34be3dbf12a5c8630629e449025e40b225112472a4bdc00dfc268614355242dd

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/10/2026, 13:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
34be3dbf12a5c8630629e449025e40b225112472a4bdc00dfc268614355242dd.exe
Size 6.5MB
Sample261003-qelf4sdc95
SHA256 34be3dbf12a5c8630629e449025e40b225112472a4bdc00dfc268614355242dd
MD5 58f1c9e9308ee8e49d7425c826765759
SHA1 a0582778d777c11d86602d37ef3b118cefe78bbb
SHA512 c37361c9078f63d072573ef8e9e2beb12f08da8af6bcfd9349c4815525b2d1d3b5d5358bcda1a982f01a7fa7e572cca7d69d6b5f6a5ec9b11162da74d5dcf271
SSDEEP 98304:4nDc9sWvmQJsJNZxmsI26kYRIgxD527BWG:4nDFx1YRnVQBWG
TLSH
T1A2666A13F29901D9D059D178CB5A9232EB72BC494BB162EF2A5077D12E76EE0BB3C710
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
2148	alg.exe
2516	DiagnosticsHub.StandardCollector.Service.exe
3708	fxssvc.exe
3120	elevation_service.exe
4416	elevation_service.exe
832	maintenanceservice.exe
3948	msdtc.exe
1804	OSE.EXE
4084	PerceptionSimulationService.exe
3472	perfhost.exe
4988	locator.exe
3392	SensorDataService.exe
5020	snmptrap.exe
2676	spectrum.exe
3492	ssh-agent.exe
2124	TieringEngineService.exe
4496	AgentService.exe
3304	vds.exe
536	vssvc.exe
1128	wbengine.exe
1884	WmiApSrv.exe
4276	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	34be3dbf12a5c8630629e449025e40b225112472a4bdc00dfc268614355242dd.exe
\??\F:\	DiagnosticsHub.StandardCollector.Service.exe

Drops file in System32 directory 31 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	34be3dbf12a5c8630629e449025e40b225112472a4bdc00dfc268614355242dd.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	34be3dbf12a5c8630629e449025e40b225112472a4bdc00dfc268614355242dd.exe
File opened for modification	C:\Windows\system32\msiexec.exe	34be3dbf12a5c8630629e449025e40b225112472a4bdc00dfc268614355242dd.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	34be3dbf12a5c8630629e449025e40b225112472a4bdc00dfc268614355242dd.exe
File opened for modification	C:\Windows\System32\vds.exe	34be3dbf12a5c8630629e449025e40b225112472a4bdc00dfc268614355242dd.exe
File opened for modification	C:\Windows\system32\locator.exe	34be3dbf12a5c8630629e449025e40b225112472a4bdc00dfc268614355242dd.exe
File opened for modification	C:\Windows\system32\wbengine.exe	34be3dbf12a5c8630629e449025e40b225112472a4bdc00dfc268614355242dd.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	34be3dbf12a5c8630629e449025e40b225112472a4bdc00dfc268614355242dd.exe
File opened for modification	C:\Windows\System32\msdtc.exe	34be3dbf12a5c8630629e449025e40b225112472a4bdc00dfc268614355242dd.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	34be3dbf12a5c8630629e449025e40b225112472a4bdc00dfc268614355242dd.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\alg.exe	34be3dbf12a5c8630629e449025e40b225112472a4bdc00dfc268614355242dd.exe
File opened for modification	C:\Windows\system32\spectrum.exe	34be3dbf12a5c8630629e449025e40b225112472a4bdc00dfc268614355242dd.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	34be3dbf12a5c8630629e449025e40b225112472a4bdc00dfc268614355242dd.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	34be3dbf12a5c8630629e449025e40b225112472a4bdc00dfc268614355242dd.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	34be3dbf12a5c8630629e449025e40b225112472a4bdc00dfc268614355242dd.exe
File opened for modification	C:\Windows\system32\dllhost.exe	34be3dbf12a5c8630629e449025e40b225112472a4bdc00dfc268614355242dd.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\a86cf6a99b11239b.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	34be3dbf12a5c8630629e449025e40b225112472a4bdc00dfc268614355242dd.exe
File opened for modification	C:\Windows\system32\vssvc.exe	34be3dbf12a5c8630629e449025e40b225112472a4bdc00dfc268614355242dd.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	34be3dbf12a5c8630629e449025e40b225112472a4bdc00dfc268614355242dd.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	34be3dbf12a5c8630629e449025e40b225112472a4bdc00dfc268614355242dd.exe
File opened for modification	C:\Windows\system32\AgentService.exe	34be3dbf12a5c8630629e449025e40b225112472a4bdc00dfc268614355242dd.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	34be3dbf12a5c8630629e449025e40b225112472a4bdc00dfc268614355242dd.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	34be3dbf12a5c8630629e449025e40b225112472a4bdc00dfc268614355242dd.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	34be3dbf12a5c8630629e449025e40b225112472a4bdc00dfc268614355242dd.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	34be3dbf12a5c8630629e449025e40b225112472a4bdc00dfc268614355242dd.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	34be3dbf12a5c8630629e449025e40b225112472a4bdc00dfc268614355242dd.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	34be3dbf12a5c8630629e449025e40b225112472a4bdc00dfc268614355242dd.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	34be3dbf12a5c8630629e449025e40b225112472a4bdc00dfc268614355242dd.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	34be3dbf12a5c8630629e449025e40b225112472a4bdc00dfc268614355242dd.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	34be3dbf12a5c8630629e449025e40b225112472a4bdc00dfc268614355242dd.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	34be3dbf12a5c8630629e449025e40b225112472a4bdc00dfc268614355242dd.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	34be3dbf12a5c8630629e449025e40b225112472a4bdc00dfc268614355242dd.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	34be3dbf12a5c8630629e449025e40b225112472a4bdc00dfc268614355242dd.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	34be3dbf12a5c8630629e449025e40b225112472a4bdc00dfc268614355242dd.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	34be3dbf12a5c8630629e449025e40b225112472a4bdc00dfc268614355242dd.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	34be3dbf12a5c8630629e449025e40b225112472a4bdc00dfc268614355242dd.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	34be3dbf12a5c8630629e449025e40b225112472a4bdc00dfc268614355242dd.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	34be3dbf12a5c8630629e449025e40b225112472a4bdc00dfc268614355242dd.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	34be3dbf12a5c8630629e449025e40b225112472a4bdc00dfc268614355242dd.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	34be3dbf12a5c8630629e449025e40b225112472a4bdc00dfc268614355242dd.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	34be3dbf12a5c8630629e449025e40b225112472a4bdc00dfc268614355242dd.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	34be3dbf12a5c8630629e449025e40b225112472a4bdc00dfc268614355242dd.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	34be3dbf12a5c8630629e449025e40b225112472a4bdc00dfc268614355242dd.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	34be3dbf12a5c8630629e449025e40b225112472a4bdc00dfc268614355242dd.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	34be3dbf12a5c8630629e449025e40b225112472a4bdc00dfc268614355242dd.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	34be3dbf12a5c8630629e449025e40b225112472a4bdc00dfc268614355242dd.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	34be3dbf12a5c8630629e449025e40b225112472a4bdc00dfc268614355242dd.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	34be3dbf12a5c8630629e449025e40b225112472a4bdc00dfc268614355242dd.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	34be3dbf12a5c8630629e449025e40b225112472a4bdc00dfc268614355242dd.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	34be3dbf12a5c8630629e449025e40b225112472a4bdc00dfc268614355242dd.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	34be3dbf12a5c8630629e449025e40b225112472a4bdc00dfc268614355242dd.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	34be3dbf12a5c8630629e449025e40b225112472a4bdc00dfc268614355242dd.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_126703\javaw.exe	34be3dbf12a5c8630629e449025e40b225112472a4bdc00dfc268614355242dd.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	34be3dbf12a5c8630629e449025e40b225112472a4bdc00dfc268614355242dd.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	34be3dbf12a5c8630629e449025e40b225112472a4bdc00dfc268614355242dd.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	34be3dbf12a5c8630629e449025e40b225112472a4bdc00dfc268614355242dd.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	34be3dbf12a5c8630629e449025e40b225112472a4bdc00dfc268614355242dd.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	34be3dbf12a5c8630629e449025e40b225112472a4bdc00dfc268614355242dd.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	34be3dbf12a5c8630629e449025e40b225112472a4bdc00dfc268614355242dd.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	34be3dbf12a5c8630629e449025e40b225112472a4bdc00dfc268614355242dd.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Direct Volume Access: Opens a physical disk for reading 1 TTPs 1 IoCs

Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

defense_evasion

Direct Volume Access

T1006

description	ioc	Process
File opened (read-only)	\??\PhysicalDrive0	SearchIndexer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	DiagnosticsHub.StandardCollector.Service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	34be3dbf12a5c8630629e449025e40b225112472a4bdc00dfc268614355242dd.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	34be3dbf12a5c8630629e449025e40b225112472a4bdc00dfc268614355242dd.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	DiagnosticsHub.StandardCollector.Service.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	34be3dbf12a5c8630629e449025e40b225112472a4bdc00dfc268614355242dd.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	34be3dbf12a5c8630629e449025e40b225112472a4bdc00dfc268614355242dd.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001b61669d3853dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000450b4d9c3853dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006650f69c3853dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000eddea29c3853dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004fdaff9c3853dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000518b2f9d3853dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ce94379c3853dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001cd1329c3853dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009430549c3853dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe

Suspicious behavior: EnumeratesProcesses 42 IoCs

pid	Process
2480	34be3dbf12a5c8630629e449025e40b225112472a4bdc00dfc268614355242dd.exe
2480	34be3dbf12a5c8630629e449025e40b225112472a4bdc00dfc268614355242dd.exe
2480	34be3dbf12a5c8630629e449025e40b225112472a4bdc00dfc268614355242dd.exe
2480	34be3dbf12a5c8630629e449025e40b225112472a4bdc00dfc268614355242dd.exe
2480	34be3dbf12a5c8630629e449025e40b225112472a4bdc00dfc268614355242dd.exe
2480	34be3dbf12a5c8630629e449025e40b225112472a4bdc00dfc268614355242dd.exe
2480	34be3dbf12a5c8630629e449025e40b225112472a4bdc00dfc268614355242dd.exe
2480	34be3dbf12a5c8630629e449025e40b225112472a4bdc00dfc268614355242dd.exe
2480	34be3dbf12a5c8630629e449025e40b225112472a4bdc00dfc268614355242dd.exe
2480	34be3dbf12a5c8630629e449025e40b225112472a4bdc00dfc268614355242dd.exe
2480	34be3dbf12a5c8630629e449025e40b225112472a4bdc00dfc268614355242dd.exe
2480	34be3dbf12a5c8630629e449025e40b225112472a4bdc00dfc268614355242dd.exe
2480	34be3dbf12a5c8630629e449025e40b225112472a4bdc00dfc268614355242dd.exe
2480	34be3dbf12a5c8630629e449025e40b225112472a4bdc00dfc268614355242dd.exe
2480	34be3dbf12a5c8630629e449025e40b225112472a4bdc00dfc268614355242dd.exe
2480	34be3dbf12a5c8630629e449025e40b225112472a4bdc00dfc268614355242dd.exe
2480	34be3dbf12a5c8630629e449025e40b225112472a4bdc00dfc268614355242dd.exe
2480	34be3dbf12a5c8630629e449025e40b225112472a4bdc00dfc268614355242dd.exe
2480	34be3dbf12a5c8630629e449025e40b225112472a4bdc00dfc268614355242dd.exe
2480	34be3dbf12a5c8630629e449025e40b225112472a4bdc00dfc268614355242dd.exe
2480	34be3dbf12a5c8630629e449025e40b225112472a4bdc00dfc268614355242dd.exe
2480	34be3dbf12a5c8630629e449025e40b225112472a4bdc00dfc268614355242dd.exe
2480	34be3dbf12a5c8630629e449025e40b225112472a4bdc00dfc268614355242dd.exe
2480	34be3dbf12a5c8630629e449025e40b225112472a4bdc00dfc268614355242dd.exe
2480	34be3dbf12a5c8630629e449025e40b225112472a4bdc00dfc268614355242dd.exe
2480	34be3dbf12a5c8630629e449025e40b225112472a4bdc00dfc268614355242dd.exe
2480	34be3dbf12a5c8630629e449025e40b225112472a4bdc00dfc268614355242dd.exe
2480	34be3dbf12a5c8630629e449025e40b225112472a4bdc00dfc268614355242dd.exe
2480	34be3dbf12a5c8630629e449025e40b225112472a4bdc00dfc268614355242dd.exe
2480	34be3dbf12a5c8630629e449025e40b225112472a4bdc00dfc268614355242dd.exe
2480	34be3dbf12a5c8630629e449025e40b225112472a4bdc00dfc268614355242dd.exe
2480	34be3dbf12a5c8630629e449025e40b225112472a4bdc00dfc268614355242dd.exe
2480	34be3dbf12a5c8630629e449025e40b225112472a4bdc00dfc268614355242dd.exe
2480	34be3dbf12a5c8630629e449025e40b225112472a4bdc00dfc268614355242dd.exe
2480	34be3dbf12a5c8630629e449025e40b225112472a4bdc00dfc268614355242dd.exe
2516	DiagnosticsHub.StandardCollector.Service.exe
2516	DiagnosticsHub.StandardCollector.Service.exe
2516	DiagnosticsHub.StandardCollector.Service.exe
2516	DiagnosticsHub.StandardCollector.Service.exe
2516	DiagnosticsHub.StandardCollector.Service.exe
2516	DiagnosticsHub.StandardCollector.Service.exe
2516	DiagnosticsHub.StandardCollector.Service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
660	Process not Found
660	Process not Found

Suspicious use of AdjustPrivilegeToken 43 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3928	34be3dbf12a5c8630629e449025e40b225112472a4bdc00dfc268614355242dd.exe
Token: SeAuditPrivilege	3708	fxssvc.exe
Token: SeRestorePrivilege	2124	TieringEngineService.exe
Token: SeManageVolumePrivilege	2124	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	4496	AgentService.exe
Token: SeBackupPrivilege	536	vssvc.exe
Token: SeRestorePrivilege	536	vssvc.exe
Token: SeAuditPrivilege	536	vssvc.exe
Token: SeBackupPrivilege	1128	wbengine.exe
Token: SeRestorePrivilege	1128	wbengine.exe
Token: SeSecurityPrivilege	1128	wbengine.exe
Token: 33	4276	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4276	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4276	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4276	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4276	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4276	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4276	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4276	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4276	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4276	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4276	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4276	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4276	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4276	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4276	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4276	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4276	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4276	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4276	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4276	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4276	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4276	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4276	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4276	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4276	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4276	SearchIndexer.exe
Token: SeDebugPrivilege	2480	34be3dbf12a5c8630629e449025e40b225112472a4bdc00dfc268614355242dd.exe
Token: SeDebugPrivilege	2480	34be3dbf12a5c8630629e449025e40b225112472a4bdc00dfc268614355242dd.exe
Token: SeDebugPrivilege	2480	34be3dbf12a5c8630629e449025e40b225112472a4bdc00dfc268614355242dd.exe
Token: SeDebugPrivilege	2480	34be3dbf12a5c8630629e449025e40b225112472a4bdc00dfc268614355242dd.exe
Token: SeDebugPrivilege	2480	34be3dbf12a5c8630629e449025e40b225112472a4bdc00dfc268614355242dd.exe
Token: SeDebugPrivilege	2516	DiagnosticsHub.StandardCollector.Service.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3928 wrote to memory of 2480	3928	34be3dbf12a5c8630629e449025e40b225112472a4bdc00dfc268614355242dd.exe	85
PID 4276 wrote to memory of 1144	4276	SearchIndexer.exe	113
PID 4276 wrote to memory of 3396	4276	SearchIndexer.exe	114

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\34be3dbf12a5c8630629e449025e40b225112472a4bdc00dfc268614355242dd.exe
"C:\Users\Admin\AppData\Local\Temp\34be3dbf12a5c8630629e449025e40b225112472a4bdc00dfc268614355242dd.exe"
1⤵
- Drops file in System32 directory
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3928
- C:\Users\Admin\AppData\Local\Temp\34be3dbf12a5c8630629e449025e40b225112472a4bdc00dfc268614355242dd.exe
  C:\Users\Admin\AppData\Local\Temp\34be3dbf12a5c8630629e449025e40b225112472a4bdc00dfc268614355242dd.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=124.0.5705.89 --initial-client-data=0x280,0x284,0x288,0x27c,0x28c,0x1405b0e38,0x1405b0e44,0x1405b0e50
  2⤵
  - Enumerates connected drives
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2480

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:2148

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2516

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:1204

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3708

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3120

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4416

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:832

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:3948

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1804

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4084

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3472

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4988

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3392

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:5020

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2676

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3492

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:3364

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2124

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4496

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:3304

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:536

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1128

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:1884

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Direct Volume Access: Opens a physical disk for reading
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4276
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1144
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:3396

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Direct Volume Access

T1006

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 f376d5da04b84c7cc77a843a3ba0c48d654fc7e5fd9c0246c7c629423f2b2a23
MD5 a19682ffdb7b47e5fa386246824ecaba
SHA1 9aa36ac3f4503a06f51b5ef644787bc99634b069
SHA512 a67f7a85a19bb3d1e11662d9402f8ef8c32c15217b5e662bffbe5f68194204851072c1cd5ac2d8212a6fb13c709e23098bebddf25e7d39b4b46c6a5342edce72
SSDEEP 49152:Ab+632BuPkFKRrdE6ohmstBhuXjfS4LWxnDDmg27RnWGj:q3q6HjBID527BWG
TLSH
T124D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 5eb581764ff82a035206937e97d08f810b5e2a96caf437cd4c5aad74ae57f0dc
MD5 71af8c10ddeda969b9c9223c62e8a5ad
SHA1 6b116ce406ce0f5b23929317cea1e41e64436059
SHA512 cdc2a7b9f0b2a6a8019b100159e6af014b9db36973ffae9f80071dde3257692d74ce0f959d0ab335d3af60967fcaf3efc9d724822dca530808227af3277ef06e
SSDEEP 24576:KXYfDtczAQsqjnhMgeiCl7G0nehbGZpbD:RtclDmg27RnWGj
TLSH
T19365F129B3D408F9EC67817CC9A2C516EA337C554760E68B03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 e35c6e4281fedf64d17a7dfea5a1ea29cc00a9d4803b4759a7c28ecf398b49fa
MD5 0e00848af8a035c367c52cb13b8e9109
SHA1 354e8b5cad53f2993771cc193dc57740d6e992f2
SHA512 2b86d8498fa00ce10ca80b66c0df516c169c95d7dc12b496198238cd48b3de51d7c4d57985f5fc8169a4c7338af3ebf8971a1a66d10247be0cd1a30ccd90b808
SSDEEP 24576:Q0Le5ji0hmxirMHsqjnhMgeiCl7G0nehbGZpbD:QPji0AcqDmg27RnWGj
TLSH
T130859E26F6748335D073C0B9C5D2A68EED7230865B3089CB4286D77C7E676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 5e8360bc23233e336de0b3539812a86969879f5cae8031afd701b2332fab4075
MD5 54129a96ddb9746afde2147d11c34419
SHA1 d47623d02422a4cc29a1d82738d1e722a6200c7b
SHA512 bcce9e62bf813ec8b4c68a94833ab5d025a8449900ad51b2cd134dc25c8107d3426d62234b778c0b6fc27e06ececdd897f9f23f54973fd1dd910b9f448788c0c
SSDEEP 24576:Da7/ezSC6vUyD/aqgrvWE6q8wyuBsqjnhMgeiCl7G0nehbGZpbD:u/ezSC6vUzPvxHjy+Dmg27RnWGj
TLSH
T118755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 48fd3f953eaab6e9f48954da9db801e55936f159997ce8354acc05ee64728bd5
MD5 ec782dc73b93fa4f1508d6a754deb9c3
SHA1 e917cd4b57ce813ebf59b4853bd0b625ef8563d4
SHA512 5b8771876bd65e5c824e249dd0c33b7e8e2d6bb60a852181cd34fd2a23becff48655d088fd021366756415257c0df571ca8384bb83f1c692b5d0ac007e7470e7
SSDEEP 24576:EVbqPb88hv/l+6MsqjnhMgeiCl7G0nehbGZpbD:EVO88hXl+fDmg27RnWGj
TLSH
T13B559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 11be7275c2584ecfbe73a6441bfa6a0f301b163fa62752733a23117fe4460303
MD5 4438380d93f48784404c2f93fa602d60
SHA1 856579018601ea6a3b3c8bb44a72d3ca4e9c6779
SHA512 53aa38a4e2621532dcd571dc609d10f7bd8521f2b693bef1e79cccb23130cb89846aa193f62f4706474cc66e46ca1df8a66ec1a95bb7f6bc305dda789d470ffb
SSDEEP 12288:oRDXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:oRDsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C04523BF865C50CAEB7608B5C3E9F11EAC137E56982008536A637CFDE6B5458CB39023
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 3250ddb0b08e351976837865988f1b6e86900ce0506f1e9af6a10dc437f08ee0
MD5 b076e7afc2dc3a366429b6402c97cabf
SHA1 de06684b7f16dd1c6540a95f3f8ba479cb101480
SHA512 528c21a8b16021bfd9ae6d82149058afc5cba5de8cfba72a759f85981fbd17f91f0259bdc8f5fef8e2ed57db16a50059898f2ff07d059b3a8216d84b12e6451b
SSDEEP 12288:zeBNUbTVO86U0Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:zJIU0sqjnhMgeiCl7G0nehbGZpbD
TLSH
T15D65CF7BEE28FCD2C27A8DB85791C600E76278314F61A3CBD165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 db57dd4694ebc7150c2e8ff0930ba6e90a3a0e5be6fb95207cd2fc3f64d553b7
MD5 bf61a151169c07e29b17090ed0ccfd9f
SHA1 99cf81509c762dc747a2e89791ac19f23c7cf9b8
SHA512 da95b6c06007fca7a8ef93416b9e8e723ca1e7fd55022beef84e87a2c8610504ee43b6a8fa159d026212a7850a2747ef50b601a1c72ddba1681858b2aed19b69
SSDEEP 49152:aQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3TH7:aQvGAdlCEL8c/yRNw5CFD527BWG
TLSH
T1EC266C656BF880F5E0A7E178897AC572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 cd081353089a8f05b7807b325eccde13849c6890d9aba524845c75c948c7bb3d
MD5 818823f10ec4d4cd57cec6db31bb3627
SHA1 fc21d94b1beb1bed9d14ca4b0976cf7eb89b595a
SHA512 41c9a75c7f7707b03220360465dae9d18253a3d23cdf6e06d6c1b0234dd2b9a9a2e5f965e65217a231a38354d2787757da443d480a0b8ae6540d4fc8ef3b21a9
SSDEEP 12288:vAwSfxL/2Dc34DLLmt0LDQewsAjWXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:4dewsAjWsqjnhMgeiCl7G0nehbGZpbD
TLSH
T16375E031FA74E036C77B0DB60B36D71A182D7A204F6119C3E3E89D9E99702D12776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 4bfaa77d41e73381c2a8499108ebd124facdba9ec54ca1a2c6ea3ff451fa8b25
MD5 4cbf5315b894c23df51888fcae3008e6
SHA1 723c6a8fa04b0242253cb68cc73ca401ce28d232
SHA512 c780c294524400f085eb63b4c38b29534e65847fb151ed13d3edfdf7b82170331365afcaede1a9d6ba7f38204643c4136b96d582b391222009af757e889743d8
SSDEEP 196608:kUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHCVQBWG:kUEtQevvqc2W1cpV2EI321B
TLSH
T165474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 e816381921f6dd5c9e4f9e29174d7b8253fe11a1f8a42d9b0d721fba44cf1b2c
MD5 47d47d679fb16e23eec7407c467ef1a9
SHA1 4a4211df788f3a35f0370dd595d4e9295d614b5d
SHA512 ce1f59a01c7b44a969e59cd65849a67332c898efa14a2d4711abb170420b77aa31648b50f0fd6f19e7bc5152d559a3e6bf9114a08c34f8bdbc1d3a1fec6be10a
SSDEEP 49152:wCbRquA/m2yL5zQfFiV+XenmE3/z6Dmg27RnWGj:ZoqtVjnmJD527BWG
TLSH
T1A4D58D1976B8C1E4D1F6C77886A2C647F37178154B309BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 44da1b7e1133a5d7f49e2714d8e1b4d5348fce99c74c2961a785b86cc84155c7
MD5 5cafeaceb49f35839fcddee4a6702d2f
SHA1 407f3fbfe5136ea71418846eb6e83b50cad08590
SHA512 598d4122165595877a1d12302b29a6b8c23caacfcbc91d6e490728990404352adc61d2ac9d5d425e3e8e9b9b4775e7aabb96c874568142575b861c19fd389be4
SSDEEP 24576:7AhGLJIFoiwtA5l7S531sqjnhMgeiCl7G0nehbGZpbD:7AMyFoiq55Dmg27RnWGj
TLSH
T1B8359D81E7F951D4F5B3AAB899B69171E976BCAA5E30C20F2160D11F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 842fe038ccb3a428a733d8d8646bcec709f8416ab2a01f13d2161a835404094e
MD5 a8497c66dd75c6e010abffcbdf28371b
SHA1 e57a569c65c20ae8ad2759ee628e6f86281df7bf
SHA512 fe371bca4658ce01e12dc86a5efa7b448c296aee998c061f27156e26455b40014cb01c2994bd50428dbd7780578a9687e91ff7178532f41fa375356cfb6c62ed
SSDEEP 12288:Vmw5HEjsChNVBFgl0WDm+ChXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L0:QwuoOWKsqjnhMgeiCl7G0nehbGZpbDl
TLSH
T1BE65F14A72A81CF9E9674539C697D136F7B3BC122A20D71F1760C65B6F33260AE2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 9a87ef7debf95b0cd437ed9c86997b9c04460dced8f13ccbad207241a2cd9452
MD5 dc2790e8a297637497b155bd94536bce
SHA1 9bcad72384e973d71452600a1b2d2159bb58b30b
SHA512 654429f854125c043410c21be015841c0e91d369765ed30ee20b55f024858c136dbceb5ddbfbdea287d31a70ffc3cb01800170dee488feb29797eb61ea71e1e4
SSDEEP 12288:RBZ1IyGXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:/ZuPsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1DE5512AA239820FAE163417CC5E5D609E7337C62673003CF166659AA6F739D44E39733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 44ebc335d39cd4f71643c8d5f5939b38c4f939df532bd1b8abaa55b3bec5adcd
MD5 cda5dbc8adaa68118145ef4c90866059
SHA1 7d1307f4c61f502c81f2778d96b8c83b0ca2dcb6
SHA512 cba8312e1e8263e8b18fe479824a0536a2c307e02ba91cb1a37a665fe73b4278e652bf99f77dfa3958682143a8f41052c4643c91f36ee921de4a7b8399aada16
SSDEEP 98304:PQRQyi36YOcPQLvw2gAf+PN3ED527BWG:+QyiKayX+PNUVQBWG
TLSH
T1D9667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 342dc2f6fb3d7e1e29fff824c7364e3f1c6175512d92c96269dc1f3806d0c61b
MD5 cb73d34bd818bad3ee420f1011d18a63
SHA1 456fcbcc255b39ac32a0bd477058b208bdab2523
SHA512 9d1d7a008e850d548cb8677b23feabfcc861be3a7fa1e57fbbe70fd7e9ac0b0a4369c2230d3b5ca76ba803dc3738b71f66a4df8a3d989eca0fe93c99df42431b
SSDEEP 98304:xQRQyi36YOcPQLvw2gAf+PN3ED527BWG:oQyiKayX+PNUVQBWG
TLSH
T113667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 9e3b96dfce247a81f2ac18eb49f636cb751fb38ff10a672bc34f8d95abc61661
MD5 823f34de533df5a442e0de56c737724a
SHA1 99ffba75d6a36bfd2443af374d1d1caf2f3dfc31
SHA512 ece432112bb610ea8662475f21e6378e8259255cc7f76b3f8a7ccd5bbc7251b30389f8beed826f38562ad843207b76d6bb691ac2f89f9a19759d38af2fbab083
SSDEEP 24576:ywvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0fsqjnhMgeiCl7Ge:M68Qg55nhheWu7PNU3/qDmg27RnWGj
TLSH
T1F9B55933B2F60099C44DE1769F4A873196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 4565d35adccd7446f9dda9f8b60865bb269e92e0244c8d4a9d16c1e9c8ebb2e6
MD5 f87701841ca9a80a235812cef35184c4
SHA1 e938e566ebb5989583e9ec6793fd0336a0c7df3e
SHA512 eedbb3df39f3074bbc88135a60011d26490226b34e42c64416eebe2aea512eb2f61663fe6a18b185430e143a6bc5510c409abd89b857631e8709cdb6ba4d5f71
SSDEEP 98304:Qy5112gYy5azzVvL69nLKnhZHD527BWG:pLIHmWhxVQBWG
TLSH
T144167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 6418f2da5f6163adac179585340f7a542f177e128e8d6459d05be581f26ea75f
MD5 5c37585380068c3db8c4a69c2eb62e25
SHA1 f94edde4c55d55baf4fd6df512b54db5b568e81f
SHA512 83d765d94d3523ded56219ce3cd67a1d112be2da52572bafb1f352ab8c34f2a6f63d88c5f7b400b0b10a8c6ee051c26ba89311f8b9561f455ee925dd3d6e9927
SSDEEP 49152:TB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glcDmg27RnWGj:lu6JmVxd2dcD527BWG
TLSH
T102D59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 bec28630ce66222515e7ffcdf25bc17683885a1b87524b54138510c41ece8016
MD5 cc91154fe6668fd3daafa7d99ca6beda
SHA1 8c59cb86cc0ebf7f893e8c657723d2a52c08103a
SHA512 7420d546444941298d4a743e7aaa3da1ee9cbf9ff99d362177ea2350d7f4f6ed5a5ef17b450930460cc1480c65db8c9c5f3e18010a60229fe22530a0c7d2d6e2
SSDEEP 49152:V1hpsNoJpF1A6UU44CwH7R4xwDmg27RnWGj:VmifPbRJD527BWG
TLSH
T109B5BE13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 4f41758e3e7674d4d0ad636aaf7fca10f872769b492ff035ff564cc262e41ac6
MD5 d5dd0d5e0f993700ce19da331c24b449
SHA1 ba5fd9607b67a7463fe8cd97a5506b83f7707e7c
SHA512 a0cfb5e54c8fb491bf5ca22e723914f054cab91d820c74765cc35b0e18b445b101f9abc4ebed94e669516f3a5e4b6b99b3477dffcf310c724d308db3f09bfdaa
SSDEEP 49152:ISuZQIY0Be2KRRVtOnks6NMHqzDmg27RnWGj:S5dKTi61zD527BWG
TLSH
T115C5BE03F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 3ebb23e799f730e29b775b2d596ce2d3aa50bd7f8638c28d39c8f012f23c1246
MD5 1b8d4e5b2a43cdf7781720ac176820b2
SHA1 2e6e0d9af1b79961f635ed20ed25d97f5b29d9f8
SHA512 257e1d5a33d9f0216bac55f2592b3ff937b57c9d5016010603455a47150dad80a312f8d267895cdd97a71a1c6e5ce14fd2af2545258790c25d31e8e06547caed
SSDEEP 49152:ThtSn8EApI0figngiDn0AP5wMDmg27RnWGj:SX2iyphND527BWG
TLSH
T1A995BE13F2D900E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 51245b62e70df7d43867d0615c071ba7b2cf683315e4ef3e6cc73f0b80d5e800
MD5 a293bc49f9a49f799e655ab1c40c3ea8
SHA1 4397958af4a2b93f91846fd2132e637a053e4a85
SHA512 cd3cbb9dfa2abad9d9f0c4fedad941b2a89ecfdb3aa5d045084ba85c0f2e59b7fa111ac1ef6910b42debed944c6eac72ea289d1687f934ee27721052ae7a503b
SSDEEP 12288:MrXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:MrsqjnhMgeiCl7G0nehbGZpbD
TLSH
T17D4523BF965C41CBE52648B5C3E5F10DAC073E5BE92004937A577CB9FBB24584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 429d619340753d1fa78f273f53d2a8f461f7b01af0dedcb43051ad4472400606
MD5 21ff1ca2a33723a35a7cde3c7d0ab5e8
SHA1 3853950ae705eaeb7ee7018d9f94cc0905b4adb3
SHA512 7ce2c190e72d8ec7587b4a0084abefca5b7618862a6296da7f37d50ee0927e673489cdbff57c2f706960dfdf39f65e720a23d40587e1c7986785852c5d3b0c40
SSDEEP 12288:oCXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:oCsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1EF4523BF965C41CBE52648B5C3E5F14DAC073E5BE92004837A9B7CBAFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 e63f210a26935f73a2a0fa1bfe9757cd41a407648f8e5adf2a5ee73a03c22894
MD5 5276c434d60414281b47e75298dfb1f1
SHA1 7e14c3345af3a4f91af0c1c4dd4442700c9ecd69
SHA512 217abc64375b14594599e981c1ac175863f3b9ec552ca780f607d07c35f1f9027fcc633aa8ea931c62a0bbd8d8d6c941135bb5caccf5da30679d20d7e139f425
SSDEEP 12288:xcXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:xcsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1254523BE965C41CBE52648B5C3E5F14DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 491f6ab0fc11f439ea13c7d7459ce9b066a556fc60fe5c5ae255dd8bed15648e
MD5 e227681b8dfcbae4eccc44be800e4b9b
SHA1 391c62861d6917380a17ca48b47645c79c00a9e3
SHA512 8484045e8607ac02b3241379551ab17fc1337da35a968690e3260f795121eeb35781a7af2325a5a1c1eee3e32c90278950dbd011544e835d51c330d9a1312736
SSDEEP 12288:zVVXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:3sqjnhMgeiCl7G0nehbGZpbD
TLSH
T17E45236B675C00C6D83285B4C2F5E11DE8237D96EB3005DB6B532CBD5FB16944F38A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 c15cf9c3428eda76e54971168c250f14020dbde031e2dfc34a7956468e8e1b08
MD5 ab6f7cc0330a9100c6aa207106441426
SHA1 99dec27207eaf3836a637569cf126a777511d53c
SHA512 5f4c926ef1650b742497435523ce6cfcf8ea207bd3c411f74243d9a569d8212d86010ee5ec0ea48d34b90250371c4e71931b836e98e116f5b46ddd2f98e9c189
SSDEEP 12288:ltXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ltsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1034523BF965C41CAE52648B5C3E5F14DAC073E5BE92004837A9B7CB9FBB24584B38462
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 64e135c226322bb8980d5339343b72c714da81ea8df67f256327accd531fad5c
MD5 511d6e052c1cf9853b1a9915e560fa9f
SHA1 4e068f95bc5d4b3257eda6c9059cac228c33906a
SHA512 3728cf202f2e283834432475764f92eb4d031072949d02c39130ab4b08f6a247f2683088718dc00a6d6f280e966d6e1bb7ca7cce118f35a20d31439c806990b2
SSDEEP 12288:xeXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:xesqjnhMgeiCl7G0nehbGZpbD
TLSH
T17C4523BE965C41CBE52648B5C3E5F14DAC073E5BE92004837A9B7CBAFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 14ece3cccbff28611d664d63c435cac1c0969cd9f546156830c414f651acdc8c
MD5 c83626da69f9a7df2ea693e69b50e5d7
SHA1 eca41ec703cba213e3b69d0a92d0c8c40e581eb6
SHA512 36fd111bed3239dcf3d6a2632853cee04477aa794705d043f45eb7d0eacefe7bd895df4fe24f851d9e6c16569867d2b7197fb4589acd71e7a02f3fb7056a1a2b
SSDEEP 12288:EaXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:EasqjnhMgeiCl7G0nehbGZpbD
TLSH
T1424523BF965C41CAE62644B5C3E5F11DAC073E5BE92004837A5BBCBAF7B14684B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 e579577be4d5ff704b60c7729a5c1f147f6611f514ceb3ee1dba86a983a81698
MD5 ba2b67e359516e628f82e0b3eed9e247
SHA1 b487aa5a26515f44d68deae2ee516fb99ee6f5d8
SHA512 18db27a0560961399d72ece40bb99ef60a67ac625bca9e25161512ab20316cacd9488332962ee151c44636c9bc4e82c894fa2297c3e6d7cefa2a4f653bfa907c
SSDEEP 24576:gZMSzFVSOisqjnhMgeiCl7G0nehbGZpbD:gZMSzfiDmg27RnWGj
TLSH
T1A86501A9B35018F8EC63813EC965D90AD5B27C5A0B70C61F13A5366B5F733A00D3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 f1404b65cecd386dc2aa80a967e4718498973bafee6b110a27d1a49216123294
MD5 63998491f2b6b94151d98ba0ab6addd2
SHA1 b9b70eb2d84b9b1745188502bf074bcc62973f65
SHA512 9ec5c12e0f1bc2b3566ebd589b30841e547b7d5046de6eadc959b14302662cd743b7957df56087768c77fa1e78f0bcf4eb84e829ab90d4b0e0beb5cc1b415830
SSDEEP 12288:d/Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:d/sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1704523BF965C51CAE52608B5C3E5F14DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 1d323e93c888ff8795608030c97d14fa22b24c2c303b1d6116e20580898335aa
MD5 0a0e8a17c85e58a4e51f6f3460fcc9a9
SHA1 fec6d2a1a7fa7bdd75960d779d33aeb73a255185
SHA512 04420f468c91bc04ce96923451c45ae51647cc7398f0a151cdc22a1921eba0746da12ab7141b87d3ac592f2732bc1ee5bffea421cd0316f55661d1e09deef9a4
SSDEEP 12288:vzXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:vzsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1784523BFA65C41CAE62644B5C3E5F14DAC073E5BE92004837A5B7CBAFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 a5b2341ad19fcd8d6fd0f1f0c0224dea3e100d0f073aa637b28ba98f5988d6be
MD5 9ad76019412987ba9d71499f36e5a278
SHA1 ac426d1a1f0b0184745675740be4058d998fa934
SHA512 9a4d550971d03ffe07fc3bde85048c33b8ff3b2e9ce425b17adeb455664b053c9632514f30cde596ad8054bbcc22ff15b8ec14317eab9a92d8fd31feaf51305f
SSDEEP 12288:3yPz5L8GXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:6zyGsqjnhMgeiCl7G0nehbGZpbD
TLSH
T13455125B73A530F9D1378138C5A29A06F7327C3647204A9F17A516BA6F736908E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 7fb463315ce35ead4c523d00887cc2e4f0414184870b0faca1b0b7319f4a0145
MD5 af03aa87a79b596aebf4dcf8dad175ea
SHA1 ff3ff4e3df254b6702dfd34cebe08f36f4fc2230
SHA512 eec60ae4ab7270d8e5a0214ddf123801021f1e3f66af3f3d853a0a2cb5219326e6714b01b9dd0571a57b07b22ab5bd8eab672d225a39bc81978952be2db693d8
SSDEEP 12288:b/Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:b/sqjnhMgeiCl7G0nehbGZpbD
TLSH
T15A4523BF965C51CAE52608B5C3E5F14DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 764a30c1f1cf42ebd4ed1563838eaa9f13b9b271f789d6f2a70af37777872eba
MD5 87c4c0871e03ec8de414d3d9d6e38436
SHA1 4b6459f59518655e44960b8baf5c58c038693e3c
SHA512 4a60d925f52082905771af0b4ca1bf6c113d2561c214594889ab4b226af95fb6c30ba9ec9bb1f2f59b1b292281faea3ca9488a19e69fdf77bf8638572a3dd94a
SSDEEP 12288:V/Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:V/sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E74523BF965C41CAE52608B5C3E5F14DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 9606514aa1ce36fc6c905d1f8db110a2cd45e1624591f3037d2132185fe04e20
MD5 7df5849ccf87edfd4010f45300f01b31
SHA1 8e0dc61525871a56a3b2f9f054618eba5093876d
SHA512 d17eb1ee4c3e70cf7f88403d413e9eecb5aeaf838431f3af8c2691119e97ac27c181e8e3c90683d44bd164faada63fcba0b2bc46e0366e92d77458a6f1c9dd80
SSDEEP 24576:tcP4mcvIjkGOxhKP2l71nNKbrh/8KBXsqjnhMgeiCl7G0nehbGZpbD:SP4m4IpOO67W8KFDmg27RnWGj
TLSH
T1A065BE2DABDC0096D0BB917886658A49FAB1742A1F3286CB1160933D7F77EE44F35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 450e3c8adde9967e64c993ff2d3fac81d26ea069a7e51bd80ecd00483fa60b08
MD5 a7e1fd13db0adbf0f4553d7d32b2fc47
SHA1 2951c57536d821c70543a821b47aa3b8edf5a5e2
SHA512 4f5a3c6db6c0793b48cfc68da91157c21be2a3b90ed0568d8a20bbbddb74c07e7be9bf992414de14b91c1d554260648f3308213034f57ef9adede97eb76bca93
SSDEEP 12288:QNsfPXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:xPsqjnhMgeiCl7G0nehbGZpbD
TLSH
T12A55015AD29802D8C06E6179C3969605F7333C2697E093CB67D1F87E1F766908EF9A03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a86cf6a99b11239b.bin

Path C:\Users\Admin\AppData\Roaming\a86cf6a99b11239b.bin
Size 12KB
SHA256 ee1db61bd92ba8708e8b8985b4ec2da91a5d9acd303a687a109d4b3d55283416
MD5 a618cd37f0fa0e2d6f2553702861effd
SHA1 9a6c47074bfdb38e38ec72e8d30d9f7822f9ee1f
SHA512 d60167dae332587c3ac48f8c5c83cbdc1dca9d42b5c9313d2e1249dd1fcd1f3aa9ee5d5a8c44fca32225a569ec932f1fb53637bb21e5bba8635fa9666f155598
SSDEEP 384:lhoWvxS/XFKtL2SNvWYLj7JI4PBbYEXRn0GM7GzF:lhVS/XFKtLv1I4PtYg87GzF
TLSH
T18542C0C1A717EB825809D6717501F24D7E7C5C76C2C1DF2F2AE39B5899C6C89480E493
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 71fc6f35ca3fa8257a19e791787f0179589b599347fb36916dd7d2369bce71d9
MD5 a1c9a3e9aeab94c19310c35be8689ce7
SHA1 c01f3244a03bdb6b17eb912aaebbcb44b49195e4
SHA512 1e61c39703884611ec3190329a397fa6cae20a39570aeea751d403f3041100891c911527ea6894c4d875fed267555fc4bae9f49169a379f08ce06b1ea9bc6d84
SSDEEP 12288:JvXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:JvsqjnhMgeiCl7G0nehbGZpbD
TLSH
T12745237FD35C518BE57659B082E9E12D781B3E669E200483BA473CFDB6B08948F38527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 1bd91caa6f968d0f69cdc5cd3572d322c56317bb44f27bf8c3365659c94fda69
MD5 ec81cbfa2fe9780c30e0b93286f58ea5
SHA1 c03394df9b91affc52802b3067c4230d858b5e30
SHA512 02976f9e5ec68c81652d468e99f2d8c91769fad2200594fc2b4006378c4aab8879bfe88ed6d0473a92c4648c614811a91a0fb6470808c8dac568b6f2bac47140
SSDEEP 49152:xa0h2GEkuAe73q3pp46zwwQRDmg27RnWGj:xa0hNYG4JwCD527BWG
TLSH
T1D085AF1E67EC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37DE84E3DB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 34567c89d600aca7164573306b6494ff00ef33e787c46eb2effc18bcc6c6f1ab
MD5 7e70823e91988f57f92b9c81422281b0
SHA1 efd68d063a6cfe9eae124897fcdddb52a27e3f22
SHA512 f1b79787d63ff1cc8a6c6c7e9fb4da07150c9e53ea9ede8d693a563062fe4225f5c7913f3332cd0896ca07cd2942eec276bdc6ae8d4bc134cfdf04bc91880ea3
SSDEEP 12288:thbHjfXSXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:thbHjPSsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1DD55127E12AC20C9E572A1BD8296D10AD632BC26172053EF27D281BE5F37DE44D39F52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 0c52fc632c26fbec67b6ded73d811677b6449503e7962a33b120b49d2d01ddbf
MD5 bb5f2610c0daf959ea27acb961803130
SHA1 28e8caad27303007b5d730536137f2574c053fe5
SHA512 2e2a9decc7d46f4809ed1fe8dea47cc0b9f05752a4d1e882936d84e985002b11909d7f8bbfa28d4fbd0bb543878809bd3d9353d78acb4af84e0687cff4ddc7d8
SSDEEP 24576:83YgnJcRTk4yti+R5dBR/KsqjnhMgeiCl7G0nehbGZpbD:8IgnaTk46pBR/eDmg27RnWGj
TLSH
T11645BF2EF2B910B9D8A6D136450147B5FB71782D1F209ACB0170C538AF1AEE85F39F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 a4a60fdcff173f9c6dc2d75110b010c813e7f2c15a6b283b3c11c19478102d60
MD5 a3bd58465b0256a0491d1c7d5373dbcb
SHA1 3246346405b1d45bc5f4812a797adeab68dd1994
SHA512 8ed6705c82491ada416323b3d3ea5d9ad2637067506a53f9b495527875504f37d3f1ed59a4c139c817809275d4305c3412deb4a2d444d687c7b1deff76f84d1c
SSDEEP 12288:ajXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ajsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A44523BE921C51CAD53649F5C2E6E11DA8073E56AB2004D379A77CBDF7B18E84B38413
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.5MB
SHA256 1f9c20332b02dd09ee86375a2037d7d361aa8e6dda381bf12b887bafc9b732de
MD5 59cccb1ac02630cbb4d508930517b522
SHA1 1ebcd862f43ca590ebacc1fc0b41527874055026
SHA512 a8b73ce705b13e7b54a3b47b0e05f9b12a3004d00ebc65252a641d7ea858c814513373fc03118ce6d22a253a5c71f78645ca9653e39586ce18f9f4263ee71ae9
SSDEEP 12288:xOb9A4LWOsvAYFTQXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9L:mpL3UTQsqjnhMgeiCl7G0nehbGZpbD
TLSH
T142750159F79800F9E87B813CC5A2D616E672785D0720E7DF03A94AA91F637E04E3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 fe84fe6e9913e2b4d74c8bd9c73619324b1c3cf8ccbd2b6c49d2e564e303ffca
MD5 3c7f327a748e34b657529846eca64026
SHA1 c61a15a82eeaf25fe42ad4b7bcfb3b298328b93f
SHA512 b9944dc52befc79eb2f374eccb6b0f0988fff9b549c21cc002f64bb5a94777074419c6ce5a766cb147f226cf9247fa3e6d40b549c9e9ad7efbe28eabd73a77ec
SSDEEP 12288:epFtpOUXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:0OUsqjnhMgeiCl7G0nehbGZpbD
TLSH
T14A55022E33EC10E9E536A17C8692D20DD6327C66172117DF06D184BE5FA3EF84D39A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 f716b89f3e431827b2f97e80c01de00470be3b7f90d8bc8319324d973e2604c8
MD5 8256e7e779996a17ecae1c7ba976a214
SHA1 ec856fdacd280c30a9b6e75401568ae7a6c1ba43
SHA512 837fc4a787227505a4492f4a40e84199336a1c51191ff1dfd6e34254b105495c78168e32e7baf1f44fb4a8cd55b240743f3e1f530087ebfb776a80360f47bf46
SSDEEP 24576:K7NM9YqZqmWMUkPjZM48Mv6bEhs/sqjnhMgeiCl7G0nehbGZpbD:K7cBWMpPjN8DbEh2Dmg27RnWGj
TLSH
T127659E2E6BAC81D5D577D13DC9E28206F6B2B4611B318ACB1162833E7F37AE44E35721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 729c9bffbfdc8f8fe4e6474cd8c33f2ec5f2b9407b04c72cca40c637f213d55b
MD5 9f767201b0ca7b6761a8717f93d432da
SHA1 8a939518eae71304731c3f5bd0d2730657c06e9b
SHA512 dcac249e94aecc696fad277bd20a9e68b445fdd8cd0d37c1deef228558d225c3c89b2c1f859e176c2c988c084e8739a9f0debc8f3baf18963fcda4fdadacab85
SSDEEP 24576:TW6BApg2YuyuNDYTabvcdvNYf8km1ZsqjnhMgeiCl7G0nehbGZpbD:TF2YuHNETovAvNYf8kmDDmg27RnWGj
TLSH
T1F4857E6A27ED80A4E0BBD27D85B6D246F9B2B8511B3055CF0255862E1F33AF44D3DB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 0784294e2e50db6e70c2f9394435b836deaf1609caef60503f206e025e13a752
MD5 9071b692e2e16b330df8533d5534e5ff
SHA1 0b106a118b57be43816edab67ba9b33b138d67d6
SHA512 1a2e3a970d5a3dbb0176e8b9a86a25f19fe07ecef4a65fad7adaaf2e051d56d824f1b22164b272b9ab13c8a51f839027efa64fe731a2a07f3e3b065c5b6ec82f
SSDEEP 24576:+AFs06+Omlf3NXEbTo4sqjnhMgeiCl7G0nehbGZpbD:3Fs060lVXuxDmg27RnWGj
TLSH
T1D865BF3F62AC00D5D07ED17D8A97C91AF6B1746307255ACB0260867E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 cb22bf5e29ca3be4abc05f1a0067c346cc1c600092a7e7ab9b35c4abd171ac1d
MD5 cb93e4f75bc971574d4f4c3292c62b97
SHA1 06210874db05a66ca6aca8e7e3c24392a9e2954e
SHA512 18d53ea5a2790279360a893602b60b9a9ca6309777c4689e281f09f9fb518a7543f80e9f13568a9d17c64a18b2c5c341dabd5604b12dd104d5dcbba409720af3
SSDEEP 24576:KJnJ5D3WXNsqjnhMgeiCl7G0nehbGZpbD:KJnJ5DGXxDmg27RnWGj
TLSH
T16A75E13DD2A810E8D4B7C2B4829A5756FE72383D2F2169C728B4D4357F12EE09A79F14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 04866172b50b63a7cb75490778772199383cbfef79b6b582bae925d07adf12b3
MD5 cfbe776d5cb0522d4e66beb44f765756
SHA1 6680b73ef1879f8601c1ad2e353b48c2f76843c7
SHA512 dae0081994c93999267a6b084f2e76acc66d5b36ce7043a959e3230378237f947c76ba5e89427db0dacd28828e3e5a99f766b00db6d992cd17e04cfc934664f4
SSDEEP 24576:gEPghm6/7IIXdwcXrif7qQncjlP65i3VuKsqjnhMgeiCl7G0nehbGZpbD:fg06DIKdwc+eQnSt65aVfDmg27RnWGj
TLSH
T1AD955C16B7EA5294E8B3CAB1C962A1169B327C509B34F7DF0AC0C92E1D33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 f470ae069819523727bee4d05a455e8ca516beb83d6745181f1addbe938c9a84
MD5 aa6cdce5b33c0fed1dde4fe24a73de9d
SHA1 f89df920cc2a16730880609c3d1b7979fa94b632
SHA512 6ee642c67f0e4424444067d5a050f3bda5f8ac15cb540962f1076c78f55f5ac51854e966c70fd9db31d0b52dd1aeb687ffc6df9a18ec9078253302d82b473953
SSDEEP 12288:6EP3RndXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ZndsqjnhMgeiCl7G0nehbGZpbD
TLSH
T18555126E679C60DAD136907D8291C209D733F4756B2127EF26A2C57E8F739E80E3CA11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.3MB
SHA256 90c8ebebae868e05306b51f37c7875094f9baa52ff70a3dbb0c37d6e5a6f76f3
MD5 27e843b5619d84d8311ee828f6ab0b05
SHA1 95b3e2f16370279a4199c76377bc29e9059bc0f3
SHA512 9300d569ff5e303128dbfe4afaf3209666dc81fcbc7fe8e673276321b7fcbcd9de3b12ce1e3b0805196b3f4f42a024af224728ece4800195e7d93652e41b02bb
SSDEEP 12288:jjkyCXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:jIyCsqjnhMgeiCl7G0nehbGZpbD
TLSH
T199551219639C60C9E6760578C6B3D1589C36BC319F2042DF6591FA3EAF72BD48E34B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 461ab4c27f0cc858fe1bba2a22c150a68beae312929f42834227ad095dab4d16
MD5 79d264b2f8935cbc19a4a1e26d28d28f
SHA1 90cf2ca7b92fa62ca07c8fa42dde5a0ab690f787
SHA512 11f541327c3bb98418a4e1fb531e87f9443a7e7e7bc8ecf4a31d94cf86b596fec0c24ae14cea1a37561c869be02092024ed7f93d40d54ea3f059f9769eb56bcd
SSDEEP 12288:syEXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ZEsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1EC45237E525C60CAE93245B8C3A5E11DA8133D766B2014E739E7FCBDEBB24D44B39812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 22a688cefcb9bd56bd6b1d4235e4e366c4b782520bfc0861a1760a02a02c99d5
MD5 46f778abd7370a5b1e6de0555429c754
SHA1 7827eee64a926e8d97ca1e0f820d9426bb7b547d
SHA512 81e3e2eb59a5c08b243436e0ae3576ac2628b158e17099b8cd603349d29110966531706242fcc46e1f3e42d2bb8654a9b9273aa6a31147dab6059dcfb6d21d8a
SSDEEP 24576:nQ9MxZKdcz9dw3nsqjnhMgeiCl7G0nehbGZpbD:nVKZ7Dmg27RnWGj
TLSH
T126558C2DABE9058AE177D27595A250C3A633B4311B31D6CF2448D03D4D7BEE8AE78F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 390bb21f69a876947fab17f20b4588d8fa5e4e829cf2ad9ffae6e02e9b2e3ea8
MD5 ccb380e4b0dddb2ca1932a68ef5b5875
SHA1 8680e1f1695710f858051cf5e2a18b28fe955ab3
SHA512 d9a9b142c7f14495ed5f9f63b244f91d77cca33e0e55e017444683297d0d334055e073406ce5f74e2b8cdec928376380ecaa791f8c7b2460be272fb6dbe5db7b
SSDEEP 12288:5yoKo2JRple9pWXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:5yocDApWsqjnhMgeiCl7G0nehbGZpbD
TLSH
T15965E01FB76D40E2E176813C8985C249E673B4315B2257CB6692C73D8F639E8BD38B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 02007b2d9bd75a15d7364f68ed6e4563ddd50dcf41ab4c8ec3bd3f21a4331914
MD5 f05f8ade428e34881d6e1313e9992e49
SHA1 d33faad108ed6a6e957d39143434d248c914af92
SHA512 f0a03f3b00ef24c7e711de03d4b0f8956bf7ec6896ea2c59f8caa0cd86700d9554de349900de5880884899dec69568ef885480f9fe37fa67a28ede826c98ff1e
SSDEEP 49152:cWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKaDmg27RnWGj:W0zuNIMD527BWG
TLSH
T14CA57B3DA2BC00A9D8AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 8416903b3f124f255301706e653f2e2e8d10f8dc2890266ce19e98fac907a7df
MD5 df4b22facb556cee7b7674d9a0ef99cd
SHA1 b7983a4aa213c49c64fc0b82636b86f6be100163
SHA512 0d6e99e7ea63d46f10e4d8a0f329abead29f862c568bf5cd7a87469d9b05a712a5adeada79444b02da89d4a250ba53b335773e87e48efad30bb50b941f0a9b67
SSDEEP 24576:v1QT7EcpfxR+N5AWAz3ooiYtjMqbhsqjnhMgeiCl7G0nehbGZpbD:STDxR+N5YzTfjMQDmg27RnWGj
TLSH
T14855B02EA7F815E9D17E85798B23C506FA727821033193CB42A0C17E1F6B9D85E7AF11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.5MB
SHA256 48b2f8b7d4ea2d538a8023a32be6135f89caf77206cd638f8197992fc8150837
MD5 0f31fb629f63e882308f559f6fd3f847
SHA1 ef266b9d254524bfed90116449a3e795315bdb4c
SHA512 603f216ddf554dcbd6fa7ac178119a40bae22baf0ba84dbc5cd1e3cd663bcc92d4a6f21b7317733e4e5a7b630ac7a15333bac90ed40b119352b9093b0df751e6
SSDEEP 24576:QTMdOz0FFS+imSLVsqjnhMgeiCl7G0nehbGZpbD:Y0K+imSLJDmg27RnWGj
TLSH
T12F75E17EA36D14E5E47BC17CC653D90AE9733862032166DB0690C0B97FA7EE46A3DB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.2MB
SHA256 4c007b6998c9b54b728bcbca088eccd84b2320651de49b3b227ca455e6828e02
MD5 1d4522c32d7afcd19e225a6a4f8d5e28
SHA1 41af3f565c5f681ea8ce659c6e2224dc0cb4e8a5
SHA512 c056ee53d86300c13fcf2ed0c57b65f47a8e42403ec1637a1c022d8cfdaf4246aa89bbade27ca4bc9d6a3f208d5d27af15f3da4d8a453fa7842b04a7c818bdb1
SSDEEP 12288:q4KQXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbEf:QQsqjnhMgeiCl7G0nehbGZpbDl
TLSH
T1F155126E63EC30D9E4729574C2B6D1099432BC36272015FF39D2D9BE9F729D48A38B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/536-281-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/832-63-0x0000000000D90000-0x0000000000DF0000-memory.dmp

Download

memory/832-73-0x0000000000D90000-0x0000000000DF0000-memory.dmp

Download

memory/832-69-0x0000000000D90000-0x0000000000DF0000-memory.dmp

Download

memory/832-75-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/1128-313-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/1804-283-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/1804-80-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/1804-86-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/1884-315-0x0000000140000000-0x0000000140205000-memory.dmp

Download

memory/1884-480-0x0000000140000000-0x0000000140205000-memory.dmp

Download

memory/2124-305-0x0000000140000000-0x0000000140221000-memory.dmp

Download

memory/2148-317-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/2480-478-0x0000000140000000-0x000000014069D000-memory.dmp

Download

memory/2480-19-0x0000000140000000-0x000000014069D000-memory.dmp

Download

memory/2480-10-0x0000000001FD0000-0x0000000002030000-memory.dmp

Download

memory/2480-16-0x0000000001FD0000-0x0000000002030000-memory.dmp

Download

memory/2516-279-0x0000000140000000-0x00000001401E8000-memory.dmp

Download

memory/2516-29-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2516-35-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2676-295-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/2676-119-0x0000000000590000-0x00000000005F0000-memory.dmp

Download

memory/2676-125-0x0000000000590000-0x00000000005F0000-memory.dmp

Download

memory/3120-280-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3120-48-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3120-42-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3304-306-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/3392-365-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3392-291-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3396-366-0x0000023E806B0000-0x0000023E806C0000-memory.dmp

Download

memory/3396-369-0x0000023E806B0000-0x0000023E806C0000-memory.dmp

Download

memory/3396-376-0x0000023E806B0000-0x0000023E806C0000-memory.dmp

Download

memory/3396-374-0x0000023E806B0000-0x0000023E806C0000-memory.dmp

Download

memory/3396-373-0x0000023E806B0000-0x0000023E806C0000-memory.dmp

Download

memory/3396-401-0x0000023E806B0000-0x0000023E806C0000-memory.dmp

Download

memory/3396-400-0x0000023E806B0000-0x0000023E806C0000-memory.dmp

Download

memory/3396-399-0x0000023E806B0000-0x0000023E806C0000-memory.dmp

Download

memory/3396-398-0x0000023E806B0000-0x0000023E806C0000-memory.dmp

Download

memory/3396-397-0x0000023E806B0000-0x0000023E806C0000-memory.dmp

Download

memory/3396-396-0x0000023E806B0000-0x0000023E806C0000-memory.dmp

Download

memory/3396-395-0x0000023E806B0000-0x0000023E806C0000-memory.dmp

Download

memory/3396-394-0x0000023E806B0000-0x0000023E806C0000-memory.dmp

Download

memory/3396-393-0x0000023E806B0000-0x0000023E806C0000-memory.dmp

Download

memory/3396-392-0x0000023E806B0000-0x0000023E806C0000-memory.dmp

Download

memory/3396-391-0x0000023E806B0000-0x0000023E806C0000-memory.dmp

Download

memory/3396-390-0x0000023E806B0000-0x0000023E806C0000-memory.dmp

Download

memory/3396-389-0x0000023E806B0000-0x0000023E806C0000-memory.dmp

Download

memory/3396-388-0x0000023E806B0000-0x0000023E806C0000-memory.dmp

Download

memory/3396-387-0x0000023E806B0000-0x0000023E806C0000-memory.dmp

Download

memory/3396-386-0x0000023E806B0000-0x0000023E806C0000-memory.dmp

Download

memory/3396-385-0x0000023E806B0000-0x0000023E806C0000-memory.dmp

Download

memory/3396-384-0x0000023E806B0000-0x0000023E806C0000-memory.dmp

Download

memory/3396-383-0x0000023E806B0000-0x0000023E806C0000-memory.dmp

Download

memory/3396-382-0x0000023E806B0000-0x0000023E806C0000-memory.dmp

Download

memory/3396-380-0x0000023E806B0000-0x0000023E806C0000-memory.dmp

Download

memory/3396-367-0x0000023E806B0000-0x0000023E806C0000-memory.dmp

Download

memory/3396-368-0x0000023E806B0000-0x0000023E806C0000-memory.dmp

Download

memory/3396-381-0x0000023E806B0000-0x0000023E806C0000-memory.dmp

Download

memory/3396-378-0x0000023E806B0000-0x0000023E806C0000-memory.dmp

Download

memory/3396-379-0x0000023E806B0000-0x0000023E806C0000-memory.dmp

Download

memory/3396-375-0x0000023E806B0000-0x0000023E806C0000-memory.dmp

Download

memory/3396-372-0x0000023E806B0000-0x0000023E806C0000-memory.dmp

Download

memory/3396-377-0x0000023E806B0000-0x0000023E806C0000-memory.dmp

Download

memory/3396-371-0x0000023E806B0000-0x0000023E806C0000-memory.dmp

Download

memory/3396-370-0x0000023E806B0000-0x0000023E806C0000-memory.dmp

Download

memory/3472-285-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/3472-103-0x00000000008F0000-0x0000000000957000-memory.dmp

Download

memory/3472-108-0x00000000008F0000-0x0000000000957000-memory.dmp

Download

memory/3492-130-0x0000000000920000-0x0000000000980000-memory.dmp

Download

memory/3492-300-0x0000000140000000-0x0000000140241000-memory.dmp

Download

memory/3492-136-0x0000000000920000-0x0000000000980000-memory.dmp

Download

memory/3708-50-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/3708-479-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/3928-22-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/3928-144-0x0000000140000000-0x000000014069D000-memory.dmp

Download

memory/3928-9-0x0000000140000000-0x000000014069D000-memory.dmp

Download

memory/3928-6-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/3928-0-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/3948-282-0x0000000140000000-0x00000001401F8000-memory.dmp

Download

memory/4084-96-0x00000000004F0000-0x0000000000550000-memory.dmp

Download

memory/4084-284-0x0000000140000000-0x00000001401EA000-memory.dmp

Download

memory/4084-90-0x00000000004F0000-0x0000000000550000-memory.dmp

Download

memory/4276-195-0x0000000009E60000-0x0000000009E68000-memory.dmp

Download

memory/4276-161-0x0000000001770000-0x0000000001780000-memory.dmp

Download

memory/4276-316-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4276-177-0x0000000001A20000-0x0000000001A30000-memory.dmp

Download

memory/4276-481-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4276-363-0x000000000BA40000-0x000000000BA48000-memory.dmp

Download

memory/4416-59-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4416-53-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4416-359-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4496-143-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4988-290-0x0000000140000000-0x00000001401D4000-memory.dmp

Download

memory/5020-292-0x0000000140000000-0x00000001401D5000-memory.dmp

Download