F9D626833984A35A02E775B875472097AF17B0023B2F77A918D3EB71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 64f815d0da123802cd7ea6e369097c7183236526997347cc2f71ca912d44cfc9
MD5 dbe5a535e6dd5f27ebdcdcda203f8ee6
SHA1 86d1bae920e24a0bb691ea62001780c2ff234b84
SHA512 88c797c163f478190c4a2aab68dd2b1ceaf17b72c07d181286151c7d9486df6601c2a9d21a9c98434c41e7cfb4e91c6629fd0049a47e1b4f14961899cc42d3d8
SSDEEP 12288:6kcM3tegtociOPyazluRF4KM7GAwOifEWDNRV8q92gnbc:61M3tBZPzwFa7/wOifnz20
TLSH
T1B5C42382E7934BE1DF011B7A51D793018B1CA8C9A611635F6BB2103B6FFBD4A80194FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 c41e461d9f9ef16918c187b2f929971ae763231511c80d4eff382a4509e061c1
MD5 3f5e05b156369c16826cad0cc3d6e6ae
SHA1 9a801baad686e3ed5579b711845b6d899511b67f
SHA512 c7197211f79826965576eb6e11d219ba29d7ae39fe6c0ee0a8a5a9eb0d4f6f4dc7d865ede4c8c015343d2ae3050776f95a9ec3b692691773422cd6e06de7f1c4
SSDEEP 12288:xkcM3tegtociOPyazluRF4KM7GAwOifEWDNRV8q92gnbc:x1M3tBZPzwFa7/wOifnz20
TLSH
T10DC42381E7934BE2DF011B7A51D793018B1CA8D9A611635F6BB2103B6FFBD4A80194FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 42d9d4bf4e3e1ff092464f94b80cc5f8ea992ab17677d83c5293f26fb8d5f47f
MD5 67fee67056849b795978a4fd99337fa6
SHA1 a8a9409b6986a8b7ce1611f9c3c8e1395f77c9c6
SHA512 78a33aa26aa545e869fa36e650492a15bcd44956702a870a44e411d994d34f3233fcfe1c1a67f0b3997ad48d761f510dcc54a84dddd5967a40ad5128baa80186
SSDEEP 24576:ZcP4mcvIjkGOxhKP2l71nNKbrh/8KBNM3tBZPzwFa7/wOifnz20:uP4m4IpOO67W8Kv4ZPzwFI/wOifnzH
TLSH
T1F465AE2DABDC0096D0BA917885668A09FAB1742A1F3286CF1170933D3F77EE54E35F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 ba14c416eb85b8f5a97dcb5867c09ee51bff5ac18bd92939398dfc30c1d96e08
MD5 f5039c516f4b64755d99d13297449b24
SHA1 5e7878f4a516fd301bcccefea68f72857a70cb8c
SHA512 e22c46e3e18e6e30bc26b18e31e401e79b53be28badd9d9a0f6c8300d9a728304ddb240216d62fbc59b89ff2ab6d41aab0696c068370d6a28ffd63e8b3145c6c
SSDEEP 12288:Vpsf0cM3tegtociOPyazluRF4KM7GAwOifEWDNRV8q92gnbc:2lM3tBZPzwFa7/wOifnz20
TLSH
T1D2E4F149D29402E4C56E6279C7968601F3277C6583E1E3CF57E0F03E1FB6A818DEA653
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

843a040d250d612b.bin

Path C:\Users\Admin\AppData\Roaming\843a040d250d612b.bin
Size 12KB
SHA256 f0d0fa6b27d93fa7d831aa1de852fed884cb9a3f78cd968d6533e564c6e415f4
MD5 c663c6928c431a560db8fa25287a9233
SHA1 9b088300cd14b2905d5a46f535c5b09be9b28300
SHA512 b22ab3240df28ae264e17b40cfc5fe8134f455a6ee3aff4449c080f79a1d05683e4df71324115c31e00ea2e649f40fb16a4d98c704425952dd2a2bf6ffb9d2b5
SSDEEP 192:t5Eks3bhcYdlg52wydLjZJCy0xwOOP9OVJf2M8MgPPDh5TOPObW6MJeRQe:PEkjYdlgEd1JYGOS9eV2MSPd5fuc
TLSH
T11B42C03DF24951280DC9B9EBB34F923100A150414912AF86DBE3FDD9AEE7484683E62D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 258a6815aedfcd4a827f3660148d2232b199d991180b2ff482a1f23d53f5f0d9
MD5 3e14c54d4478806eace2bacab0af368b
SHA1 6e0646bf1bab765c3716cf18304021000681242e
SHA512 c590799d04dc9d4f23361045b0014098c9687108df4ab464cfd48cec151f70106a2a731ed6d1644e75dd020bbfd66849aaccc6e552f39403188ad37bea98eca7
SSDEEP 12288:VUcM3tegtociOPyazluRF4KM7GAwOifEWDNRV8q92gnbc:VFM3tBZPzwFa7/wOifnz20
TLSH
T177D42342E3D68BD2EF615B7510E7D211471DB8E85B10A28F7A72103F2AF7C86C82556F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 a206df51d0f4b4fee0c4dd23716b6be521f36a941bf3179a677acd3611b04664
MD5 a5252d8413c3c8e239daf7e3b435ef4d
SHA1 353110ac104a26206972f1b692f8849b14b4f3fe
SHA512 48dc71cd252a463577eb5b06dc3c9f753e126d79a2a314abd7500230bbe641ea664032c02b61aa601fa435d7a96a6958059eeb8b4ae1656b4aab6249f0935e2c
SSDEEP 49152:ga0h2GEkuAe73q3pp46zwwQT4ZPzwFI/wOifnzH:ga0hNYG4JwNYtH
TLSH
T1DE859E1E67EC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37DE84D3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 659KB
SHA256 080c2a9348ff099e886d413510ed9575add19165f2076635366b8080cc7e268e
MD5 c0c659521b2ec7e2b5705ee4be26cbec
SHA1 a25ef91269be3adba2f9a0629dcb8879dbfdc2f4
SHA512 55ff3f7e314f40eeee38282df2cf655bde0f4f22e8f4a7a4205663aa9d380dfe02066996166f7984fadf47d4dcaaf85c4bda00851de5c02d4aa549512d1e09e4
SSDEEP 12288:1hbHjfX3cM3tegtociOPyazluRF4KM7GAwOifEWDNRV8q92gnbc:1hbHjPMM3tBZPzwFa7/wOifnz20
TLSH
T164E4126E67AD11D5E631A27D81938206C331B8651721A3EF27E2813E0F7BED54C39F92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 cf0bdb6777231039b7dad036ec9241ced5a5c5d543eed666ff27198a9d0ed52a
MD5 ad4aa1bacf81a0104f347b43b48a4130
SHA1 fe8c9fba374b735e9fa3350769117cf6302dffb9
SHA512 a7d73a20e90d21b60b16f3ac3029fedb8b537d4ca85238b42bd4cd0089e69a41f8d9af0c1769e1beb6716df925a59655dc69e2babb4755abc009bb12425c0128
SSDEEP 24576:Q3YgnJcRTk4yti+R5dBR/EM3tBZPzwFa7/wOifnz20:QIgnaTk46pBR/E4ZPzwFI/wOifnzH
TLSH
T10045BF2DF3B910B9C8A6D236454247B5EB71782D1F2096CB0170C538AF1AEE89E35F5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 578KB
SHA256 173a2ff90c0abdf6730e207f40cd7fbb31185dbc37345148c81d7e1e4ed10051
MD5 bd154d82b3e44283962318bc324615c7
SHA1 c4fa643f3f5c3434a09b6365e975efaae42cd5a1
SHA512 af1f3b1cd8fa148517b080e6926e35f265dd62b3be52f928446a9846f36234725cc9ff5dfdc712e578cb1af6d1926f29a5f17e20f9dba867cadb2373f992f7e4
SSDEEP 12288:AAcM3tegtociOPyazluRF4KM7GAwOifEWDNRV8q92gnbc:ARM3tBZPzwFa7/wOifnz20
TLSH
T1BBC42381E3938AD2DF115BB911D793118708A9D8572163DF2AB2603B2BF7DCB80355AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 940KB
SHA256 ef171bf27c75cd0247adf6fcc82c1d63c530b7ff2e2f408240b47d276cf38369
MD5 66bd6f69838ba2a7926efae70e7b4ff5
SHA1 c215c5947ed7f25b9a58f437111b1fbbca61383c
SHA512 3828e54a1ee502333c59221803d0167455926b4863e9cc92c629570d169bed2545b6e613d07b13330372934b31d8b78f05eb99dd74295f0ed8fd3facb05cf850
SSDEEP 12288:JObIA4LWOsvAYFTFcM3tegtociOPyazluRF4KM7GAwOifEWDNRV8q92gnbc:+AL3UT6M3tBZPzwFa7/wOifnz20
TLSH
T1D225F155F79500F5ED67923C85A38612D372B89D0320E3DF07A84A6A1F637E24E3EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 671KB
SHA256 c460d799eef32c3ca069c6d5e7f9324d7c1208bcf6b145f88a8439b5f259b04b
MD5 e6917fcda82b3cba1804ed4f18b57871
SHA1 5304de0e7a901797c969aee4cde7bc7ff379e693
SHA512 73262c4f68654e9ea50d48fe0fe4763c5a573602a66dad6cb62f6af667618466537d8555566dd51e7cfe3e4fa33b83c950952d83f85f67f220688f50898056bc
SSDEEP 12288:4pFtvORcM3tegtociOPyazluRF4KM7GAwOifEWDNRV8q92gnbc:QOGM3tBZPzwFa7/wOifnz20
TLSH
T11AE4021937ED11E5D635A23D85D39309C371B8A5072263DF06E0807E1FB7EE89C3AA66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 cb49e7014475c06432c7301aa422dd000f0b77311f838bb80264c23959df92d3
MD5 a883871191d9fa4a133542233ed91124
SHA1 2842c9914d05bc0e2bcf5dfe788c2ee0584939a4
SHA512 be692e59c1b9eed93b849afab3daec1d0abb87fec5d46d4a7832d6f6c86c825b9fd08efa820563519f853408bdac5224db43255802c65d6d0ee174c2d14ef85f
SSDEEP 24576:u7NM9YqZqmWMUkPjZM48Mv6bEhs1M3tBZPzwFa7/wOifnz20:u7cBWMpPjN8DbEhs4ZPzwFI/wOifnzH
TLSH
T150659E2E6BEC81E5D576D13DC9E28205F6B2B4611B318ACF1162833E6F37AE44E35721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 d9f16e0af9c43677c1e9e862571c4125cd767ab65d13281d09d2b1ea7ac2731a
MD5 1eb6e50a22e2584a50a96c2cd0f48eab
SHA1 a87329218406ccd34883512c1e02abcbb43dc4bd
SHA512 bdd131cfe9804f955a75ade2dc9159aa85d611c3fa9912180c7694e91c4e1331c9f473c0db71fb9926b35c98b824046fcff2440d8dd39ed9e4a775aa06a68e0a
SSDEEP 49152:3F2YuHNETovAvNYf8kmV4ZPzwFI/wOifnzH:O6BCf8kXYtH
TLSH
T12C857E6927ED80A4E0BBD27D45B7D246FAB2B8511B3056CF0255862E1F33AF44D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 24222ba1273a4783362a63fa936fc6b33c7fbe82e664cf021d1cb3bf6c834e38
MD5 762acbc2abc768037ca14be3c9f25ba5
SHA1 6d4be484bebe797a78a31713e1ede8af5ef40dbe
SHA512 d957734a31b1896e159e92c8372c3d52c69eba74dfb624c6a991853a99597f47c234bb34618622f1642bc01972c22dc01f68700b3b1b52e13fe7a1b0bf4edecd
SSDEEP 24576:7AFs06+Omlf8NXEbToCM3tBZPzwFa7/wOifnz20:0Fs060loXuz4ZPzwFI/wOifnzH
TLSH
T1A965AE2F62AC00D5D07ED17D8997C91AF7B1746707216ACB0260863E7F6BEE85E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 885KB
SHA256 04eb5906a18803c196532083da600bb44ecfe21d0f6b3c575cd836e5eedbd7a3
MD5 8faf33eebb22254b59d8f845a92e0131
SHA1 46f427dbc1974895f60f25bf4423f34c64b3cf86
SHA512 1d294ec50c30b6ac54cffb5a93483e869921c1b7de0389a4d1ce3d0e5b979e432bd113e9a0a2b4e19240a22af8bb76cca8ef63ef5f6813fd429fb68f50b013f3
SSDEEP 12288:LCJnJ5D3VkrDzxEcM3tegtociOPyazluRF4KM7GAwOifEWDNRV8q92gnbc:GJnJ5D3WXzM3tBZPzwFa7/wOifnz20
TLSH
T16715D02DD2A810E4D4B7C374819A5756FF72387D2B226ACB28B4D4353F12EE09979F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 c78701029c385ebf477accea2cbfbe6016e700fbfc18f9a135e74b5a8a7b8eee
MD5 84498a0044f45b6aa4c654502f00e6d8
SHA1 9c0e4081687541cf82538e00cec91050922791e8
SHA512 e0d6c48abec29c0a219a632503e7373d26cec708852e3a398e7a5c81c099ba6227770fafdc9a8e9151ef099d9dc1fc2d2adb24acb754db588a198d3afaba2396
SSDEEP 49152:Rg06DIKdwc+eQnSt65aVZ4ZPzwFI/wOifnzH:a4YtH
TLSH
T116956C15B7EA5294E9B3CAB1C962A1169B327C509B34F7DF0AC0C92E1E33BD1D934B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 661KB
SHA256 646fb0c27f494b1e04f9ec749f3e4e60422eaed9b5a7501bfa3e9d95ade86f10
MD5 a7405e7eb7cb822015fd7fd5e686942b
SHA1 800dda692c0e3a135d52a37395b25efc2e30fe99
SHA512 d499de8c9986208051808342bb96b0bda18fdfda7dadcaf8ec847dddea4cd84545e53c41e77b69ecb977e00cf76d6ca01bc787b4131969e4cc21cf6c35ac227f
SSDEEP 12288:tEP3RnIcM3tegtociOPyazluRF4KM7GAwOifEWDNRV8q92gnbc:OnJM3tBZPzwFa7/wOifnz20
TLSH
T128E4125D67AD60E5D626A23D81D28205C372F0B4271223EF16F2813E4FB7EEA5D3CA51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 712KB
SHA256 c29aee1037b94edb67e5a29fbe7ee7c5576f8ea6b0799e2f8ffa7b9eb65c2610
MD5 1dba6d2a595e886c6dad70a3d39a257c
SHA1 de4b525b9250e97bf02544b6b7463812f255e194
SHA512 56d430590fe9cc67d9604821747860b4d7a1261275b97fae8472eab97a8e85c135ed17c84fe93ca0d3be06455a4206b42355f5b2e341630e885ff4402363246d
SSDEEP 12288:ZjkyncM3tegtociOPyazluRF4KM7GAwOifEWDNRV8q92gnbc:ZIycM3tBZPzwFa7/wOifnz20
TLSH
T18BF41204A3D591D0EB75073895A382108B39BC605B21A3DF66E1E13F6FB7FC59834B6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 584KB
SHA256 a79de81225164b1ca8d06118ee6917f241ee82472aaf498b9c7e8400b51f1920
MD5 3410b1c9c9e5529ae2c427e736b05f13
SHA1 9f7afc859ad2a96de57acdb3e3bc36bb2550aca2
SHA512 f6916ebac3c280da67c5d78dd5a58f1ec5330e9deff84b91c866660cc59dae0f2307a048b9a6c41116c3673810f602e8dd02917d1549b994bda8f40cd19ec37f
SSDEEP 12288:tyBcM3tegtociOPyazluRF4KM7GAwOifEWDNRV8q92gnbc:MWM3tBZPzwFa7/wOifnz20
TLSH
T1CED42349A3A356E1DF110B7911E79701871878A8572132EF2AF2A03B5FF7DC680359EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 a689eca6747907e27212091cd98947d814155d31ba2dc4433d9102f2433f3608
MD5 f8add136865bce144c9c0d7bbd4a7981
SHA1 5b3d88d8182879a45493bea694c1ee01288102d4
SHA512 31f1112720a90193621eef58401d9cc80c988135221a068ac20d9a30a6fc68f3c615163b57743f826c6c60a8b42f2139199008352dc560655c86efba921127ef
SSDEEP 24576:7Q9MxZKdcz9dw39M3tBZPzwFa7/wOifnz20:7VKZ94ZPzwFI/wOifnzH
TLSH
T1DC558D2DABE905DAE177D27595A250C3A633B4301B31D6CF2448D03D4DBBEE8AA74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 772KB
SHA256 da1926a9a61015700d9f0a869de95f164dbcddcbb8fcde84544ce96a1b9d7d7e
MD5 f738a50816623ce588d87b94657990f5
SHA1 abbab81c0b7080d6a13e786b28205cc33dbd0081
SHA512 711bce22d512dea96b443a37b1828f2a8e4c9faf06153c9a0341ee86986d83e63cef1ef17c4c472b1669c907eb17e9d5c0d62f5d76b03979d1c44ab40066cf8a
SSDEEP 12288:KyoKo2JRple9pDcM3tegtociOPyazluRF4KM7GAwOifEWDNRV8q92gnbc:KyocDApoM3tBZPzwFa7/wOifnz20
TLSH
T1A2F4E15FB7AA40E2D162823C89868705E773B0705B2263CB6691C33E4F779E9BD34B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 1a86da1e772879f51a6d9c0549e23e1e403cff84ec147c91c6c14e9809207ede
MD5 143e2423819f854a8ce5b3f6767108a4
SHA1 2851f1744e3ef9cefedc02530bd78152734b0f21
SHA512 1bb63d53f280ef7ecfc5d62f23d84e68589eee8f60f9d9129af1168f788d5a02bf40110534a318ff2d42fbde6719d9a038112f1385af1a173ff3e2eea7ea5068
SSDEEP 49152:6WcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKo4ZPzwFI/wOifnzH:80zuNIzYtH
TLSH
T1F3A57C3DA2F800A8D9AAC375C5461366EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 9302e77ea7a9e6ce9952c88e364c5cbaea072e1cb6d62d5f7c92e46139cf880d
MD5 1d5c857b2abc1a228ab3aa3d2eef2e0e
SHA1 5120356f3792163ba1d4c5c424fbc207f448c3db
SHA512 3801866ddb6100c1ae801bf397cc9ec1b057aa70ea0aba95c49a69a4d9028bb1baf3d0b08cdf6b7669314365ee0a2064596b1b04246d3416db479c0ffa7d0e42
SSDEEP 24576:d1QT7EcpfxR+N5AWAz3ooiYzjMqb/M3tBZPzwFa7/wOifnz20:oTDxR+N5YzTBjMm4ZPzwFI/wOifnzH
TLSH
T1A255B02EA7F905E5D17E86799A23C502FB727861033193CF42A0C17E1E6B9D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 877KB
SHA256 5d0cc518d2ad840d7b653525a5a559e9fec514dd8149b126005e907fbfae67da
MD5 3c20dae3ac638c8512ee204d34c6493e
SHA1 25f7a1d861e54879fe7375d03052820b7e0d0e7e
SHA512 22760b42346aa401b82e58f76f30c42f0a986d7e94e5639d512d2c2c3ccaea3122614df73297c72428ecf3adf9498eaf26e3a282bdd69f71da96ced087f96909
SSDEEP 24576:8TMdOz0FFS+UmSLbM3tBZPzwFa7/wOifnz20:U0K+UmSLb4ZPzwFI/wOifnzH
TLSH
T18815F17EA3AD14E5E53BC27D9643C906E6723465032266DB06E0C07E3FABED47939B40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 635KB
SHA256 c25c6393e18c2775664e76bbff6a3fa6b48ee861bdae32ad513c696688807bb8
MD5 e0bf18c267ade2dc3963ec652e858c09
SHA1 041cdcf7d46dda172ec3fb30fbd4d50822d2644e
SHA512 7bdcaa1002b8ff344cdab09ad111e2e4a2b789962294a4e76f7d4745efe29d68d16586bbb1a2dcb0d076c1427e4de06e47395c0938af836d069e2c436efff824
SSDEEP 12288:l4KFcM3tegtociOPyazluRF4KM7GAwOifEWDNRV8q92gnbc:h6M3tBZPzwFa7/wOifnz20
TLSH
T1BCD4124963E925D0EA22577986A782018734B8A5132163FF3AF1C03F5FB7EC5C439B66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/412-15-0x0000000001FC0000-0x0000000002020000-memory.dmp

Download

memory/412-21-0x0000000140000000-0x000000014069C000-memory.dmp

Download

memory/412-99-0x0000000140000000-0x000000014069C000-memory.dmp

Download

memory/412-9-0x0000000001FC0000-0x0000000002020000-memory.dmp

Download

memory/464-164-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/464-166-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/848-186-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/848-494-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/848-209-0x0000000001A20000-0x0000000001A30000-memory.dmp

Download

memory/848-227-0x0000000009E60000-0x0000000009E68000-memory.dmp

Download

memory/848-193-0x0000000001770000-0x0000000001780000-memory.dmp

Download

memory/980-414-0x0000021E1BD60000-0x0000021E1BD70000-memory.dmp

Download

memory/980-384-0x0000021E1BD60000-0x0000021E1BD70000-memory.dmp

Download

memory/980-416-0x0000021E1BD60000-0x0000021E1BD70000-memory.dmp

Download

memory/980-417-0x0000021E1BD60000-0x0000021E1BD70000-memory.dmp

Download

memory/980-418-0x0000021E1BD60000-0x0000021E1BD70000-memory.dmp

Download

memory/980-413-0x0000021E1BD60000-0x0000021E1BD70000-memory.dmp

Download

memory/980-415-0x0000021E1BD60000-0x0000021E1BD70000-memory.dmp

Download

memory/980-380-0x0000021E1BD60000-0x0000021E1BD70000-memory.dmp

Download

memory/980-381-0x0000021E1BD60000-0x0000021E1BD70000-memory.dmp

Download

memory/980-382-0x0000021E1BD60000-0x0000021E1BD70000-memory.dmp

Download

memory/980-383-0x0000021E1BD60000-0x0000021E1BD70000-memory.dmp

Download

memory/980-385-0x0000021E1BD60000-0x0000021E1BD70000-memory.dmp

Download

memory/980-386-0x0000021E1BD60000-0x0000021E1BD70000-memory.dmp

Download

memory/980-387-0x0000021E1BD60000-0x0000021E1BD70000-memory.dmp

Download

memory/980-388-0x0000021E1BD60000-0x0000021E1BD70000-memory.dmp

Download

memory/980-389-0x0000021E1BD60000-0x0000021E1BD70000-memory.dmp

Download

memory/980-390-0x0000021E1BD60000-0x0000021E1BD70000-memory.dmp

Download

memory/980-391-0x0000021E1BD60000-0x0000021E1BD70000-memory.dmp

Download

memory/980-392-0x0000021E1BD60000-0x0000021E1BD70000-memory.dmp

Download

memory/980-393-0x0000021E1BD60000-0x0000021E1BD70000-memory.dmp

Download

memory/980-394-0x0000021E1BD60000-0x0000021E1BD70000-memory.dmp

Download

memory/980-395-0x0000021E1BD60000-0x0000021E1BD70000-memory.dmp

Download

memory/980-396-0x0000021E1BD60000-0x0000021E1BD70000-memory.dmp

Download

memory/980-397-0x0000021E1BD60000-0x0000021E1BD70000-memory.dmp

Download

memory/980-411-0x0000021E1BD60000-0x0000021E1BD70000-memory.dmp

Download

memory/980-410-0x0000021E1BD60000-0x0000021E1BD70000-memory.dmp

Download

memory/980-409-0x0000021E1BD60000-0x0000021E1BD70000-memory.dmp

Download

memory/980-408-0x0000021E1BD60000-0x0000021E1BD70000-memory.dmp

Download

memory/980-407-0x0000021E1BD60000-0x0000021E1BD70000-memory.dmp

Download

memory/980-406-0x0000021E1BD60000-0x0000021E1BD70000-memory.dmp

Download

memory/980-405-0x0000021E1BD60000-0x0000021E1BD70000-memory.dmp

Download

memory/980-404-0x0000021E1BD60000-0x0000021E1BD70000-memory.dmp

Download

memory/980-403-0x0000021E1BD60000-0x0000021E1BD70000-memory.dmp

Download

memory/980-402-0x0000021E1BD60000-0x0000021E1BD70000-memory.dmp

Download

memory/980-401-0x0000021E1BD60000-0x0000021E1BD70000-memory.dmp

Download

memory/980-400-0x0000021E1BD60000-0x0000021E1BD70000-memory.dmp

Download

memory/980-399-0x0000021E1BD60000-0x0000021E1BD70000-memory.dmp

Download

memory/980-398-0x0000021E1BD60000-0x0000021E1BD70000-memory.dmp

Download

memory/1652-180-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/1652-126-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/1784-168-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/1784-95-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/1784-89-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/1784-98-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/2092-38-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/2092-30-0x0000000000680000-0x00000000006E0000-memory.dmp

Download

memory/2092-39-0x0000000000680000-0x00000000006E0000-memory.dmp

Download

memory/2400-107-0x0000000000B20000-0x0000000000B80000-memory.dmp

Download

memory/2400-172-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/2400-101-0x0000000000B20000-0x0000000000B80000-memory.dmp

Download

memory/2400-110-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/2764-142-0x00000000004D0000-0x0000000000530000-memory.dmp

Download

memory/2764-136-0x00000000004D0000-0x0000000000530000-memory.dmp

Download

memory/2764-343-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/2764-145-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/3016-161-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/3016-377-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/3240-117-0x0000000000750000-0x00000000007B7000-memory.dmp

Download

memory/3240-177-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/3240-122-0x0000000000750000-0x00000000007B7000-memory.dmp

Download

memory/3240-116-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/3252-133-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/3252-292-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/3264-82-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/3264-43-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/3732-85-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/3988-81-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/3988-74-0x0000000001A40000-0x0000000001AA0000-memory.dmp

Download

memory/3988-68-0x0000000001A40000-0x0000000001AA0000-memory.dmp

Download

memory/3988-76-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/3988-79-0x0000000001A40000-0x0000000001AA0000-memory.dmp

Download

memory/4012-376-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4012-129-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4012-185-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4048-173-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/4048-379-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/4324-181-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/4324-477-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/4364-63-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4364-57-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4364-157-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4364-66-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4556-412-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4556-178-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4676-169-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4676-378-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4840-158-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/4840-155-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/4840-361-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/4840-149-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/5052-17-0x0000000140000000-0x000000014069C000-memory.dmp

Download

memory/5052-0-0x0000000001FB0000-0x0000000002010000-memory.dmp

Download

memory/5052-22-0x0000000001FB0000-0x0000000002010000-memory.dmp

Download

memory/5052-84-0x0000000140000000-0x000000014069C000-memory.dmp

Download

memory/5052-6-0x0000000001FB0000-0x0000000002010000-memory.dmp

Download

memory/5092-115-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/5092-28-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/5108-144-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5108-54-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5108-46-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/5108-52-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download