51fe13836ed60fd02e8b66e3c854ad77ed5a3c834f0b1993c39e1777c1682052

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
07/03/2024, 19:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
51fe13836ed60fd02e8b66e3c854ad77ed5a3c834f0b1993c39e1777c1682052.exe
Size 889KB
Sample240307-ynd3dsdc4t
SHA256 51fe13836ed60fd02e8b66e3c854ad77ed5a3c834f0b1993c39e1777c1682052
MD5 510d6a07e897edab0b610f996347a119
SHA1 b4a72561df0be4fc5579e1a7ad4ef460e4b4adb6
SHA512 f88dbd47f0d60848deeb0bfcea4f4f49e621ed27788cc317b2a81da09c27ee7fefa65fe6def57583757ef60f2b5e3b79efeb0b1e203830db8e0aaa5b3ed0012a
SSDEEP 24576:65F1ZpAxvbpT0rdwQWOwN7PPpgyqn4zh:20xv9QrtWOs6Q
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
5012	alg.exe
2272	DiagnosticsHub.StandardCollector.Service.exe
3668	elevation_service.exe
4980	elevation_service.exe
2200	maintenanceservice.exe
2336	OSE.EXE
4232	fxssvc.exe
1692	msdtc.exe
2648	PerceptionSimulationService.exe
4856	perfhost.exe
4384	locator.exe
1276	SensorDataService.exe
4840	snmptrap.exe
4808	spectrum.exe
1256	ssh-agent.exe
4924	TieringEngineService.exe
4052	AgentService.exe
4016	vds.exe
1724	vssvc.exe
3948	wbengine.exe
3672	WmiApSrv.exe
2036	SearchIndexer.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in System32 directory 28 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	51fe13836ed60fd02e8b66e3c854ad77ed5a3c834f0b1993c39e1777c1682052.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	51fe13836ed60fd02e8b66e3c854ad77ed5a3c834f0b1993c39e1777c1682052.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	51fe13836ed60fd02e8b66e3c854ad77ed5a3c834f0b1993c39e1777c1682052.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\6e4563b812d07ad8.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	51fe13836ed60fd02e8b66e3c854ad77ed5a3c834f0b1993c39e1777c1682052.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\106.0.5249.119\chrome_installer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\106.0.5249.119\chrome_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateSetup.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_91140\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_91140\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006d9007a8c970da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001e8b3aafc970da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000dc7dd5a7c970da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
2272	DiagnosticsHub.StandardCollector.Service.exe
2272	DiagnosticsHub.StandardCollector.Service.exe
2272	DiagnosticsHub.StandardCollector.Service.exe
2272	DiagnosticsHub.StandardCollector.Service.exe
2272	DiagnosticsHub.StandardCollector.Service.exe
2272	DiagnosticsHub.StandardCollector.Service.exe
2272	DiagnosticsHub.StandardCollector.Service.exe
3668	elevation_service.exe
3668	elevation_service.exe
3668	elevation_service.exe
3668	elevation_service.exe
3668	elevation_service.exe
3668	elevation_service.exe
3668	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
672	Process not Found
672	Process not Found

Suspicious use of AdjustPrivilegeToken 40 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4268	51fe13836ed60fd02e8b66e3c854ad77ed5a3c834f0b1993c39e1777c1682052.exe
Token: SeDebugPrivilege	2272	DiagnosticsHub.StandardCollector.Service.exe
Token: SeTakeOwnershipPrivilege	3668	elevation_service.exe
Token: SeAuditPrivilege	4232	fxssvc.exe
Token: SeRestorePrivilege	4924	TieringEngineService.exe
Token: SeManageVolumePrivilege	4924	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	4052	AgentService.exe
Token: SeBackupPrivilege	1724	vssvc.exe
Token: SeRestorePrivilege	1724	vssvc.exe
Token: SeAuditPrivilege	1724	vssvc.exe
Token: SeBackupPrivilege	3948	wbengine.exe
Token: SeRestorePrivilege	3948	wbengine.exe
Token: SeSecurityPrivilege	3948	wbengine.exe
Token: 33	2036	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2036	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2036	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2036	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2036	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2036	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2036	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2036	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2036	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2036	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2036	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2036	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2036	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2036	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2036	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2036	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2036	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2036	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2036	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2036	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2036	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2036	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2036	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2036	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2036	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2036	SearchIndexer.exe
Token: SeDebugPrivilege	3668	elevation_service.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2036 wrote to memory of 5008	2036	SearchIndexer.exe	129
PID 2036 wrote to memory of 5008	2036	SearchIndexer.exe	129
PID 2036 wrote to memory of 1532	2036	SearchIndexer.exe	130
PID 2036 wrote to memory of 1532	2036	SearchIndexer.exe	130

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\51fe13836ed60fd02e8b66e3c854ad77ed5a3c834f0b1993c39e1777c1682052.exe
"C:\Users\Admin\AppData\Local\Temp\51fe13836ed60fd02e8b66e3c854ad77ed5a3c834f0b1993c39e1777c1682052.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:4268

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:5012

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2272

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3668

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4980

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2200

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2336

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:3472

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4232

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:1692

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2648

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:4856

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4384

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1276

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:4840

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4808

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1256

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:4764

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4924

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4052

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:4016

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1724

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3948

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:3672

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2036
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5008
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:1532

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
Size 128KB
SHA256 130d5ef2f6318869fd7d1925302a59ef0a7647fd156a640ece4ce25a4e4b944e
MD5 a1161a3a98ef1cdea903839caef13bea
SHA1 b7c1dc249f7f90b9069a1f1e0457e93d27b59c65
SHA512 7253cb7c311e3d16659ca77aa9513ffc7aded92e0a6181fc51e1cc7b2ae437a6b306332664013b3ec394463a09b863fa8b7e6292046a6345cfd0b1ebae32d772
SSDEEP 3072:qw+kz/J2ucd1dAMSe+DxYc6OkUKZX1esc0R5:qqh2hYer2oeIR5
MD5 SHA1 SHA512 SSDEEP

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 781KB
SHA256 40d5520b72b8771dd950a1a43ca6d0755d49d6e7d4f9a67e592ab6544b8ce7dd
MD5 abf5502f21dab3c99c02088d2e3512ab
SHA1 ee359ac1f7ab3e0273d5c3bd78e2c337be3e9620
SHA512 d2e7574f6e99b83dc621855ba12527976cf54b59c8414e3413f18c80bdd77673103bc22afad3f7afc4c6585622e99cf558c36a05517122083af2ebd71966ee0d
SSDEEP 12288:KC0P9Q/Jcui6PStDCf7O4TsH+mGadTSdZKKQWOs5NgsPjYc+igyjj6n4za9:WPsJcui6bpT0rdwQWOwN7PPpgyqn4za
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 512KB
SHA256 0506c698dd109f83a45ca24b15c80277cf2cb4e80e230bf50e38262c07f98f77
MD5 95a7bde266ca180c32d8570e2a8a576a
SHA1 ce4d42f1bc195f97f0e3228810855f0af30783a0
SHA512 a721b93a959950adf1a98382a5e790022360da30f2025eaeaf222b7023ea101bedba84265c4c846359704771a8274a882d4e37b6e1ce746c652f0d9490bc2541
SSDEEP 6144:AE7cV3iwbAFRWAbd4nf0H05yqE6Hl0ChW0+ksllAXBu0lWGWUAJQ4t0BHQQf+LM:77a3iwbihym2g7XO3LWUHfz
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 d8819b4136028ccd66bfa751510afbb06f869ed23d3146fced62393738c42248
MD5 8723ffce2296099586e8911c39cfc210
SHA1 141a200ef72464751308bdbbaffdf1464dfcd284
SHA512 db84db86e03887273dd7120506a12474f7e19123b4d4fd7ffb8e5d3058d9a7e43426a00090d048b725c0cabc8d10509f716c1c9bdf2fae96e237b3c41a4b7c1d
SSDEEP 24576:3BpDRmi78gkPXlyo0GxjrjbpT0rdwQWOwN7PPpgyqn4z2:xNRmi78gkPX4o0GxjH9QrtWOs6Q
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 e9904a42780309bf00f15e583029cad270b61f3e068d5f3bc9dd32ec1dc476bb
MD5 1ef57abfb23ae2f21a4f9b03612e6235
SHA1 595e2a56cb2c91f6948d17854415bfa6a06fe23c
SHA512 65ef2b1e71b2b0081a397f8cf7078a7d1650f1f28623435e4a57e6e8cde5dd84fbdd82c0174c09c16250c6526f40ed3fcc9910b64e2b06ec0f941b3bc4dbf211
SSDEEP 24576:aLOS2oyPIXVGbpT0rdwQWOwN7PPpgyqn4z/:K/yP9QrtWOs6Q
MD5 SHA1 SHA512 SSDEEP

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 63d2afa008bd45b6cd3bed2e312ed1a7f92b27a23eb680aec130a5ade8abc624
MD5 9f5b61d4ea80e1b335f529a835c9dc34
SHA1 4abac46cc6ae845b095ce9ff7f3ed25842af7760
SHA512 32838bb5475a760c49636756ff3c55843c0d7facb5cfbbe8e010287ec8eab5247026a959b65dabd574276e563bd31c5c0d81773e63ecdeab69e6ad178287b010
SSDEEP 12288:bf4PStDCf7O4TsH+mGadTSdZKKQWOs5NgsPjYc+igyjj6n4zaU:bf4bpT0rdwQWOwN7PPpgyqn4zR
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 a966621ec7705fb3b2a708084ea1281cb0de9d3b5de5d3b95ab97f872525334e
MD5 4848bb0cf530a566d85557d7f66cd263
SHA1 a587186e6c8cd3173c009bdffa5cc67fd98e391e
SHA512 78122730a31c580b4b078f740e95df7a6894fd82edd34a021e77edd29bbd9e217b6e3262df47513ed0ca616d63143ce7cbe27827707e364c19c1cec9ca65e751
SSDEEP 12288:qeBNUbTVO86UVPStDCf7O4TsH+mGadTSdZKKQWOs5NgsPjYc+igyjj6n4za5:qJIUVbpT0rdwQWOwN7PPpgyqn4zm
MD5 SHA1 SHA512 SSDEEP

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 eb806459f497b2b73a85394a47a3efb7d0dceaf1b87bfd04609a2a100452e844
MD5 33d977d35fde7a7bbe8d2d9609ba0769
SHA1 212ed4ff40480d01a8e254f99826a67f154654d3
SHA512 67c2f7817bf905dfd32c2da2f42d1c0e412e26639437a7a4015c88354c1336556e6b41a1d24ea054be3d71b64473a6363426e7381c7210f61b9cf4d6e63acaac
SSDEEP 49152:eQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THR:eQvGAdlCEL8c/yRNw5CyqrEr
MD5 SHA1 SHA512 SSDEEP

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 bb5e12f32b7630a2418916170c94756e907dffdeb37848a92d1984f31d6240b7
MD5 3e9e6e5d2c004e149ccccae80e64c658
SHA1 39568d70abcef3394a2a918d874ce3a63eb87ed0
SHA512 809a06022ada8259840ffc51cb8c6fa472cd175c701e25cc1f4d0224c62dbb048826ffa49be5116724649280e085272710438fff793fd09dba17b493b26ffb8c
SSDEEP 12288:dAwSfxL/2Dc34DLLmt0LDQewsAjrPStDCf7O4TsH+mGadTSdZKKQWOs5NgsPjYc3:OdewsAjrbpT0rdwQWOwN7PPpgyqn4zx
MD5 SHA1 SHA512 SSDEEP

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 252e93fea8722340e70f0ec9fed97cb225760cb9be4d7fd19317f90a9e90b05e
MD5 dc136aba2c7a6b42b46d254a13a4a04d
SHA1 dbf9cfa461a0b18fc47627e08ef8f861ac4c8d8b
SHA512 1de3b377e4fe8d95de108aef4b2fa1a1b066a6ff27adc2043c7d3a4ca6d70fd76ea295d4380419d36874e3f369cb7efc42625233678744f097508777da1d9e8e
SSDEEP 49152:gCbRquA/m2yL5zQfFiV+XenmE3/zL9QrtWOs6Q:poqtVjnm2qrEr
MD5 SHA1 SHA512 SSDEEP

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 ca964380a5719e2ff1d5a9f70c8bcfe3ceab646ed80b2e6a83d98f27793858d7
MD5 3d47b659744db783c5384eb5bc60324c
SHA1 ab053396997eb6d2a2f02a26d0b62a875a891b08
SHA512 e4595b065ba24c5f2cfec59a2aadb13a1be901d504957c087523f0da9a21ee692390646b7d8a29e3c3baaf0482c4e76cade1f8f36f2f1cae3f74881a04a179e3
SSDEEP 24576:8AhGLJIFoiwtA5l7S53WbpT0rdwQWOwN7PPpgyqn4ze:8AMyFoiq5m9QrtWOs6Q
MD5 SHA1 SHA512 SSDEEP

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 1af18791969b462cd56c9ba41977a0602d76246fdaaf6efaeff9f5117fa5a42e
MD5 835f013cf70ff362f10798c1239c417a
SHA1 6ae8fe42f0eea5a163ff55667ed257bb590c898b
SHA512 04a7aa63403407e1f2a92961d0ecab47fde4d687415cd69860fbdfc000870edc2a140036431f10aaa6f363adf58174d2e799958c1bfa523d92afe69c7f6eb65d
SSDEEP 12288:Jmw5HEjsChNVBFgl0WDm+CiPStDCf7O4TsH+mGadTSdZKKQWOs5NgsPjYc+igyjF:EwuoOWPbpT0rdwQWOwN7PPpgyqn4zt
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 7d8dd31e6fc2e383383200a8b991b57e26dbac21502c1ec50c8c5a77e1a6d808
MD5 63ed2d0dcc306be8d998d5c161435262
SHA1 001eb9e22c34a521d97278e64ceff25791083bae
SHA512 4be13a221633c9fffb603e52b97011298b6d709ee077c8af4728c58891197d56006d0574d983c149950735f74ab69e5909c831ade78e92a10e37587c63858541
SSDEEP 12288:ZBZ1IybPStDCf7O4TsH+mGadTSdZKKQWOs5NgsPjYc+igyjj6n4zao:3ZuEbpT0rdwQWOwN7PPpgyqn4zD
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe
Size 1024KB
SHA256 9aeef2d8d871fc101e8fb126335c93936255ec6b32d538b414566aee695b7781
MD5 f00f9cd6610e3e486a67c40049e573e3
SHA1 77db8155d7df91aed94064ae5e8e334c912ebb8d
SHA512 ff9b7dd3719b5e9e5daff1db5bf1f0f79d48357591320c4f8163bda6aa1f9ff6f4897921e77266267a591483ced8ec11066ae4b042980950584c4de3817559a5
SSDEEP 24576:kj8f3jtqe5RsLiN9W8LK2hIgrR9tBMkrBjv:kj8f3jtqiCLg9LK2hIOR+k9jv
MD5 SHA1 SHA512 SSDEEP

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe
Size 960KB
SHA256 11a320eaaae224ec1c182386eb2b1acd0ed2e559ce7032644d069c0b1824ef37
MD5 c5a02905ddec0a5eb2736a16c6be38ad
SHA1 742f12e1640af9c65a80ad2448c68333ba4c8d58
SHA512 02b1f258f43a56bfe4e661a6f0c41643c7e76a16ae33984589ba59b6d311c62792c3af0811f92d99665958578592618805a49188db82d4132eb76e4fca65f069
SSDEEP 24576:lj8f3jtqe5RsLiN9W8LK2hIgrR9tBMkrBN:lj8f3jtqiCLg9LK2hIOR+k9N
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe
Size 1.1MB
SHA256 6f5a37361d208ebac96e9b7932494a08b218c040965a911498308d2979385b69
MD5 50c02bbf2cce34bceb3a6d0ba765e5be
SHA1 09d21c167deb8fcc29e06378cc2612a1d7c604a0
SHA512 80b7f705088c8c25a23cf5b543d7bfe36b04abb17e9a876c09cd19b27476085cb076c18441f9cd2ce1635062dbf09b3bdd8e98f2e7fd4545a9f567158cc27d94
SSDEEP 24576:AfzeNbBmwfn8Nrlj+SWWiEboxHmfx+XeH:AfzabJ8llj+SWWi2mkx+X6
MD5 SHA1 SHA512 SSDEEP

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
Size 2.1MB
SHA256 bdcf3f7878e160156f7a3b4cb56a2d291dc7bc71effcb8512aa2918154e6d214
MD5 e436c61075f5847baa60eff124463f84
SHA1 bd8065b14e6201bda24f206ce36d3d870b85dbdd
SHA512 c6600c73585237c57a777097e085c814c57eebccdb7e7efd40088063b8cc7f2f53561885baaa58117e2633b98b89484b90edaa144c79677cd3ddba66666388f0
SSDEEP 49152:Aa/3xXBSZ4K5MJ1LvTMxbfsYBYSgxu9+fw4T99QrtWOs6Q:aZ4K5MJabfsYNqqrEr
MD5 SHA1 SHA512 SSDEEP

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe
Size 960KB
SHA256 1c7d95c6a9336be38b0bb55bd210593e7c3d8cc0f7e84f47d0dacb48658bb2a7
MD5 e01e3de964dc77af3cd651a58e62b182
SHA1 05123e9fd2431fe43d19647a57e4d8fdabff431c
SHA512 10173dac94ec352d3548dba18e90ab31f72d4969d8a47d8de40c4296d12ff3926033604e80e9d42a58f9cbe4431a1682fb7ac13814fe78d4c3091e339305245b
SSDEEP 12288:Mv/AgmWJwiR5yUyLuoM6u/9gGJL6unnOPlZjK7enmPlzbKeEoO8Cwys/N9FJnp:LgNJw85yUKzDu/9gKPlfLO8C495
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 1.5MB
SHA256 2f6ae2337e6269fdce8326337a655aed40092c909772e89e43c03feca82b93ac
MD5 a9bcc0e3a5f8d9449bb48a98117e602e
SHA1 c9a94302dcb3e908005426eaea85ee948a784c8f
SHA512 a1ac54fbf225cf4912e7057f57b8c50dbd3fda4cb2608c39313349ee5d477d4ecaa777c3f2b74e87cb7d676edb6e84c2b7ff44a3b65b454d29d9a682d02a2e2b
SSDEEP 49152:HOBynH1wM+v6UJxLQd7BHjdfF9QrtWOs6Q:Zn4LQd7LdqrEr
MD5 SHA1 SHA512 SSDEEP

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 5d25ad190e2accc5e6707179a85fec558d8c7b5b451f346c0a81301accfdf207
MD5 09c4c8db3a5c35219af41c92e7604050
SHA1 889a4ceb0640e5fe30ab9f7740f679d2dc63a6e0
SHA512 980107723a58e2b3389459269fc09132b4b3130e54e75b80ba7c612d18bb064c5ab2ef8e3690a30318be459ff730b4ab830a850ba0c3b381bdb4171c1cd5100e
SSDEEP 12288:nQPStDCf7O4TsH+mGadTSdZKKQWOs5NgsPjYc+igyjj6n4zaP:nQbpT0rdwQWOwN7PPpgyqn4zE
MD5 SHA1 SHA512 SSDEEP

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 1634b9d6a73a4e7ab2500b027af2f4d97bcef6febc60920714b9a67917a551b8
MD5 f01244320210c85769a8f6578e7001fd
SHA1 1d429c55c7daec79411dc796deea1e5fce5355ed
SHA512 ad83471e6323317953d661572677496c458612c775bb7d90707533b38cdcbbebaf2d6657372d07d5deea4d191b7cd8958a8526ac267e5c3824df32a525f60eef
SSDEEP 12288:5XPStDCf7O4TsH+mGadTSdZKKQWOs5NgsPjYc+igyjj6n4zaP:5XbpT0rdwQWOwN7PPpgyqn4zE
MD5 SHA1 SHA512 SSDEEP

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 d4349eb2c48e8b35e98507672fa157544d9245a7eeeb52e559771ffecc58ba93
MD5 6d2130aa49f67531953e0bd7376f30e1
SHA1 20be9fdcb04e382f266cc756299ed40461c0a568
SHA512 86d6288ca5c628c4ccfc7d3246e0254fa29bcd4d92109a89ab9f56942a7fab2cb39daafb87036621ab81a57bfa8627a9933356ce1a023f8045dba1e928ea46a1
SSDEEP 12288:KtPStDCf7O4TsH+mGadTSdZKKQWOs5NgsPjYc+igyjj6n4zaP:KtbpT0rdwQWOwN7PPpgyqn4zE
MD5 SHA1 SHA512 SSDEEP

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 f118d9991524fcc7e83ff9c0eea8e5887c21d774d8a4dee39b72374597b9441e
MD5 1109ba9f73908c38780f661f535417c8
SHA1 acb913f8d9ea9b018b953a54feb01ad8c82037e3
SHA512 c9daecdd8513735cc9865cbaa833664a6d5b5d039f44154d08752f6713bd1b27d9f2b84ddaddc78ee4fbc0989a1bde1fdfb2ecccf95fc08614b616f5d7aa1620
SSDEEP 12288:uV2PStDCf7O4TsH+mGadTSdZKKQWOs5NgsPjYc+igyjj6n4zas:rbpT0rdwQWOwN7PPpgyqn4z/
MD5 SHA1 SHA512 SSDEEP

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 e3791b250f7609dd4a563d7c0ebb6003c96f0a8309d9ad8fe296247341731166
MD5 e0d284a14360dd6e0d84813d9283ced4
SHA1 100ef84bacb20e44f9786f7617922945b2f32afe
SHA512 307aa48b6644482baea1ececd7e7976c5af473cfd63e215aafebee739bc191f46094c9cc9eb97d8e3f974eadf9d8c2f62b800dcaa1a86672022e223355258eff
SSDEEP 12288:r+PStDCf7O4TsH+mGadTSdZKKQWOs5NgsPjYc+igyjj6n4zab:r+bpT0rdwQWOwN7PPpgyqn4zA
MD5 SHA1 SHA512 SSDEEP

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 8491420e401193b25c09e62a2a47b42ab5ae39a78e6d3d2f9763764133326954
MD5 320a87ccd7a98ea7a6bd5467c78989fb
SHA1 07e688a47ed529193543252deb13c437d562c2e6
SHA512 66372be146e7350a634a904711f63706babe8124e44f963d7f43e6697af0aad686509befa9365b0a28fc10c971b06f245f43a1c910ed4d46e83280e3dd604245
SSDEEP 12288:PjPStDCf7O4TsH+mGadTSdZKKQWOs5NgsPjYc+igyjj6n4zab:PjbpT0rdwQWOwN7PPpgyqn4zA
MD5 SHA1 SHA512 SSDEEP

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 4fecb68a3d3dff494c1962070de6122914431943486088f2825a2f7dcf8315a7
MD5 bea1b8a14d5d8b34fc1aef8ed6c0148d
SHA1 610c8fb79f3ce2d8fed6b0708e41ae7a36fc6144
SHA512 02af2c14852254f15350dcbfd7f4569d31996a07864a4e7279c9b5613b7c270fab5b8bb93d2aba6045d5b48eeb8eece682bf9a2232d5e00a1c8cac6ceb2fb4e1
SSDEEP 12288:xfPStDCf7O4TsH+mGadTSdZKKQWOs5NgsPjYc+igyjj6n4zaj:xfbpT0rdwQWOwN7PPpgyqn4z4
MD5 SHA1 SHA512 SSDEEP

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 f5de51ba0fe47384a36e845551b456d58d0af0d9da3a7749a1fbeadbbd33d6cc
MD5 942ed63a6d8fcb03592abc7bd346b0be
SHA1 3401f57c49584e61ba22f333d09aed7861e9fa94
SHA512 87132e56efed04112562a0598c2941fc26dea0739cb1e22b599bba1e616fec462a06b5a7f8c35da54dcb457f0e4a50bebaad4a2fc5ef4200856bdb906756eaf0
SSDEEP 24576:7ZMSzFVSO3bpT0rdwQWOwN7PPpgyqn4zO:7ZMSzfT9QrtWOs6Q
MD5 SHA1 SHA512 SSDEEP

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 2d5ce9bf9a18b32a296c4a058b3dbf9b1635d7c9eaf4bcb11149a6cd15074ada
MD5 e5ce41100a6fc5ea9b3dd0fd95f266c3
SHA1 84577dfa6ba8e494a276c0da534ba6454d5c458c
SHA512 8567846a305e8cc47da198098666d6125a3346c751044d6ac46eb9f0932860cf251d8e07b0b2644285d84e067404813b3c8df03429f7f45cf5bb0035340a3746
SSDEEP 12288:X0PStDCf7O4TsH+mGadTSdZKKQWOs5NgsPjYc+igyjj6n4zao:X0bpT0rdwQWOwN7PPpgyqn4zP
MD5 SHA1 SHA512 SSDEEP

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 72b2b15210d043c60397b204cf5ac108629566496e12307a64bb7091f9b7d9ee
MD5 c6fc4f386a6628547187a31d2e2e31cb
SHA1 909e4d875ca753fe58673610ecf3db4c87b4742e
SHA512 8e58822a7e634ed813718436e861dd47c7dc8b1cc107dbcceeb23e618fb9a618d0f1efc19fbecebcaec89c00c8de2df6aa738d7d93222093aa620600e2803a3d
SSDEEP 12288:DoPStDCf7O4TsH+mGadTSdZKKQWOs5NgsPjYc+igyjj6n4zao:DobpT0rdwQWOwN7PPpgyqn4zP
MD5 SHA1 SHA512 SSDEEP

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 7cecb0f38cecfa2b8c8af521f2869c87429238823b3d3bd68c45321c88a99f24
MD5 d33a49817894616affc7e1bf79801ff5
SHA1 e9a3f8b9a608a601aec6342ebf20a078cf175d2e
SHA512 f0a70e7479ab9d6b36fd364b6c0e53b1e16cf8b28455abb46719fd7a76ecfd60717e6e50bb3ed82e3a4e55c9092317d9eaf2b1ff472a199a7b78adde48a732d0
SSDEEP 12288:gyPz5L8bPStDCf7O4TsH+mGadTSdZKKQWOs5NgsPjYc+igyjj6n4zau:RzybbpT0rdwQWOwN7PPpgyqn4z1
MD5 SHA1 SHA512 SSDEEP

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 3127dc662512fe10820722f424fa33457e8ecb4abb5d739d466c907ac5fbd69f
MD5 1c59a703b2d86139c867d2fc05d25783
SHA1 ff10fe90d452ba5270662ac96ef82ffbd97271b1
SHA512 8a619227bf6b92fe4c9c1ec037ebbd775a229baae929d2e3e8123111437a7229896efae39bdb50acafc9ed8c40eb68beda633f0d0e27e1ea09df3aed614c3eb3
SSDEEP 12288:Y0PStDCf7O4TsH+mGadTSdZKKQWOs5NgsPjYc+igyjj6n4zao:Y0bpT0rdwQWOwN7PPpgyqn4zP
MD5 SHA1 SHA512 SSDEEP

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 c16f3a30e96d79ef5577354d467983b144326740ebeb08580735c25363286315
MD5 225384e0ab3bcb643827336f79307d24
SHA1 05e948ac7d43624d7e99ed2c9b920abe99027161
SHA512 b7efc025a1bf6dafb79ae8e0dfefc1d9ba2712842a6575a8cba2a47a8cee1833d9f8ab6da56afd416cc83c7cc07cafb2df02835df51aee1765df9adc4da06135
SSDEEP 12288:j0PStDCf7O4TsH+mGadTSdZKKQWOs5NgsPjYc+igyjj6n4zaf:j0bpT0rdwQWOwN7PPpgyqn4zo
MD5 SHA1 SHA512 SSDEEP

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 f71d31aeb14aa2dd13591a8c5e2b918c66ecf0f5b09b4244a5340062da65868f
MD5 e61849e86b5c0f6c52d9162e86333190
SHA1 c6518ff90061432cea05e0189a86dd7cb9866bca
SHA512 032005da5cc3fd6aa3ea84ba6ddc5217fc1ccb74c92a8d2b7d0f537d97cbe9b5746ee2f1d4a3e1404f7703ad19a18fd6d7918ebe276d05a328f987805f69eff2
SSDEEP 12288:YyPz5L8bPStDCf7O4TsH+mGadTSdZKKQWOs5NgsPjYc+igyjj6n4zaN:5zybbpT0rdwQWOwN7PPpgyqn4z+
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 832KB
SHA256 4f1f4d461d86f25d21b9208717cc136e74ffd1283dde287788ccece905f60232
MD5 34a1a1f148db5562ff6166832a037ab5
SHA1 a9f229ea810a11b4e4cd2a964876c5b09b03545b
SHA512 76bc8dd51fffae805c39a6c45d63008e953a9f838f521edbb86c5ce939ce74051b4e30f06f6549c7fe1c1e5239aa535d5194f696d1b48a3773b8af141f12e9b1
SSDEEP 24576:5THaLl3z0zD9bpT0rdwQWOwN7PPpgyqn4zM:5T6LljC9QrtWOs6QQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 768KB
SHA256 65ee9c211bbe44daf58f682026a5273652623b21d886d8424a191339fc4cd073
MD5 7547024175930d3ae5ba7230db246ffe
SHA1 a6941e953d081cfff89d464b27777e37b0645e5a
SHA512 d2d6ac8cb6f35a40201cf0548db60d00dcbf5e9314c4d6da3df7d8f9d9a717be78f82d1805cdae11427edb6e92e3075987dec460aeeeddf4a6cb85276563be16
SSDEEP 12288:ji4e7+RdTfgwCHKy7GLbbdIvqPStDCf7O4TsH+mGadTSdZKKE:j37d9CHKy7GZpbpT0rdwE
MD5 SHA1 SHA512 SSDEEP

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 6021443be7cfd81264f9a8ee36116b0b522ccd11168d1cf29dc3a2ddc96a8a52
MD5 a418dbcd1114d3488ce3d4eafe9bb248
SHA1 af96794719304cbe5975da6087be5a6ebee9a353
SHA512 d8acf2b3881f755003788b2034f3fb5b040157ec862932089be6876f6c726fb25de51bfcc011d2c8c3f06d4cd6a989ff62ee0e26689387c279d6dd2efe78858f
SSDEEP 12288:INPStDCf7O4TsH+mGadTSdZKKQWOs5NgsPjYc+igyjj6n4zao:INbpT0rdwQWOwN7PPpgyqn4zD
MD5 SHA1 SHA512 SSDEEP

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 229f70719bf10bfea8fe85af376698c4a33efe31bfc04c5958838afa73b58c37
MD5 f9d47f4b25df9cb4273c0be3f7fbfbb1
SHA1 2814e8c39d2c1a8310937944dcf9fcc43faccc71
SHA512 2198ed137e86edf01066c3067ad9f9e92dbb15b9396942cecc91a084512551620d05ae68d7b86c48a2bd519d4f0ce700b4acb42aee61d42845f647a31f4efc61
SSDEEP 12288:k7PStDCf7O4TsH+mGadTSdZKKQWOs5NgsPjYc+igyjj6n4zaQ:k7bpT0rdwQWOwN7PPpgyqn4zL
MD5 SHA1 SHA512 SSDEEP

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 b6eb4f047b68bc6857102f0d8ac41bd6570adc7c9bd6d9ed06fb0a0c0097b0db
MD5 b1e1e151ecbaec78bb943edc81929bc6
SHA1 e8241a68cfdd1bc7ea36a739b258310633f37df6
SHA512 ca35b6a589a7b73603b63d92c9b4fb330dcdbdb558ac0632aa0bfe8a9b34607488d833ba25040b2d30e868f4237fc14ce8b9656e04cc1d78a199a47efc91da7e
SSDEEP 12288:GqPStDCf7O4TsH+mGadTSdZKKQWOs5NgsPjYc+igyjj6n4zaU:GqbpT0rdwQWOwN7PPpgyqn4zv
MD5 SHA1 SHA512 SSDEEP

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 7f5dbe6096f2dbc361f3be088682f6d6947b64807ded4005c67ee971c49aa8c1
MD5 4b6eda8a2d911f76a0a4db30bbfe7c1e
SHA1 6198508b18214a8c3e883507409b7e0daf5f614f
SHA512 971f44c6b2d9347e7d9efd00f8bfec5917ae69284a0b836ae160f8f2efa0bb8c9462ef3aaff42f0b2688512514f2d03ee67123c2a8e8d5f2bface0400ebbc9c6
SSDEEP 12288:V0PStDCf7O4TsH+mGadTSdZKKQWOs5NgsPjYc+igyjj6n4zaU:V0bpT0rdwQWOwN7PPpgyqn4zv
MD5 SHA1 SHA512 SSDEEP

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 f19fcaecbaf2b557de35dff0ec73eb67b0c81d6adf62abc45a9a0af978edba17
MD5 9bd849ddc73c75398fb161518b405094
SHA1 337c0d1172ed1a386926c2ca6844769a95a9aa89
SHA512 f4c75ce13668a2fda297b4832d8127b8bac4a105ebcd923e417f290b060d0a38f58a109d05d8cad3f8a1ffdcb0127d75ad78c356d7550e27755b7c7ce858af83
SSDEEP 12288:hNPStDCf7O4TsH+mGadTSdZKKQWOs5NgsPjYc+igyjj6n4zao:hNbpT0rdwQWOwN7PPpgyqn4zD
MD5 SHA1 SHA512 SSDEEP

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 696KB
SHA256 6a776a0c5f8bf92551c6ef7ddc733a27c31e0f1a6c67f749e20145aaf0722a76
MD5 1ebb1639f35b4e3022cff0d5e0e36ec5
SHA1 ec112b5cc6f2958dd394f3592cea7de89389b639
SHA512 ddf1fef9a16fe232219fdd12b7ea6fdfc70d17b98447efde599d63a2936bb3037f814f3b967fbae53ab68062fade894a6a5121d75951cfd7509e434743af0c95
SSDEEP 12288:7FYq0SzPStDCf7O4TsH+mGadTSdZKKQWOs5NgsPjYc+igyjj6n4zaV:7gSzbpT0rdwQWOwN7PPpgyqn4z6
MD5 SHA1 SHA512 SSDEEP

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 06c8fe5f744f3bad4637efaf99bdaed6e1f19322a5d68f9e2e52bb23d7be5cac
MD5 3c84fe0a6dbe0e00d7c1aac5b8d079be
SHA1 53914fd9fab4805b6b3e997115a58ef6a551017f
SHA512 ab8c16949adcac7e01539a72a8aaec733ddb78d4d7416c901b9818eabb0b533993cccb44efb7584ceacd97d1940ffaf0729605a1ad43c4f7ac91185fd4b41628
SSDEEP 12288:cOPStDCf7O4TsH+mGadTSdZKKQWOs5NgsPjYc+igyjj6n4zav:cObpT0rdwQWOwN7PPpgyqn4zK
MD5 SHA1 SHA512 SSDEEP

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 db501614c01611b930961dc2a1be9818a983f9c6ef42dd931d603da2d8d04f66
MD5 f37550d4b3efd94965168c01ba560bea
SHA1 5bf8f5a53bc2226c97d28a52c27ed6fa46e55157
SHA512 dd2ac2c095d52b252f414bb8aeb531fe1244796f757e7e9ee60271bc6e082abcf88a36f6a7d7686b3c382445664f60ce088d6c055f031cbd98b40952942a1692
SSDEEP 49152:9a0h2GEkuAe73q3pp46zwwQY9QrtWOs6Q:9a0hNYG4Jw9qrEr
MD5 SHA1 SHA512 SSDEEP

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 659KB
SHA256 486ae2852930f64e7ced69a520480924a13956efad69333fc68380b7ec536ed7
MD5 47aaf989ec9206bf1001becb9bc2b042
SHA1 3a90910cb4a5661a8bf18b39423a8ea5744478fb
SHA512 de6295e9dc158b9be010d1b9771f28e0ef59901525d8bf796a15e83c97e0964b791dea739b87a05b13423b9b47319241840a0c5c8bd1faa9a026dce1be5952b0
SSDEEP 12288:UhbHjfXpPStDCf7O4TsH+mGadTSdZKKQWOs5NgsPjYc+igyjj6n4za7:UhbHjPpbpT0rdwQWOwN7PPpgyqn4zQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 680aa6b49369144ff918f2b0c26e714cdcc2f20da8853ba41553c29578b3190e
MD5 ecbbc2cc65b0ec0ab9b31d3764e10174
SHA1 aacf4b30474a93ab9439289ef5e930dbce2c4085
SHA512 3ac92c2dba940c0027cf552cd01f5a84ffa6e652cc1ffc38d6a7a4250c01d0051366025a034e3f558f797c07cefa5cfb6bff50f94036e8e2b068acf101a9c70d
SSDEEP 24576:J3YgnJcRTk4yti+R5dBR/hbpT0rdwQWOwN7PPpgyqn4zx:JIgnaTk46pBR/h9QrtWOs6Q
MD5 SHA1 SHA512 SSDEEP

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 578KB
SHA256 9b6e0a8947e999206296802f0059699a061eeb1445f8d65f7a6be1c4784d37fc
MD5 5c130f2a4f6c5968356564a3ecc7d001
SHA1 5601dc40323afd8ada9564f34bd50a3dc6067aa8
SHA512 adb3811a2a9993886c85e31967220760914552a71dd70e2511537ecf017a0c4374132629c379f4493f5193b75bb790ed31d68752cc0cf5611d0e32beef824f28
SSDEEP 12288:jKPStDCf7O4TsH+mGadTSdZKKQWOs5NgsPjYc+igyjj6n4zaG:jKbpT0rdwQWOwN7PPpgyqn4zJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 940KB
SHA256 f17b02ae26c10b74e8c419fe69c5c575d912a837b3355dcaeaaff7c0514a967d
MD5 a6278bffa6ddc3fea65829758f9e64be
SHA1 8d4b7ff8ec52a9d183ebcd7e82f7fc454cf5e3d3
SHA512 afd22c3cd47141c565a18a49dd7189b1337d7451269d3a8879984cf7828cb9c199a6ac642740863762113c7a392547420b6cf9b3008f99f753986fead9228405
SSDEEP 12288:sOb9A4LWOsvAYFTDPStDCf7O4TsH+mGadTSdZKKQWOs5NgsPjYc+igyjj6n4zaU:RpL3UTDbpT0rdwQWOwN7PPpgyqn4zD
MD5 SHA1 SHA512 SSDEEP

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 671KB
SHA256 cb04268098b79a40a8cb5ee3da4231e9236742fec93f14ae723d1b42b97818f2
MD5 796f4e57cc5152fd50365f9cda298a42
SHA1 262e20279cf6a3c8977cf46da00198704051e2f3
SHA512 b2f2303023c56aa99fdeaf079fec0ad8bf12279cadc3fee6ad205420b9dd1e0bec99a38195d952f45d8429e0f2d1e0a2a909b7a6b1085f95d35a08f1f970588c
SSDEEP 12288:RpFtpOvPStDCf7O4TsH+mGadTSdZKKQWOs5NgsPjYc+igyjj6n4zaQ:hOvbpT0rdwQWOwN7PPpgyqn4zf
MD5 SHA1 SHA512 SSDEEP

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 bf0e460306e8aad7430910aa60f845716d55fd76799894bb4a0a17a023677008
MD5 42d4c58882fb3acb47214c0f2e9bbe2a
SHA1 5bccc8cdca8d86bccf00d62889e89a4f6373ba8e
SHA512 21147de6217419825927aa2e379c873e74a70ac88cb3d7871d721bb2cd3f64481b35bc9d2474f9ff55f2dfe1fd0007b069bacbe9b8782e24bd9ec56f83ea260a
SSDEEP 24576:p7NM9YqZqmWMUkPjZM48Mv6bEhsebpT0rdwQWOwN7PPpgyqn4zk:p7cBWMpPjN8DbEhJ9QrtWOs6Q
MD5 SHA1 SHA512 SSDEEP

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 d3ffd403b206dc486fb25699d380dbf521c50923067baacb40cce9b4bc230b26
MD5 aa696bb9b25c74c488ce0fdf04ff7f20
SHA1 417c874e34dd05d9233b348c8a33661a010994bc
SHA512 1eb6864dade9bdbfe556b5faa6bce93fa8071d7d56e3d7d9b3800db240573d390b115acb8213cd3a24733059b49547f526226c0e36c39c0071b37024b0af2ac4
SSDEEP 24576:3W6BApg2YuyuNDYTabvcdvNYf8km1cbpT0rdwQWOwN7PPpgyqn4zH:3F2YuHNETovAvNYf8km+9QrtWOs6Q
MD5 SHA1 SHA512 SSDEEP

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 3351be7020e84a15102215c4aa714449768125bb79d2e315f0ac7b9c35defa88
MD5 1cdbfd2f83dcae7826b7f70a550bf9b9
SHA1 5268aa13fe59f23421d6848d5dc982798642c0de
SHA512 c388a1add5f08b7732ee08b17179d656c274926af91560adf13859f686363492ba89de200f79909c4ac0ef7f2ae63342a56f153d39dba1e571a5030e885997e2
SSDEEP 24576:VAFs06+Omlf3NXEbTorbpT0rdwQWOwN7PPpgyqn4zo:aFs060lVXu49QrtWOs6Q
MD5 SHA1 SHA512 SSDEEP

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 885KB
SHA256 b128d47d00095b70dbb3074db69c5dc236e9c0270dac2d59501467bfcb5ea09f
MD5 4a0e80988596f3f8b4d589b9882a9a29
SHA1 e6bbd6b12371a73bdc081366df99c2bd692edecf
SHA512 0fb530000c174c6b62110051f3f6e663c1462e5ea30c8fb91188381088e3a92a6c789b219d41f542334242df5fe30779f4613a26b6cf0ff8d36aaf199957e5cb
SSDEEP 24576:JJnJ5D3WX4bpT0rdwQWOwN7PPpgyqn4zS:JJnJ5DGX49QrtWOs6Q
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 9bcf032db7fd120c72e29f30f35e9137a8c8c17ceaa6da26dfe85e4e25560d85
MD5 217e978c750862fda9ac55dd32ab3dbf
SHA1 7c47a1b8e8ca0ee372ea722d13b4c8460ceefb88
SHA512 ec795118b207b1746c2f6523e8d1db522db0612e40b63368babdf4d430b700d64cb6c9d66441407d07d687c6660384a05e9e3c682eacc501b4505a1254c540c8
SSDEEP 24576:PEPghm6/7IIXdwcXrif7qQncjlP65i3VuhbpT0rdwQWOwN7PPpgyqn4zH:og06DIKdwc+eQnSt65aVy9QrtWOs6Q
MD5 SHA1 SHA512 SSDEEP

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 661KB
SHA256 6916ed29f60186403842ea19310e49968f89cf85e700b49824b5ac77305e2bf2
MD5 b9233d21b3c24ff0dd009f58e8f4f090
SHA1 918a99f9f434ecb2ec0cf34db5c37f877df833d3
SHA512 e34c68ea408e80aa728d74b5dabc464de89aab8e0c1b3c5bcd7cee5102500b55a61bfc6e3b03eeeb81ddbfee72299843a83b66e2383442437c031b80f88add96
SSDEEP 12288:GEP3RnIPStDCf7O4TsH+mGadTSdZKKQWOs5NgsPjYc+igyjj6n4za5:FnIbpT0rdwQWOwN7PPpgyqn4zO
MD5 SHA1 SHA512 SSDEEP

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 712KB
SHA256 42c5d48d7487ad45852cfa733bc9d1599a3207585d2426c4981ed13bc49eb855
MD5 78b99a102938f7550253fe6ab0003d31
SHA1 53289d2586de637ea7031e0b1e2645c0803f6114
SHA512 80b03d74375fdfed6a29140a3a73c20b387d346b43e3db3d01faf6bdaea5218ce6b7a54c3d0540fed0575d4defea915fb9fa603ba48cbccd288cc0315e71e21a
SSDEEP 12288:6jkyZPStDCf7O4TsH+mGadTSdZKKQWOs5NgsPjYc+igyjj6n4zac:6IyZbpT0rdwQWOwN7PPpgyqn4zP
MD5 SHA1 SHA512 SSDEEP

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 584KB
SHA256 6f3789869d97f5e4bb5d51266c41ca265724c0c1d684539c269aa54bdc98b5fb
MD5 353a843c38b284f499124f770e35afbe
SHA1 c0903eedffbccc02dcc5f7c27be938e2ea6f12d7
SHA512 4e106d8350804d090ffb883d3fda518c53c457bf9dfd07c0f498bf0fad1c06482a991ae78dac244bb017f408a2c1f5b46f92dfb15fdc7aa0b4c16402e1bc8b8d
SSDEEP 12288:+yfPStDCf7O4TsH+mGadTSdZKKQWOs5NgsPjYc+igyjj6n4zaX:nfbpT0rdwQWOwN7PPpgyqn4zs
MD5 SHA1 SHA512 SSDEEP

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 0e7c5d9ccacdf119d881a332414ef5c92dd899bbd16b5f5d3e25291110e47931
MD5 fed57fe5acd31e28e7d4a40506f3feed
SHA1 2fad8d8b1807f3f8306673719e1d7ba22e37c72c
SHA512 161f245d429c10dfdf18c35e30347590650a780cc4c96890618fd0813b5349c75f6f1e8d91b576a3dd2c7fe2e4efd3e40413fbc1f96a6d0ff9dd97c1bebe698d
SSDEEP 24576:0Q9MxZKdcz9dw3mbpT0rdwQWOwN7PPpgyqn4zh:0VKZm9QrtWOs6Q
MD5 SHA1 SHA512 SSDEEP

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 772KB
SHA256 fa410d3d74bdd138dd7522a747ae1a5fe12de032a789f5e23e74c6736428a871
MD5 f751c665a2ee2054edda6b622f21b988
SHA1 a461b5add25982f3f7638698d3c59cc42634219e
SHA512 aca7652ec63339f09766f5e0f89adf45d97db5f2fea88361b006ebc07aa4c16a394df25dd728aa004ce358af48f6f6ef5fc68c0db3204b14591d986d65e0716b
SSDEEP 12288:TyoKo2JRple9pFPStDCf7O4TsH+mGadTSdZKKQWOs5NgsPjYc+igyjj6n4zac:TyocDApFbpT0rdwQWOwN7PPpgyqn4z/
MD5 SHA1 SHA512 SSDEEP

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 e3704c55e5fad4f608d300a455b38eaa662feb30d203c87dd82d42d6695dea30
MD5 abac38e4186248acf44ef6c33910132b
SHA1 d4f5e9d428345298fcaf7af6efbc0d82cf12c00e
SHA512 6ad24efc19a266e6086ef26970d742878c2e83ab3d4a03caff8e123e11fe718fe56fe976e19e6531664146329edceaaad113b06b3bd935861d00fc5bd6d1377e
SSDEEP 49152:AWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKF9QrtWOs6Q:y0zuNIDqrEr
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 f6d9362bb586fe6484f17fd243f08d4a57f6e99642c782a1a59975e4829efe8d
MD5 7c4960bfabe48b1e788f09e97708b37e
SHA1 3ffde0b4caeae23b4fddbf7e4f073b087471af1d
SHA512 45ec169eb764655945394165360b8cb388cd9ec041dcd2fe5bdbb8c028eceaa80b7170212a0f2f94fb463781ced94ea551c5757f142b8855dd0be672d74f92fe
SSDEEP 24576:A1QT7EcpfxR+N5AWAz3ooiYtjMqbIbpT0rdwQWOwN7PPpgyqn4zR:9TDxR+N5YzTfjMj9QrtWOs6Q
MD5 SHA1 SHA512 SSDEEP

Submit Download

office2016setup.exe

Path C:\odt\office2016setup.exe
Size 5.6MB
SHA256 e975b531923d5ddb0f8cce8688271127b70f1f6d759f91515f7d1e89381e7801
MD5 ba3d3e9708e1a73b16501c21f9976d27
SHA1 c04dfa0c375905407ac0b77f29d102bd9a35590a
SHA512 651fbd42cd0de7ae905113eb1a2cc70a8a6282c912970afb8e9c9e3bab247d5f1268b0340587041018411d8065b9c30a7b8b0b155dc2bfc40773893527fa6a9a
SSDEEP 98304:l7M701RgX4iuSl1DtlEq81xZPGnzURnBh6gGL/QmvD/cTwY2h3FvqrEr:JM7pTXexZPGzURnBh6gGLF+W30
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1256-317-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/1256-308-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/1256-429-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/1276-287-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/1276-467-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/1276-335-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/1532-463-0x0000021A057B0000-0x0000021A057C0000-memory.dmp

Download

memory/1532-424-0x0000021A03810000-0x0000021A03820000-memory.dmp

Download

memory/1532-462-0x0000021A03810000-0x0000021A03820000-memory.dmp

Download

memory/1532-430-0x0000021A03810000-0x0000021A03820000-memory.dmp

Download

memory/1532-443-0x0000021A03810000-0x0000021A03820000-memory.dmp

Download

memory/1532-425-0x0000021A03820000-0x0000021A03830000-memory.dmp

Download

memory/1532-464-0x0000021A057B0000-0x0000021A057C0000-memory.dmp

Download

memory/1532-465-0x0000021A057B0000-0x0000021A057C0000-memory.dmp

Download

memory/1532-444-0x0000021A04370000-0x0000021A04380000-memory.dmp

Download

memory/1532-433-0x0000021A03810000-0x0000021A03820000-memory.dmp

Download

memory/1532-475-0x0000021A03810000-0x0000021A03820000-memory.dmp

Download

memory/1532-477-0x0000021A05A10000-0x0000021A05A20000-memory.dmp

Download

memory/1692-257-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/1724-332-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/1724-468-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/2036-471-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/2036-345-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/2200-57-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2200-72-0x0000000140000000-0x00000001400CA000-memory.dmp

Download

memory/2200-67-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2200-63-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2200-56-0x0000000140000000-0x00000001400CA000-memory.dmp

Download

memory/2272-26-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/2272-17-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/2272-18-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/2272-236-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/2336-70-0x00000000004F0000-0x0000000000550000-memory.dmp

Download

memory/2336-71-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/2336-78-0x00000000004F0000-0x0000000000550000-memory.dmp

Download

memory/2336-245-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/2648-266-0x0000000000B40000-0x0000000000BA0000-memory.dmp

Download

memory/2648-315-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/2648-260-0x0000000000B40000-0x0000000000BA0000-memory.dmp

Download

memory/2648-259-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/3668-35-0x0000000140000000-0x0000000140237000-memory.dmp

Download

memory/3668-33-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/3668-40-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/3668-241-0x0000000140000000-0x0000000140237000-memory.dmp

Download

memory/3672-341-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/3672-470-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/3948-336-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/3948-469-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4016-466-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4016-328-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4052-448-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4052-325-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4232-252-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4232-250-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4268-8-0x0000000002080000-0x00000000020E0000-memory.dmp

Download

memory/4268-0-0x0000000140000000-0x00000001400E7000-memory.dmp

Download

memory/4268-1-0x0000000002080000-0x00000000020E0000-memory.dmp

Download

memory/4268-24-0x0000000002080000-0x00000000020E0000-memory.dmp

Download

memory/4268-27-0x0000000140000000-0x00000001400E7000-memory.dmp

Download

memory/4384-331-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/4384-284-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/4808-344-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4808-303-0x0000000000600000-0x0000000000660000-memory.dmp

Download

memory/4808-294-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4840-291-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/4840-339-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/4856-273-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/4856-327-0x0000000000830000-0x0000000000897000-memory.dmp

Download

memory/4856-323-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/4856-280-0x0000000000830000-0x0000000000897000-memory.dmp

Download

memory/4856-274-0x0000000000830000-0x0000000000897000-memory.dmp

Download

memory/4924-320-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/4924-442-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/4980-45-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/4980-52-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/4980-44-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/4980-242-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/5012-13-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/5012-80-0x0000000140000000-0x00000001400AA000-memory.dmp

Download