43a994e8c74cc8585b0bf45ffe1a10a1ec05029a86821f47e347e0bfa0439a57

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/10/2026, 12:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
43a994e8c74cc8585b0bf45ffe1a10a1ec05029a86821f47e347e0bfa0439a57.exe
Size 6.5MB
Sample261003-py3dasyeqa
SHA256 43a994e8c74cc8585b0bf45ffe1a10a1ec05029a86821f47e347e0bfa0439a57
MD5 976c96e58828d83e8a64dde805d8cdeb
SHA1 200637e9b96c32af038195c15f9affb292c05c41
SHA512 d62be2a696ee6f3eeac12cba320430ee991e538a336ed7d90665d13fff32ece7547dd407efc03b3ba4da9f228009b47caf29b7d2d7663361b09a5a187426ff04
SSDEEP 98304:snDc9sWvmQJsJNZxmsJ26kYRIg/U023W:snDFxmYRRp4W
TLSH
T1BB666A13F29A01D9D059D178CB5A9232EB71BC494BB162EF2A5077D12E76EE0BB3C710
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
5760	alg.exe
4336	DiagnosticsHub.StandardCollector.Service.exe
2160	fxssvc.exe
2152	elevation_service.exe
2592	elevation_service.exe
3360	maintenanceservice.exe
6076	msdtc.exe
900	OSE.EXE
1472	PerceptionSimulationService.exe
1640	perfhost.exe
4536	locator.exe
4344	SensorDataService.exe
4704	snmptrap.exe
5496	spectrum.exe
3836	ssh-agent.exe
4856	TieringEngineService.exe
2672	AgentService.exe
1448	vds.exe
5308	vssvc.exe
5784	wbengine.exe
4956	WmiApSrv.exe
5776	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	43a994e8c74cc8585b0bf45ffe1a10a1ec05029a86821f47e347e0bfa0439a57.exe
\??\F:\	alg.exe

Drops file in System32 directory 31 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\alg.exe	43a994e8c74cc8585b0bf45ffe1a10a1ec05029a86821f47e347e0bfa0439a57.exe
File opened for modification	C:\Windows\system32\wbengine.exe	43a994e8c74cc8585b0bf45ffe1a10a1ec05029a86821f47e347e0bfa0439a57.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	alg.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	43a994e8c74cc8585b0bf45ffe1a10a1ec05029a86821f47e347e0bfa0439a57.exe
File opened for modification	C:\Windows\system32\msiexec.exe	43a994e8c74cc8585b0bf45ffe1a10a1ec05029a86821f47e347e0bfa0439a57.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	43a994e8c74cc8585b0bf45ffe1a10a1ec05029a86821f47e347e0bfa0439a57.exe
File opened for modification	C:\Windows\system32\spectrum.exe	43a994e8c74cc8585b0bf45ffe1a10a1ec05029a86821f47e347e0bfa0439a57.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	43a994e8c74cc8585b0bf45ffe1a10a1ec05029a86821f47e347e0bfa0439a57.exe
File opened for modification	C:\Windows\System32\vds.exe	43a994e8c74cc8585b0bf45ffe1a10a1ec05029a86821f47e347e0bfa0439a57.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	43a994e8c74cc8585b0bf45ffe1a10a1ec05029a86821f47e347e0bfa0439a57.exe
File opened for modification	C:\Windows\system32\AgentService.exe	43a994e8c74cc8585b0bf45ffe1a10a1ec05029a86821f47e347e0bfa0439a57.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	alg.exe
File opened for modification	C:\Windows\system32\dllhost.exe	43a994e8c74cc8585b0bf45ffe1a10a1ec05029a86821f47e347e0bfa0439a57.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	43a994e8c74cc8585b0bf45ffe1a10a1ec05029a86821f47e347e0bfa0439a57.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	43a994e8c74cc8585b0bf45ffe1a10a1ec05029a86821f47e347e0bfa0439a57.exe
File opened for modification	C:\Windows\system32\AgentService.exe	alg.exe
File opened for modification	C:\Windows\System32\msdtc.exe	43a994e8c74cc8585b0bf45ffe1a10a1ec05029a86821f47e347e0bfa0439a57.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	43a994e8c74cc8585b0bf45ffe1a10a1ec05029a86821f47e347e0bfa0439a57.exe
File opened for modification	C:\Windows\system32\dllhost.exe	alg.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	alg.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	43a994e8c74cc8585b0bf45ffe1a10a1ec05029a86821f47e347e0bfa0439a57.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	43a994e8c74cc8585b0bf45ffe1a10a1ec05029a86821f47e347e0bfa0439a57.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	43a994e8c74cc8585b0bf45ffe1a10a1ec05029a86821f47e347e0bfa0439a57.exe
File opened for modification	C:\Windows\system32\vssvc.exe	43a994e8c74cc8585b0bf45ffe1a10a1ec05029a86821f47e347e0bfa0439a57.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	43a994e8c74cc8585b0bf45ffe1a10a1ec05029a86821f47e347e0bfa0439a57.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\cfe85a77227ba850.bin	alg.exe
File opened for modification	C:\Windows\system32\locator.exe	43a994e8c74cc8585b0bf45ffe1a10a1ec05029a86821f47e347e0bfa0439a57.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	43a994e8c74cc8585b0bf45ffe1a10a1ec05029a86821f47e347e0bfa0439a57.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	43a994e8c74cc8585b0bf45ffe1a10a1ec05029a86821f47e347e0bfa0439a57.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	43a994e8c74cc8585b0bf45ffe1a10a1ec05029a86821f47e347e0bfa0439a57.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	43a994e8c74cc8585b0bf45ffe1a10a1ec05029a86821f47e347e0bfa0439a57.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	43a994e8c74cc8585b0bf45ffe1a10a1ec05029a86821f47e347e0bfa0439a57.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	43a994e8c74cc8585b0bf45ffe1a10a1ec05029a86821f47e347e0bfa0439a57.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	43a994e8c74cc8585b0bf45ffe1a10a1ec05029a86821f47e347e0bfa0439a57.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	43a994e8c74cc8585b0bf45ffe1a10a1ec05029a86821f47e347e0bfa0439a57.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	43a994e8c74cc8585b0bf45ffe1a10a1ec05029a86821f47e347e0bfa0439a57.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	43a994e8c74cc8585b0bf45ffe1a10a1ec05029a86821f47e347e0bfa0439a57.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	43a994e8c74cc8585b0bf45ffe1a10a1ec05029a86821f47e347e0bfa0439a57.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	43a994e8c74cc8585b0bf45ffe1a10a1ec05029a86821f47e347e0bfa0439a57.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	43a994e8c74cc8585b0bf45ffe1a10a1ec05029a86821f47e347e0bfa0439a57.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	43a994e8c74cc8585b0bf45ffe1a10a1ec05029a86821f47e347e0bfa0439a57.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	43a994e8c74cc8585b0bf45ffe1a10a1ec05029a86821f47e347e0bfa0439a57.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	43a994e8c74cc8585b0bf45ffe1a10a1ec05029a86821f47e347e0bfa0439a57.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	43a994e8c74cc8585b0bf45ffe1a10a1ec05029a86821f47e347e0bfa0439a57.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	43a994e8c74cc8585b0bf45ffe1a10a1ec05029a86821f47e347e0bfa0439a57.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	43a994e8c74cc8585b0bf45ffe1a10a1ec05029a86821f47e347e0bfa0439a57.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	43a994e8c74cc8585b0bf45ffe1a10a1ec05029a86821f47e347e0bfa0439a57.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	43a994e8c74cc8585b0bf45ffe1a10a1ec05029a86821f47e347e0bfa0439a57.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	alg.exe
File opened for modification	C:\Program Files\FindOptimize.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	alg.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	43a994e8c74cc8585b0bf45ffe1a10a1ec05029a86821f47e347e0bfa0439a57.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	43a994e8c74cc8585b0bf45ffe1a10a1ec05029a86821f47e347e0bfa0439a57.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	43a994e8c74cc8585b0bf45ffe1a10a1ec05029a86821f47e347e0bfa0439a57.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	43a994e8c74cc8585b0bf45ffe1a10a1ec05029a86821f47e347e0bfa0439a57.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	43a994e8c74cc8585b0bf45ffe1a10a1ec05029a86821f47e347e0bfa0439a57.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	43a994e8c74cc8585b0bf45ffe1a10a1ec05029a86821f47e347e0bfa0439a57.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	43a994e8c74cc8585b0bf45ffe1a10a1ec05029a86821f47e347e0bfa0439a57.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	43a994e8c74cc8585b0bf45ffe1a10a1ec05029a86821f47e347e0bfa0439a57.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	43a994e8c74cc8585b0bf45ffe1a10a1ec05029a86821f47e347e0bfa0439a57.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	43a994e8c74cc8585b0bf45ffe1a10a1ec05029a86821f47e347e0bfa0439a57.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	43a994e8c74cc8585b0bf45ffe1a10a1ec05029a86821f47e347e0bfa0439a57.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	43a994e8c74cc8585b0bf45ffe1a10a1ec05029a86821f47e347e0bfa0439a57.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	43a994e8c74cc8585b0bf45ffe1a10a1ec05029a86821f47e347e0bfa0439a57.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe

Direct Volume Access: Opens a physical disk for reading 1 TTPs 1 IoCs

Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

defense_evasion

Direct Volume Access

T1006

description	ioc	Process
File opened (read-only)	\??\PhysicalDrive0	SearchIndexer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	43a994e8c74cc8585b0bf45ffe1a10a1ec05029a86821f47e347e0bfa0439a57.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	alg.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	alg.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	43a994e8c74cc8585b0bf45ffe1a10a1ec05029a86821f47e347e0bfa0439a57.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	43a994e8c74cc8585b0bf45ffe1a10a1ec05029a86821f47e347e0bfa0439a57.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	43a994e8c74cc8585b0bf45ffe1a10a1ec05029a86821f47e347e0bfa0439a57.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fd23b2123553dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a14ab9123553dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000088f1fc113553dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000162955123553dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f2c9f5113553dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bb3222133553dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000208030133553dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000feacbb123553dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000e7dac133553dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
5768	43a994e8c74cc8585b0bf45ffe1a10a1ec05029a86821f47e347e0bfa0439a57.exe
5768	43a994e8c74cc8585b0bf45ffe1a10a1ec05029a86821f47e347e0bfa0439a57.exe
5768	43a994e8c74cc8585b0bf45ffe1a10a1ec05029a86821f47e347e0bfa0439a57.exe
5768	43a994e8c74cc8585b0bf45ffe1a10a1ec05029a86821f47e347e0bfa0439a57.exe
5768	43a994e8c74cc8585b0bf45ffe1a10a1ec05029a86821f47e347e0bfa0439a57.exe
5768	43a994e8c74cc8585b0bf45ffe1a10a1ec05029a86821f47e347e0bfa0439a57.exe
5768	43a994e8c74cc8585b0bf45ffe1a10a1ec05029a86821f47e347e0bfa0439a57.exe
5768	43a994e8c74cc8585b0bf45ffe1a10a1ec05029a86821f47e347e0bfa0439a57.exe
5768	43a994e8c74cc8585b0bf45ffe1a10a1ec05029a86821f47e347e0bfa0439a57.exe
5768	43a994e8c74cc8585b0bf45ffe1a10a1ec05029a86821f47e347e0bfa0439a57.exe
5768	43a994e8c74cc8585b0bf45ffe1a10a1ec05029a86821f47e347e0bfa0439a57.exe
5768	43a994e8c74cc8585b0bf45ffe1a10a1ec05029a86821f47e347e0bfa0439a57.exe
5768	43a994e8c74cc8585b0bf45ffe1a10a1ec05029a86821f47e347e0bfa0439a57.exe
5768	43a994e8c74cc8585b0bf45ffe1a10a1ec05029a86821f47e347e0bfa0439a57.exe
5768	43a994e8c74cc8585b0bf45ffe1a10a1ec05029a86821f47e347e0bfa0439a57.exe
5768	43a994e8c74cc8585b0bf45ffe1a10a1ec05029a86821f47e347e0bfa0439a57.exe
5768	43a994e8c74cc8585b0bf45ffe1a10a1ec05029a86821f47e347e0bfa0439a57.exe
5768	43a994e8c74cc8585b0bf45ffe1a10a1ec05029a86821f47e347e0bfa0439a57.exe
5768	43a994e8c74cc8585b0bf45ffe1a10a1ec05029a86821f47e347e0bfa0439a57.exe
5768	43a994e8c74cc8585b0bf45ffe1a10a1ec05029a86821f47e347e0bfa0439a57.exe
5768	43a994e8c74cc8585b0bf45ffe1a10a1ec05029a86821f47e347e0bfa0439a57.exe
5768	43a994e8c74cc8585b0bf45ffe1a10a1ec05029a86821f47e347e0bfa0439a57.exe
5768	43a994e8c74cc8585b0bf45ffe1a10a1ec05029a86821f47e347e0bfa0439a57.exe
5768	43a994e8c74cc8585b0bf45ffe1a10a1ec05029a86821f47e347e0bfa0439a57.exe
5768	43a994e8c74cc8585b0bf45ffe1a10a1ec05029a86821f47e347e0bfa0439a57.exe
5768	43a994e8c74cc8585b0bf45ffe1a10a1ec05029a86821f47e347e0bfa0439a57.exe
5768	43a994e8c74cc8585b0bf45ffe1a10a1ec05029a86821f47e347e0bfa0439a57.exe
5768	43a994e8c74cc8585b0bf45ffe1a10a1ec05029a86821f47e347e0bfa0439a57.exe
5768	43a994e8c74cc8585b0bf45ffe1a10a1ec05029a86821f47e347e0bfa0439a57.exe
5768	43a994e8c74cc8585b0bf45ffe1a10a1ec05029a86821f47e347e0bfa0439a57.exe
5768	43a994e8c74cc8585b0bf45ffe1a10a1ec05029a86821f47e347e0bfa0439a57.exe
5768	43a994e8c74cc8585b0bf45ffe1a10a1ec05029a86821f47e347e0bfa0439a57.exe
5768	43a994e8c74cc8585b0bf45ffe1a10a1ec05029a86821f47e347e0bfa0439a57.exe
5768	43a994e8c74cc8585b0bf45ffe1a10a1ec05029a86821f47e347e0bfa0439a57.exe
5768	43a994e8c74cc8585b0bf45ffe1a10a1ec05029a86821f47e347e0bfa0439a57.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
660	Process not Found
660	Process not Found

Suspicious use of AdjustPrivilegeToken 46 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	560	43a994e8c74cc8585b0bf45ffe1a10a1ec05029a86821f47e347e0bfa0439a57.exe
Token: SeTakeOwnershipPrivilege	5768	43a994e8c74cc8585b0bf45ffe1a10a1ec05029a86821f47e347e0bfa0439a57.exe
Token: SeAuditPrivilege	2160	fxssvc.exe
Token: SeRestorePrivilege	4856	TieringEngineService.exe
Token: SeManageVolumePrivilege	4856	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	2672	AgentService.exe
Token: SeBackupPrivilege	5308	vssvc.exe
Token: SeRestorePrivilege	5308	vssvc.exe
Token: SeAuditPrivilege	5308	vssvc.exe
Token: SeBackupPrivilege	5784	wbengine.exe
Token: SeRestorePrivilege	5784	wbengine.exe
Token: SeSecurityPrivilege	5784	wbengine.exe
Token: 33	5776	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5776	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5776	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5776	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5776	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5776	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5776	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5776	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5776	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5776	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5776	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5776	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5776	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5776	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5776	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5776	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5776	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5776	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5776	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5776	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5776	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5776	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5776	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5776	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5776	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5776	SearchIndexer.exe
Token: SeDebugPrivilege	5768	43a994e8c74cc8585b0bf45ffe1a10a1ec05029a86821f47e347e0bfa0439a57.exe
Token: SeDebugPrivilege	5768	43a994e8c74cc8585b0bf45ffe1a10a1ec05029a86821f47e347e0bfa0439a57.exe
Token: SeDebugPrivilege	5768	43a994e8c74cc8585b0bf45ffe1a10a1ec05029a86821f47e347e0bfa0439a57.exe
Token: SeDebugPrivilege	5768	43a994e8c74cc8585b0bf45ffe1a10a1ec05029a86821f47e347e0bfa0439a57.exe
Token: SeDebugPrivilege	5768	43a994e8c74cc8585b0bf45ffe1a10a1ec05029a86821f47e347e0bfa0439a57.exe
Token: SeDebugPrivilege	5760	alg.exe
Token: SeDebugPrivilege	5760	alg.exe
Token: SeDebugPrivilege	5760	alg.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 560 wrote to memory of 5768	560	43a994e8c74cc8585b0bf45ffe1a10a1ec05029a86821f47e347e0bfa0439a57.exe	87
PID 5776 wrote to memory of 5992	5776	SearchIndexer.exe	117
PID 5776 wrote to memory of 3360	5776	SearchIndexer.exe	118

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\43a994e8c74cc8585b0bf45ffe1a10a1ec05029a86821f47e347e0bfa0439a57.exe
"C:\Users\Admin\AppData\Local\Temp\43a994e8c74cc8585b0bf45ffe1a10a1ec05029a86821f47e347e0bfa0439a57.exe"
1⤵
- Drops file in System32 directory
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:560
- C:\Users\Admin\AppData\Local\Temp\43a994e8c74cc8585b0bf45ffe1a10a1ec05029a86821f47e347e0bfa0439a57.exe
  C:\Users\Admin\AppData\Local\Temp\43a994e8c74cc8585b0bf45ffe1a10a1ec05029a86821f47e347e0bfa0439a57.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=124.0.5705.89 --initial-client-data=0x268,0x26c,0x270,0x244,0x274,0x1405b0e38,0x1405b0e44,0x1405b0e50
  2⤵
  - Enumerates connected drives
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5768

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
PID:5760

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:4336

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:3520

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2160

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2152

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2592

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3360

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:6076

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:900

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1472

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:1640

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4536

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4344

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:4704

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:5496

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3836

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4856

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:1236

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2672

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:1448

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5308

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5784

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:4956

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Direct Volume Access: Opens a physical disk for reading
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5776
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5992
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
  2⤵
  - Modifies data under HKEY_USERS
  PID:3360

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Direct Volume Access

T1006

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 b90e8ee17e0d47b4039f373f2dbdfebbcfdc4bd0258043ac3a0a92ed2bafc6ef
MD5 a2e303998a449acc662bbfe2199f6b81
SHA1 3494e59ccdc614b653ad167cf11bd7637eb3d960
SHA512 e738fd691e22dfe9c4d8842fc10470d5b358e9feab06cb79a66d66842636e12c26ff4602e9257f91a0ab918ef4b87d304b8d6fcc249159e09a8c27728680e66b
SSDEEP 49152:nb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnZe30jaNf1TWbdz:V3q6sjBcU023W
TLSH
T1E8D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 3126e4b962764eb35a5d98caf2039b0835a98f563a07d851a621ddfc32a63135
MD5 155333607a6e082113d099a8b4c6f427
SHA1 0f460f7b9fd4861c9b129d5e62f046a9604fec02
SHA512 668a3ea8466bf3bf10f3f958ca875715fedae59bf4e9ac00142085d11c070603f6914f58afc1a0637b7f8483fb063fc3424695d8455ee93518c7578dc989bc32
SSDEEP 24576:qXYfDtczANgXe4i7ojhsP5Lgrk1TWb4AN5:xtcze30jaNf1TWbdz
TLSH
T13A65F12877D409F9ED678278C8E28611EA737C814360EB9B03E499661F336D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 370114182f56cfc58bff8119369317979dc1f6f3f956e0f4226067418de71041
MD5 87fc41fcda2c4c14e3ca0b8b69c23c39
SHA1 55d63ac5b730d075111b425d09ec69127db78d4a
SHA512 3e817cafc4feffd81ed951213a8dafa470ef24620e6166ce0ec191277f72fb15472d1d3aecb1b461be16f03fd9bdba52a464e2ccafbec863699adccfacc091f9
SSDEEP 24576:Y0Le5ji0hmxxrMegXe4i7ojhsP5Lgrk1TWb4AN5:YPji0Ajue30jaNf1TWbdz
TLSH
T1FE85AE16F6748735D073C0B9C5D2A78AED71308257308ACB4286D77C3E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 9df3cb45731d04e839251c1e009802591ed1b48e6ed18bff69436405489b34b0
MD5 1a66d54b90359d7dc529101b5d4995cb
SHA1 40ca3751875b94683c3d11b3d3dbbb23e9310b45
SHA512 9a8d2fea59233d976fa18a9e55c075b134a753262a012e5d1dcff76c60873b84eb7bb9f4a693c6b6de9284797c99f711e496981950894bab07198146eed237ae
SSDEEP 24576:ea7/ezSC6vUyD/aqgrvWn6q8wyuMgXe4i7ojhsP5Lgrk1TWb4AN5:Z/ezSC6vUzPveHjyqe30jaNf1TWbdz
TLSH
T169756C25F5788323D0B2D0BAC5D6AA9AFE723046573089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 2e6336a115e2d8fcfdb2b19785eb7333c9f5192ebb500373787f14abe8aba5f9
MD5 1d771daed73fa178335e2fa91a979ada
SHA1 9f912d739862dcca8872ef57d4d9746a62885815
SHA512 3f4f8cd17992f40442f0f109a4e1c6878afec005fd39430cc6daab8be7361c94c00e33684d451f6c5521aeba249a694f0a479e3cdb1550006070600b49be35c6
SSDEEP 24576:FVbqPb88hv/l+YRgXe4i7ojhsP5Lgrk1TWb4AN5:FVO88hXl+re30jaNf1TWbdz
TLSH
T16B559E66F5748331D073C0BAC4D39A9AEE3234425B318ACB1246D76C2E67BE6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 8772e344c4479b56337c9f29377aab2260c4020ebc7343f1c530078c724d0a36
MD5 a7b5c96421c49d43815866cbe0c8e919
SHA1 e7bdaa24e8c60d3b7b82f606533d2d1073d64226
SHA512 d8467c4bb027eceff599d0b83349365213abd186a5ade1236f9d9f89015f73e64be25fedda2f9ebcdd46e151f084a08dc55a2f5f749df5982ce8ce38d66f0107
SSDEEP 12288:KLV0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:KLigXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1AB4523929F5449C6F38BC3F4A0F7CB91E9B11EC061444E6B47E0FE9319BC89ADAD8059
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 37df71a892a0b3847a07e1c77fd592f13a839988b961d83e6e5ea7009c062acf
MD5 a6132263d6960c1f943db3b7f6489b34
SHA1 1496789d173c7343177a4fc3928650391712d71a
SHA512 99ea6a418b765229d38d9e242199b603aa970f9e31577fd294245ddced72bd5d0c2816b98e6f61ff49361f8787bc21998a8f97b0a898cd1c187ea7116b620084
SSDEEP 12288:ReBNUbTVO86U40DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:RJIU5gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T19965CF3BEE28FCD2C27E8DB85691C740E7B278704B5293CBD164820E9E235E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 550f219e4930beacebadd3b65fbf99c9ed85f11b2315fccebfbee3006c1fbedb
MD5 5e27e4730aeef5d85d49080483ae0821
SHA1 2535a03f2ecb310c6894ef59b888a1d6e318e350
SHA512 3d066c11597c5d3120a1a9c2b2b3e3ba69a25f0dcb870c13153a9e1f2469995b79d396ff2fe4c538dc488fbfcf68766773c9b8e93190a82d510d430e798099ec
SSDEEP 49152:MQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THQ:MQvGAdlCEL8c/DRNw5CTU023W
TLSH
T185267D656BF880F5E0A7E174897AC6B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 59d412c6f3bbac6cb3a49d3b0c241cfe6a800229154f6fb0d4510e5c9faa938c
MD5 83790ca6af770e9c91f1e7dab9e81e1f
SHA1 47b38498dc09771a223ebf8b228258308e109d43
SHA512 c31ee62dc027dfc7ac870bc4884eeae1f8a07d2ba52ec48581f975773d7782ed4415297c72ee722a02e5b36ac8215ff5482738a17c96e26f5db97c5f70669052
SSDEEP 24576:J0ewsAj3gXe4i7ojhsP5Lgrk1TWb4AN5:Slj+e30jaNf1TWbdz
TLSH
T1D775E031FE74E032C3BB0DB21B76C706587C6A604B511AC3E3E89E9E59742D22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 7c8e94c81e6379582ea4d1e379556bbb07be14e6c434404b30684d8fdb48b3d4
MD5 c230277e07d7a3e3d346220244ac3857
SHA1 c54145920cd3c3f9960ecdd2839b06da09118f3d
SHA512 e107e8f4f47104fcf08eec31320fb3f31bd8d6c4e0301d7e64e960442959f676476662fe7bf8daa7f992359eb9b77f5a0faf22cd705e1727da0e41eba4f43499
SSDEEP 196608:nUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHmp4W:nUEtQevvqc2W1cpV2tI32O4W
TLSH
T13C474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 f4cadcb5fb0463eded033f784efe5e91d8ba69b912785c091c207910e617783e
MD5 9f1403878fcc11ed1af99fee1342727c
SHA1 9cb557a864d31c82f23bb60c09271f6b3dc20570
SHA512 852e1da19334aecf4993decf454bbc5ec1729d88c8878b7b266d9bcb7aff202e8553985f7da348c6b8093f2ffe5b11f72e9d783cbfb97645c1feaff21b380a5f
SSDEEP 49152:qCbRquA/m2yL5zTfFiV+XenmE3/zee30jaNf1TWbdz:foquVjnmvU023W
TLSH
T1A3D58D0976B8C2E4D1F6C77886A2C647F37178154B319BEF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 9388f32092a358fc11a5ae8bc2c136d6be9e9a72a7a1b9004f838b2f9d8e451a
MD5 3ca1cdb1cdb7f68308d8d32c4b204a07
SHA1 d855fc7707d75336f3b989eac1889cdbca0f7fb0
SHA512 b5b0eee5030f5d9a9a73d4e26427837d83de8b1ac1c644e5dad9497361e514559dfa6d4b0bd059b45c3607039345cde5832ea01706a223793cb08af14743a00f
SSDEEP 24576:ZAhGL3IFoiwtA5l7S534gXe4i7ojhsP5Lgrk1TWb4AN5:ZAMUFoiq5/e30jaNf1TWbdz
TLSH
T1ED359D81EBF955D4F5B3AAB899B68571EA76BCA65E30C20F1160D11F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 2d57e271cea608b739c1c1e9977dec5d68a6b3a3b798ca74c04fedcaaf1ac19b
MD5 8b197620f233770c12ce8588e24425ce
SHA1 1c860814bf2196a71574344206ed1a46a7ef101c
SHA512 d78928ed5a5ed12750e08b152f1495233893643b5181001eb06723ae8fee54cf2541ab2ac1450c6bdbba92dd9f36b3cc7fc014331cde6d14fa27c57b8ba37a1d
SSDEEP 12288:vmw5HEjsChNVBFgl0WDm+C/0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1Ty:Owu4OWzgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1B865F14676A40CF9E5A78278C597C636F7F2BC412A21CB1F07A0C65B5F37261AD2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 6889fbb65cdbb1705c31ceda1e3d72bdbf4e0f6cb4599eae72632cd44f36e1c8
MD5 aae69c4e20e37ea9d46cf78d36fa915b
SHA1 7604449b8f32246a601eeb0f1a35784e7cbe86c1
SHA512 d7a7fe6dbc25b8ffbd277f73a659013d1cfedb634af4edf93eae1c4bf9e5520ca16d91defe5dd4215968ec8a32ccbff32b69d88878e9d29ee56207255309eec2
SSDEEP 12288:WeZ1IyO0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:LZumgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T19B55129637E421F9E2978278D4F28741E7B23882237147CF02A096A71F76DD65E39732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 665116dc6a5fb72e17cae524460840efef64f585b092076fd4165fc280209651
MD5 b6b234daa0e42eaba0af6d823f2c467f
SHA1 87aa0ebfca036c721d414cb143ae876d58d01b40
SHA512 a682cd073e949c882b7068e10f02b6f98f5a85d26934e0abc26a1522c6229c33582c4a69e345cdf2259c00483cc78df3005f16354c50e0e30d7a932cbf4fa638
SSDEEP 49152:xj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23Uk:YQRQyi36YOcPbLvw2gAf+PN3gU023W
TLSH
T156667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 17e6c82f69a77831a2f322264b9326b7fd5438ce2cae0f5b06066b61e0fabd1b
MD5 8b287b1fab7648cb152c5a41326c1541
SHA1 14d54db0ad88df7d5b996fa538d55c7f38e1bb0c
SHA512 51542207f3bc5984d52fda8f57a0d3e728b520a27bacc955de34ee2d4b267e438e5d27cd63e0239d6164990f80b4afbfc66e5e365b4ada5301e6d8cd05bfbd94
SSDEEP 49152:3j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23Uk:GQRQyi36YOcPbLvw2gAf+PN3gU023W
TLSH
T12D667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 c75d30dfa794573a6a1c93fa6a5eacec7e8e34d2ab7ec7643276bfd7d1a978e9
MD5 d2a3890e562de70f90a4773f849fbe3a
SHA1 04ad6e063185c612943093ce534e112cad8873d0
SHA512 4e3be578093fc4ae34081708cf402145303407fda78841f0be083c242348b3e21641fee8e48ce31d6982e112adc522eb8a10e06ca17f60aa4fde6bb3f97250cc
SSDEEP 49152:H68Qg55nhceWu7PNU3/ue30jaNf1TWbdz:xthLRc/uU023W
TLSH
T1C5B54933B2F200A9C04DE1769F4A872196D27C758FE0E7DB855172161FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 aa931f9385158b9c8637fa93fb09bbd0154d8c7c6b97f6ae8774528985515e96
MD5 3e13700c458a0160f441f10e3ff4959d
SHA1 0a9f7e1df4e466782298ea55cda0e50d371f6ddb
SHA512 1c83ea37b6678da84ff735fb19fef9bf029f30f828aa4102d2b1b07f5c4e580bc05b8e57a94351d28e9ec7babd1d18f4d277b90226ff292779f6d7c5c93ab1e2
SSDEEP 49152:83aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk996:5y5112gYy5azzVvt69nLKnhZ1U023W
TLSH
T1E7168B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 5662062033cebfe1a23285718e4ff1dda8330a3c6beb3f6daa5fb6f422a3a4db
MD5 717bcfacbc5dddb77417681b1c5c736e
SHA1 0b9c37de7027fc33df5c1bc0a031a106f49d43cd
SHA512 2d29f2123f54149a6f0c3ae2b15fa8f9440a331042a648cfd95cc767f4ef67cce58eabaf85475a472d0db02907b661540fe6399c3424c450d991e8e7b08aeaae
SSDEEP 49152:vB+taZ3usBWOBr4tEGL0bqx0z+n217aau1gl4e30jaNf1TWbdz:Ru6Jmdxd2d4U023W
TLSH
T19AD59D13F1DA01E8D05ED578974A9233EA62BC490B34B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 d285f2724ad404b1b179ba3aadeb0ae3b641d46c261d816134e2aba6b8186ac4
MD5 d0cadd675666e6db23d0f641188f6ddf
SHA1 91f78beeb30c8b6b46ac43879e1f3e8401447dde
SHA512 e1d21eba2c7fc30a88715886200bc205a068b0124fd0bad696972ea5bc33fef3cd362738abff7bde0ceaf091cf5d0f0375c05e0b76a61c9c50008999bf80ab42
SSDEEP 49152:C1hpsNoJpF1A63U44CwH7R4xke30jaNf1TWbdz:CmifPWRvU023W
TLSH
T1CDB5BE13F2D901E8D05ED17887569232EA62BC460B34B6DF0A90B7961F7BEE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 b0609ea317d25091b840f54c4a3a77d951f247673eecdb7f0697f6684bb59ef0
MD5 68271e8a627ccb07856572f80606d405
SHA1 9cc14248e6a5c9345b0afb3b28051411b9c22799
SHA512 fa4f1cb8671acf07fbd102261c39ece0195029e1a82768addcd9d3b5342a950c1e0cf89c9feb9731e2c9b7c768d73cb80ed337f1445b78dd3f6a86b10555370c
SSDEEP 49152:pSuZQIY0Be2KcRVtOnks6NMHqpe30jaNf1TWbdz:n5dKii61pU023W
TLSH
T160C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF068072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 29e58db32eba88ba97347b653ec2ddbdbd85fcbeee64790a63d80f2c78188012
MD5 2e93b9d29fdf9b822559d2c4534b45a7
SHA1 697da6319fc6ac7c15e5443df2d7ce284452b328
SHA512 eb041d482a6736ca68efe63a8ed18b1214b6c442832f8ff0b944c826d149a3ce672058c6e8472b16bf27d47c8116d876a389b3e189aba6bcf7d017c48019bdd0
SSDEEP 49152:WhtSn8EApI0fig3giDn0AP5wIe30jaNf1TWbdz:3X2imph7U023W
TLSH
T11595BE13F2D900E8D05ED178C7568632E962BC160B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 ddff59e12c89a5ae7446f8b8f973bff7a8d5fd11efaac995179cc12a3d594e4e
MD5 205663e7f69a01c2eaabb8a356e5ec6a
SHA1 aa5a1a102497d180b9ce746ed32a66ce95796c65
SHA512 def9a47511294536e4cdf296c32df37b6aeec67e1ca2784777adc75fd0d2c30372dd0c2ac7a5a519cfd913a427bfcb3e927c7d37e7dae46ea99b44d9e98a6bae
SSDEEP 12288:Gd0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:GKgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T140452392AE554AC6E34BC3F0D0F787C1E9A11FC272444D6B17E0FA531DBCC9A6AD8468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 fea5caf7c2257315b9ec48c6e4c323ef46bd4f105b780f1b2534abf18ede430c
MD5 c4b1445a1056bd591b4c11d3433c2b55
SHA1 c8573e0440f7a9f8c22d45e80254ffb326d51114
SHA512 fb09b332ce190f319d7f2c54c7c45d60cac755e4c3ec9cd57393f7600c178a90a04ca6d33e8114ce52abf0c640ca9f64cbb0cde465613f3e013e65cb4e80fc8c
SSDEEP 12288:MS0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:MLgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1B54523A2AE5549C6E34BC3F0D0F7C7D1E9A11FC272414D6B17E0F9531DBCCAA6A88468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 b7989a0b10707eae48cd657d3ac541e699a908e2e158361e1a2de0e721f99243
MD5 df9e90511b878aa603ece7ebed8f6105
SHA1 35a6a008fe095fc17abd931f53307fd15d8436e0
SHA512 e613f23b414f82e93292beaba7189b57a927cb30c5f960e97606a835b3d636b7eff0fb2d93471bffa66b32474c32f635475e6e478d06b3a2b6a54550c26f71ad
SSDEEP 12288:8g0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5LB:8hgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1394523A2AE5549C6E34BC3F0D0F787D1E9E11EC272404D6B17E0F9531DBCC9A6AC84A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 211d40cde19419e86eef7810e909e907d9eef7fe1eae5fbea475d28c2de436b0
MD5 f098869d43080508ad6d23db29c95677
SHA1 fd29a558ab2831104039cecb70827f782392a0ca
SHA512 3cf8365572ae3286b5c94811bc06f25fc44ee95b0503053eaa7a40471796eb22d6390b63a59f9d676175d49242f8b4cf43f47af9121da7f06f8d036288e7a24b
SSDEEP 12288:cVb0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5LB:tgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1CF4523926F6505C6E28BC3F4C0F38791E6F13DC173114BAF47D069530EB4AD96EA8A68
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 de0ca759383f428ac8911669a2252bcdcdbc65a624b3a463f311d0df197dc10c
MD5 c11b660ee278b278b624d450f88129e5
SHA1 7a4d5fde0038de2db499a0bee351e8b81316b9b5
SHA512 29785ef0ae3e54e19624902d7e2e75c3b8fe3ec9ae8401c1ae39a2e022a3e7ae26fa894fb06d9983cf097045e096973d344c65103fad0bc47c7f7faa253a7e60
SSDEEP 12288:+z0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:+wgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T191452392AE5549C6E34BC3F0D0F787D1E9E11FC272404D6B17E0F9531DBC8AA6AD84A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 a68ca330970bb6431cd213781e450c6039f6c6ebf4b2720f084b2cb48ce121d7
MD5 c23615a3c6eda66bdd7424e1f7568c8f
SHA1 558b44bcdd204df4134c9607c89c4fc0673734e6
SHA512 420406bcf0954f1ba83de5d99d8b1fae19a991b4a61e14e03697534af4f3da11b976f29686557a6c7144e3225045278c2e636c65858ce254071f765b41b78e55
SSDEEP 12288:wG0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:wfgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1C2452392AE5549C6E34BC3F0D0F7C7D1E9A11FC272404E6B17E0F9531DBC8AA6AC8468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 c4f1eb51b9f5683f22a2cb3fc9c65a201070a244ca064339e6008e1d8abb5521
MD5 4cbc1b6693ab799cb3d8660fdfb3dfc4
SHA1 296c813b26375d82377e0c4de8487297fa42aae0
SHA512 a2b92aae39ccc15b2a076e8f63e3498a1f08c50a66f84ba78a5b27c6f01af7663fd43d81d679fefa0aee8bf18496b0547fbb664cdcc3d2fe5b171fbfba41bdd7
SSDEEP 12288:5K0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:5DgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T16A452392AE5549C6E34BC3F0D0E7C7D1E5A11FC272444E6B17E0F9531DFC8AA6A88468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 652124dcbc8e6a444f513719246212943fa319ffbeb8f5e57a0ef210ab1d9996
MD5 1344855a0b9cacbbccb376b83407a3f5
SHA1 9a57b1c0c38cfd46703921bebe184fe848286a7e
SHA512 1212331147634545c70fb2ef819ae1ea32ddb6a4d5d2a9d987d98701015b5c995ffe31062d11e42263d7382317ade030096207e1cfd0d1b7f40e1e3cc38a6014
SSDEEP 24576:aZMRzFVSOrgXe4i7ojhsP5Lgrk1TWb4AN5:aZMRzfGe30jaNf1TWbdz
TLSH
T10C650295B3900CF4ED67827EC8A68A06D6B27C561760CA1F03F436671F733A11D2DBA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 8565b1e33b70c46ca73a46b396feed14e0c6b08da64747f2d3eddf06061acd0a
MD5 a3014a619952804bd5e92a2504b5b0d5
SHA1 917f02cc63226700b5cb0406dcb0f35e9a9b5b6b
SHA512 fb0d7a5139a3647ab23828299102c4c89a384b7917acd84dccd72c4effcf7d73024cae13dbe8da6dcc8c2b6271d9185b569eb1b83028ec3348a5f04c53a14395
SSDEEP 12288:BJ0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:BWgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T196452392AE5509C6E34BC3F0D0E7C7D1E9E11FC272404E6B57E0FA531DBCC9A6A88468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 b6c09e78373db3212a065f2bc98742abcf64ba4c053170d8bb34c0bad016c255
MD5 d9ac3a8f7728d6fc62d9fe5ea23f7502
SHA1 7898a536427efd5eb806e955fe6406b41489045a
SHA512 56381a88ff1aaea48964200cf81c918ee73b3b3ad8c30fd88b602735dc49b5c6fd84b9ead5d14446e9d897705a2656565890003203eaebf63181dc98dff342cc
SSDEEP 12288:Pl0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:PSgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T190452392AE5549C6E34BC3F0D0E7C7D1E9A11FC272414E6B17E0FA531DBCC9A6AC8468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 36112dc635175a9ac19682af312c6425e3dfd36a82fb579133bf145485471ccd
MD5 6a83dbde10f241f55947eeeea1086495
SHA1 6160a2a4b41a482d4f7a4ff9681db3c23ed13cd6
SHA512 428e249855fd1385f40db85d3ce8f7e5a9e3b980d263914cdfaaac0fc2518930b3b9de375ae7cfa98f030c1de0bc52a063c245712de7c60c5deb549708c6f973
SSDEEP 12288:EyPz5L8O0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:dzyngXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T13555025777A120E9D1678278C4E24B41F7B27C7217208EAF03A057732E776E19E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 284cd31f2f0e8ef3f5bcc213689f0256f891cc5ec2bf687be550b2e0592ed83b
MD5 dd591889199095c14c0ce8ecf95828a0
SHA1 0f63c5fae6347467fa18a69143213b4800da00c5
SHA512 29bbab39d72ae4241b63c1599b64b8b7b8e2a200d66af5977b352239c6bdea1a839aab4025ed43db8e1c66e51af47cf74d1877dc692d1f8ba20583ce91097cfb
SSDEEP 12288:YJ0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:YWgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T14E452392AE5509C6E34BC3F0D0E7C7D1E9E11FC272414E6B57E0FA531DBCC9A6A88468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 0d89ad9426df017014204f278f4ccb605a500c98e29b39f69d2a34091e3a9678
MD5 6464d2bd12eb4990d9a7ee9fb75d9b7f
SHA1 8d7d28a39fb974de21c89a9aba060756128fd341
SHA512 63926a59e4ce542fee8bc254b0493cb9b28868f0c0ef742733006ca8233251e15dd24ebb80fa6a7cc8f2b9df2a1d07b7af3485fa3b2491313506d2bd6cf48774
SSDEEP 12288:yJ0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:yWgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1E2452392AE5509C6E34BC3F0D0E7C7D1E9E11FC272414E6B57E0FA531DBCC9A6A88468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 c47623e6275c5480abd98e9a69d6feae75a411aecb22ddf59aed3be3873499ed
MD5 dc12dab0db899ecbf82f8bb41e2c1a84
SHA1 7fd6f381adb77ea9be3749e5ce3c58f34eca05e2
SHA512 a2412db74ce6db01ee797b4a68a16112a44171ad9e5ad4a05356f653ee832749d6f2eb67b178690a36edf737c2141ae64f1bb8dae429c29194909d77b933b90a
SSDEEP 24576:bcP4mcvIjkGOxhKP2l71SNKbrh/8KBugXe4i7ojhsP5Lgrk1TWb4AN5:QP4m4IpOO67N8KTe30jaNf1TWbdz
TLSH
T1ED65AE2DABDC0096D0BB917485A58A49FAB1742A2F3286CB1160933D3F77EE54F35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 e5dc05f7be05a0b3da1f51bffb062dff5bbdedbf52b321a52d31c00a48715f0b
MD5 d988f690d2c45944d29c9221c0bd197a
SHA1 bf09f4f5061f9070f0001e86e62eaf15b22342c3
SHA512 0fb01f6fd2ce1702474a8f29f778f81e854f1530ff3d1f5b97c62590db6cd7dc6a2e286eeb1c8b9b3e77dd708473bcfabd9be32a605df5f4df9c01117a2e75d8
SSDEEP 12288:Obsf50DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:VmgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T15D55F15AD29802D8C15E92B5C3968A41F3733C9193E1C7CB13D0F93E1F79A949EE9A13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cfe85a77227ba850.bin

Path C:\Users\Admin\AppData\Roaming\cfe85a77227ba850.bin
Size 12KB
SHA256 ab03214da65edc62cba6c8314283ed71f3b614094bcb1746ec293b83f6703bd1
MD5 206b0dd9c0b89683421c9388555f04c4
SHA1 99017883af4efec506c29e78217e193f67f59b54
SHA512 d46136dae7ceb912720bfa8207610b22d6aa635504a2478367678f94c2e540e26b84193845cf7fac4b07c634eebe6ece6b59030b9e135135528c842fbacd7db1
SSDEEP 384:ogZz2easNufLGUc+YKAJxU6iYCpuHXzLpFU:DZCsATGc/OCp2/pS
TLSH
T10242C0625C31BEF4CEB8491536BA8520B1E337975FFA2B01E95E18E1A20CCE0D63294D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 4ff83146112bb0e772a5fa6eb4c064a309d99c4f39a75f615f2c0e90434bb376
MD5 e1bc2a6cac2a8bb078a2cbeb6e989456
SHA1 785bc73c8a44f81dc27e762f0824c91ec45d798c
SHA512 b9d0bafc0a52f1e3fcdafc8d25a8af24df64c905e2b2b82f610d329c24eb1bfc8580743d22f5d0fddef08c3d5446d56c1c7e1c0c93f8a755ed3349e541b9f65f
SSDEEP 12288:NZ0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:NGgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1394523629F584DC7F29BC3F090F7C760E5662FC07B00899B52D0BA5319B8CDAAEA4519
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 5c2a74e5de4e0db57bdac8b8e03f4e4191ace9aeb5fe9b2954af0f06ac0183fc
MD5 56d0fa9fa275e2955dcacfb9d0de80f8
SHA1 417e8b7fad5f279a4670243a2c7b3e3a53a494a8
SHA512 d69c88dabb23894d08b8c0523c2f79f395cbf272ba5a2c3002f5c9aad58d4699a52bfca0ade4d634d1920b5ce87cd260fe731e25cc6295746919022dafd6b763
SSDEEP 49152:9a0h2GEkuAe73q3pp46zwwQXe30jaNf1TWbdz:9a0hNYG4JwmU023W
TLSH
T12485AF1E67EC82B5D0BAD278C9A6814BE6B2B4261B3156CF1190853D3F37DE44E3DB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 88ec5b10e028b3c0aeae5e40728c6bddab678b7c28e5fecc5318fbdf70fe9a91
MD5 95c68134ab14ceb9a24e77f71cac4f5c
SHA1 6791c65b44ac203a6e5d319b08dc81185bc94d5c
SHA512 fb7c08fc07a8deb2e15e96687de55a61ec25d1c17f197e2f2884cc2224acfab83e177961793317acc5a3cc867a7067cb3eb885fe4d180c068fddd92e66f2ae7d
SSDEEP 12288:3hbHjfXC0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:3hbHjPbgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1A65512BE2AAC10C9F276D2BC91E28646D371BC51271187EF13D0927A0F3ADE95D38E51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 1002131a10ba9117e82f626b2f1819cf48c299122e6580e1380a682842761ec7
MD5 19f63cd5c42b28c798f7d89535cfadad
SHA1 7e14e780d7d6d0a8c3e7238f9cb16a7c31ba931b
SHA512 e570ca74e762c691668d7f9cd1b9a8c33497ffdb28f3f81050e05e53c70a1a6c65f0108649a63c583af0c318611b490dc2c268b5e0683bcc274441b0643c7a6a
SSDEEP 24576:s3YgnJcRTk4yti+R5dpR/zgXe4i7ojhsP5Lgrk1TWb4AN5:sIgnaTk46ppR/Ke30jaNf1TWbdz
TLSH
T1F945BF2DF2B910B9D4AAD236414147B5FB71782D1F209ACB01B0C538AF1AEE85E39F5D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 496312545fa2583d43f07208c6656d5f71a92fd54cd48462461ba609774038b8
MD5 72836e5512a94102c91a1ce145a7918b
SHA1 d5b3a15d40156b1fa617af951335f915222aa426
SHA512 6b82a6e06da4094dade2e34ed317483d413fb9eda6e02b9a37d1e2efa8bc5cc87d331a27fbfca7d7eabc9989f3b71ba84f84f3e0a4f9a62030d8bca2c391b868
SSDEEP 12288:010DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:0CgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T112452391AE554DC6E24BC3F490E7C791E5A12FC133014EEB16E0FA531ABCCEA6EB4458
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.5MB
SHA256 e65a8fa0dd6d4427bcd1b0adc6a3045f6bc6e756aa9779c61f063ddb706db49c
MD5 cc143219223b47af19609772034dd670
SHA1 998fd43d09a11a3e835b5fbf0327436fd98084b6
SHA512 6ed37140bcbbedaaca2624b6c38d48743fdac459435134533558b488df704a708665cd05ee2c194965d9cbe0674790a39aa3dc37d8f8726a383a54e40a6c1f0b
SSDEEP 12288:5ObfA4LWOsvAYFTs0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAf:ubL3UTNgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T11B75F155F79400F9E96BC17CC4A28A12E2B2789D1364D7DF03A88B661F637E64E3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 af0391d4d7d38af5bb11cc8196efa527e191bbc5f4550f1afb4d09a1245f3778
MD5 48f1d397cc51b59512751987098660dc
SHA1 5338df3e0d259d4a2d2c5dca47358c0ea0cd9ffc
SHA512 cf2a778ac5d836b0851fe910052e0f95bbc790131242379bfbfc372894a09b3fcd9bd00734cecb3a5898b9e9a36c1145bba7c5e8114a66811e1b4f7f6d747f70
SSDEEP 12288:YpFtIOY0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:TOZgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T19655026A3BEC10D5E16A927C85D38349D3B17C92171147EF02E081BA1FB7EF86C79A61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 3fdfe876bfe4baf372906de6e85a7c87e157fc9c008f144a24476caa08339f3e
MD5 43084668f7b0690353a893aa26bb6aad
SHA1 b924eda9124b8b7a5ed1ba6c34eeb7dce7b15db2
SHA512 71a208a1b7f01804a6c93cef44b11d0928d9c76f337bccd617d29e6f3d1178118333f2c75bc26ea6c6ec099372ccfbad005133c7bf089cb9413313c7128c23dd
SSDEEP 24576:37NM9YmZqmWMUkPjZM48Mv6bEhsWgXe4i7ojhsP5Lgrk1TWb4AN5:37cBWMpPjN8DbEhie30jaNf1TWbdz
TLSH
T172659E2E6BAC81D5D577D13DC9E28205F6B2B4611B318ACF1262833E6F37AE44E35721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 17a78118f2a5dd3ca6a1101b3689c9a1d4618fe94f74fb8c3aa50c032ceee7ea
MD5 242b5849d1dd7f7f94540f270bc19aee
SHA1 e1646f3cdd66edadd1e8d079a7021598bbd7a762
SHA512 0ad075eeb8bf48b41b5696251de160a3c1761fccef13c3b10ef77c48e0eabf44f7f4572b3b4a04c9a542d13e01c1323dffd565e6e0bc09703dba608979fc9193
SSDEEP 49152:KF2YuHNETovcvNYf8kmZe30jaNf1TWbdz:D6tCf8kkU023W
TLSH
T177857E6927ED80A4E0BBD27D45F6D246FAB2B8511B3056CF0255862E1F33AF44D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 6fff0c2e00504d6752aa9e48a65f198cffa7d772c921808e127f07d7f40315aa
MD5 9d4ea761dc5bd413820ba39597e30a8c
SHA1 72356dbc3f1dc641b2ad7c341f151df9e813a611
SHA512 9f351b893d18774f03696ba2c0303a9c4a009136b722a6adc1a5bd6753448ca60b243f1aca2c11ccea09f4276a9e7a47881867441938e0921840b2d3935d5a56
SSDEEP 24576:6AFs06+OmlfkNXEbToVgXe4i7ojhsP5Lgrk1TWb4AN5:DFs060lwXu3e30jaNf1TWbdz
TLSH
T11965BF2F66AC00D5D07ED17D8A97C91AF6B1746307255ACB0260C63E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 2844635603d22270a3a5809d2cae4522d85822dabf119e1174c8e02b03e7da5f
MD5 72f7142300cf0a44e5df7462ac08f1ee
SHA1 dafbe536fadfce141613dd85f92f91b2bf91858d
SHA512 86db5b61bdc0a158bbfae49a5bb625430df2dd53a79e8fe57663f1fbf03d7acbb683f75a73d8282061b402018a796c329cfe481523f5274f4c52493b6b671897
SSDEEP 24576:KJnJ5D3WtQgXe4i7ojhsP5Lgrk1TWb4AN5:KJnJ5DGt3e30jaNf1TWbdz
TLSH
T1A675D02DD2A810E8D0B7C3B4819A5B95FF72386D2B226EC714B4D5353F12EE09979F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 654a38371fda9492bd56ca507a113088ab6b0a7f85c1555c21d4eb3f5c5ea49f
MD5 397a393003392ac39e9068fb6d566ef9
SHA1 adebb3a8490172e3b85711fa94ad85c56f7d9f41
SHA512 a82e028589eb06bd6b134bca239461346830025456fa3258b1c30c75a26217398062d85e9382c131927d4930072085ba1ff3813f8f2b771ed6c9f6061950c9c3
SSDEEP 49152:wo06DIKdwc+eQnSt65aVte30jaNf1TWbdz:dLU023W
TLSH
T1D0955C16BBEA5294E8B3CAB1C96295169B327C509B34F7DF0AC0C92E1D33BD1D934B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 cece99ae3fbab3c2f8a7f7faf133748f208c38544b684e42e3eacb9c9351a6f9
MD5 83de70d90c58dae15bdc6addbdab52f3
SHA1 c566d77f9120e86e2eb430b2fe2d07b9b43bee58
SHA512 908eea1b8d6c7ae773444e51b40dec97c0eee06abe4b1cb5f0685ed4ccbe6a2603520f246b724b7d3467b3b3372a88d64536e71be56e8dde4f11bb1e6cc2110c
SSDEEP 12288:9EP3RrT0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:erQgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1AF55126D6B9C60D9D16BD17C90E28745D3B2F4A127421BEF02E0D27E4E779E92E3CA10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.3MB
SHA256 944896e047556dcf12a680978019632fea1447a5b7b09b46aedcd84def879b60
MD5 5c68097904619557d520cbe5de8a279b
SHA1 08d14cc40566dfdaee59d3ceabc23196f31da155
SHA512 5f361e10265c2760ad983ecaf1bd133c034a887dc03c7f7ec58ef29e349b3b977a1733b959d15376f9519621eecb97bf93568607f22b5e99cb56b943f02f52a0
SSDEEP 12288:WjkyS0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:WIyLgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1AA551205679854C5E2AB8278D5F38390DA71BC602B1087EF11D0FA3F6F7AAE4AD34B15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 26b2e995d6372d1df8f2530ecb118b77ac2e2e6a17876a01622b9063ade2ce11
MD5 76cb2b082ffe231546bf733645a3307a
SHA1 6301b46f1e52d787bb495cb64c816b96728c8056
SHA512 ea5d406181a2b7c130e888317805e25cf4c4cf163aa08b7b8751d0c8b52dcd02b3ee26aaa1c34081f3aefa27e1292c67b47dd560445ee6eba02aea764ec0c87c
SSDEEP 12288:2Fo0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:0JgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1504523596A6519CAE247C3F490F78B91E5B13ED133000DFF12E0FA734EB88DA69B4858
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 e55faf5b7369335f960b28a5f1ac298382bf8e8d8e3855d00c00df3897952860
MD5 b875d8c01ce062f080547936e6b1accf
SHA1 1e9eec3c33d2f66f1e21067d0c302d1df701a0cb
SHA512 eb987f9acba2138e4df4d8ca18637de871a3428c845c3878e931a6da4a1b015ff31961be34fec9a81e2a157858d8fad6a2baf4c76a680b2d85763c08f22e8063
SSDEEP 24576:AQ9MxZKdcz97w3+gXe4i7ojhsP5Lgrk1TWb4AN5:AVKXRe30jaNf1TWbdz
TLSH
T1B1557C2DABE909CAE177D27595A240C3A673B4311B31D6CF2448D03D4D7AEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 32787b09fda1034cbe062bfd49ec19871d3da2e6730315139e2c23594a4f4fc5
MD5 f7991f3fb3d7120157a1d5a68a28d375
SHA1 16886b1b9b23b4891a4be02bbda17bdb718b2d28
SHA512 470e3997cc8b27c05f7477be7838c58687fc086395e727600177125afc8c14447a36cdd6f0bee81afae9726c080b45c9a10925fcd9d01f005e4b20b0af14cb04
SSDEEP 24576:SyocxAp3gXe4i7ojhsP5Lgrk1TWb4AN5:PocxAp+e30jaNf1TWbdz
TLSH
T1AA65E01FBB6940E2E166823C88868741E7B3B4702B5257DB52D1C33E4E779E9BD38B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 5e4994ff42eed809dc56c5fbfe9ce0b0b42dc9a0ba6daba2795f0e39645ed647
MD5 c2d41e61729279d6d046d7a38fda0373
SHA1 bbeb17b305e61918f2780e64c8d8783ad4e75195
SHA512 fe5a215aa741682ba0baa8b532109e39abf0fbfb6cfdc7f6b6f187350a417783265e80c136f1476cbd49bac92808bc98cf8c5b345eaacacbeb655638ca9ba054
SSDEEP 49152:qWcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIK+e30jaNf1TWbdz:s0zuNIaU023W
TLSH
T1A7A57C3DA2BC00A9D9AAC375C14513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 2766ab54ab27cd3e87219f4616191a650de39cb142f0d75b8d379af6dcf89796
MD5 bfea7ec84a1519071bb63afdf77daf63
SHA1 1c8a5892e227fb8cf87f89fe1b2cea6f1fb5ed87
SHA512 09d31062e17a374863e47b3cef86321fd4ef866f517e80bfb64757b1d95c80eb8ccc5ab6c8ca61483b035fab4f86fe03818fd9a186e5dadae242f5b09c94a39e
SSDEEP 24576:/1QT7EcpfxR+N5AWAz3ooiYujMqbsgXe4i7ojhsP5Lgrk1TWb4AN5:CTDxR+N5YzT4jMEe30jaNf1TWbdz
TLSH
T1A655B02EA7F815E9D1BEC5789A23C512FA727851033193CB42A0C17E1E7B9D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.5MB
SHA256 0c048f56ee77db59309ba0ae07ff0c9545b79c812e62b99d1aefe83f335f1bf5
MD5 2553833049b13ec48ef6b8b19c066069
SHA1 ca1d19d526696f2fb95d4db56588ffca539b872e
SHA512 69d7efc8b27fc095dae21471991fa94e3f4a09aa7be71ea5afed12cf5feff2c704faa9fd73459ad0b2604ca44a41435b8ef00300920f62a7f5e04433d4f13e6d
SSDEEP 24576:OTMdOz0FFS+bmSLYgXe4i7ojhsP5Lgrk1TWb4AN5:60K+bmSLve30jaNf1TWbdz
TLSH
T1B575F17EA76D14E5E17BC27CD653CA06E672386103216ADB06D0C17A2F5BEE4393DB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.2MB
SHA256 86678d36a7e6909711ef9d54c8910e2f38f65f27dd4c3da676fe66eab86338ec
MD5 0d33d5c6fa4eec50b7ff3928238299d0
SHA1 c61341e47eb1acc2e84fc8889ae5808ca4a1bdc2
SHA512 df67bce086ae4f85a659b118df93f72600c817303a8ca94b45cfa07013d9a036b2cfa9488b326c565f4ec15949e6724fcd70da31f7c0e50dc6d0996edb2c9aeb
SSDEEP 12288:G47s0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:9NgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T18955125967E824C5F167C2B4D1F78341D6707CA223100AFF26E0EA7B0F7A9D99978B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/560-22-0x0000000001FC0000-0x0000000002020000-memory.dmp

Download

memory/560-75-0x0000000140000000-0x000000014069D000-memory.dmp

Download

memory/560-6-0x0000000001FC0000-0x0000000002020000-memory.dmp

Download

memory/560-18-0x0000000140000000-0x000000014069D000-memory.dmp

Download

memory/560-0-0x0000000001FC0000-0x0000000002020000-memory.dmp

Download

memory/900-240-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/900-128-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/900-124-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/900-118-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/1448-241-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/1448-238-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/1448-232-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/1448-488-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/1472-139-0x0000000140000000-0x00000001401EA000-memory.dmp

Download

memory/1472-130-0x0000000000520000-0x0000000000580000-memory.dmp

Download

memory/1472-136-0x0000000000520000-0x0000000000580000-memory.dmp

Download

memory/1472-252-0x0000000140000000-0x00000001401EA000-memory.dmp

Download

memory/1640-265-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/1640-144-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/2152-71-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2152-63-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/2152-178-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2152-69-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/2160-72-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Download

memory/2160-59-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Download

memory/2160-52-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/2160-53-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Download

memory/2160-74-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/2592-85-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2592-202-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2592-79-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2592-87-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2672-223-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2672-217-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2672-226-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/2672-228-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2672-230-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/3360-499-0x000001EDFD210000-0x000001EDFD220000-memory.dmp

Download

memory/3360-493-0x000001EDFD210000-0x000001EDFD220000-memory.dmp

Download

memory/3360-100-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/3360-497-0x000001EDFD210000-0x000001EDFD220000-memory.dmp

Download

memory/3360-498-0x000001EDFD210000-0x000001EDFD220000-memory.dmp

Download

memory/3360-500-0x000001EDFD210000-0x000001EDFD220000-memory.dmp

Download

memory/3360-501-0x000001EDFD210000-0x000001EDFD220000-memory.dmp

Download

memory/3360-496-0x000001EDFD210000-0x000001EDFD220000-memory.dmp

Download

memory/3360-495-0x000001EDFD210000-0x000001EDFD220000-memory.dmp

Download

memory/3360-494-0x000001EDFD210000-0x000001EDFD220000-memory.dmp

Download

memory/3360-492-0x000001EDFD210000-0x000001EDFD220000-memory.dmp

Download

memory/3360-491-0x000001EDFD210000-0x000001EDFD220000-memory.dmp

Download

memory/3360-104-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/3360-102-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/3360-490-0x000001EDFD210000-0x000001EDFD220000-memory.dmp

Download

memory/3360-96-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/3360-90-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/3836-194-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/3836-200-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/3836-203-0x0000000140000000-0x0000000140241000-memory.dmp

Download

memory/3836-467-0x0000000140000000-0x0000000140241000-memory.dmp

Download

memory/4336-48-0x0000000140000000-0x00000001401E8000-memory.dmp

Download

memory/4336-49-0x0000000000680000-0x00000000006E0000-memory.dmp

Download

memory/4336-40-0x0000000000680000-0x00000000006E0000-memory.dmp

Download

memory/4344-158-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/4344-289-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4344-166-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4344-164-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/4344-466-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4344-464-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/4536-147-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/4536-155-0x0000000140000000-0x00000001401D4000-memory.dmp

Download

memory/4536-276-0x0000000140000000-0x00000001401D4000-memory.dmp

Download

memory/4536-153-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/4704-385-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/4704-170-0x0000000000610000-0x0000000000670000-memory.dmp

Download

memory/4704-179-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/4704-176-0x0000000000610000-0x0000000000670000-memory.dmp

Download

memory/4856-212-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/4856-482-0x0000000140000000-0x0000000140221000-memory.dmp

Download

memory/4856-214-0x0000000140000000-0x0000000140221000-memory.dmp

Download

memory/4856-206-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/4956-274-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/4956-277-0x0000000140000000-0x0000000140205000-memory.dmp

Download

memory/4956-587-0x0000000140000000-0x0000000140205000-memory.dmp

Download

memory/4956-268-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/5308-253-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/5308-250-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/5308-489-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/5496-182-0x0000000000700000-0x0000000000760000-memory.dmp

Download

memory/5496-188-0x0000000000700000-0x0000000000760000-memory.dmp

Download

memory/5496-190-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/5496-449-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/5760-35-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/5760-127-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/5760-27-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/5760-36-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/5768-10-0x0000000001FA0000-0x0000000002000000-memory.dmp

Download

memory/5768-99-0x0000000140000000-0x000000014069D000-memory.dmp

Download

memory/5768-21-0x0000000140000000-0x000000014069D000-memory.dmp

Download

memory/5768-16-0x0000000001FA0000-0x0000000002000000-memory.dmp

Download

memory/5776-588-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/5776-287-0x0000000000840000-0x00000000008A0000-memory.dmp

Download

memory/5776-290-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/5776-315-0x0000000001DC0000-0x0000000001DD0000-memory.dmp

Download

memory/5776-333-0x000000000A200000-0x000000000A208000-memory.dmp

Download

memory/5776-486-0x000000000D720000-0x000000000D728000-memory.dmp

Download

memory/5776-299-0x0000000001B10000-0x0000000001B20000-memory.dmp

Download

memory/5776-281-0x0000000000840000-0x00000000008A0000-memory.dmp

Download

memory/5784-266-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/5784-262-0x0000000000B80000-0x0000000000BE0000-memory.dmp

Download

memory/5784-256-0x0000000000B80000-0x0000000000BE0000-memory.dmp

Download

memory/5784-554-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/6076-225-0x0000000140000000-0x00000001401F8000-memory.dmp

Download

memory/6076-106-0x0000000140000000-0x00000001401F8000-memory.dmp

Download

memory/6076-107-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/6076-113-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download