8f8d1bcaa8fbf65148900da63e9150d3a87d8b48bc8dcec760f12d28656fefc6

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
15/10/2026, 15:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8f8d1bcaa8fbf65148900da63e9150d3a87d8b48bc8dcec760f12d28656fefc6.exe
Size 6.6MB
Sample261015-stlrjag16w
SHA256 8f8d1bcaa8fbf65148900da63e9150d3a87d8b48bc8dcec760f12d28656fefc6
MD5 37880b89601913005ee7716a5f38d85c
SHA1 03dd2c1561055e072c53dfa448de8ed59e9e9095
SHA512 3de4ca69ef9d81fc8d88447579b1327a6710dab85fe4bf36848a2d802cffd92959b9956b2ed025d95a202ed33ed2fe027a8cb2f5669839d2928b632f5c7885de
SSDEEP 196608:01J1aqNY52B3EjP6Li9WQVjYr7GBIvyXX:0/k+22B3EjP6LGWQVjeG
TLSH
T15466C053B311207CC84B6872643D6F7B8C291D63972286DF89E83CA25B749C26A3D75F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery ransomware spyware stealer upx

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
2352	alg.exe
2120	DiagnosticsHub.StandardCollector.Service.exe
3756	fxssvc.exe
3712	elevation_service.exe
4520	elevation_service.exe
3480	maintenanceservice.exe
1532	msdtc.exe
3344	OSE.EXE
988	PerceptionSimulationService.exe
4484	perfhost.exe
3000	locator.exe
992	SensorDataService.exe
1780	snmptrap.exe
4576	spectrum.exe
5048	ssh-agent.exe
1636	TieringEngineService.exe
3440	AgentService.exe
2452	vds.exe
5084	vssvc.exe
3080	wbengine.exe
3224	WmiApSrv.exe
2112	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 43 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	8f8d1bcaa8fbf65148900da63e9150d3a87d8b48bc8dcec760f12d28656fefc6.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	8f8d1bcaa8fbf65148900da63e9150d3a87d8b48bc8dcec760f12d28656fefc6.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	8f8d1bcaa8fbf65148900da63e9150d3a87d8b48bc8dcec760f12d28656fefc6.exe
File opened for modification	C:\Windows\system32\wbengine.exe	8f8d1bcaa8fbf65148900da63e9150d3a87d8b48bc8dcec760f12d28656fefc6.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	8f8d1bcaa8fbf65148900da63e9150d3a87d8b48bc8dcec760f12d28656fefc6.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	8f8d1bcaa8fbf65148900da63e9150d3a87d8b48bc8dcec760f12d28656fefc6.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	8f8d1bcaa8fbf65148900da63e9150d3a87d8b48bc8dcec760f12d28656fefc6.exe
File opened for modification	C:\Windows\System32\alg.exe	8f8d1bcaa8fbf65148900da63e9150d3a87d8b48bc8dcec760f12d28656fefc6.exe
File opened for modification	C:\Windows\System32\msdtc.exe	8f8d1bcaa8fbf65148900da63e9150d3a87d8b48bc8dcec760f12d28656fefc6.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	8f8d1bcaa8fbf65148900da63e9150d3a87d8b48bc8dcec760f12d28656fefc6.exe
File opened for modification	C:\Windows\system32\AgentService.exe	8f8d1bcaa8fbf65148900da63e9150d3a87d8b48bc8dcec760f12d28656fefc6.exe
File opened for modification	C:\Windows\system32\vssvc.exe	8f8d1bcaa8fbf65148900da63e9150d3a87d8b48bc8dcec760f12d28656fefc6.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	8f8d1bcaa8fbf65148900da63e9150d3a87d8b48bc8dcec760f12d28656fefc6.exe
File opened for modification	C:\Windows\system32\dllhost.exe	8f8d1bcaa8fbf65148900da63e9150d3a87d8b48bc8dcec760f12d28656fefc6.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	8f8d1bcaa8fbf65148900da63e9150d3a87d8b48bc8dcec760f12d28656fefc6.exe
File opened for modification	C:\Windows\System32\vds.exe	8f8d1bcaa8fbf65148900da63e9150d3a87d8b48bc8dcec760f12d28656fefc6.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\ed06f87a26b1277.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	8f8d1bcaa8fbf65148900da63e9150d3a87d8b48bc8dcec760f12d28656fefc6.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	8f8d1bcaa8fbf65148900da63e9150d3a87d8b48bc8dcec760f12d28656fefc6.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	8f8d1bcaa8fbf65148900da63e9150d3a87d8b48bc8dcec760f12d28656fefc6.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	8f8d1bcaa8fbf65148900da63e9150d3a87d8b48bc8dcec760f12d28656fefc6.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	8f8d1bcaa8fbf65148900da63e9150d3a87d8b48bc8dcec760f12d28656fefc6.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	8f8d1bcaa8fbf65148900da63e9150d3a87d8b48bc8dcec760f12d28656fefc6.exe
File opened for modification	C:\Windows\system32\locator.exe	8f8d1bcaa8fbf65148900da63e9150d3a87d8b48bc8dcec760f12d28656fefc6.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	8f8d1bcaa8fbf65148900da63e9150d3a87d8b48bc8dcec760f12d28656fefc6.exe
File opened for modification	C:\Windows\system32\spectrum.exe	8f8d1bcaa8fbf65148900da63e9150d3a87d8b48bc8dcec760f12d28656fefc6.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	8f8d1bcaa8fbf65148900da63e9150d3a87d8b48bc8dcec760f12d28656fefc6.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	8f8d1bcaa8fbf65148900da63e9150d3a87d8b48bc8dcec760f12d28656fefc6.exe
File opened for modification	C:\Windows\system32\AgentService.exe	8f8d1bcaa8fbf65148900da63e9150d3a87d8b48bc8dcec760f12d28656fefc6.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0001000000017431-385.dat	upx
behavioral1/files/0x000100000001704d-384.dat	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	8f8d1bcaa8fbf65148900da63e9150d3a87d8b48bc8dcec760f12d28656fefc6.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	8f8d1bcaa8fbf65148900da63e9150d3a87d8b48bc8dcec760f12d28656fefc6.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	8f8d1bcaa8fbf65148900da63e9150d3a87d8b48bc8dcec760f12d28656fefc6.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	8f8d1bcaa8fbf65148900da63e9150d3a87d8b48bc8dcec760f12d28656fefc6.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	8f8d1bcaa8fbf65148900da63e9150d3a87d8b48bc8dcec760f12d28656fefc6.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	8f8d1bcaa8fbf65148900da63e9150d3a87d8b48bc8dcec760f12d28656fefc6.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	8f8d1bcaa8fbf65148900da63e9150d3a87d8b48bc8dcec760f12d28656fefc6.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	8f8d1bcaa8fbf65148900da63e9150d3a87d8b48bc8dcec760f12d28656fefc6.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	8f8d1bcaa8fbf65148900da63e9150d3a87d8b48bc8dcec760f12d28656fefc6.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	8f8d1bcaa8fbf65148900da63e9150d3a87d8b48bc8dcec760f12d28656fefc6.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	8f8d1bcaa8fbf65148900da63e9150d3a87d8b48bc8dcec760f12d28656fefc6.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	8f8d1bcaa8fbf65148900da63e9150d3a87d8b48bc8dcec760f12d28656fefc6.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	8f8d1bcaa8fbf65148900da63e9150d3a87d8b48bc8dcec760f12d28656fefc6.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	8f8d1bcaa8fbf65148900da63e9150d3a87d8b48bc8dcec760f12d28656fefc6.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	8f8d1bcaa8fbf65148900da63e9150d3a87d8b48bc8dcec760f12d28656fefc6.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	8f8d1bcaa8fbf65148900da63e9150d3a87d8b48bc8dcec760f12d28656fefc6.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	8f8d1bcaa8fbf65148900da63e9150d3a87d8b48bc8dcec760f12d28656fefc6.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	8f8d1bcaa8fbf65148900da63e9150d3a87d8b48bc8dcec760f12d28656fefc6.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	8f8d1bcaa8fbf65148900da63e9150d3a87d8b48bc8dcec760f12d28656fefc6.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	8f8d1bcaa8fbf65148900da63e9150d3a87d8b48bc8dcec760f12d28656fefc6.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	8f8d1bcaa8fbf65148900da63e9150d3a87d8b48bc8dcec760f12d28656fefc6.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	8f8d1bcaa8fbf65148900da63e9150d3a87d8b48bc8dcec760f12d28656fefc6.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	8f8d1bcaa8fbf65148900da63e9150d3a87d8b48bc8dcec760f12d28656fefc6.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	8f8d1bcaa8fbf65148900da63e9150d3a87d8b48bc8dcec760f12d28656fefc6.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	8f8d1bcaa8fbf65148900da63e9150d3a87d8b48bc8dcec760f12d28656fefc6.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	8f8d1bcaa8fbf65148900da63e9150d3a87d8b48bc8dcec760f12d28656fefc6.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	8f8d1bcaa8fbf65148900da63e9150d3a87d8b48bc8dcec760f12d28656fefc6.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	8f8d1bcaa8fbf65148900da63e9150d3a87d8b48bc8dcec760f12d28656fefc6.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	8f8d1bcaa8fbf65148900da63e9150d3a87d8b48bc8dcec760f12d28656fefc6.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	8f8d1bcaa8fbf65148900da63e9150d3a87d8b48bc8dcec760f12d28656fefc6.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	8f8d1bcaa8fbf65148900da63e9150d3a87d8b48bc8dcec760f12d28656fefc6.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	8f8d1bcaa8fbf65148900da63e9150d3a87d8b48bc8dcec760f12d28656fefc6.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	8f8d1bcaa8fbf65148900da63e9150d3a87d8b48bc8dcec760f12d28656fefc6.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	8f8d1bcaa8fbf65148900da63e9150d3a87d8b48bc8dcec760f12d28656fefc6.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	8f8d1bcaa8fbf65148900da63e9150d3a87d8b48bc8dcec760f12d28656fefc6.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe

Direct Volume Access: Opens a physical disk for reading 1 TTPs 1 IoCs

Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

defense_evasion

Direct Volume Access

T1006

description	ioc	Process
File opened (read-only)	\??\PhysicalDrive0	SearchIndexer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 10 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	8f8d1bcaa8fbf65148900da63e9150d3a87d8b48bc8dcec760f12d28656fefc6.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	8f8d1bcaa8fbf65148900da63e9150d3a87d8b48bc8dcec760f12d28656fefc6.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	8f8d1bcaa8fbf65148900da63e9150d3a87d8b48bc8dcec760f12d28656fefc6.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	DiagnosticsHub.StandardCollector.Service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	DiagnosticsHub.StandardCollector.Service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	8f8d1bcaa8fbf65148900da63e9150d3a87d8b48bc8dcec760f12d28656fefc6.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WmiApSrv.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8f8d1bcaa8fbf65148900da63e9150d3a87d8b48bc8dcec760f12d28656fefc6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8f8d1bcaa8fbf65148900da63e9150d3a87d8b48bc8dcec760f12d28656fefc6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	8f8d1bcaa8fbf65148900da63e9150d3a87d8b48bc8dcec760f12d28656fefc6.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	8f8d1bcaa8fbf65148900da63e9150d3a87d8b48bc8dcec760f12d28656fefc6.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000075c2257fb95cdd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007dd7387fb95cdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cb350e7cb95cdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002b68c37cb95cdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000689d597db95cdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009798107cb95cdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9933 = "MPEG-4 Audio"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9926 = "M3U file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9908 = "Wave Sound"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000113aa7bb95cdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000087cf687cb95cdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000001a2a27eb95cdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 49 IoCs

pid	Process
2120	DiagnosticsHub.StandardCollector.Service.exe
2120	DiagnosticsHub.StandardCollector.Service.exe
2120	DiagnosticsHub.StandardCollector.Service.exe
2120	DiagnosticsHub.StandardCollector.Service.exe
2120	DiagnosticsHub.StandardCollector.Service.exe
2120	DiagnosticsHub.StandardCollector.Service.exe
2120	DiagnosticsHub.StandardCollector.Service.exe
4940	8f8d1bcaa8fbf65148900da63e9150d3a87d8b48bc8dcec760f12d28656fefc6.exe
4940	8f8d1bcaa8fbf65148900da63e9150d3a87d8b48bc8dcec760f12d28656fefc6.exe
4940	8f8d1bcaa8fbf65148900da63e9150d3a87d8b48bc8dcec760f12d28656fefc6.exe
4940	8f8d1bcaa8fbf65148900da63e9150d3a87d8b48bc8dcec760f12d28656fefc6.exe
4940	8f8d1bcaa8fbf65148900da63e9150d3a87d8b48bc8dcec760f12d28656fefc6.exe
4940	8f8d1bcaa8fbf65148900da63e9150d3a87d8b48bc8dcec760f12d28656fefc6.exe
4940	8f8d1bcaa8fbf65148900da63e9150d3a87d8b48bc8dcec760f12d28656fefc6.exe
4940	8f8d1bcaa8fbf65148900da63e9150d3a87d8b48bc8dcec760f12d28656fefc6.exe
4940	8f8d1bcaa8fbf65148900da63e9150d3a87d8b48bc8dcec760f12d28656fefc6.exe
4940	8f8d1bcaa8fbf65148900da63e9150d3a87d8b48bc8dcec760f12d28656fefc6.exe
4940	8f8d1bcaa8fbf65148900da63e9150d3a87d8b48bc8dcec760f12d28656fefc6.exe
4940	8f8d1bcaa8fbf65148900da63e9150d3a87d8b48bc8dcec760f12d28656fefc6.exe
4940	8f8d1bcaa8fbf65148900da63e9150d3a87d8b48bc8dcec760f12d28656fefc6.exe
4940	8f8d1bcaa8fbf65148900da63e9150d3a87d8b48bc8dcec760f12d28656fefc6.exe
4940	8f8d1bcaa8fbf65148900da63e9150d3a87d8b48bc8dcec760f12d28656fefc6.exe
4940	8f8d1bcaa8fbf65148900da63e9150d3a87d8b48bc8dcec760f12d28656fefc6.exe
4940	8f8d1bcaa8fbf65148900da63e9150d3a87d8b48bc8dcec760f12d28656fefc6.exe
4940	8f8d1bcaa8fbf65148900da63e9150d3a87d8b48bc8dcec760f12d28656fefc6.exe
4940	8f8d1bcaa8fbf65148900da63e9150d3a87d8b48bc8dcec760f12d28656fefc6.exe
4940	8f8d1bcaa8fbf65148900da63e9150d3a87d8b48bc8dcec760f12d28656fefc6.exe
4940	8f8d1bcaa8fbf65148900da63e9150d3a87d8b48bc8dcec760f12d28656fefc6.exe
4940	8f8d1bcaa8fbf65148900da63e9150d3a87d8b48bc8dcec760f12d28656fefc6.exe
4940	8f8d1bcaa8fbf65148900da63e9150d3a87d8b48bc8dcec760f12d28656fefc6.exe
4940	8f8d1bcaa8fbf65148900da63e9150d3a87d8b48bc8dcec760f12d28656fefc6.exe
4940	8f8d1bcaa8fbf65148900da63e9150d3a87d8b48bc8dcec760f12d28656fefc6.exe
4940	8f8d1bcaa8fbf65148900da63e9150d3a87d8b48bc8dcec760f12d28656fefc6.exe
4940	8f8d1bcaa8fbf65148900da63e9150d3a87d8b48bc8dcec760f12d28656fefc6.exe
4940	8f8d1bcaa8fbf65148900da63e9150d3a87d8b48bc8dcec760f12d28656fefc6.exe
4940	8f8d1bcaa8fbf65148900da63e9150d3a87d8b48bc8dcec760f12d28656fefc6.exe
4940	8f8d1bcaa8fbf65148900da63e9150d3a87d8b48bc8dcec760f12d28656fefc6.exe
4940	8f8d1bcaa8fbf65148900da63e9150d3a87d8b48bc8dcec760f12d28656fefc6.exe
4940	8f8d1bcaa8fbf65148900da63e9150d3a87d8b48bc8dcec760f12d28656fefc6.exe
4940	8f8d1bcaa8fbf65148900da63e9150d3a87d8b48bc8dcec760f12d28656fefc6.exe
4940	8f8d1bcaa8fbf65148900da63e9150d3a87d8b48bc8dcec760f12d28656fefc6.exe
4940	8f8d1bcaa8fbf65148900da63e9150d3a87d8b48bc8dcec760f12d28656fefc6.exe
3712	elevation_service.exe
3712	elevation_service.exe
3712	elevation_service.exe
3712	elevation_service.exe
3712	elevation_service.exe
3712	elevation_service.exe
3712	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
656	Process not Found
656	Process not Found

Suspicious use of AdjustPrivilegeToken 44 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4444	8f8d1bcaa8fbf65148900da63e9150d3a87d8b48bc8dcec760f12d28656fefc6.exe
Token: SeAuditPrivilege	3756	fxssvc.exe
Token: SeRestorePrivilege	1636	TieringEngineService.exe
Token: SeManageVolumePrivilege	1636	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	3440	AgentService.exe
Token: SeBackupPrivilege	5084	vssvc.exe
Token: SeRestorePrivilege	5084	vssvc.exe
Token: SeAuditPrivilege	5084	vssvc.exe
Token: SeBackupPrivilege	3080	wbengine.exe
Token: SeRestorePrivilege	3080	wbengine.exe
Token: SeSecurityPrivilege	3080	wbengine.exe
Token: 33	2112	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2112	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2112	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2112	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2112	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2112	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2112	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2112	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2112	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2112	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2112	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2112	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2112	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2112	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2112	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2112	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2112	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2112	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2112	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2112	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2112	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2112	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2112	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2112	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2112	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2112	SearchIndexer.exe
Token: SeDebugPrivilege	2120	DiagnosticsHub.StandardCollector.Service.exe
Token: SeDebugPrivilege	4940	8f8d1bcaa8fbf65148900da63e9150d3a87d8b48bc8dcec760f12d28656fefc6.exe
Token: SeDebugPrivilege	4940	8f8d1bcaa8fbf65148900da63e9150d3a87d8b48bc8dcec760f12d28656fefc6.exe
Token: SeDebugPrivilege	4940	8f8d1bcaa8fbf65148900da63e9150d3a87d8b48bc8dcec760f12d28656fefc6.exe
Token: SeDebugPrivilege	4940	8f8d1bcaa8fbf65148900da63e9150d3a87d8b48bc8dcec760f12d28656fefc6.exe
Token: SeDebugPrivilege	4940	8f8d1bcaa8fbf65148900da63e9150d3a87d8b48bc8dcec760f12d28656fefc6.exe
Token: SeDebugPrivilege	3712	elevation_service.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4444 wrote to memory of 4940	4444	8f8d1bcaa8fbf65148900da63e9150d3a87d8b48bc8dcec760f12d28656fefc6.exe	92
PID 2112 wrote to memory of 5092	2112	SearchIndexer.exe	121
PID 2112 wrote to memory of 2888	2112	SearchIndexer.exe	122

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\8f8d1bcaa8fbf65148900da63e9150d3a87d8b48bc8dcec760f12d28656fefc6.exe
"C:\Users\Admin\AppData\Local\Temp\8f8d1bcaa8fbf65148900da63e9150d3a87d8b48bc8dcec760f12d28656fefc6.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4444
- C:\Users\Admin\AppData\Local\Temp\8f8d1bcaa8fbf65148900da63e9150d3a87d8b48bc8dcec760f12d28656fefc6.exe
  C:\Users\Admin\AppData\Local\Temp\8f8d1bcaa8fbf65148900da63e9150d3a87d8b48bc8dcec760f12d28656fefc6.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=136.0.6008.52 --initial-client-data=0x2b8,0x2bc,0x2c0,0x2b4,0x2c4,0x927324,0x927330,0x92733c
  2⤵
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4940

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:2352

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2120

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:4496

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3756

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3712

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4520

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3480

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:1532

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3344

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:988

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4484

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:3000

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:992

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:1780

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4576

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5048

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:2300

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1636

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3440

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:2452

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5084

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3080

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:3224

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Direct Volume Access: Opens a physical disk for reading
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2112
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5092
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:2888

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Direct Volume Access

T1006

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 db99ebd4f07767d34ab4f2d06d8e020db3649cdfb94f25a10a98bb65b5026ebf
MD5 c42f87ffc9a902d1c5d6bcea471ac722
SHA1 921f2c91815fc4d092e7c6479d54e55aadb67253
SHA512 def878bb7330f1fa51b6615d8154c8fdb36c598f48c6f63455da7a9ba55cfd5be70c71428f3cededc6b43fa9ac0f7736229eb22cb6b8c793a63f0937e51a8779
SSDEEP 49152:Vb+632BuPkFKRrdE6ohmstBhuXjfS4LWxn9x4x8EVep:r3q6HjBGix8EVy
TLSH
T1E2D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 45d1d357e64c72c41c6c3f7e8c7346b911f42c05476b027d30e4af4c33607672
MD5 0ef923b97bd86d21461fd213dd172bc4
SHA1 5646d1960caa7a201a34ad06a13dad338aff4800
SHA512 0f755943d9e78e0f9cd8118fd1c6294ed7c3e9a1037f710e1640a4b95f89c424208303919a1a3818c66c92a147297475046addeb475d20bcdd380575854810c2
SSDEEP 12288:h1XLsswWkxy2lRq2czAv+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogk:PXYfDtczAvyxknw4FYnshx8OfVe247
TLSH
T17E75F12877D508F9EC6B8139CDB28512E633B8554770E38B03E4A5295F336D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.9MB
SHA256 d34b5cadf6a9c1c3dfc1441addf44d2cd7a317848ce84f6e14bc37db675746d9
MD5 9c7cffe2b670409241a3ad02ac6032a5
SHA1 b4c4220394536926c9d0ad0de590059975ec85d5
SHA512 9e928180bf5c764890e977624c822346e54a6f1a6cb972147283f5eae23bec2f4f68909470b056f7f4ec1b539b3b84dc858d9935cd6bf5b27ab5fbb391a7766d
SSDEEP 24576:20Le5ji0hmxFrM6yxknw4FYnshx8OfVe247:2Pji0ArYx4x8EVep
TLSH
T1FE95AE25F6748331D073C0B9C5D2A69EED7130825B308ACB4296D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 dc09c72f3380e7d6051e4c759b82118374aa7345e79b13839917172d1fcc19ca
MD5 928075de5d51bbf151b4a40158e1c0ef
SHA1 4d232aa51a076244afed2950b04f1cec90729660
SHA512 2bbf1bda536b2e80c221c10343365133c7d9951090afae11c80d3b932b9f5453b7dd4fd9edef87cdafd952d60a75ecf9840d1614949e8f92f0812d10f41058a8
SSDEEP 24576:Fa7/ezSC6vUyD/aqgrvWE6q8wyucyxknw4FYnshx8OfVe247:M/ezSC6vUzPvxHjycx4x8EVep
TLSH
T1F7756D25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E276E5C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 84890941bd5af9d00653c1195e91338f15d78063d26f41c98323ca579382086a
MD5 8c2afc27c75d8567467a49a8c5809f90
SHA1 33daab00f61e18a2e7d60492b94221c84d88d72c
SHA512 cfa05d3b0fbf9f4e2f3683cf2a3c06aa2f562de58c441e8906ccee17422dfe69216d213752c5bcbbdec949f3ce70edcff030767c26ba67314166e446665b2680
SSDEEP 24576:HVbqPb88hv/l+6Tyxknw4FYnshx8OfVe247:HVO88hXl+5x4x8EVep
TLSH
T14F559E65F5B48331D073C0BAC5D2AA9AEE3234425B31CACB0246D76C3E67AD5D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 4c9ea2df6ddf9a17337cae36c5629b2bceeb7b529c0865b0921bdd3719427901
MD5 3991ec2be15b6c7e1cb6e7c66dc969b5
SHA1 b71aa669578379c6c08aed4ebd918011c56ea7ee
SHA512 1eb90faa78237c75358efcb8e3e9ea83747ee63834ff906ad361a1adf40a820b00bf8c6817b150cabec72e4705150c63f0b7c156802c4bcd285f9baabca795d8
SSDEEP 12288:pNu+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:pNuyxknw4FYnshx8OfVe247
TLSH
T10765237CA7DDA4E1FA5E14331B7572622616F9A4DA74C11BC778B14EE0F0CA0D06E623
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.6MB
SHA256 1525dd99f38654b7b9141d179fb10aa08a0114fd457dfe0b00e1be420af7c7e9
MD5 9a1c838e2b2041cfad4bd7da2ce1197e
SHA1 e8784c6c2e40dc34714fd0e8bcb42c8298bcd9ce
SHA512 41682522860119419a6ceadd9c83a229c383580c581cd5123c1cec4927f22c2e6c569cf06da6acad6eab315169a2a5889aa0279b497a5822e5773877f8c47148
SSDEEP 12288:aeBNUbTVO86UL+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:aJIULyxknw4FYnshx8OfVe247
TLSH
T12E75CF7BEE28FCD2C27E5DB95B918200A77274704B6293CBD175820EDE235E05E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 4a4844ed7e67de1097dc050d5daf7f608bc9e10bf9f12c618202250775df704d
MD5 a0715ac55a80c52812b28097020c7693
SHA1 2c6863c472ca37dcfed9fc1d07099348448b0769
SHA512 7f6ae7289173f7ea991db8954ec004094789f4f605404a047e27683659c583c0352d74545554578f74ed365330975c67ae514c5c5414e69e53c7a122841549fe
SSDEEP 49152:DQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THc:DQvGAdlCEL8c/yRNw5CHix8EVy
TLSH
T14B267D656BF880F5E0A7E174897AC6B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.7MB
SHA256 8938c1a241eeca3d39aa93ccf05439383ac48a38b999e6d94f2be9ee2fdeec36
MD5 6eed8013e1faf419a53956a73674acea
SHA1 7b9a009e8e289a67e2714ce44c4a2326b8303720
SHA512 de5e1ce246aa028662fd0f4de29ef30390f2fd901889a36edfde7422952fb8f7b69dfc29aa1d8d70150d28b68cde889c4dbac7b6b6632149df54056064331f7f
SSDEEP 12288:CAwSfxL/2Dc3LDLLmt0LDQewsAj9+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr9:H6ewsAj9yxknw4FYnshx8OfVe247
TLSH
T1C285E030FE74E032C67F0DB21B36D716142DB9604B611AC3E3F89A9E99705D2637AA17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 48fb7cfe6a44045cfa7c2192caa033dbe730778099d8e35b86458f396f021b48
MD5 47dcc98080734560357acb0a4949e0f9
SHA1 8ee79e49091a4a5389e206714e358d7cfc66d6ce
SHA512 552bb193b831671c829be7b80b54a4caca86988d673ac4870564e8179e2c7d3c46de1ebaf7a227d65cd549d226922703716a701abef8ad10022109c5c6ee012e
SSDEEP 196608:OUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJH9:OUEtQevvqc2W1cpV2EI32
TLSH
T169474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 b6123d53c8707543a1d66c4591bfe2993d3e6e926d7fb69f25c52786171ec8bf
MD5 3b0ff690b4a7b138728a6e81dc60fd8e
SHA1 c9d764a55dea87c875eb8c969c7ba57d739c8b05
SHA512 ef2bd7edfb27ed24d251961e31e6b421091cba2533409b917cd83a95b8523b7fba98dbb20e4ea44867bc19735a7dc9784e01672a723c8820fe94968bb8747efb
SSDEEP 49152:tCbRquA/m2yL5zQfFiV+XenmE3/zIx4x8EVep:KoqtVjnm7ix8EVy
TLSH
T12FD58E1976B8C1E4D1F6C77886A2C647F37178154B30A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 8e3687d4aae08ea1094b60d1465a15a23dfee03d71d6ee68b00003a51c0afd8e
MD5 8657612885f4fe236902832437d4b176
SHA1 5c9c55f1d3fcfb6372a8e01053910e000fa65ed1
SHA512 43f0f6e5255c09626ef18bf91fc39ea634dd4a279b58d15ff45fa0479e65f87caf885c8bed3d00dae866001f3c076f77250fb7390b3f52afce9602583e208a1d
SSDEEP 24576:nAhGLJIFoiwtA5l7S534yxknw4FYnshx8OfVe247:nAMyFoiq5Lx4x8EVep
TLSH
T11B35AD80E7F955D4F5B3AA7899B69171EA76BCA65E31C20F2260D10F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.6MB
SHA256 214cedbc0170cacf73d8a0e017e135166535fe1b4aedcf0e3c9e5bbe2985798b
MD5 16b44fb82249c6e1593958caaf4338d9
SHA1 484c4e9437cea18c6bec8130cb24469eceafc879
SHA512 9dbff3ed7fa18b9d76720cda33fcf663b4bc3f2b22502d2d1f18d7dcfa36ba36b6a4ba0cb868961808e9183becc48f9d7aa66327d13d12c9742bc6982d7b55ed
SSDEEP 12288:Gmw5HEjsChNoBFgl0WDm+C8+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXy:fwuFOW5yxknw4FYnshx8OfVe247
TLSH
T19175F14977E91CF9E9A741398657D132F7B2B8112A31C71F4760C65BAF33260AD2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.4MB
SHA256 30f465f0140c8f56e41009e5c79003d6560acf188d5aefd8dd3113d711ec298e
MD5 7398b6326ea72cdab7f05ad57adbf3ee
SHA1 328f0fe83fa88fe46c2bb0f28667b86319863b91
SHA512 fc69f41432371bc66c7daef09bfc3e0cba5d5b17479fdba42116bda88f4c5b9c35ab1cd28bd2c47ac4579d5746a38073b3714aa2ebe38c6f7da92d3ce49fff17
SSDEEP 12288:eFZ1IyN+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:sZuSyxknw4FYnshx8OfVe247
TLSH
T1376512AC33E860F1E1A7113A89F15205E76274A2677183CF4768625EAF72DD09D3E723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 66e31845f7dc35f120952bd7fe21d0f51a4d72b71b12e302205ecae2062a7681
MD5 2029834ec89e4d6926df58bef3d7e395
SHA1 5d2ad4d319c18f5f9e3d44c5398859ebd6a56b5a
SHA512 927149542bd095b1f359db4fd4c72613b210de6e4265b033445fb48b246de8aa8faa82b7a2a3b833b450de18904a15413e33f8b4f864239c92bfc3f93f46bc7f
SSDEEP 49152:Qj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uo:3QRQyi36YOcPQLvw2gAf+PN3yix8EVy
TLSH
T1D8667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 a3371c985075cb7b05597ae042c6703e4dc6a7b40c888bbee98b79f96c617c35
MD5 af9d8198aa0c82598edd8a25f1f40df5
SHA1 fa07be1ca5342ad966eb61cf7151481dbd10e55b
SHA512 ac44d128f0d2443820dbcd7068572d5495c66f59957016261ac608f2820cf852487606a57a983d7bffcfb196f7eb4fa481d66e150c88ebe2c5781637af43a21d
SSDEEP 49152:Mj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uo:DQRQyi36YOcPQLvw2gAf+PN3yix8EVy
TLSH
T1F8667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 e3ba84d2eb4a4a41945be2c10c95b9b275dd5d8b65f0de157198c65e908989a5
MD5 873930c2532d03935ee13019680fef83
SHA1 e0e4c039c83e6fdf9a54a9033019c0a6611cf76e
SHA512 5810f47c183da09d3013c223af64f751bbf394bd97a40c6d499eef659aab269f7c9ec859cefd0bd59d5e3b69173fbe4e08a1e5b7c377943ccf8b72671a407736
SSDEEP 24576:iwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0Cyxknw4FYnshx8Z:c68Qg55nhheWu7PNU3/Yx4x8EVep
TLSH
T1CEB55A33B2F600A9C44DE1769F46973196D27C718FE0E3DB8515720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 2e068d44e02d8dcf88982b7eaa6dbb1bb579ca709844631f7ae4384aba474575
MD5 c743566f5f1480e830c6ead58e5555c6
SHA1 b1b80c6d513e76eeb21e4085de268bef969b35d4
SHA512 6c183388fb1586185bf282cd94d0b3af47f9d8bcee5a61bc486693bbcafb6b2c9c1c22e18b43fb0976507471e1bc6ca5b714391053b774490579884117988ba9
SSDEEP 49152:f3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99m:Sy5112gYy5azzVvL69nLKnhZhix8EVy
TLSH
T1CB167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 da6845a6b1ec1cd30cce028e3aa0f9d6c64e151115145b2e57d8fc3b7481dc4f
MD5 007271a04eef67cdb7f268ca8b956715
SHA1 432828543c9a983cd0c9a5373c9d7129c675dd82
SHA512 2ecb6f5515570542a25bfc90954b13137f52f7122f2287a7ed8f2d99cf5b81b517ed28480380081a16d9c9ba38751d9439a85f7aeecf437800e454855d30726e
SSDEEP 49152:ZB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glKx4x8EVep:Pu6JmVxd2dKix8EVy
TLSH
T173D59D13F1DA01E8D06ED479974A9233FA62BC490B34B6DF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 edb3acfe87307ca6887da04365841dc5b8fdd5f6d0ae4b74a57d70af0f85181a
MD5 e1234103203488738cf03efd0cffae2f
SHA1 43568af73bfeda42d038db15431f26697e2b39b8
SHA512 00d17285f7a02ecb77ff835964d27a86ee15127fdf0f1e80e558fd6ebb61ca95aeb5403b37ae779531773999b2f9f40a7cb01919ad4e09f9f4bac949c6cc23b0
SSDEEP 49152:b1hpsNoJpF1A6UU44CwH7R4xOx4x8EVep:bmifPbR7ix8EVy
TLSH
T1A9B5BE13F2D900E8D05ED17887569232EA62BC460B34B6DF0A90B7962F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 166bfff1d6ec6416e4293d7370b30f201302ddadb1144dc19db0fd72b1151441
MD5 d9fe2d661955a8a4b5526b746204f54e
SHA1 43dcd9d53e1915a5a33ce03b83d2d5b6d2721c65
SHA512 9ae5b164c1bcbe9fb85476dc7cb39336b09a860ec239d8ec3a9a912357e513fb2921b81a85091436e8725720a790df6d64bd43035e4e04010c00b62dcb3d3010
SSDEEP 49152:sSuZQIY0Be2KRRVtOnks6NMHqNx4x8EVep:O5dKTi61Nix8EVy
TLSH
T11BC5BE13F2E940E8E0BED67487769232EA72BC464B34A6DF064072591E77EE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 8daae966b88e15eae1d726b32f509e5d73a76246c810b1795ebacdc01bbe56fd
MD5 681da4b84976c195659d777a86a9dcde
SHA1 bf7e714f48981c16552cdd47b6a437ccaf32baa6
SHA512 136a06c7ed926e736f3a46e1b8b1f44ad02c0cecd1f2f489bc33a1e0a1a37c6a04272c5564e19e64c9305747e57dc329ee63767e3d6505c5a70d5e5e4632a299
SSDEEP 49152:JhtSn8EApI0figngiDn0AP5wax4x8EVep:4X2iyphvix8EVy
TLSH
T10795BE13F2D900E8D05ED179C7568632EA62BC160B34A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 2a82873a26aa0aa9fcda9592ebac90323ebe1984d6de34c3c18df9bc267eeaab
MD5 b23c35fc7fc689e4011ea265b2c59289
SHA1 832d8a76e5d2ba8dcda592e3339469301a094645
SHA512 179cdb0263664e3bfd4f50193d1a21395bf2ce609b207889359d0a5f118f980dc0d4fb6199a85ba54c90bcee6f2ee09a68c903401428d02bfc91cb3ed9de3c25
SSDEEP 12288:rG+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:rGyxknw4FYnshx8OfVe247
TLSH
T15065237CBBDAA5E2F50D11734B7172626609B5A5EB71811BCB6DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 fc25b2beffcb87b9c2486553a35a4eaa814afebbed26e17c69f983c3161be86a
MD5 8e2a4d57955ae250221c2dbaf386429a
SHA1 feaa7d93c93bcb600bdd4a905418d1c7172b0270
SHA512 e0cff30546440fdd937bb46e67c2c48a244212f1321eb45f51ee9640503433af56903be87169ad4360aafab4af0aad95bf2454bdbb8eba4567a229030c0e0ae7
SSDEEP 12288:cB+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:cByxknw4FYnshx8OfVe247
TLSH
T1AF6523BCBBDA95E2F50D10734B7172626609B5A5EB75811BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 c73e9af09a7d5fa91ffc3164cc47ca23adc88d59ee348560476664ce74bf1347
MD5 5ac295f3fb0374e6a1ae9d2cef78fc9d
SHA1 3f7547669312c018dacfe755b383c0023c122c0c
SHA512 5d20ef639eb06b1d2191d2b4b22e278d1f454d82b199478e2c4fc17ceda5c77bd85c7fe63f668f4257ad0993c35f6f4bcdb1ee71676e1318b436321adef9b577
SSDEEP 12288:FD+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:FDyxknw4FYnshx8OfVe247
TLSH
T10665237CBBDEA5D2E50D10734B7273626609B5A5EB75811BCB6DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.4MB
SHA256 24ea14c8d9414b3672da51500b763c91e2f2b7bc01858a8daa25fb8eddc2ab91
MD5 ce4b8f136ef6e8118bd375678f5f5e98
SHA1 ac74473f2d29b9545a56eae473c37d845d358a8f
SHA512 b91af825447b434bf4c4777d31745524f67982ac28531ec1733e3b773e3f60c4637649883c1ccfc546833e2a4698e1ea6d5033797bf2d739dd01ed74de6d85ae
SSDEEP 12288:MVY+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:/yxknw4FYnshx8OfVe247
TLSH
T13365237C77EE50D1E85A51738A726222B365B8E5E731C35FCB24710EE9B0890A43DB63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 298aec9d0222659851dddc3b4f2d4adcbd7846b8ab4350c8ac6a959a5e08f4be
MD5 b2179bd743e7b6b9dc8df828aa0f14eb
SHA1 ff3b8158ccb920ec70ba1ba11c9ce119ef4241cc
SHA512 c23cbbdfbef632864e810cd5f5f39115b18c1bb67c838972eb1c806200330d41878ba5a33b2df3aa18abcd3f821eeed59daef7f5654439fa1ba9456235e0873e
SSDEEP 12288:Og+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Ogyxknw4FYnshx8OfVe247
TLSH
T1A365237CBBDF95E2E50D10734B7163626609B5A6EA75811BCB6DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 6a104886f496e6c8369205a80a2d4e84289d4c1292b6bc20532fafb9c2b4ff71
MD5 53026426debf68e28c78c2248eb42913
SHA1 ab2b714dc583354cb70ecc3838869f29b10a36bd
SHA512 cb8cab6bc61c57437d4fe2f650b9745a12ad0c3cb84fc1c70216455d27bf6bde14055ee12deb2bd93610c9653c108b2cfa2e1d436fc67155a6eb03afdeb26fcd
SSDEEP 12288:o1+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:o1yxknw4FYnshx8OfVe247
TLSH
T11065237CBBDE95E2E50D10734B7172626609B5A5EB71811BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 3e3e7ad46d41ad4be431c77f6b2d791c87f81b5b1e3bb48eeed63992a3b83bbb
MD5 81695fcdd22ab696672933e56918bf5a
SHA1 4ce377c7666d58fc03b6758557609e6662609ca9
SHA512 ff1f06aeab2bc6fa16009f5a23312c1e28bbef71a6806f7e4214d53ad721c3c18366704de5a28820431758dcfd40ab9c26ed7316e247d9444ed56a3b80a4d45e
SSDEEP 12288:Ep+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Epyxknw4FYnshx8OfVe247
TLSH
T1AC65237CBBDB95E2F50D10734B7172626609B5A5EA75821BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.6MB
SHA256 d62c67f6fa0d16789b27d202e9177c694d4782f958d2a6327b3fa9997d4ca8e1
MD5 724178dcc0cdca05cdb717afd6af5267
SHA1 fb941482988a93b8abc14c6cf75a5d9713a4f105
SHA512 5cfad018a611a704cbf1ed03052c943b2d43ff1058e890e5214d6bc1d8a0f4e064830d4b2a22599c17b966e7b9d3be7aa6ccfab7286f57abfdf5562dcdd9d676
SSDEEP 12288:viZwbZzzFEoS2cPvyh+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:KZMdzFVSOhyxknw4FYnshx8OfVe247
TLSH
T1057502A8B39018F4EC67413ECD259916D6B27C594B70C21F43B8362B5F736A05C3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 07fa32f5516c9298e894541e96b6a9014321f5fc67698fc0af63818f0ea2619d
MD5 8d4f578d6be4f6f2d06850de8bf47882
SHA1 74eac34fe7e277ac51fb877d8cb5a9469107567e
SHA512 ec80a7aab7d749c713ce40b92e0306968761e20d1a4a59ab59e13fca23bdab87f8848cb97907aa01fc7245476bfc6017dfb5f176b659c005e5dc4c4cacd24c72
SSDEEP 12288:gi+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:giyxknw4FYnshx8OfVe247
TLSH
T1A76523BCB7DAA5E2F50D10734B7173626609B5A5FA75811BCB6DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 99825d45ff3502f1ca7a00258cade78ce2b66190171e84100e413e9b0be9b233
MD5 1095da23960929757dfd9945574a4025
SHA1 d30a8320e45b8380d2e08c05dd7e99ab03163a6d
SHA512 4995fc6ed5dc985144f95f86db1d935543836e7b9f14ea98e44a8d16bf314924218a1e130ae83011e4d5b074215898b0b2dfedbe922f6262336e7266f9f81109
SSDEEP 12288:u++hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:u+yxknw4FYnshx8OfVe247
TLSH
T16A65237CBBDA95E2F50D10734B7172666609B6A5FA71821BCB7DB00EF1F0CA0A01E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.5MB
SHA256 3a54c7b9bd7ce30e52711a3a439cbfa8c86d78777302e45abbe83d989a0aa7d8
MD5 22a2fc4c838606f801c13573448278e1
SHA1 94471dbf5816051a247c342441fb8ac104b1b83c
SHA512 54521570111aac48cf148dceae6a620710d732f6db96d474e62d51fdd551796e28e74343637b2354c5f8c8f18eacdb546ef04f8360dfed2f2950d7ff4d7ad6cf
SSDEEP 12288:jyPz5L8N+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:OzyNyxknw4FYnshx8OfVe247
TLSH
T1FD75125B73E530F5D12A4236C9621612F372B872473086AF87A4537A6E735E09D3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 487f358842a547f7f749fb32a48eec4e6adee56dce9b0ff9639886de2b4bf43a
MD5 0de3fafae7c2bc2348578b706aa187ba
SHA1 bcd6dedd546ba0b03b2d9e4776c20be29489f274
SHA512 ea77ee48881793157b06af8ad336d1834122b9c2cb9f0435f888c6a94b63d46dd440b24619de01cc580387ff0dae13f769d50f326d27b7ff517f1bce7607808a
SSDEEP 12288:ji+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:jiyxknw4FYnshx8OfVe247
TLSH
T1136523BCB7DAA5E2F50D10734B7173626609B5A5EA75811BCB6DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 0e11f287e222034211dba0bf5332aa9fb9f50c10cb475ebf01ef9c338bd60b63
MD5 ea12a5d19d86771724d2f5295684483b
SHA1 c7b72e5efbe5c65d815b7153251d6340fd55bdaf
SHA512 3ffe5ba9fc378df208c805cef90d816d412294186089256a4200e317abd151a7889994d2390cca150dbe3814dfe82c236c0a74d2f20d4cb073b91e7fddfab60c
SSDEEP 12288:hi+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:hiyxknw4FYnshx8OfVe247
TLSH
T1CB6523BCB7DAA5E2F50D10734B7173666609B5E5EA71811BCB6DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.5MB
SHA256 ae30f2668095ba1d0ac3592b16915f24a796ee3bf0ee902a87f5a1574f86d8e4
MD5 f299dfd7c4b432e2aa21d4de66f013dd
SHA1 db95514364f64e1b757fdc7ab6430a918422b1ed
SHA512 9874a90cf08b28b615b4c700f624fff1325c0d58ec852fb5e941fdbe18aca8ece5af013693c4f297445f6156f4c3de59867ffbed61e1cf3a9d13fbbd683844b4
SSDEEP 12288:ZyPz5L8N+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:YzyNyxknw4FYnshx8OfVe247
TLSH
T1FE75125B73E530F5E13A4236C9621612F372B872473086AF87A4527A6E735E09D3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 ad1c55b460723b7bac2207a756a7d5cdec9251b307a902acfc0e161aa8b0aac9
MD5 08bc703fd7af6f9e8a9e7847ea50b9ed
SHA1 c897757f9bd5dfcda69c80ba69486d973c8c5c74
SHA512 a29097e341b2b50333534d53b169fbd9bc09d6d82e7fbf9832d6bc39df4514cfce95d82d7e3e5f0f441cd85658d491ce44307aa9aaa9d17bc0f5180796c65f24
SSDEEP 24576:DcP4mcvIjkGOxhKP2l71nNKbrh/8KBqyxknw4FYnshx8OfVe247:4P4m4IpOO67W8KHx4x8EVep
TLSH
T1E465BE2DABDC0096D0BA913486658A4AFAB1742A1F3286CF1160933D7F77EE54F35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.5MB
SHA256 801f882174be1b0fb6a03df9d8a9eb43f9c61ac2f36a7b6cf22798cd8963c0d0
MD5 74c162af2dbee36f524e50bce01aad6c
SHA1 d41e31d60c3440fdc5dc689ef7063a2e4ac6aab3
SHA512 2ee75941483841c71bffdf594518171623a5e11a25720921dd3c55ab28e5de27d348ab48d9210714dd187068ed8b06b2854d4e7e58103a0ab51cc5d125f69783
SSDEEP 12288:l+sfS+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:zSyxknw4FYnshx8OfVe247
TLSH
T18975F028E29802E4D06E2176CB625641B3237C6597F1D3CB93D0F53E1FB1990ADEAB13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ed06f87a26b1277.bin

Path C:\Users\Admin\AppData\Roaming\ed06f87a26b1277.bin
Size 12KB
SHA256 5409d1088ba2dab980d47278765a411ae95304661cdf332a93aaa246c09bbaa6
MD5 bc0932c740785a442d5e912363cd46de
SHA1 e9778343e6e0e5df571cb2c04ab76ae3525093a4
SHA512 2501858197e05669f61c72b99712191818e4d742f4f6cbb38bd6cc1fe8f364c786b71cebca3c9c6c234465652304c3489085cd80ecab5d85986e4f2f2339570c
SSDEEP 384:/D9QdAWk7q5aCRvw9P7KaCasGJDeC1flbXv:adA+sovuWaCavvJ1Xv
TLSH
T10542C08D39E6589435049C8A359AE8F906C6CCE4E55B683FF13198C007CFD9A9EE034E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 414f7a05e4d76dd18e88a75ba26ccad0c080cf37a28a413b6802b32ee7b9f9b9
MD5 01dd935c6348cb017c6a0b0a067e3e36
SHA1 ce9e17a12a1fa6af2ab6bdd91ce151201209fc45
SHA512 b70ddf923af5b76af79a92be711f2c91aa619cef37a85d1b6265b008d9a9fe9a7f3596c80c6d70ca0275a8f8d68a07b4b4d587964a351008f6171510a3f112fa
SSDEEP 12288:py+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:pyyxknw4FYnshx8OfVe247
TLSH
T1FB65237CA7DDA992F56D25730A31A231361AB2B4DF70C14BD768B11EE4B0CA0D83E617
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 f9c4130ff23afb676864bdddc05ec975d2e030f14b6a9a8927f02b4a27255f14
MD5 4764e0dc0407ac42e54b1c09c4097cc5
SHA1 333390c3e8bbb81adc73d9793a5732a3974459db
SHA512 6bb70d326618d8910be7c9a472118a6f6d1a1ce317c89b8cee54a82e23b525831a2fb0baf0503594b503249f92ecbe251e735e47c540aa2897cf0948ed2cb352
SSDEEP 49152:Ia0h2GEkuAe73q3pp46zwwQjx4x8EVep:Ia0hNYG4Jwwix8EVy
TLSH
T19085AE1D67EC82B5D0BAD278C9A6814BE6B2B4260B3156CF1190853D7F37DE44E3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\System32\AppVClient.exe
Size 2.0MB
SHA256 842c6a466dd45543e98faa2b9f3c6bbe40a3143f10881fdd9df1cd20cb8152e7
MD5 2110046b1d1cbeb6e6a6208f70eff4a0
SHA1 d6488e098909417f4aa81f9d2e97dfd15e3be81c
SHA512 1c05a90378c5e07ef03b83b2cc6977abe5ee86dd3e8e8c4886c9890149e1d808d714cfcc668401f0555242763751fd60a844578ffa3a5706e9ffbf99b9b7766d
SSDEEP 49152:NTDxR+N5YzTljMux4x8EVepfr6iABXMCbn:5u5Cix8EVyfvyXX
TLSH
T1F2A5E12EA7F945E5D1BE85798B238512FB727821073193CF42A0C17E0E6B9D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.4MB
SHA256 ccb454ef3503569d13f3274d647a6a7bad281783656b67e9cda232bab6070052
MD5 4fdcf2a1a8c82d230ce97a23167b4ae0
SHA1 1456b2b0cb0f128bd3b85c71ef2587cfa279fc24
SHA512 962f958b538b4372d570a3d3fb379ffb1599c38d09e47da981023da41c246ce092df8bf08158003235e70bb85cb94929c56632b871e8756af1a6b1a4c44c3a8b
SSDEEP 12288:FhbHjfXx+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:FhbHjPxyxknw4FYnshx8OfVe247
TLSH
T13565117C27EC20D1F175A17A86A28206D331B8651B3193EF93A5923E9F36CE45C39F52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 4f1aa73b21a148c5efde94c75544df149031bab015317f88b21990d918a3e54a
MD5 9298bb2bb8404b6f781320b4a2c29f43
SHA1 40c0947e097d0a042a6729489a6a20f80abf8786
SHA512 a8db5bf1f0397dfb092b37acc3601c32ea713da87dc17f646020cb1f0ecaed14e471886272c912ccc1a6e898f02ebf8083e260d64b40d991f8de5502fe591a83
SSDEEP 24576:m3YgnJcRTk4yti+R5dBR/5yxknw4FYnshx8OfVe247:mIgnaTk46pBR/8x4x8EVep
TLSH
T14C45BF2DF3B910B9D8AAD136450143B5FB71782D1F2096CB0174C538AF1AEE89E39F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.4MB
SHA256 761c1de76cfba4b9847e8bbc19dbaa0b3135e0c56ef31f8a5580fa5135e2c908
MD5 df6b09a2e44287cfe821e9071e853bc9
SHA1 8cd4bb0b66c6eed79342e6f68b1f010a820a0137
SHA512 473dd35f539921b1d2583c91effdf1805d3a019faca04c2f33af479275a73e3d97329de0f9051de29b4be336430b59d76234392c8a811be4bcd3f6fce00f05c7
SSDEEP 12288:3O+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:3Oyxknw4FYnshx8OfVe247
TLSH
T17E6523BC67DAA5D2E55D15730A7262263605B2A0EB7182DBC77DB10EF1F0CE0A03E653
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 37c0a9d3d2f0401885359691af9534fdcc4cc362d82bd5688d5f5553993be803
MD5 54fb2b4dfb4be35ca5d344c77aab4224
SHA1 0721c3a22a4afcabdd38e30902962add932918e0
SHA512 dcc26787a5b7d23d8c15195e8da863018eef8d2c4d058f7eb0e192e89f7dde12623068c0cb3406cf68e0396913b54f2df9e5489ea940b4d1fd2466fe51c3b21f
SSDEEP 12288:qOb6A4LWOsvAYFTv+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:bCL3UTvyxknw4FYnshx8OfVe247
TLSH
T15E850158F7D400F5E86B813DC9729612E272B49D0774E3DF43A88A691F636E18E3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 bdebe17843d1f41fd70b034265662defb5ceb61eafa2d1c6b5c68513f2b2baa0
MD5 166935900fb117abb995d884ce538eb7
SHA1 c322fc723771ce65f2becf8ec4999c17550c2fd1
SHA512 b09b2e8610b7070ea068216216fb2b8f31cfea8e54e86b1cf07c03096ad2f7465dcba20b09d1ca01b81d00a4b7e4db95801acfb34419d4760df02c197c29932b
SSDEEP 12288:5pFtkOr+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:UOryxknw4FYnshx8OfVe247
TLSH
T11465022C37ED10E1E179613A8AA25309D371B465473253DF43A0916E9FB3DF8AC3EA52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 ab0624d4925d0a7c72034306c249c18313ff98e16962823fe5801e248161e54b
MD5 91c8df2b6a74f6282a0a2de46338d1e4
SHA1 22ea21539c38583cce237eb737572bad84763018
SHA512 5de74382631b95b081a03d42be5d247ca4825a8ad8d61a09fb47c4255db731a19f1dfc88a6c6483577f247aa3063336d9e7b41043d6c897e67e3394f27dc6e43
SSDEEP 24576:V7NM9YqZqmWMUkPjZM48Mv6bEhsiyxknw4FYnshx8OfVe247:V7cBWMpPjN8DbEhUx4x8EVep
TLSH
T135659E2D6BEC81E5D476D13DC9A28205F6B2B4611B318ACF5162833E7F37AE44E39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 ef8169adf6d6028746c7d8bd81dbdc8fed96668c649cc2ea9bd02f39cdef89e5
MD5 54d96c623fe5e1bc793d3191b2daf4b8
SHA1 344b141f3bfc10191fa42c60d43c4f6d9161b36b
SHA512 30b115e8e52d0f5cf9cdfb7c964c7269cf44b48f28dda03fb7a967e5987a0aabec485673a10c6251f44d41068fa907c39a4fc325cec6eddd134fd97642527e27
SSDEEP 24576:CW6BApg2YuyuNDYTabvcdvNYf8km1Eyxknw4FYnshx8OfVe247:CF2YuHNETovAvNYf8km9x4x8EVep
TLSH
T114858D2927ED80A4E0BBD27D45B6D246FAB2B8511B3056CF4255862E1F33AF44D3DB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 09899e8326598b3fafb8dfe282902be2fe18db11b456c2420553038aa16fab4e
MD5 71dca19e34e6123f737b6ac7729f3627
SHA1 a6e90c8bc5502c6168f0376cf53f601ed67fd3bc
SHA512 a606cf04046335b40a6b6ef2251769f516f2f7213a1db245d9967415bcb89a49ce3a27173ad76d8cfed3449b9dfeabbd567701425ee7d25833f19c815fffb9c9
SSDEEP 24576:8AFs06+Omlf3NXEbToHyxknw4FYnshx8OfVe247:RFs060lVXuDx4x8EVep
TLSH
T19365AF2F62EC00D5D07ED17E8A97C91AF6B17463072556CB0260863E7F6BEE85E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.7MB
SHA256 d28da11651b592988f38d9e16240fb1af5594342b86f9b70bb8f4f4ededd3dc6
MD5 86a5306cdb4e836b66dd51062327a30f
SHA1 8df6b9a2a705c6f2ddd0bc939ee04ac5062d57c1
SHA512 d3544314cfe30790ff47bf67f239173491fc4fd35c19579e030ee0b61d0693479de2c0eb92a51ef54da80933626bc7b53ad948f40a63174d8ac92fc60873f17d
SSDEEP 12288:iCJnJ5D3Vkr8zxC+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:jJnJ5D3WoAyxknw4FYnshx8OfVe247
TLSH
T13385D03CD2A810E4D4B7C274825A2756FE72343D2F226ACB58B4D5397F22EE09979F14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 44df313df30d1b69995c4794b46a4d2ac85af34862ec90acbe2963ed1ff90ad0
MD5 6b66c0f0c169848d6672257c897b1971
SHA1 3f6687b2b360fd425439a09cf12a7f4ebcff7da9
SHA512 a935ef2b044431ab806d7b7a5f891d4cc526e792f924d8e510f2f0defeee83cc4ee786d7b2a73c14ce4f0694eba6de6a70d3893b4da8b513a5e54a2a19cb46f4
SSDEEP 24576:8EPghm6/7IIXdwcXrif7qQncjlP65i3Vu5yxknw4FYnshx8OfVe247:jg06DIKdwc+eQnSt65aV5x4x8EVep
TLSH
T191955C15B7EA5294E8B3CAB1CA62A1169B327C509B34F7DF0AC0C92E1D33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.4MB
SHA256 484e2991a1eca372f55d2d77d2f81132a8cd5de2ae8db9324c77e2b1eb4df67f
MD5 a01cad98179f6345a96a99d9cfca1d34
SHA1 878b1031e4e778451950eca2bbad4856b4f99fc4
SHA512 72c68a681457a77974588c0791d8b0683e7bb41a3e6dba92aa2448a115bfaedc18317a1fc2b68b5cc87ebed6544eacce7d94a4d9b9d58154fae007c557ad8aa7
SSDEEP 12288:/EP3RM8+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:EM8yxknw4FYnshx8OfVe247
TLSH
T1D065126C77DD70E1E52A503A86A18205D372F0706B6253EF86E5D23E8E72CE46D3DB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.5MB
SHA256 a877a6a4e1ba944ff31f55306320122464d853064c1739bafe3d3b10cb491fdd
MD5 2a698fc588b2233bcb0ff493e751f2d8
SHA1 3fb509242993532f36c1f20b2c935182edf24432
SHA512 1a492c026e30ae3927c30436ad8808ff3de8252268ac27644c0517651f24b009d88c7f33d2ed503cbc35db4da3cbac9aba7033149dc106c3f57f1bfe5f70ae90
SSDEEP 12288:KjkyB+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:KIyByxknw4FYnshx8OfVe247
TLSH
T1D875121C63D8A0D1E57905368A7392A15A35BC709F3193DFD290F23EAE71ED0A839B13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.4MB
SHA256 3406768e495ea43462799f6e70b117d379786011b57a914e9032ed00535d406d
MD5 a8a14c4a452fc0daf8a7c058e275335e
SHA1 29141b50dec649a7e2b0ba204d3515ec3cec3cd7
SHA512 7556b76e1410897f973336586dca92e21545f6cf67411e04f5d679ab425c13cf8b2c8dab50737913622ea18da58121d382379c4348f9e6cc181e575adbed6714
SSDEEP 12288:qG7+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:H7yxknw4FYnshx8OfVe247
TLSH
T11965237C63EAB4E1E9191173063163626215B1B4AB7191EFC6F8F13EE6B0CD0A03E953
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 805e09e65e165f356badceecc22e28f4c0b577ccbdd415ae3cb23b9f87d374f9
MD5 1b59fd6982c8a9f9b91817292cd1209b
SHA1 6aa3141a96cd7372c2e4929826573c6f6c8b5fae
SHA512 e42f17cc2b63b3ea26c9d1eae56e97c1da3715c52c51346a08aea7e7737ea8b700bd59228c86167c8429992ee7d4347a8f51eb38af926a7f0a3fec1d359a494c
SSDEEP 24576:WQ9MxZKdcz9dw3ayxknw4FYnshx8OfVe247:WVKZ1x4x8EVep
TLSH
T137558C2DABE905DAE177D23595B250C3A633B4311B31D6CF2448D03D4D7AEE8AA78F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.6MB
SHA256 3e0670cff808ffd852fdb016f98908489e4374783b8f466bfc38e4b4f09a239f
MD5 0dd8e6a6c4c97c499ac9623156cdbda2
SHA1 61c21391f280237ac8dd3b7105a4b610f8791e6c
SHA512 f546cad8db251a12ed714995475fa4ec0b906456bd4b8c446da15730827d00dd70926ec8a11540c5e455e81e30dff366e2df2f8c7d18b0ce809a42c95dbde4d0
SSDEEP 12288:1yoKo2SRple9p9+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:1yocgAp9yxknw4FYnshx8OfVe247
TLSH
T12075E01FB7AE40E2E166813C89958345E773B0705B6253CB9691C33D8E739E8BD38B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 91521ee4c36ad26bd9db3aaa8388fa65be0152da9c4a07087ebeaa4976c8ae2b
MD5 1934347fb97385d8e27cb6d09c22242b
SHA1 91ef79534c53b95d59c5a6403d9a66c6b1747450
SHA512 aa6d59a82150e5eb7915385824903987136641283ccfe5f2dcc1aff6c7066c4717a3291397223482518edcf8a384dc6070e0aabd4aef857f8d5e50659b79bfaf
SSDEEP 49152:qWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKox4x8EVep:s0zuNIaix8EVy
TLSH
T1C3A57B3DA2EC00A9D8AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 2.0MB
SHA256 ff5963d775a8c84380d5511e57928383cb844230b8cdbc606959e51d71732d3b
MD5 be96496024bae6f24b82f2f1a99f5987
SHA1 44184d23a7edcd79b2297911f589737dbc8f047e
SHA512 aec919c41249fc20d4fee726cd4e6785b0186d64f3d97b66d732758ff171f691d9293d657353cf3d277fd32fc2aaaa386a26e53b73a0668efae248bace76949a
SSDEEP 49152:aTDxR+N5YzTljMux4x8EVepfr6iABXMCbn:Ku5Cix8EVyfvyXX
TLSH
T193A5E12EA7F945E5D1BE85798B238512FB727821073193CF42A0C17E0E6B9D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.7MB
SHA256 a0ae461c12e3c8e09aa61bad7dc85ee058906da2afc1cf1682b9c1925057fdbe
MD5 98e1e386a87d6ae7f45e436ffe7864f5
SHA1 1c190d3f2e2d132b6615b7a7b2bc7f483c76dda9
SHA512 b52398c227aa99c99f3372390bf7bbd4dedddbd5c1c5e6d4cbcf71944ad64115ffae5012dfc3111d6f8a53adc44c440f3ec32e66a3abfb437de9e4e41c6fe990
SSDEEP 24576:1TMdOz0FFS+7mSLYyxknw4FYnshx8OfVe247:v0K+7mSL7x4x8EVep
TLSH
T15885F13DA3AD14E5E47BC17D9A538906F67234610322A6DB06A0C07D7FA7EE4793EB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fxssvc.exe

Path C:\Windows\system32\fxssvc.exe
Size 1.9MB
SHA256 6a193a109b8d9fb3dacbe1a6c4ad7eef230d1db9008bf710a643c26d0e59205d
MD5 d915df00a9005c157c6209a03ff9db3f
SHA1 11fcce4af0a0423265985090000955941b5e8f41
SHA512 da734b3aaa116c40fff4f92ab16c065edd6919ce36d489a7c2049a66fdc179550fb54f352e549d6bc259f98d76895cbf938fa87bc1f1f62fa828c17b140c7246
SSDEEP 49152:SpgnaTk46pSR/8x4x8EVep2r6iABXMCbn:SyTix8EVy2vyXX
TLSH
T1CA95E12DF2B910B9D8AAD136450143B5BB71783D1F3196CB4270C138AF1AED89E39F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.4MB
SHA256 e502843dba8eca6c4ced2c12c8a582c46b0851a0afcc619f88e1eb9b155df284
MD5 a3ed93087d5b138e18e29cdb4465db2c
SHA1 b58965a7cd04fd68d168f118100e2bdafa40e40d
SHA512 6dacee6c8c40fcddd27e1b8e9c518c5be5b4fab12850ac4c07053edaff11c58876d0439267c91e72d42ce389d6ee5dc53ad49cf3bdd6a43fff0b530c2784c960
SSDEEP 12288:t4pv+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Kvyxknw4FYnshx8OfVe247
TLSH
T10365122C23EC30E1F46A52328A3252169631B875673192FF6AE4E17E9F718E4D43DB13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/988-275-0x0000000140000000-0x0000000140177000-memory.dmp

Download

memory/988-102-0x00000000004F0000-0x0000000000550000-memory.dmp

Download

memory/988-94-0x00000000004F0000-0x0000000000550000-memory.dmp

Download

memory/992-278-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/992-443-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/1532-257-0x0000000140000000-0x0000000140185000-memory.dmp

Download

memory/1636-290-0x0000000140000000-0x00000001401AE000-memory.dmp

Download

memory/1780-279-0x0000000140000000-0x0000000140162000-memory.dmp

Download

memory/2112-199-0x0000000009E60000-0x0000000009E68000-memory.dmp

Download

memory/2112-182-0x0000000001A20000-0x0000000001A30000-memory.dmp

Download

memory/2112-301-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/2112-451-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/2112-166-0x0000000001770000-0x0000000001780000-memory.dmp

Download

memory/2112-448-0x000000000CD80000-0x000000000CD88000-memory.dmp

Download

memory/2120-32-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/2120-38-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/2120-44-0x0000000140000000-0x0000000140175000-memory.dmp

Download

memory/2352-28-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/2352-450-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/2452-291-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/2888-455-0x000001E0EBD20000-0x000001E0EC390000-memory.dmp

Download

memory/3000-277-0x0000000140000000-0x0000000140161000-memory.dmp

Download

memory/3080-299-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/3224-300-0x0000000140000000-0x0000000140192000-memory.dmp

Download

memory/3344-90-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/3344-84-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/3344-274-0x0000000140000000-0x000000014019B000-memory.dmp

Download

memory/3440-147-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/3480-78-0x0000000140000000-0x00000001401A1000-memory.dmp

Download

memory/3480-75-0x0000000001A50000-0x0000000001AB0000-memory.dmp

Download

memory/3480-72-0x0000000001A50000-0x0000000001AB0000-memory.dmp

Download

memory/3480-66-0x0000000001A50000-0x0000000001AB0000-memory.dmp

Download

memory/3712-304-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3712-46-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/3712-52-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/3756-79-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4444-16-0x0000000003F30000-0x0000000003F96000-memory.dmp

Download

memory/4444-256-0x0000000000400000-0x00000000016FC000-memory.dmp

Download

memory/4444-6-0x0000000003730000-0x00000000037B5000-memory.dmp

Download

memory/4444-0-0x0000000003530000-0x0000000003610000-memory.dmp

Download

memory/4444-1-0x0000000003730000-0x00000000037B5000-memory.dmp

Download

memory/4444-7-0x0000000000400000-0x00000000016FC000-memory.dmp

Download

memory/4444-9-0x0000000003F30000-0x0000000003F96000-memory.dmp

Download

memory/4444-441-0x0000000000400000-0x00000000016FC000-memory.dmp

Download

memory/4484-112-0x0000000000830000-0x0000000000896000-memory.dmp

Download

memory/4484-276-0x0000000000400000-0x0000000000563000-memory.dmp

Download

memory/4484-107-0x0000000000830000-0x0000000000896000-memory.dmp

Download

memory/4520-273-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4520-56-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4520-62-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4576-123-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/4576-281-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4576-129-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/4940-25-0x00000000034D0000-0x0000000003555000-memory.dmp

Download

memory/4940-19-0x00000000034D0000-0x0000000003555000-memory.dmp

Download

memory/4940-268-0x0000000003E30000-0x0000000003E96000-memory.dmp

Download

memory/4940-26-0x0000000000400000-0x00000000016FC000-memory.dmp

Download

memory/4940-263-0x0000000003E30000-0x0000000003E96000-memory.dmp

Download

memory/4940-444-0x0000000000400000-0x00000000016FC000-memory.dmp

Download

memory/5048-289-0x0000000140000000-0x00000001401CE000-memory.dmp

Download

memory/5048-134-0x0000000000DB0000-0x0000000000E10000-memory.dmp

Download

memory/5048-140-0x0000000000DB0000-0x0000000000E10000-memory.dmp

Download

memory/5084-292-0x0000000140000000-0x00000001401FC000-memory.dmp

Download