Overview

overview

10

Static

static

10

2026-11-09...ar.exe

windows10-2004-x64

9

2026-11-09...ar.exe

windows11-ltsc_2024-x64

9

Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    10/11/2026, 12:16

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-11-09_9ad459ec1ecb95ae828d62a609f772ee_amadey_cobalt-strike_darkgate_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe
  • Size 10.3MB
  • Sample261110-pfty7sav6w
  • SHA256 32d0be66a2de2420d686a671dacff519377278664352a8401826ff526988ff48
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
defense_evasiondiscoveryexecutionmacropersistenceransomwarespywarestealerupx

Malware Config

Signatures

  • Custom signature
    Detects executables embedding registry key / value combination indicative of disabling Windows Defen 2 IoCs
  • Custom signature
    detects Windows exceutables potentially bypassing UAC using eventvwr.exe 2 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

    Run Powershell and hide display window.

    execution
  • Suspicious Office macro 1 IoCs

    Office document equipped with macros.

    macro
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 32 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 24 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 43 IoCs
  • UPX packed file 11 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 48 IoCs
  • Launches sc.exe 7 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Direct Volume Access: Opens a physical disk for reading 1 TTPs 1 IoCs

    Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

    defense_evasion
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 4 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 12 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 64 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-11-09_9ad459ec1ecb95ae828d62a609f772ee_amadey_cobalt-strike_darkgate_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-11-09_9ad459ec1ecb95ae828d62a609f772ee_amadey_cobalt-strike_darkgate_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe"
    1⤵
    • Checks computer location settings
    • Enumerates connected drives
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Reads the TCP/IP host and domain name from the registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4296
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Set-Location 'C:\Users\Admin\AppData\Roaming\Sysmon'; & .\Sysmon.exe -i -accepteula"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3388
      • C:\Users\Admin\AppData\Roaming\Sysmon\Sysmon.exe
        "C:\Users\Admin\AppData\Roaming\Sysmon\Sysmon.exe" -i -accepteula
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:5760
        • C:\Users\Admin\AppData\Local\Temp\Sysmon.exe
          "C:\Users\Admin\AppData\Roaming\Sysmon\Sysmon.exe" -i -accepteula
          4⤵
          • Executes dropped EXE
          • Drops file in Windows directory
          • Suspicious use of WriteProcessMemory
          PID:2860
          • C:\Windows\Sysmon.exe
            "C:\Windows\Sysmon.exe" -nologo -accepteula -m
            5⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:4496
            • C:\Windows\system32\wevtutil.exe
              "C:\Windows\system32\wevtutil.exe" um "C:\Users\Admin\AppData\Local\Temp\MANB3DA.tmp"
              6⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:1800
            • C:\Windows\system32\wevtutil.exe
              "C:\Windows\system32\wevtutil.exe" im "C:\Users\Admin\AppData\Local\Temp\MANB4B6.tmp"
              6⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:4516
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Set-Location 'C:\Users\Admin\AppData\Roaming\Sysmon'; & .\Sysmon.exe -c Keller.xml"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3760
      • C:\Users\Admin\AppData\Roaming\Sysmon\Sysmon.exe
        "C:\Users\Admin\AppData\Roaming\Sysmon\Sysmon.exe" -c Keller.xml
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1668
        • C:\Users\Admin\AppData\Local\Temp\Sysmon.exe
          "C:\Users\Admin\AppData\Roaming\Sysmon\Sysmon.exe" -c Keller.xml
          4⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:1552
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Start-Process cmd.exe -ArgumentList '/c wevtutil sl "Microsoft-Windows-Sysmon/Operational" /ms:1073741824 /rt:false /ab:false' -WindowStyle Hidden -Verb RunAs"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:5640
      • C:\Windows\system32\cmd.exe
        "C:\Windows\system32\cmd.exe" /c wevtutil sl Microsoft-Windows-Sysmon/Operational /ms:1073741824 /rt:false /ab:false
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:744
        • C:\Windows\system32\wevtutil.exe
          wevtutil sl Microsoft-Windows-Sysmon/Operational /ms:1073741824 /rt:false /ab:false
          4⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:5072
    • C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c ativarservicos.bat
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:1328
      • C:\Windows\system32\sc.exe
        sc config PcaSvc start= auto
        3⤵
        • Launches sc.exe
        PID:1824
      • C:\Windows\system32\sc.exe
        sc config PlugPlay start= auto
        3⤵
        • Launches sc.exe
        PID:2308
      • C:\Windows\system32\sc.exe
        sc config DPS start= auto
        3⤵
        • Launches sc.exe
        PID:4196
      • C:\Windows\system32\sc.exe
        sc config DiagTrack start= auto
        3⤵
        • Launches sc.exe
        PID:3508
      • C:\Windows\system32\sc.exe
        sc config SysMain start= auto
        3⤵
        • Launches sc.exe
        PID:2356
      • C:\Windows\system32\sc.exe
        sc config EventLog start= auto
        3⤵
        • Launches sc.exe
        PID:1296
      • C:\Windows\system32\sc.exe
        sc config Sysmon start= auto
        3⤵
        • Launches sc.exe
        PID:5744
      • C:\Windows\system32\net.exe
        net start PcaSvc
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4912
        • C:\Windows\system32\net1.exe
          C:\Windows\system32\net1 start PcaSvc
          4⤵
            PID:3496
        • C:\Windows\system32\net.exe
          net start PlugPlay
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:5304
          • C:\Windows\system32\net1.exe
            C:\Windows\system32\net1 start PlugPlay
            4⤵
              PID:3108
          • C:\Windows\system32\net.exe
            net start DPS
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:5740
            • C:\Windows\system32\net1.exe
              C:\Windows\system32\net1 start DPS
              4⤵
                PID:5820
            • C:\Windows\system32\net.exe
              net start DiagTrack
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:5296
              • C:\Windows\system32\net1.exe
                C:\Windows\system32\net1 start DiagTrack
                4⤵
                  PID:3120
              • C:\Windows\system32\net.exe
                net start SysMain
                3⤵
                • Suspicious use of WriteProcessMemory
                PID:2052
                • C:\Windows\system32\net1.exe
                  C:\Windows\system32\net1 start SysMain
                  4⤵
                    PID:2308
                • C:\Windows\system32\net.exe
                  net start EventLog
                  3⤵
                  • Suspicious use of WriteProcessMemory
                  PID:3508
                  • C:\Windows\system32\net1.exe
                    C:\Windows\system32\net1 start EventLog
                    4⤵
                      PID:5672
                  • C:\Windows\system32\net.exe
                    net start Sysmon
                    3⤵
                    • Suspicious use of WriteProcessMemory
                    PID:3252
                    • C:\Windows\system32\net1.exe
                      C:\Windows\system32\net1 start Sysmon
                      4⤵
                        PID:1568
                  • C:\Windows\SYSTEM32\cmd.exe
                    cmd.exe /c ativarusn.bat
                    2⤵
                    • Executes a command shell one-liner
                    • Suspicious use of WriteProcessMemory
                    PID:5800
                    • C:\Windows\system32\fsutil.exe
                      fsutil fsinfo drivetype A:
                      3⤵
                      • Enumerates connected drives
                      PID:3264
                    • C:\Windows\system32\findstr.exe
                      findstr /i "Fixed"
                      3⤵
                        PID:4256
                      • C:\Windows\system32\fsutil.exe
                        fsutil fsinfo drivetype B:
                        3⤵
                        • Enumerates connected drives
                        PID:5560
                      • C:\Windows\system32\findstr.exe
                        findstr /i "Fixed"
                        3⤵
                          PID:4308
                        • C:\Windows\system32\fsutil.exe
                          fsutil fsinfo drivetype C:
                          3⤵
                            PID:5536
                          • C:\Windows\system32\findstr.exe
                            findstr /i "Fixed"
                            3⤵
                              PID:5140
                            • C:\Windows\system32\fsutil.exe
                              fsutil fsinfo drivetype D:
                              3⤵
                                PID:4532
                              • C:\Windows\system32\findstr.exe
                                findstr /i "Fixed"
                                3⤵
                                  PID:4928
                                • C:\Windows\system32\fsutil.exe
                                  fsutil fsinfo drivetype E:
                                  3⤵
                                  • Enumerates connected drives
                                  PID:5764
                                • C:\Windows\system32\findstr.exe
                                  findstr /i "Fixed"
                                  3⤵
                                    PID:5440
                                  • C:\Windows\system32\fsutil.exe
                                    fsutil fsinfo drivetype F:
                                    3⤵
                                      PID:5948
                                    • C:\Windows\system32\findstr.exe
                                      findstr /i "Fixed"
                                      3⤵
                                        PID:2220
                                      • C:\Windows\system32\fsutil.exe
                                        fsutil fsinfo drivetype G:
                                        3⤵
                                        • Enumerates connected drives
                                        PID:5940
                                      • C:\Windows\system32\findstr.exe
                                        findstr /i "Fixed"
                                        3⤵
                                          PID:3904
                                        • C:\Windows\system32\fsutil.exe
                                          fsutil fsinfo drivetype H:
                                          3⤵
                                          • Enumerates connected drives
                                          PID:1084
                                        • C:\Windows\system32\findstr.exe
                                          findstr /i "Fixed"
                                          3⤵
                                            PID:5820
                                          • C:\Windows\system32\fsutil.exe
                                            fsutil fsinfo drivetype I:
                                            3⤵
                                            • Enumerates connected drives
                                            PID:4988
                                          • C:\Windows\system32\findstr.exe
                                            findstr /i "Fixed"
                                            3⤵
                                              PID:4164
                                            • C:\Windows\system32\fsutil.exe
                                              fsutil fsinfo drivetype J:
                                              3⤵
                                              • Enumerates connected drives
                                              PID:4488
                                            • C:\Windows\system32\findstr.exe
                                              findstr /i "Fixed"
                                              3⤵
                                                PID:1532
                                              • C:\Windows\system32\fsutil.exe
                                                fsutil fsinfo drivetype K:
                                                3⤵
                                                • Enumerates connected drives
                                                PID:6024
                                              • C:\Windows\system32\findstr.exe
                                                findstr /i "Fixed"
                                                3⤵
                                                  PID:6048
                                                • C:\Windows\system32\fsutil.exe
                                                  fsutil fsinfo drivetype L:
                                                  3⤵
                                                  • Enumerates connected drives
                                                  PID:6056
                                                • C:\Windows\system32\findstr.exe
                                                  findstr /i "Fixed"
                                                  3⤵
                                                    PID:4868
                                                  • C:\Windows\system32\fsutil.exe
                                                    fsutil fsinfo drivetype M:
                                                    3⤵
                                                    • Enumerates connected drives
                                                    PID:4896
                                                  • C:\Windows\system32\findstr.exe
                                                    findstr /i "Fixed"
                                                    3⤵
                                                      PID:5960
                                                    • C:\Windows\system32\fsutil.exe
                                                      fsutil fsinfo drivetype N:
                                                      3⤵
                                                      • Enumerates connected drives
                                                      PID:1880
                                                    • C:\Windows\system32\findstr.exe
                                                      findstr /i "Fixed"
                                                      3⤵
                                                        PID:5068
                                                      • C:\Windows\system32\fsutil.exe
                                                        fsutil fsinfo drivetype O:
                                                        3⤵
                                                        • Enumerates connected drives
                                                        PID:4920
                                                      • C:\Windows\system32\findstr.exe
                                                        findstr /i "Fixed"
                                                        3⤵
                                                          PID:3660
                                                        • C:\Windows\system32\fsutil.exe
                                                          fsutil fsinfo drivetype P:
                                                          3⤵
                                                          • Enumerates connected drives
                                                          PID:3912
                                                        • C:\Windows\system32\findstr.exe
                                                          findstr /i "Fixed"
                                                          3⤵
                                                            PID:1932
                                                          • C:\Windows\system32\fsutil.exe
                                                            fsutil fsinfo drivetype Q:
                                                            3⤵
                                                            • Enumerates connected drives
                                                            PID:4120
                                                          • C:\Windows\system32\findstr.exe
                                                            findstr /i "Fixed"
                                                            3⤵
                                                              PID:548
                                                            • C:\Windows\system32\fsutil.exe
                                                              fsutil fsinfo drivetype R:
                                                              3⤵
                                                              • Enumerates connected drives
                                                              PID:4732
                                                            • C:\Windows\system32\findstr.exe
                                                              findstr /i "Fixed"
                                                              3⤵
                                                                PID:4180
                                                              • C:\Windows\system32\fsutil.exe
                                                                fsutil fsinfo drivetype S:
                                                                3⤵
                                                                • Enumerates connected drives
                                                                PID:3604
                                                              • C:\Windows\system32\findstr.exe
                                                                findstr /i "Fixed"
                                                                3⤵
                                                                  PID:5992
                                                                • C:\Windows\system32\fsutil.exe
                                                                  fsutil fsinfo drivetype T:
                                                                  3⤵
                                                                  • Enumerates connected drives
                                                                  PID:5032
                                                                • C:\Windows\system32\findstr.exe
                                                                  findstr /i "Fixed"
                                                                  3⤵
                                                                    PID:3696
                                                                  • C:\Windows\system32\fsutil.exe
                                                                    fsutil fsinfo drivetype U:
                                                                    3⤵
                                                                    • Enumerates connected drives
                                                                    PID:4768
                                                                  • C:\Windows\system32\findstr.exe
                                                                    findstr /i "Fixed"
                                                                    3⤵
                                                                      PID:2400
                                                                    • C:\Windows\system32\fsutil.exe
                                                                      fsutil fsinfo drivetype V:
                                                                      3⤵
                                                                      • Enumerates connected drives
                                                                      PID:1416
                                                                    • C:\Windows\system32\findstr.exe
                                                                      findstr /i "Fixed"
                                                                      3⤵
                                                                        PID:4632
                                                                      • C:\Windows\system32\fsutil.exe
                                                                        fsutil fsinfo drivetype W:
                                                                        3⤵
                                                                        • Enumerates connected drives
                                                                        PID:4540
                                                                      • C:\Windows\system32\findstr.exe
                                                                        findstr /i "Fixed"
                                                                        3⤵
                                                                          PID:5984
                                                                        • C:\Windows\system32\fsutil.exe
                                                                          fsutil fsinfo drivetype X:
                                                                          3⤵
                                                                          • Enumerates connected drives
                                                                          PID:2716
                                                                        • C:\Windows\system32\findstr.exe
                                                                          findstr /i "Fixed"
                                                                          3⤵
                                                                            PID:2456
                                                                          • C:\Windows\system32\fsutil.exe
                                                                            fsutil fsinfo drivetype Y:
                                                                            3⤵
                                                                            • Enumerates connected drives
                                                                            PID:3056
                                                                          • C:\Windows\system32\findstr.exe
                                                                            findstr /i "Fixed"
                                                                            3⤵
                                                                              PID:3104
                                                                            • C:\Windows\system32\fsutil.exe
                                                                              fsutil fsinfo drivetype Z:
                                                                              3⤵
                                                                              • Enumerates connected drives
                                                                              PID:1436
                                                                            • C:\Windows\system32\findstr.exe
                                                                              findstr /i "Fixed"
                                                                              3⤵
                                                                                PID:4328
                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Set-Location 'C:\Users\Admin\AppData\Roaming\Sysmon'; & .\Sysmon.exe -i -accepteula"
                                                                              2⤵
                                                                              • Command and Scripting Interpreter: PowerShell
                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                              PID:4344
                                                                              • C:\Users\Admin\AppData\Roaming\Sysmon\Sysmon.exe
                                                                                "C:\Users\Admin\AppData\Roaming\Sysmon\Sysmon.exe" -i -accepteula
                                                                                3⤵
                                                                                • Executes dropped EXE
                                                                                • System Location Discovery: System Language Discovery
                                                                                PID:3112
                                                                                • C:\Users\Admin\AppData\Local\Temp\Sysmon.exe
                                                                                  "C:\Users\Admin\AppData\Roaming\Sysmon\Sysmon.exe" -i -accepteula
                                                                                  4⤵
                                                                                  • Executes dropped EXE
                                                                                  PID:1584
                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Set-Location 'C:\Users\Admin\AppData\Roaming\Sysmon'; & .\Sysmon.exe -c Keller.xml"
                                                                              2⤵
                                                                              • Command and Scripting Interpreter: PowerShell
                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                              PID:2748
                                                                              • C:\Users\Admin\AppData\Roaming\Sysmon\Sysmon.exe
                                                                                "C:\Users\Admin\AppData\Roaming\Sysmon\Sysmon.exe" -c Keller.xml
                                                                                3⤵
                                                                                • Executes dropped EXE
                                                                                • System Location Discovery: System Language Discovery
                                                                                PID:2344
                                                                                • C:\Users\Admin\AppData\Local\Temp\Sysmon.exe
                                                                                  "C:\Users\Admin\AppData\Roaming\Sysmon\Sysmon.exe" -c Keller.xml
                                                                                  4⤵
                                                                                  • Executes dropped EXE
                                                                                  PID:4440
                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Start-Process cmd.exe -ArgumentList '/c wevtutil sl "Microsoft-Windows-Sysmon/Operational" /ms:1073741824 /rt:false /ab:false' -WindowStyle Hidden -Verb RunAs"
                                                                              2⤵
                                                                              • Command and Scripting Interpreter: PowerShell
                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                              PID:3968
                                                                              • C:\Windows\system32\cmd.exe
                                                                                "C:\Windows\system32\cmd.exe" /c wevtutil sl Microsoft-Windows-Sysmon/Operational /ms:1073741824 /rt:false /ab:false
                                                                                3⤵
                                                                                • Executes a command shell one-liner
                                                                                PID:1400
                                                                                • C:\Windows\system32\wevtutil.exe
                                                                                  wevtutil sl Microsoft-Windows-Sysmon/Operational /ms:1073741824 /rt:false /ab:false
                                                                                  4⤵
                                                                                    PID:5152
                                                                            • C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
                                                                              C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
                                                                              1⤵
                                                                              • Executes dropped EXE
                                                                              • Drops file in System32 directory
                                                                              • Drops file in Program Files directory
                                                                              • Drops file in Windows directory
                                                                              • Reads the TCP/IP host and domain name from the registry
                                                                              PID:1904
                                                                            • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                                                              "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                                                                              1⤵
                                                                              • Executes dropped EXE
                                                                              PID:6080
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                              1⤵
                                                                              • Executes dropped EXE
                                                                              PID:3140
                                                                            • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
                                                                              "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
                                                                              1⤵
                                                                              • Executes dropped EXE
                                                                              PID:2316
                                                                            • C:\Windows\System32\msdtc.exe
                                                                              C:\Windows\System32\msdtc.exe
                                                                              1⤵
                                                                              • Executes dropped EXE
                                                                              • Drops file in System32 directory
                                                                              • Drops file in Windows directory
                                                                              PID:3752
                                                                            • \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
                                                                              "c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
                                                                              1⤵
                                                                              • Executes dropped EXE
                                                                              PID:4616
                                                                            • C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
                                                                              C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
                                                                              1⤵
                                                                              • Executes dropped EXE
                                                                              PID:5736
                                                                            • C:\Windows\SysWow64\perfhost.exe
                                                                              C:\Windows\SysWow64\perfhost.exe
                                                                              1⤵
                                                                              • Executes dropped EXE
                                                                              • System Location Discovery: System Language Discovery
                                                                              PID:6004
                                                                            • C:\Windows\system32\locator.exe
                                                                              C:\Windows\system32\locator.exe
                                                                              1⤵
                                                                              • Executes dropped EXE
                                                                              PID:3144
                                                                            • C:\Windows\System32\SensorDataService.exe
                                                                              C:\Windows\System32\SensorDataService.exe
                                                                              1⤵
                                                                              • Executes dropped EXE
                                                                              • Checks SCSI registry key(s)
                                                                              PID:5140
                                                                            • C:\Windows\System32\snmptrap.exe
                                                                              C:\Windows\System32\snmptrap.exe
                                                                              1⤵
                                                                              • Executes dropped EXE
                                                                              • Reads the TCP/IP host and domain name from the registry
                                                                              PID:4240
                                                                            • C:\Windows\system32\spectrum.exe
                                                                              C:\Windows\system32\spectrum.exe
                                                                              1⤵
                                                                              • Executes dropped EXE
                                                                              • Checks SCSI registry key(s)
                                                                              PID:2988
                                                                            • C:\Windows\System32\OpenSSH\ssh-agent.exe
                                                                              C:\Windows\System32\OpenSSH\ssh-agent.exe
                                                                              1⤵
                                                                              • Executes dropped EXE
                                                                              PID:5020
                                                                            • C:\Windows\system32\svchost.exe
                                                                              C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
                                                                              1⤵
                                                                                PID:2312
                                                                              • C:\Windows\system32\TieringEngineService.exe
                                                                                C:\Windows\system32\TieringEngineService.exe
                                                                                1⤵
                                                                                • Executes dropped EXE
                                                                                • Checks processor information in registry
                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                PID:1484
                                                                              • C:\Windows\system32\AgentService.exe
                                                                                C:\Windows\system32\AgentService.exe
                                                                                1⤵
                                                                                • Executes dropped EXE
                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                PID:4120
                                                                              • C:\Windows\System32\vds.exe
                                                                                C:\Windows\System32\vds.exe
                                                                                1⤵
                                                                                • Executes dropped EXE
                                                                                PID:4636
                                                                              • C:\Windows\system32\vssvc.exe
                                                                                C:\Windows\system32\vssvc.exe
                                                                                1⤵
                                                                                • Executes dropped EXE
                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                PID:3908
                                                                              • C:\Windows\system32\wbengine.exe
                                                                                "C:\Windows\system32\wbengine.exe"
                                                                                1⤵
                                                                                • Executes dropped EXE
                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                PID:3944
                                                                              • C:\Windows\system32\wbem\WmiApSrv.exe
                                                                                C:\Windows\system32\wbem\WmiApSrv.exe
                                                                                1⤵
                                                                                • Executes dropped EXE
                                                                                • Reads the TCP/IP host and domain name from the registry
                                                                                PID:516
                                                                              • C:\Windows\system32\SearchIndexer.exe
                                                                                C:\Windows\system32\SearchIndexer.exe /Embedding
                                                                                1⤵
                                                                                • Executes dropped EXE
                                                                                • Direct Volume Access: Opens a physical disk for reading
                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                PID:2352
                                                                                • C:\Windows\system32\SearchProtocolHost.exe
                                                                                  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
                                                                                  2⤵
                                                                                  • Modifies data under HKEY_USERS
                                                                                  PID:4632
                                                                                • C:\Windows\system32\SearchFilterHost.exe
                                                                                  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
                                                                                  2⤵
                                                                                  • Modifies data under HKEY_USERS
                                                                                  PID:4472
                                                                              • C:\Windows\Sysmon.exe
                                                                                C:\Windows\Sysmon.exe
                                                                                1⤵
                                                                                • Executes dropped EXE
                                                                                PID:752
                                                                              • C:\Windows\System32\svchost.exe
                                                                                C:\Windows\System32\svchost.exe -k LocalServiceNoNetwork -p -s DPS
                                                                                1⤵
                                                                                • Drops file in System32 directory
                                                                                • Checks processor information in registry
                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                PID:2000
                                                                              • C:\Windows\System32\svchost.exe
                                                                                C:\Windows\System32\svchost.exe -k LocalService -p -s WdiServiceHost
                                                                                1⤵
                                                                                  PID:5812
                                                                                • C:\Windows\System32\svchost.exe
                                                                                  C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s WdiSystemHost
                                                                                  1⤵
                                                                                    PID:2332
                                                                                  • C:\Windows\System32\svchost.exe
                                                                                    C:\Windows\System32\svchost.exe -k utcsvc -p
                                                                                    1⤵
                                                                                      PID:4504
                                                                                    • C:\Windows\system32\svchost.exe
                                                                                      C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s SysMain
                                                                                      1⤵
                                                                                      • Drops file in Windows directory
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                      PID:4204
                                                                                      • C:\Windows\system32\defrag.exe
                                                                                        "C:\Windows\system32\defrag.exe" -p 106c -s 0000000000000280 -b -OnlyPreferred C:
                                                                                        2⤵
                                                                                          PID:4028
                                                                                      • C:\Windows\Sysmon.exe
                                                                                        C:\Windows\Sysmon.exe
                                                                                        1⤵
                                                                                        • Executes dropped EXE
                                                                                        • Reads the TCP/IP host and domain name from the registry
                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                        PID:3788
                                                                                      • C:\Windows\system32\wbem\unsecapp.exe
                                                                                        C:\Windows\system32\wbem\unsecapp.exe -Embedding
                                                                                        1⤵
                                                                                          PID:5452
                                                                                        • C:\Windows\Sysmon.exe
                                                                                          C:\Windows\Sysmon.exe
                                                                                          1⤵
                                                                                          • Executes dropped EXE
                                                                                          • Reads the TCP/IP host and domain name from the registry
                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                          PID:5488

                                                                                        Network

                                                                                              MITRE ATT&CK Enterprise v16

                                                                                              Replay Monitor

                                                                                              Loading Replay Monitor...

                                                                                              Downloads

                                                                                              elevation_service.exe
                                                                                              • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                                              • Size 2.7MB
                                                                                              • SHA256 789c0cfe312b7d499abddc073358d2f7adda6ac32009f24ac7e94683eb8eff1a
                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                              Submit Download

                                                                                              maintenanceservice.exe
                                                                                              • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
                                                                                              • Size 2.2MB
                                                                                              • SHA256 f8f106545894881e0e66dad191251bcf65013c6611398868ad6d2a6ebeca259c
                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                              Submit Download

                                                                                              maintenanceservice.exe
                                                                                              • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
                                                                                              • Size 1.4MB
                                                                                              • SHA256 c9602641d3fb188857474688c3c1d8880625ef8d647adf15b4d55ce84bb80cf7
                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                              Submit Download

                                                                                              maintenanceservice.exe
                                                                                              • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
                                                                                              • Size 2.2MB
                                                                                              • SHA256 4fda44a042ce65cb43fe8ad7eb303ccf586fd4d201fe0b2651e382ffb05b0aff
                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                              Submit Download

                                                                                              OSE.EXE
                                                                                              • Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
                                                                                              • Size 1.4MB
                                                                                              • SHA256 5455519e1cbf16e3993f3b6729847b7752b23d824e0e06bb74d2a471cb40b7b5
                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                              Submit Download

                                                                                              elevation_service.exe
                                                                                              • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                                                                              • Size 2.8MB
                                                                                              • SHA256 b787f4410fd69c9ed6a5d968734e72f124f4994d90d031b9093a7ecb1e52348e
                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                              Submit Download

                                                                                              wmpnetwk.exe
                                                                                              • Path C:\Program Files\Windows Media Player\wmpnetwk.exe
                                                                                              • Size 2.2MB
                                                                                              • SHA256 367a95aa9cfcdd5a2a890b002663f2453a5f37a93148661deb64496b06040275
                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                              Submit Download

                                                                                              wmpnetwk.exe
                                                                                              • Path C:\Program Files\Windows Media Player\wmpnetwk.exe
                                                                                              • Size 2.2MB
                                                                                              • SHA256 35016119dad8ee4f12930d93d5a5f3ac8a7920e2d254cbd0489734bde7979112
                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                              Submit Download

                                                                                              powershell.exe.log
                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                                                                                              • Size 2KB
                                                                                              • SHA256 b1f292b6199aa29c7fafbca007e5f9e3f68edcbbca1965bc828cc92dc0f18bb8
                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                              Submit Download

                                                                                              StartupProfileData-NonInteractive
                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                              • Size 64B
                                                                                              • SHA256 9446d609c3183c147b820e084c47ac4cbda9f5cff8138b6cc02cc09df9adeddc
                                                                                              • MD5 SHA1 SHA512
                                                                                              Submit Download

                                                                                              StartupProfileData-NonInteractive
                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                              • Size 64B
                                                                                              • SHA256 9105698f1a7891c4255137db174b9b834557a6df59d4f88b58b566c828b87451
                                                                                              • MD5 SHA1 SHA512
                                                                                              Submit Download

                                                                                              StartupProfileData-NonInteractive
                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                              • Size 64B
                                                                                              • SHA256 a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf
                                                                                              • MD5 SHA1 SHA512
                                                                                              Submit Download

                                                                                              MANB3DA.tmp
                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\MANB3DA.tmp
                                                                                              • Size 99KB
                                                                                              • SHA256 f7eae416e5a3d9bfb2bfe8a9753dc2f381361a8e81c9921d874ebf1d1125b9d0
                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                              Submit Download

                                                                                              __PSScriptPolicyTest_q531ihdn.cl3.ps1
                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_q531ihdn.cl3.ps1
                                                                                              • Size 60B
                                                                                              • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                              Submit Download

                                                                                              ativarservicos.bat
                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\ativarservicos.bat
                                                                                              • Size 248B
                                                                                              • SHA256 2ab823c89be788710ff2f383683ede1407fc26555ba1ec7bcbd59911caf91007
                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                              Submit Download

                                                                                              ativarusn.bat
                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\ativarusn.bat
                                                                                              • Size 442B
                                                                                              • SHA256 14e3abcace921ecd3517a011cbbac6f21d794bd9ca7f3d37d19b52da1d175c33
                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                              Submit Download

                                                                                              Keller.xml
                                                                                              • Path C:\Users\Admin\AppData\Roaming\Sysmon\Keller.xml
                                                                                              • Size 391KB
                                                                                              • SHA256 070f46bee7a0cc212f2c392221cbc91e3c8630c6a747a1aea52cd88d76287a6a
                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                              Submit Download

                                                                                              Sysmon.exe
                                                                                              • Path C:\Users\Admin\AppData\Roaming\Sysmon\Sysmon.exe
                                                                                              • Size 8.1MB
                                                                                              • SHA256 71485d919102387e71f20ddc809bd849b7694d2b3f2cdd45a15a4ef9f9c788f2
                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                              Submit Download

                                                                                              UndoBackup.docm
                                                                                              • Path C:\Users\Admin\Documents\UndoBackup.docm
                                                                                              • Size 777KB
                                                                                              • SHA256 7492e164a948d54f6dc284fa0b70e86cdba3a8a7270789d90631fdee5768b041
                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                              Submit Download

                                                                                              SRU.LOG
                                                                                              • Path C:\WINDOWS\SYSTEM32\SRU\SRU.LOG
                                                                                              • Size 64KB
                                                                                              • SHA256 f6ca777d19811f3acb11b003b7b9e68b826079942c9b732c7bbdf447083b3ba9
                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                              Submit Download

                                                                                              SRUTMP.LOG
                                                                                              • Path C:\WINDOWS\SYSTEM32\SRU\SRUTMP.LOG
                                                                                              • Size 64KB
                                                                                              • SHA256 de2f256064a0af797747c2b97505dc0b9f3df0de4f489eac731c23ae9ca9cc31
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              FINDSTR.EXE-2E9C6FE2.pf
                                                                                              • Path C:\Windows\Prefetch\FINDSTR.EXE-2E9C6FE2.pf
                                                                                              • Size 1KB
                                                                                              • SHA256 eb21a643ac3729956b16ce5c876028fd0d3dccd74cb9923f171a8b85c832527b
                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                              Submit Download

                                                                                              FSUTIL.EXE-2646CFBB.pf
                                                                                              • Path C:\Windows\Prefetch\FSUTIL.EXE-2646CFBB.pf
                                                                                              • Size 1KB
                                                                                              • SHA256 0d9926401d904b84b17d44f516649cba0448c3b0f5ef077240587e2e21c1860f
                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                              Submit Download

                                                                                              NET.EXE-DF44F913.pf
                                                                                              • Path C:\Windows\Prefetch\NET.EXE-DF44F913.pf
                                                                                              • Size 1KB
                                                                                              • SHA256 acf5f75ca06ce25c34cfcbf8c0feb6b3b360d4bcb838cb29bfbd2c660a0058cd
                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                              Submit Download

                                                                                              NET.EXE-DF44F913.pf
                                                                                              • Path C:\Windows\Prefetch\NET.EXE-DF44F913.pf
                                                                                              • Size 1KB
                                                                                              • SHA256 acb91bbcf3ec59f3424184a045affac34e330a284bf3104d4e78dd3db271c7da
                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                              Submit Download

                                                                                              NET1.EXE-849DA590.pf
                                                                                              • Path C:\Windows\Prefetch\NET1.EXE-849DA590.pf
                                                                                              • Size 2KB
                                                                                              • SHA256 a89cd60c154e9f335afe0c390b7fe1db66cb3cbe0e319427cdafee39af87539a
                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                              Submit Download

                                                                                              perfhost.exe
                                                                                              • Path C:\Windows\SysWOW64\perfhost.exe
                                                                                              • Size 1.2MB
                                                                                              • SHA256 3a4852a02ca09b4468054f2cb82431da5d868678d7cf3f37d702c2a4faf87298
                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                              Submit Download

                                                                                              Sysmon.exe
                                                                                              • Path C:\Windows\Sysmon.exe
                                                                                              • Size 4.3MB
                                                                                              • SHA256 39b094613132377bc236f4ad940a3e02c544f86347c0179a9425edc1bd3b85cd
                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                              Submit Download

                                                                                              AgentService.exe
                                                                                              • Path C:\Windows\System32\AgentService.exe
                                                                                              • Size 1.7MB
                                                                                              • SHA256 a131ac3b1db91761ca687cb3804ca7a95c5798e77de1e1ad3366a059860a6887
                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                              Submit Download

                                                                                              AgentService.exe
                                                                                              • Path C:\Windows\System32\AgentService.exe
                                                                                              • Size 2.5MB
                                                                                              • SHA256 61ba004dc1cb337aa49f4d011a8f859482a34b02810f7d9718245fa08849743c
                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                              Submit Download

                                                                                              DiagnosticsHub.StandardCollector.Service.exe
                                                                                              • Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
                                                                                              • Size 1.3MB
                                                                                              • SHA256 38bff3dee7e77b276dfbb75f6d0fab6498ff362805fc00cb09f7270abb9f34f7
                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                              Submit Download

                                                                                              Locator.exe
                                                                                              • Path C:\Windows\System32\Locator.exe
                                                                                              • Size 1.2MB
                                                                                              • SHA256 3b7de6294ff9187c1110298b08b21196c9cc0410c866895f8c62b0ab34a5a96e
                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                              Submit Download

                                                                                              ssh-agent.exe
                                                                                              • Path C:\Windows\System32\OpenSSH\ssh-agent.exe
                                                                                              • Size 1.5MB
                                                                                              • SHA256 ce40f8c75ecf5145176f07ad038d33dae7db9afa546f394c75a8e09a3a130586
                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                              Submit Download

                                                                                              PerceptionSimulationService.exe
                                                                                              • Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
                                                                                              • Size 1.3MB
                                                                                              • SHA256 fe1713f5ee03de7fa45b55d7258bd77d1f3d9057deca848c5f011d541e4275e2
                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                              Submit Download

                                                                                              SearchIndexer.exe
                                                                                              • Path C:\Windows\System32\SearchIndexer.exe
                                                                                              • Size 1.4MB
                                                                                              • SHA256 ba303982bab4ace73a61180eabbe3b185cc6d2a5566a90e586ead0f0a56e26b0
                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                              Submit Download

                                                                                              SensorDataService.exe
                                                                                              • Path C:\Windows\System32\SensorDataService.exe
                                                                                              • Size 1.8MB
                                                                                              • SHA256 237f080bda45980b61cedaf10af76ccb13e80785a743c50ab2922cca2db97917
                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                              Submit Download

                                                                                              SensorDataService.exe
                                                                                              • Path C:\Windows\System32\SensorDataService.exe
                                                                                              • Size 2.5MB
                                                                                              • SHA256 e227981528ca398038686e5f3af9f0d6af94d2bfe05211e27fea21ffcda2d284
                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                              Submit Download

                                                                                              SensorDataService.exe
                                                                                              • Path C:\Windows\System32\SensorDataService.exe
                                                                                              • Size 2.5MB
                                                                                              • SHA256 4854996e1af2c1248643967ddd85286812cb3f83be6004a1ee5ecfb54304c4b1
                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                              Submit Download

                                                                                              SgrmBroker.exe
                                                                                              • Path C:\Windows\System32\SgrmBroker.exe
                                                                                              • Size 2.2MB
                                                                                              • SHA256 433dc5270bed52d9cb0e36285477d471502389d324f2f51647aaa8ff92c51ad7
                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                              Submit Download

                                                                                              Spectrum.exe
                                                                                              • Path C:\Windows\System32\Spectrum.exe
                                                                                              • Size 1.4MB
                                                                                              • SHA256 312956d708ed0b61bf9286dabfce6b07c9ba66b0cc665898bb18467cc54f44c7
                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                              Submit Download

                                                                                              TieringEngineService.exe
                                                                                              • Path C:\Windows\System32\TieringEngineService.exe
                                                                                              • Size 1.5MB
                                                                                              • SHA256 c1feabf94f2d3feeb847cb084059961f66636f5660277aaa6c8f1622a160ab14
                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                              Submit Download

                                                                                              VSSVC.exe
                                                                                              • Path C:\Windows\System32\VSSVC.exe
                                                                                              • Size 2.0MB
                                                                                              • SHA256 a4ba838d8af4236815be5b667f95983a3fd23354464742afff7844a474305492
                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                              Submit Download

                                                                                              alg.exe
                                                                                              • Path C:\Windows\System32\alg.exe
                                                                                              • Size 854KB
                                                                                              • SHA256 8bd0c683632eaca623ffad987352bd75ce573d90b1864cd90851fd95067240f2
                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                              Submit Download

                                                                                              msdtc.exe
                                                                                              • Path C:\Windows\System32\msdtc.exe
                                                                                              • Size 1.3MB
                                                                                              • SHA256 b20e55d7bad6b0b8ebc16c1e279e98c384666fe1163fab421003d06bb6864e6b
                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                              Submit Download

                                                                                              msiexec.exe
                                                                                              • Path C:\Windows\System32\msiexec.exe
                                                                                              • Size 2.0MB
                                                                                              • SHA256 0d20ad373deaa3246ad8d95412ee0031b04e2eb7c606702fc6dde630b410cc3d
                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                              Submit Download

                                                                                              snmptrap.exe
                                                                                              • Path C:\Windows\System32\snmptrap.exe
                                                                                              • Size 1.2MB
                                                                                              • SHA256 93473d723d747788b430efa26a50f5b410924eb123ddb23f4d786a1e241cd530
                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                              Submit Download

                                                                                              vds.exe
                                                                                              • Path C:\Windows\System32\vds.exe
                                                                                              • Size 1.3MB
                                                                                              • SHA256 e451fedbf91ee27d9690bfdcdc693c6fe8b667a5263813a5a9c91f535a0ce707
                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                              Submit Download

                                                                                              WmiApSrv.exe
                                                                                              • Path C:\Windows\System32\wbem\WmiApSrv.exe
                                                                                              • Size 1.4MB
                                                                                              • SHA256 49e44b868d33d1aff6cc0bdde78b947308e2fba6a83235db9539d4f146f56fee
                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                              Submit Download

                                                                                              wbengine.exe
                                                                                              • Path C:\Windows\System32\wbengine.exe
                                                                                              • Size 2.1MB
                                                                                              • SHA256 51a2476c9cdaa03d438ef42a7df1f6e38d04a29c771d691424b72fa429f3d7e7
                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                              Submit Download

                                                                                              AgentService.exe
                                                                                              • Path C:\Windows\system32\AgentService.exe
                                                                                              • Size 2.5MB
                                                                                              • SHA256 9eef0b0d04cec76b863d610700de0b76065c8f5f4f421379e3c8d13f91a34c30
                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                              Submit Download

                                                                                              AppVClient.exe
                                                                                              • Path C:\Windows\system32\AppVClient.exe
                                                                                              • Size 1.5MB
                                                                                              • SHA256 0d44e0f2ecaa3ee1268b5e14e28db90c67dfdc5b3d715bb6d1e2dace07e69f33
                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                              Submit Download

                                                                                              SgrmBroker.exe
                                                                                              • Path C:\Windows\system32\SgrmBroker.exe
                                                                                              • Size 2.2MB
                                                                                              • SHA256 deca8f45bfbcc92cd778a3efeb28fb88bfc1fca4089cd6e47b979a06899d544e
                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                              Submit Download

                                                                                              fxssvc.exe
                                                                                              • Path C:\Windows\system32\fxssvc.exe
                                                                                              • Size 1.4MB
                                                                                              • SHA256 64699679ab634d6b3692f6648dcf33dc18d3df549ecd8da2475e0691f92ca04e
                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                              Submit Download

                                                                                              msiexec.exe
                                                                                              • Path C:\Windows\system32\msiexec.exe
                                                                                              • Size 2.0MB
                                                                                              • SHA256 9be980eb52def86ed6cdb15be2ff93101857432767d0a7a099cea53fc3ca054f
                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                              Submit Download

                                                                                              memory/516-495-0x0000000140000000-0x0000000140164000-memory.dmp
                                                                                              Download

                                                                                              memory/516-203-0x0000000140000000-0x0000000140164000-memory.dmp
                                                                                              Download

                                                                                              memory/1484-180-0x0000000140000000-0x0000000140180000-memory.dmp
                                                                                              Download

                                                                                              memory/1484-415-0x0000000140000000-0x0000000140180000-memory.dmp
                                                                                              Download

                                                                                              memory/1904-34-0x0000000000680000-0x00000000006E0000-memory.dmp
                                                                                              Download

                                                                                              memory/1904-43-0x0000000000680000-0x00000000006E0000-memory.dmp
                                                                                              Download

                                                                                              memory/1904-42-0x0000000140000000-0x0000000140147000-memory.dmp
                                                                                              Download

                                                                                              memory/2000-508-0x0000022FCFB60000-0x0000022FCFB61000-memory.dmp
                                                                                              Download

                                                                                              memory/2316-75-0x00000000016E0000-0x0000000001740000-memory.dmp
                                                                                              Download

                                                                                              memory/2316-69-0x00000000016E0000-0x0000000001740000-memory.dmp
                                                                                              Download

                                                                                              memory/2316-179-0x0000000140000000-0x0000000140174000-memory.dmp
                                                                                              Download

                                                                                              memory/2316-83-0x0000000140000000-0x0000000140174000-memory.dmp
                                                                                              Download

                                                                                              memory/2316-80-0x00000000016E0000-0x0000000001740000-memory.dmp
                                                                                              Download

                                                                                              memory/2352-208-0x0000000140000000-0x0000000140179000-memory.dmp
                                                                                              Download

                                                                                              memory/2352-496-0x0000000140000000-0x0000000140179000-memory.dmp
                                                                                              Download

                                                                                              memory/2352-233-0x0000000001A30000-0x0000000001A40000-memory.dmp
                                                                                              Download

                                                                                              memory/2352-217-0x0000000001780000-0x0000000001790000-memory.dmp
                                                                                              Download

                                                                                              memory/2352-249-0x0000000009E70000-0x0000000009E78000-memory.dmp
                                                                                              Download

                                                                                              memory/2352-717-0x000000000CAB0000-0x000000000CAB8000-memory.dmp
                                                                                              Download

                                                                                              memory/2988-309-0x0000000001340000-0x00000000013CD000-memory.dmp
                                                                                              Download

                                                                                              memory/2988-151-0x0000000140000000-0x0000000140169000-memory.dmp
                                                                                              Download

                                                                                              memory/2988-349-0x0000000140000000-0x0000000140169000-memory.dmp
                                                                                              Download

                                                                                              memory/2988-152-0x0000000000700000-0x0000000000760000-memory.dmp
                                                                                              Download

                                                                                              memory/2988-145-0x0000000000700000-0x0000000000760000-memory.dmp
                                                                                              Download

                                                                                              memory/3140-65-0x0000000000890000-0x00000000008F0000-memory.dmp
                                                                                              Download

                                                                                              memory/3140-82-0x0000000140000000-0x00000001402D4000-memory.dmp
                                                                                              Download

                                                                                              memory/3140-59-0x0000000000890000-0x00000000008F0000-memory.dmp
                                                                                              Download

                                                                                              memory/3144-202-0x0000000140000000-0x0000000140133000-memory.dmp
                                                                                              Download

                                                                                              memory/3144-132-0x0000000140000000-0x0000000140133000-memory.dmp
                                                                                              Download

                                                                                              memory/3388-106-0x0000022022180000-0x00000220221A2000-memory.dmp
                                                                                              Download

                                                                                              memory/3752-184-0x0000000140000000-0x0000000140157000-memory.dmp
                                                                                              Download

                                                                                              memory/3752-85-0x0000000140000000-0x0000000140157000-memory.dmp
                                                                                              Download

                                                                                              memory/3908-476-0x0000000140000000-0x00000001401FC000-memory.dmp
                                                                                              Download

                                                                                              memory/3908-195-0x0000000140000000-0x00000001401FC000-memory.dmp
                                                                                              Download

                                                                                              memory/3944-489-0x0000000140000000-0x0000000140216000-memory.dmp
                                                                                              Download

                                                                                              memory/3944-199-0x0000000140000000-0x0000000140216000-memory.dmp
                                                                                              Download

                                                                                              memory/4120-185-0x0000000140000000-0x00000001401C0000-memory.dmp
                                                                                              Download

                                                                                              memory/4120-187-0x0000000140000000-0x00000001401C0000-memory.dmp
                                                                                              Download

                                                                                              memory/4240-140-0x0000000140000000-0x0000000140134000-memory.dmp
                                                                                              Download

                                                                                              memory/4240-310-0x0000000140000000-0x0000000140134000-memory.dmp
                                                                                              Download

                                                                                              memory/4296-21-0x0000000002BA0000-0x0000000002C00000-memory.dmp
                                                                                              Download

                                                                                              memory/4296-0-0x0000000002040000-0x00000000020C4000-memory.dmp
                                                                                              Download

                                                                                              memory/4296-79-0x0000000140000000-0x0000000141D68000-memory.dmp
                                                                                              Download

                                                                                              memory/4296-6-0x0000000002040000-0x00000000020C4000-memory.dmp
                                                                                              Download

                                                                                              memory/4296-13-0x0000000002BA0000-0x0000000002C00000-memory.dmp
                                                                                              Download

                                                                                              memory/4296-7-0x0000000140000000-0x0000000141D68000-memory.dmp
                                                                                              Download

                                                                                              memory/4472-733-0x0000016946CC0000-0x0000016946CD0000-memory.dmp
                                                                                              Download

                                                                                              memory/4472-750-0x0000016946CC0000-0x0000016946CD0000-memory.dmp
                                                                                              Download

                                                                                              memory/4472-755-0x0000016946CC0000-0x0000016946CD0000-memory.dmp
                                                                                              Download

                                                                                              memory/4472-756-0x0000016946CC0000-0x0000016946CD0000-memory.dmp
                                                                                              Download

                                                                                              memory/4472-757-0x0000016946CC0000-0x0000016946CD0000-memory.dmp
                                                                                              Download

                                                                                              memory/4472-758-0x0000016946CC0000-0x0000016946CD0000-memory.dmp
                                                                                              Download

                                                                                              memory/4472-759-0x0000016946CC0000-0x0000016946CD0000-memory.dmp
                                                                                              Download

                                                                                              memory/4472-760-0x0000016946CC0000-0x0000016946CD0000-memory.dmp
                                                                                              Download

                                                                                              memory/4472-724-0x0000016946CC0000-0x0000016946CD0000-memory.dmp
                                                                                              Download

                                                                                              memory/4472-725-0x0000016946CC0000-0x0000016946CD0000-memory.dmp
                                                                                              Download

                                                                                              memory/4472-726-0x0000016946CC0000-0x0000016946CD0000-memory.dmp
                                                                                              Download

                                                                                              memory/4472-744-0x0000016946CC0000-0x0000016946CD0000-memory.dmp
                                                                                              Download

                                                                                              memory/4472-722-0x0000016946CC0000-0x0000016946CD0000-memory.dmp
                                                                                              Download

                                                                                              memory/4472-723-0x0000016946CC0000-0x0000016946CD0000-memory.dmp
                                                                                              Download

                                                                                              memory/4472-727-0x0000016946CC0000-0x0000016946CD0000-memory.dmp
                                                                                              Download

                                                                                              memory/4472-730-0x0000016946CC0000-0x0000016946CD0000-memory.dmp
                                                                                              Download

                                                                                              memory/4472-729-0x0000016946CC0000-0x0000016946CD0000-memory.dmp
                                                                                              Download

                                                                                              memory/4472-731-0x0000016946CC0000-0x0000016946CD0000-memory.dmp
                                                                                              Download

                                                                                              memory/4472-735-0x0000016946CC0000-0x0000016946CD0000-memory.dmp
                                                                                              Download

                                                                                              memory/4472-737-0x0000016946CC0000-0x0000016946CD0000-memory.dmp
                                                                                              Download

                                                                                              memory/4472-736-0x0000016946CC0000-0x0000016946CD0000-memory.dmp
                                                                                              Download

                                                                                              memory/4472-734-0x0000016946CC0000-0x0000016946CD0000-memory.dmp
                                                                                              Download

                                                                                              memory/4472-745-0x0000016946CC0000-0x0000016946CD0000-memory.dmp
                                                                                              Download

                                                                                              memory/4472-739-0x0000016946CC0000-0x0000016946CD0000-memory.dmp
                                                                                              Download

                                                                                              memory/4472-738-0x0000016946CC0000-0x0000016946CD0000-memory.dmp
                                                                                              Download

                                                                                              memory/4472-732-0x0000016946CC0000-0x0000016946CD0000-memory.dmp
                                                                                              Download

                                                                                              memory/4472-740-0x0000016946CC0000-0x0000016946CD0000-memory.dmp
                                                                                              Download

                                                                                              memory/4472-743-0x0000016946CC0000-0x0000016946CD0000-memory.dmp
                                                                                              Download

                                                                                              memory/4472-742-0x0000016946CC0000-0x0000016946CD0000-memory.dmp
                                                                                              Download

                                                                                              memory/4472-741-0x0000016946CC0000-0x0000016946CD0000-memory.dmp
                                                                                              Download

                                                                                              memory/4472-728-0x0000016946CC0000-0x0000016946CD0000-memory.dmp
                                                                                              Download

                                                                                              memory/4472-746-0x0000016946CC0000-0x0000016946CD0000-memory.dmp
                                                                                              Download

                                                                                              memory/4472-753-0x0000016946CC0000-0x0000016946CD0000-memory.dmp
                                                                                              Download

                                                                                              memory/4472-752-0x0000016946CC0000-0x0000016946CD0000-memory.dmp
                                                                                              Download

                                                                                              memory/4472-751-0x0000016946CC0000-0x0000016946CD0000-memory.dmp
                                                                                              Download

                                                                                              memory/4472-749-0x0000016946CC0000-0x0000016946CD0000-memory.dmp
                                                                                              Download

                                                                                              memory/4472-748-0x0000016946CC0000-0x0000016946CD0000-memory.dmp
                                                                                              Download

                                                                                              memory/4472-747-0x0000016946CC0000-0x0000016946CD0000-memory.dmp
                                                                                              Download

                                                                                              memory/4616-97-0x0000000140000000-0x000000014016E000-memory.dmp
                                                                                              Download

                                                                                              memory/4616-89-0x0000000000820000-0x0000000000880000-memory.dmp
                                                                                              Download

                                                                                              memory/4616-95-0x0000000000820000-0x0000000000880000-memory.dmp
                                                                                              Download

                                                                                              memory/4616-189-0x0000000140000000-0x000000014016E000-memory.dmp
                                                                                              Download

                                                                                              memory/4636-190-0x0000000140000000-0x0000000140147000-memory.dmp
                                                                                              Download

                                                                                              memory/4636-472-0x0000000140000000-0x0000000140147000-memory.dmp
                                                                                              Download

                                                                                              memory/5020-174-0x0000000000C50000-0x0000000000CB0000-memory.dmp
                                                                                              Download

                                                                                              memory/5020-167-0x0000000000C50000-0x0000000000CB0000-memory.dmp
                                                                                              Download

                                                                                              memory/5020-400-0x0000000140000000-0x00000001401A1000-memory.dmp
                                                                                              Download

                                                                                              memory/5020-173-0x0000000140000000-0x00000001401A1000-memory.dmp
                                                                                              Download

                                                                                              memory/5140-135-0x0000000140000000-0x00000001401D7000-memory.dmp
                                                                                              Download

                                                                                              memory/5140-207-0x0000000140000000-0x00000001401D7000-memory.dmp
                                                                                              Download

                                                                                              memory/5140-315-0x0000000140000000-0x00000001401D7000-memory.dmp
                                                                                              Download

                                                                                              memory/5736-194-0x0000000140000000-0x0000000140149000-memory.dmp
                                                                                              Download

                                                                                              memory/5736-108-0x0000000000B40000-0x0000000000BA0000-memory.dmp
                                                                                              Download

                                                                                              memory/5736-114-0x0000000000B40000-0x0000000000BA0000-memory.dmp
                                                                                              Download

                                                                                              memory/5736-118-0x0000000140000000-0x0000000140149000-memory.dmp
                                                                                              Download

                                                                                              memory/6004-122-0x0000000000800000-0x0000000000867000-memory.dmp
                                                                                              Download

                                                                                              memory/6004-198-0x0000000000400000-0x0000000000535000-memory.dmp
                                                                                              Download

                                                                                              memory/6004-129-0x0000000000400000-0x0000000000535000-memory.dmp
                                                                                              Download

                                                                                              memory/6004-127-0x0000000000800000-0x0000000000867000-memory.dmp
                                                                                              Download

                                                                                              memory/6080-47-0x0000000000C90000-0x0000000000CF0000-memory.dmp
                                                                                              Download

                                                                                              memory/6080-55-0x0000000140000000-0x00000001402E9000-memory.dmp
                                                                                              Download

                                                                                              memory/6080-56-0x0000000000C90000-0x0000000000CF0000-memory.dmp
                                                                                              Download

                                                                                              memory/6080-139-0x0000000140000000-0x00000001402E9000-memory.dmp
                                                                                              Download