6e6d1ecd26a0273765e2eabb1f4164cd2d3c61c2ee4a424bed8ea09807f031fd

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
03/04/2024, 10:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-04-03_cd7b199f57142ddaeca9c24b0819df6d_magniber_revil_zxxz.exe
Size 24.3MB
Sample240403-mcbmcaca6v
SHA256 6e6d1ecd26a0273765e2eabb1f4164cd2d3c61c2ee4a424bed8ea09807f031fd
MD5 cd7b199f57142ddaeca9c24b0819df6d
SHA1 4dcea2edabad051a54cbe3dcb7f8992e70c4fc8d
SHA512 ef6d21fc1fda9aaa3af415e0fb9313c69e9fcf57f5a0555da10f97b58966c7a28b75cdbfa1367e086df9457fac233034706395208191fe4c931925320e7a713d
SSDEEP 196608:7P0Hj6JigboXZDwqY8a/qVwsEXX1KOgCu3JK1Op3H2SAmGcWqnlv018iP:7PboGX8a/jWWu3cI2D/cWcls1J
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
3284	alg.exe
1284	DiagnosticsHub.StandardCollector.Service.exe
3956	fxssvc.exe
4964	elevation_service.exe
3940	elevation_service.exe
1452	maintenanceservice.exe
3916	msdtc.exe
1700	OSE.EXE
4736	PerceptionSimulationService.exe
712	perfhost.exe
3140	locator.exe
4460	SensorDataService.exe
2040	snmptrap.exe
4296	spectrum.exe
3828	ssh-agent.exe
3580	TieringEngineService.exe
380	AgentService.exe
368	vds.exe
2424	vssvc.exe
3564	wbengine.exe
4308	WmiApSrv.exe
2244	SearchIndexer.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in System32 directory 31 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\wbengine.exe	2024-04-03_cd7b199f57142ddaeca9c24b0819df6d_magniber_revil_zxxz.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\dllhost.exe	alg.exe
File opened for modification	C:\Windows\system32\AgentService.exe	alg.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2024-04-03_cd7b199f57142ddaeca9c24b0819df6d_magniber_revil_zxxz.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2024-04-03_cd7b199f57142ddaeca9c24b0819df6d_magniber_revil_zxxz.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2024-04-03_cd7b199f57142ddaeca9c24b0819df6d_magniber_revil_zxxz.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2024-04-03_cd7b199f57142ddaeca9c24b0819df6d_magniber_revil_zxxz.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2024-04-03_cd7b199f57142ddaeca9c24b0819df6d_magniber_revil_zxxz.exe
File opened for modification	C:\Windows\system32\locator.exe	2024-04-03_cd7b199f57142ddaeca9c24b0819df6d_magniber_revil_zxxz.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2024-04-03_cd7b199f57142ddaeca9c24b0819df6d_magniber_revil_zxxz.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2024-04-03_cd7b199f57142ddaeca9c24b0819df6d_magniber_revil_zxxz.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2024-04-03_cd7b199f57142ddaeca9c24b0819df6d_magniber_revil_zxxz.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2024-04-03_cd7b199f57142ddaeca9c24b0819df6d_magniber_revil_zxxz.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\28f022fc822cf6b9.bin	alg.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	alg.exe
File opened for modification	C:\Windows\System32\alg.exe	2024-04-03_cd7b199f57142ddaeca9c24b0819df6d_magniber_revil_zxxz.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2024-04-03_cd7b199f57142ddaeca9c24b0819df6d_magniber_revil_zxxz.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2024-04-03_cd7b199f57142ddaeca9c24b0819df6d_magniber_revil_zxxz.exe
File opened for modification	C:\Windows\System32\vds.exe	2024-04-03_cd7b199f57142ddaeca9c24b0819df6d_magniber_revil_zxxz.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2024-04-03_cd7b199f57142ddaeca9c24b0819df6d_magniber_revil_zxxz.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2024-04-03_cd7b199f57142ddaeca9c24b0819df6d_magniber_revil_zxxz.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	alg.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2024-04-03_cd7b199f57142ddaeca9c24b0819df6d_magniber_revil_zxxz.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2024-04-03_cd7b199f57142ddaeca9c24b0819df6d_magniber_revil_zxxz.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2024-04-03_cd7b199f57142ddaeca9c24b0819df6d_magniber_revil_zxxz.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2024-04-03_cd7b199f57142ddaeca9c24b0819df6d_magniber_revil_zxxz.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2024-04-03_cd7b199f57142ddaeca9c24b0819df6d_magniber_revil_zxxz.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	alg.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2024-04-03_cd7b199f57142ddaeca9c24b0819df6d_magniber_revil_zxxz.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2024-04-03_cd7b199f57142ddaeca9c24b0819df6d_magniber_revil_zxxz.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2024-04-03_cd7b199f57142ddaeca9c24b0819df6d_magniber_revil_zxxz.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	2024-04-03_cd7b199f57142ddaeca9c24b0819df6d_magniber_revil_zxxz.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	2024-04-03_cd7b199f57142ddaeca9c24b0819df6d_magniber_revil_zxxz.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2024-04-03_cd7b199f57142ddaeca9c24b0819df6d_magniber_revil_zxxz.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	2024-04-03_cd7b199f57142ddaeca9c24b0819df6d_magniber_revil_zxxz.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe	2024-04-03_cd7b199f57142ddaeca9c24b0819df6d_magniber_revil_zxxz.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	2024-04-03_cd7b199f57142ddaeca9c24b0819df6d_magniber_revil_zxxz.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2024-04-03_cd7b199f57142ddaeca9c24b0819df6d_magniber_revil_zxxz.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	2024-04-03_cd7b199f57142ddaeca9c24b0819df6d_magniber_revil_zxxz.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	alg.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	2024-04-03_cd7b199f57142ddaeca9c24b0819df6d_magniber_revil_zxxz.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2024-04-03_cd7b199f57142ddaeca9c24b0819df6d_magniber_revil_zxxz.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2024-04-03_cd7b199f57142ddaeca9c24b0819df6d_magniber_revil_zxxz.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2024-04-03_cd7b199f57142ddaeca9c24b0819df6d_magniber_revil_zxxz.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe	2024-04-03_cd7b199f57142ddaeca9c24b0819df6d_magniber_revil_zxxz.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe	2024-04-03_cd7b199f57142ddaeca9c24b0819df6d_magniber_revil_zxxz.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2024-04-03_cd7b199f57142ddaeca9c24b0819df6d_magniber_revil_zxxz.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2024-04-03_cd7b199f57142ddaeca9c24b0819df6d_magniber_revil_zxxz.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2024-04-03_cd7b199f57142ddaeca9c24b0819df6d_magniber_revil_zxxz.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	2024-04-03_cd7b199f57142ddaeca9c24b0819df6d_magniber_revil_zxxz.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\106.0.5249.119\chrome_installer.exe	2024-04-03_cd7b199f57142ddaeca9c24b0819df6d_magniber_revil_zxxz.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2024-04-03_cd7b199f57142ddaeca9c24b0819df6d_magniber_revil_zxxz.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2024-04-03_cd7b199f57142ddaeca9c24b0819df6d_magniber_revil_zxxz.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2024-04-03_cd7b199f57142ddaeca9c24b0819df6d_magniber_revil_zxxz.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	2024-04-03_cd7b199f57142ddaeca9c24b0819df6d_magniber_revil_zxxz.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2024-04-03_cd7b199f57142ddaeca9c24b0819df6d_magniber_revil_zxxz.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	2024-04-03_cd7b199f57142ddaeca9c24b0819df6d_magniber_revil_zxxz.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	2024-04-03_cd7b199f57142ddaeca9c24b0819df6d_magniber_revil_zxxz.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2024-04-03_cd7b199f57142ddaeca9c24b0819df6d_magniber_revil_zxxz.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2024-04-03_cd7b199f57142ddaeca9c24b0819df6d_magniber_revil_zxxz.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2024-04-03_cd7b199f57142ddaeca9c24b0819df6d_magniber_revil_zxxz.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9933 = "MPEG-4 Audio"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006fd3fe59b085da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000122dbb5ab085da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9923 = "Windows Media playlist"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008d08765ab085da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005a48145ab085da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004b814d5ab085da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000eac3f95cb085da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003db9865ab085da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c192255cb085da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007af6085cb085da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
1548	2024-04-03_cd7b199f57142ddaeca9c24b0819df6d_magniber_revil_zxxz.exe
1548	2024-04-03_cd7b199f57142ddaeca9c24b0819df6d_magniber_revil_zxxz.exe
1548	2024-04-03_cd7b199f57142ddaeca9c24b0819df6d_magniber_revil_zxxz.exe
1548	2024-04-03_cd7b199f57142ddaeca9c24b0819df6d_magniber_revil_zxxz.exe
1548	2024-04-03_cd7b199f57142ddaeca9c24b0819df6d_magniber_revil_zxxz.exe
1548	2024-04-03_cd7b199f57142ddaeca9c24b0819df6d_magniber_revil_zxxz.exe
1548	2024-04-03_cd7b199f57142ddaeca9c24b0819df6d_magniber_revil_zxxz.exe
1548	2024-04-03_cd7b199f57142ddaeca9c24b0819df6d_magniber_revil_zxxz.exe
1548	2024-04-03_cd7b199f57142ddaeca9c24b0819df6d_magniber_revil_zxxz.exe
1548	2024-04-03_cd7b199f57142ddaeca9c24b0819df6d_magniber_revil_zxxz.exe
1548	2024-04-03_cd7b199f57142ddaeca9c24b0819df6d_magniber_revil_zxxz.exe
1548	2024-04-03_cd7b199f57142ddaeca9c24b0819df6d_magniber_revil_zxxz.exe
1548	2024-04-03_cd7b199f57142ddaeca9c24b0819df6d_magniber_revil_zxxz.exe
1548	2024-04-03_cd7b199f57142ddaeca9c24b0819df6d_magniber_revil_zxxz.exe
1548	2024-04-03_cd7b199f57142ddaeca9c24b0819df6d_magniber_revil_zxxz.exe
1548	2024-04-03_cd7b199f57142ddaeca9c24b0819df6d_magniber_revil_zxxz.exe
1548	2024-04-03_cd7b199f57142ddaeca9c24b0819df6d_magniber_revil_zxxz.exe
1548	2024-04-03_cd7b199f57142ddaeca9c24b0819df6d_magniber_revil_zxxz.exe
1548	2024-04-03_cd7b199f57142ddaeca9c24b0819df6d_magniber_revil_zxxz.exe
1548	2024-04-03_cd7b199f57142ddaeca9c24b0819df6d_magniber_revil_zxxz.exe
1548	2024-04-03_cd7b199f57142ddaeca9c24b0819df6d_magniber_revil_zxxz.exe
1548	2024-04-03_cd7b199f57142ddaeca9c24b0819df6d_magniber_revil_zxxz.exe
1548	2024-04-03_cd7b199f57142ddaeca9c24b0819df6d_magniber_revil_zxxz.exe
1548	2024-04-03_cd7b199f57142ddaeca9c24b0819df6d_magniber_revil_zxxz.exe
1548	2024-04-03_cd7b199f57142ddaeca9c24b0819df6d_magniber_revil_zxxz.exe
1548	2024-04-03_cd7b199f57142ddaeca9c24b0819df6d_magniber_revil_zxxz.exe
1548	2024-04-03_cd7b199f57142ddaeca9c24b0819df6d_magniber_revil_zxxz.exe
1548	2024-04-03_cd7b199f57142ddaeca9c24b0819df6d_magniber_revil_zxxz.exe
1548	2024-04-03_cd7b199f57142ddaeca9c24b0819df6d_magniber_revil_zxxz.exe
1548	2024-04-03_cd7b199f57142ddaeca9c24b0819df6d_magniber_revil_zxxz.exe
1548	2024-04-03_cd7b199f57142ddaeca9c24b0819df6d_magniber_revil_zxxz.exe
1548	2024-04-03_cd7b199f57142ddaeca9c24b0819df6d_magniber_revil_zxxz.exe
1548	2024-04-03_cd7b199f57142ddaeca9c24b0819df6d_magniber_revil_zxxz.exe
1548	2024-04-03_cd7b199f57142ddaeca9c24b0819df6d_magniber_revil_zxxz.exe
1548	2024-04-03_cd7b199f57142ddaeca9c24b0819df6d_magniber_revil_zxxz.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
652	Process not Found
652	Process not Found

Suspicious use of AdjustPrivilegeToken 45 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1548	2024-04-03_cd7b199f57142ddaeca9c24b0819df6d_magniber_revil_zxxz.exe
Token: SeAuditPrivilege	3956	fxssvc.exe
Token: SeRestorePrivilege	3580	TieringEngineService.exe
Token: SeManageVolumePrivilege	3580	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	380	AgentService.exe
Token: SeBackupPrivilege	2424	vssvc.exe
Token: SeRestorePrivilege	2424	vssvc.exe
Token: SeAuditPrivilege	2424	vssvc.exe
Token: SeBackupPrivilege	3564	wbengine.exe
Token: SeRestorePrivilege	3564	wbengine.exe
Token: SeSecurityPrivilege	3564	wbengine.exe
Token: 33	2244	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2244	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2244	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2244	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2244	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2244	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2244	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2244	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2244	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2244	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2244	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2244	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2244	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2244	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2244	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2244	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2244	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2244	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2244	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2244	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2244	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2244	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2244	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2244	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2244	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2244	SearchIndexer.exe
Token: SeDebugPrivilege	1548	2024-04-03_cd7b199f57142ddaeca9c24b0819df6d_magniber_revil_zxxz.exe
Token: SeDebugPrivilege	1548	2024-04-03_cd7b199f57142ddaeca9c24b0819df6d_magniber_revil_zxxz.exe
Token: SeDebugPrivilege	1548	2024-04-03_cd7b199f57142ddaeca9c24b0819df6d_magniber_revil_zxxz.exe
Token: SeDebugPrivilege	1548	2024-04-03_cd7b199f57142ddaeca9c24b0819df6d_magniber_revil_zxxz.exe
Token: SeDebugPrivilege	1548	2024-04-03_cd7b199f57142ddaeca9c24b0819df6d_magniber_revil_zxxz.exe
Token: SeDebugPrivilege	3284	alg.exe
Token: SeDebugPrivilege	3284	alg.exe
Token: SeDebugPrivilege	3284	alg.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2244 wrote to memory of 1852	2244	SearchIndexer.exe	118
PID 2244 wrote to memory of 1852	2244	SearchIndexer.exe	118
PID 2244 wrote to memory of 840	2244	SearchIndexer.exe	119
PID 2244 wrote to memory of 840	2244	SearchIndexer.exe	119

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2024-04-03_cd7b199f57142ddaeca9c24b0819df6d_magniber_revil_zxxz.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-03_cd7b199f57142ddaeca9c24b0819df6d_magniber_revil_zxxz.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1548

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3284

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:1284

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:2396

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3956

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4964

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3940

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:1452

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:3916

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1700

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4736

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:712

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:3140

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4460

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:2040

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4296

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3828

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:4360

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3580

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:380

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:368

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2424

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3564

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:4308

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2244
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1852
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
  2⤵
  - Modifies data under HKEY_USERS
  PID:840

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
Size 2.1MB
SHA256 9b21652ff85e3f46f3b76929554aca067a44402e04b4f6e8dbac7834bcd123b7
MD5 c507ec39ddec8815c2f3ef0116ce94c6
SHA1 10eb7182ab504cda1d5d2c699df584c3921b9ed9
SHA512 0b6c913473fdec8b2421a1cb80487738d10388ccb70ca46f327b2e30c6ffde9f73a96b9c6c0943c9cfaf64c970f60f07773b13a31450cd4cbda2abbe7fdab2ec
SSDEEP 49152:IuYk3H5koUXfTqkkYLO/W2buywzMbOX+T7z5RP4suIRbDv:IPfTqi90b9PHn3
MD5 SHA1 SHA512 SSDEEP

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 781KB
SHA256 cb845a785a77d55efc44adab85476f66b7e13d9c3a702160e1fd29fbc8a8856e
MD5 c87810c900531014fdbd0e5e1924683b
SHA1 d87bc9901ad2333876c05ac398e9122a197dadd6
SHA512 d13aae37b7504f629fc1d2bf57e99caceac6856d6b463e08ec55598a391d91f4822b23f9dc9ef0f75d9a52c70c17539fa64ad963210f500a2d657c83dd1e5642
SSDEEP 24576:GPsJcui8Hofe3y1sInB2COzRq8DvFqtX:Gwcu9P4suIRbDv
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 26efe8205c6d84c417054959600bd48181f40ebffde4486e85cd01fce1e68528
MD5 dc5ab1f6c966e765b94a9e7ceb948971
SHA1 b66652ec2bd9c1cdaec5c41e281ae51bfa4f1aac
SHA512 042f37bc0eaa329fed9cb3838b79b7f93c1b55461dadd152442510f2df59459974fe730289c4025a222999eaba8e5c4cb3f97ba048365c59d89dd7fc93348ff5
SSDEEP 24576:B+gkEVfh4CoYHofe3y1sInB2COzRq8DvFqtS:IgkExScP4suIRbDv
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 7ca14b1535ea5ba1a257addbd8aa958fd3d44fdf49a2cb07ffe09ae14ac0cf32
MD5 40c44f790047d408bc455b8a1880073b
SHA1 54c1d1af51c65f5d6632824baf4937dedcda2df3
SHA512 c0edb6fa1e63936b8f471267a515df35da03ca3a4cf5062927ac0f180259198c020772b00b88ceade3e3e25b9641439ae8254c078f482967e43618176e69bffb
SSDEEP 24576:2BpDRmi78gkPXlyo0GxjrRHofe3y1sInB2COzRq8DvFqt6:yNRmi78gkPX4o0GxjxP4suIRbDv
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 35e8ce1b59ddb29c444ef81efb8b75c427274992a5a1d88cfc3b5495c82def70
MD5 603e3cf6b902543b2b731a4f1648ba5a
SHA1 c9661a4fe0489823fefff6089502b82c0a0184cf
SHA512 f3a51ce228675f866e5361f87642da7cd913c6e08d79d2519b7d782cf8ae009f430ef1d13304b55d5a84fd0b47226013e819148ef5ed4f8a732a87239fec7325
SSDEEP 24576:3LOS2oyPIXVYHofe3y1sInB2COzRq8DvFqtA:h/y5P4suIRbDv
MD5 SHA1 SHA512 SSDEEP

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 665213e588086e3f492deac0b5ebf325af41844547739c21332fb40081eeb5a0
MD5 57242e89585096cd558e7fd75e0cb81e
SHA1 659a9d8ac321c12f50bc3cec2f37665f4fd11905
SHA512 1e5ac6236d3f312a721848e67cd15f67443c42284f022028722497850c75f5233c4468799f2fd9d81460879c7c4a9933e9194e00d04d616e3ec5bfc0c922732a
SSDEEP 12288:vfi3Dbif4YAJ93y1NrLiLtJ8nBxu7DCOzRq8DvQgqAbhIf:vfiHofe3y1sInB2COzRq8DvFqtf
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 588a945ea73483d39a736e80fff3c0ffb557c9416e8031072c821bddecff734f
MD5 70a4f6c8da62ebaad1814693635520c7
SHA1 10d13d739d7106a546777063bf0e66bf75748583
SHA512 cdbd57fdeffb3bc87cece8faa0f8ad099043103dee146a50718c6e87e9926ee1e71e920a37415d1c989a97c38c9ed702dfc6972419acc2133ac76b911aae3d10
SSDEEP 12288:OeBNUbTVO86UT3Dbif4YAJ93y1NrLiLtJ8nBxu7DCOzRq8DvQgqAbhIg:OJIUTHofe3y1sInB2COzRq8DvFqtg
MD5 SHA1 SHA512 SSDEEP

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 a3ae732c2b706d66d8f38ae3cb5e534e4a20e9f1e6747c10ae4f73fd799bc0a5
MD5 a6c3e8cdf0ffde68b1cd8adbf6300129
SHA1 6cf323123090ad5f3a5feefbee2d78df41c90119
SHA512 17b26b2ca079f0e8ae5bf2dfb98ab08cb02e608ac187b5c8e0878df52bf120cead76606962fcf82d6715083d5e98b2c1bb78b1cb82730a23506c90a76adf3c63
SSDEEP 49152:jQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THz:jQvGAdlCEL8c/yRNw5C6PHn3
MD5 SHA1 SHA512 SSDEEP

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 fd4cec12970b7a067fc50195bcd76d5e2ab9673e31b548c518db4ccb5ac41b6a
MD5 5302c4b404f2f4ee562b06788496fefd
SHA1 77207a4f45a2c802718ffcc23fe2841a48ef7afd
SHA512 0a41b59a5ee07a66af78e8a4a40513068c84b58dc925b6c3f9d095e20565d9a3449b1b3f82b9aec193138b29da4d45ece7454fcf32dd800cc6f2463a3d85b06f
SSDEEP 24576:IdewsAjJHofe3y1sInB2COzRq8DvFqt0:Ilj9P4suIRbDv
MD5 SHA1 SHA512 SSDEEP

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 6a4dfc01bb8710521f518952206ff82340115eb8534e462ea3993d8cce32f672
MD5 2ae8b8fd905ad6517f19cb1808be8f7a
SHA1 b9f122e24d764baf6a3079653179bb5be2f9a2a9
SHA512 2cc2c06f664f4e17ef177a87ffc9091fd9474d00a9d1c5a673060d985604fda9eff76b6de905b61819f71436a69b4114de32fad192bfb9dca20789f8a49f368e
SSDEEP 196608:QUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHlP:QUEtQevvqc2W1cpV2EI32V
MD5 SHA1 SHA512 SSDEEP

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 3781dd068069c9316db7e8818cd459a54a0766ad4f54f7178a56f13ba9a92077
MD5 0130cb539bba6bb3449dc0f3f4364cf2
SHA1 4ae5010fa958d5ce769e0b851e0da63d94ef80bd
SHA512 b53c8fec74e6495c4ad24a6e0d1d7290d08f0db2aa9f2bc9cbf02b9a5a44da954176ac6fea65d10a21314a203b1fe11ec78765e0e7d06e76cec245c6d36b235f
SSDEEP 49152:SCbRquA/m2yL5zTfFiV+XenmE3/zdP4suIRbDv:3oquVjnm2PHn3
MD5 SHA1 SHA512 SSDEEP

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 846d8c1fc94a87237a4c64d33bbdb3a734f1493333c2dcef49f98bc23627f741
MD5 0e5bf3eec9daf615c9e45268d0a7ff69
SHA1 fdfae3b93efd721597d28349128e69d37a10574e
SHA512 29e822737a8a06783d32dc3abfc9acf561b9668ff68ada83468179a8bc7444955193f6fa08d3bc202c40a4f1f7c01cc793ad1ea26f2cb74d249149ce2c66b09b
SSDEEP 24576:rAhGLJIFoiwtA5l7S53oHofe3y1sInB2COzRq8DvFqtO:rAMyFoiq5GP4suIRbDv
MD5 SHA1 SHA512 SSDEEP

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 c65d78830a0a131f70a5276fb2c5f96d4b576c3aaa7621cc4383a389b0676ed9
MD5 0a6ed5317d7e67618cae1e34039d3628
SHA1 2aa2b650f48aefd24cfe1eee70e3f2edc593a5a3
SHA512 5b56f649c9d16c8c5ca2a38662a905e8ca64703d881a0420958d2a2061d717f48b641dfdb21e2fbc5b5ec9524e4050ff2cf2321e11bfff4a7db4612953179646
SSDEEP 12288:mmw5HEjsChNVBFgl0WDm+CU3Dbif4YAJ93y1NrLiLtJ8nBxu7DCOzRq8DvQgqAbP:/wuoOWNHofe3y1sInB2COzRq8DvFqt6
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 e1b75047dd3079ac2381cf3c7b9ba404ad58f43a8833fc28c560d101f9ee29dd
MD5 dbf7b57a64cbd9ad61bf2f338c5a7a8c
SHA1 c5e9c4a1fb6e18f30a36da206b87f1f3dc347bcc
SHA512 48ba2d792f9fbd2b559921dcf4649e67de32997a229c75992d8203aa506ce0178d18206c6aa79d23cbba666638c18d385f7ad4aaf883c88a39b0321ca671c546
SSDEEP 12288:VBZ1Iy53Dbif4YAJ93y1NrLiLtJ8nBxu7DCOzRq8DvQgqAbhIt:DZuuHofe3y1sInB2COzRq8DvFqtt
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe
Size 4.8MB
SHA256 4df33bff9a0f7d531354e819a8a7b278b9e5368feab6e535ff30ab90b5f90993
MD5 3ee782ab62540348f521332fe05e30c7
SHA1 451897ed2ae4b4570f2f48ecf0d3151172e2a126
SHA512 a34c061fe626609799cbc575b1153fd80f1d039b7f5e19917287c296b0fbb5cd54a4585c76c3a42a71a556a71646b385b687f4ac61f2cf958ec720f4b840952c
SSDEEP 49152:Fj8f3jtqiCLg9LK2hIOR+k9jdAsizqxSiZ4K5MZqkL92c6nkdmbDfiIerM1R6ZPS:erZ4K5M+XDfiIewG+x6xZ14TPHn3
MD5 SHA1 SHA512 SSDEEP

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe
Size 4.8MB
SHA256 30303357f023ebcec7da26636802096547d940147978edacee0879504b0c8ebc
MD5 2f64422e61dd7f4842513410343f1c7b
SHA1 a2778ecb564691fe2a556e470bcd0554e46fa449
SHA512 76bcb8fa70f90ecd57dc8b015509aef65f6da0c4a3ab5cc75d3b3568339412180f32f1d2237ba0d762e4ed98b58e6f34a3d7703e48835f75830e58eec7e4c2a3
SSDEEP 49152:Hj8f3jtqiCLg9LK2hIOR+k9jdAsizqxSiZ4K5MZqkL92c6nkdmbDfiIerM1R6ZPS:grZ4K5M+XDfiIewG+x6xZ14TPHn3
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe
Size 2.2MB
SHA256 9699bc15c3abefa59f25af8f36b2ad10c45cfb3ebcd4d511bf5474399837a3b9
MD5 7e6480d018230af4e5566796c2276292
SHA1 69cb01e2e6ecddd6bf5f253a489db9f8992a662b
SHA512 4c440845fa5389fedc8e49434b9fd70608d5d253a399eaba99f444e7bc7715dc1d795ce9aa66d3f180557453c0e7db5100e725a9fd12edc56f4cf65561d4771b
SSDEEP 49152:5fzabJ8llj+SWWi2mkx+X+diWP4suIRbDv:yui23PHn3
MD5 SHA1 SHA512 SSDEEP

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
Size 2.1MB
SHA256 9b825cf260ea3c575bad0c3afdcad84483e9148a39aeaa1124204dcd36fc5c76
MD5 3fe2f7440980fed1fdc4b16043cf6d78
SHA1 8a764bdcf5c372ee8a58f786a4252c785b8078fe
SHA512 d36a140cae524b074c4bd71a608dc8fc91356d9622a5260e23453be73c066149f67bdfa0a14b7cf2dd4efb9c1997c8622cfe9d9a87a703e8ed4abe599943b8e7
SSDEEP 49152:ya/3xXBSZ4K5MJ1LvTMxbfsYBYSgxu9+fw4TzP4suIRbDv:cZ4K5MJabfsYNyPHn3
MD5 SHA1 SHA512 SSDEEP

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe
Size 1.8MB
SHA256 d08f6f033391025b05b78e3b24fb873a30ac0ade7fbf64c04ca4d916615e0c20
MD5 000e5fb6e0bca34014640f2d456ea5ab
SHA1 47254e8a2cb9faa85161be3c109ec75b1be33ef7
SHA512 7b79ae442ef582b9039724b2959c682dbf82f487df257b38be49e630cd127485dda9b543b04487cadd440d96debb2b0ca492d7b12104d9cca3de5eeb16850c4c
SSDEEP 24576:ogNJw85yUKzDu/9gKPlfLO8C49BgKHHofe3y1sInB2COzRq8DvFqtm:ogNJtUzDu/9gKPxHC4pP4suIRbDv
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 1.5MB
SHA256 846a7b59de209225d0969e22ac7cb5bc0a55b3b3350d350fa834b2b4a73513c3
MD5 780aeb3e274bff4ba82646a16a2c8106
SHA1 7e78f1692498ea0640c6209f86ef844d6a114eeb
SHA512 258624466be6d8a9c169828866338d5013dba8ce168922391596be9c5cdd5b757cbe67c32ba9662713997f000100545bdab317284435545d1efaab4caab153e7
SSDEEP 49152:SOBynH1wM+v6UJxLQd7BHjdf7P4suIRbDv:Gn4LQd7LTPHn3
MD5 SHA1 SHA512 SSDEEP

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 dd43f4cf5d3a3bb2b1915c5f7cfb10231a1a9e565bc59340ac2d9dbb054df85b
MD5 a8624283e809b4870ae9921998285da6
SHA1 9ab82ff81b269d4005b3558d20e4fbbbc3033312
SHA512 a411d7bc540feff35d7af8aae32971c507504c5ded706c3638cbd4e0ea40ff6e8aacca8cc7979bf5e247932c61b72557f12aa54426672750ae5ba0389e0d64de
SSDEEP 12288:YK3Dbif4YAJ93y1NrLiLtJ8nBxu7DCOzRq8DvQgqAbhIX:YKHofe3y1sInB2COzRq8DvFqtX
MD5 SHA1 SHA512 SSDEEP

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 56f8627baf9d63bdcd112be1d1f927210e2f940a80e1fe74426700c2066fcdb0
MD5 d0e80003041c376914446cf60bbc71f5
SHA1 6549a9c79bcad6677a1f2bf3f4ad6ea6d7503915
SHA512 01b15808e01be6ebce9790b35acdf117a929801007e9d74f00e2599593d36c3ac2a472b1c073a3f48b685b5a2ae69e52b0c1b03246a91012efa69fbf6101a49d
SSDEEP 12288:qF3Dbif4YAJ93y1NrLiLtJ8nBxu7DCOzRq8DvQgqAbhIX:qFHofe3y1sInB2COzRq8DvFqtX
MD5 SHA1 SHA512 SSDEEP

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 b1ed334cfd01b6c3e2acf699055a26d105ace7cfae4a7d5df7b1014fbd4d8ae4
MD5 49f8c6c96b4d8ea8755e2659d5385388
SHA1 07ed558d4462bd9a1478289fdc60dc320efaa7db
SHA512 482ba623cddc73c7c35a9a3a87ca2d72b240f26d9cbeff591e33f246decf19e9973efafc85e7975909c00b91a0008b0bd641b72aece307e1900443e9d06fb0ab
SSDEEP 12288:fb3Dbif4YAJ93y1NrLiLtJ8nBxu7DCOzRq8DvQgqAbhIX:fbHofe3y1sInB2COzRq8DvFqtX
MD5 SHA1 SHA512 SSDEEP

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 4cf2ee0ec247e6d30bd90d6c94f303bf88b646f2dac973df2ecd538b9a51964d
MD5 cb5cad342a03c07c493a671dc58927c3
SHA1 064247f527e039c71aa0f57248eb6e9819ac60e4
SHA512 f744add895cbfcd42a7bc13917c1d450d8d9f8f0c3dbe92db9733de8c1bc74a6e1bc91fed617c2faec99b671d6983f51de1be11e3969f34db6ba5ec7fd2f31f5
SSDEEP 12288:fVI3Dbif4YAJ93y1NrLiLtJ8nBxu7DCOzRq8DvQgqAbhI7:iHofe3y1sInB2COzRq8DvFqt7
MD5 SHA1 SHA512 SSDEEP

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 dd8681e3a548b8eb5226e26046a0b76140486845d140d5adfca215004b69ac3b
MD5 803720d778a10aef83bfd136ed5a2458
SHA1 3d526e4d8f72ea8a933f478e93defc5772353eaa
SHA512 6caaf14a1a751b91ad6be2edd8b3fbf351802d4edd52bb54aa773ae6e03a5a5310b10cd15a29706ef6071de1dc51a804c4b8d27cb474f05b6a223678c5be3a11
SSDEEP 12288:cA3Dbif4YAJ93y1NrLiLtJ8nBxu7DCOzRq8DvQgqAbhIu:cAHofe3y1sInB2COzRq8DvFqtu
MD5 SHA1 SHA512 SSDEEP

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 36a61d89f96e1cc9c9d5fab0e04571f4c3c6233007b0a27ec1848757ff3b8b13
MD5 bbef1476f8ce8bd3d3513fc675d31e55
SHA1 b3fe10024c83fbb48fea42532dbae8736f2bf1cb
SHA512 f6cb68918dbf5dbc9f6a87b34339eecdbd9eda678ffeaa8b212dd13b0d362546a30e02c92a62f401f6a38b3dd69cb88fe0d8bec3affa632ae8de17687de18ae1
SSDEEP 12288:nR3Dbif4YAJ93y1NrLiLtJ8nBxu7DCOzRq8DvQgqAbhIu:nRHofe3y1sInB2COzRq8DvFqtu
MD5 SHA1 SHA512 SSDEEP

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 6992d20f6e96edc72099ea9250313e7c7a2725031c3f4f68b8adc44cda3c3054
MD5 17b030f449888164fad0de965ae2ff26
SHA1 4226ddecac18f1ca9e59bfc4acca312d3457aef7
SHA512 979e4cc2232dfb17c86e8f752b37869340195564a818e0c158f5a709abb8ebfc581512da238bd50feabeb20b333549eae2e1082075233a6bd3da7784f7536d41
SSDEEP 12288:4d3Dbif4YAJ93y1NrLiLtJ8nBxu7DCOzRq8DvQgqAbhIT:4dHofe3y1sInB2COzRq8DvFqtT
MD5 SHA1 SHA512 SSDEEP

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 a6c607ca29fe4b12156ad0b1b6f1e355d7a5ead76aefe845f0e8c6653ad4aaf1
MD5 a063dd9457cd6371e1e23b166c58848c
SHA1 7c1094a1495d2bb544b13cf494ea2fd99b3a646f
SHA512 9fa4e1a9290bc26d3acbff2013ea0a680a902ff3e6d2d85f7da17314ec2ad3d7e0a8b41bd83e1b17d57291949170032a0f98d4edf57b6213013c819712af0c30
SSDEEP 24576:SZMSzFVSOlHofe3y1sInB2COzRq8DvFqtF:SZMSzfFP4suIRbDv
MD5 SHA1 SHA512 SSDEEP

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 ef949414f124e3bb3c4ced1e1db6d9673dba7035d02d4c4a44bb4321259626d6
MD5 1fd83be38604f63bd9aba81a79a2be84
SHA1 41ec44e04958a618ff08c5b68b12b12334a5a700
SHA512 50083498550ac35c6cf2da55894f28553246afd776e367f9769401601accca11ab59b32b86d34ba5c5ccd5ea72080c4f2b1ddf0f40841e288aef4025e0cba9e1
SSDEEP 12288:We3Dbif4YAJ93y1NrLiLtJ8nBxu7DCOzRq8DvQgqAbhIb:WeHofe3y1sInB2COzRq8DvFqtb
MD5 SHA1 SHA512 SSDEEP

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 9753d1a32ac2cfc6e2e5c80e9f2ee4cdd4e7c0cd0831597a8dfdca1e420532cb
MD5 d26c301fefdb673160a7c502bba556f5
SHA1 851746a76b84e9df6e2e5c7cbe7a23402cd04d4c
SHA512 e5a2e07673e158585b1e83ca374cab1bd1bd41908187a66de2b9ca65f9992ee405af3cab48fe9c65d293824a20282919c9a4ac1e0cf909b82cf507eff04ac04c
SSDEEP 12288:XS3Dbif4YAJ93y1NrLiLtJ8nBxu7DCOzRq8DvQgqAbhI9:XSHofe3y1sInB2COzRq8DvFqt9
MD5 SHA1 SHA512 SSDEEP

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 86ac452b00264f82ebb43a5355e5c7095e31d9ef91f56911f281986bd231d259
MD5 696d2475175b966a05690bf4e7ac5ab8
SHA1 4ec233a9cf653458b8d86ee4724237a1f8cb58ef
SHA512 3c44621ba981c896ddf0c3e00b0766585c0c298d66a863a2d4f83b3ac090dc925ab1aec05d75ceb532ee52e75bd218f5b9d591491b7f297d44ab801fa6c0b015
SSDEEP 12288:ayPz5L853Dbif4YAJ93y1NrLiLtJ8nBxu7DCOzRq8DvQgqAbhIJ:Hzy5Hofe3y1sInB2COzRq8DvFqtJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 e0af89199aa84beb55d6b7165a6dfb93a1bf913a8f898172dcacf8cf2d475bd4
MD5 551dd505694e4201c0bf94f5262113a8
SHA1 33e24613650a8a5d4b8e8c3ab9b9dd5a4ba8a364
SHA512 75b7666afa2682c377a973135f116b7d6c6367c9efefc3877108f196131480930cad9e7f049f04ae9ba9209e887dcefa1553f6973aeaa15294f6a420c14ff92d
SSDEEP 12288:ke3Dbif4YAJ93y1NrLiLtJ8nBxu7DCOzRq8DvQgqAbhIv:keHofe3y1sInB2COzRq8DvFqtv
MD5 SHA1 SHA512 SSDEEP

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 f4537d31dbb461b2af2208128c49681a47c17d3c1c2b0efb7163edc59c1b1606
MD5 b109d27d2e68cfc31122896523a2bdce
SHA1 ae2d95de7b31946b15e191afb51a0f6052211ee4
SHA512 6fd36ee08fb3429d8c53289acb3abaddfd4c05116b092f270c4e948854720444fc778135d92b926a3b9d6aae65bba51cf5d7ec490239c566341812216860751b
SSDEEP 12288:xe3Dbif4YAJ93y1NrLiLtJ8nBxu7DCOzRq8DvQgqAbhIv:xeHofe3y1sInB2COzRq8DvFqtv
MD5 SHA1 SHA512 SSDEEP

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 c2bbc8cae65586216ece1ec25ffc7318a5e3ecc6e1d0e8ad76bfd2b6d8f764fe
MD5 f7d516493a2547e635797f2a97efa717
SHA1 dff143efa53bf95a4301726eec643672e9f2249f
SHA512 27565bd1f7bf17bd42abd4fe804320dee1bd01e00191c8aaedcc972e4e4172df75602c2f7eb25bfe85efffb3eb79f2790f6dbe612301e1a7010abe26e8b8b4b4
SSDEEP 12288:7yPz5L853Dbif4YAJ93y1NrLiLtJ8nBxu7DCOzRq8DvQgqAbhIM:2zy5Hofe3y1sInB2COzRq8DvFqtM
MD5 SHA1 SHA512 SSDEEP

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 ba6a46957a707b88e5a0a6042e2a38bdf9e830c70c9b6e2b653b5eb8171f0ae6
MD5 3acad71c42806d82578907274b02bb0f
SHA1 13812ac70cf67c2a44eebbf9534be3b0b89db86d
SHA512 93b1c27d64c7843b640463dfd32d986eea825e67f08b1c5b49ef191d3f763717a4705686da308e31e9ae26cb0f6c590fb502200ce033528f753dd5ff2b9b5510
SSDEEP 24576:WcP4mcvIjkGOxhKP2l71SNKbrh/8KB2Hofe3y1sInB2COzRq8DvFqt1:xP4m4IpOO67N8K6P4suIRbDv
MD5 SHA1 SHA512 SSDEEP

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 696KB
SHA256 2c4e4b8ca57487825083ad9e75828a77527f21c71222001debfa7758bb8c9c53
MD5 0829a132580fb614de3dc7bce96320ed
SHA1 7db117d8d9aba7758db8c4d936a959906c319053
SHA512 ec4e925764da79b078e6f42376a13a254c5a331472863f1acd9526fc3182d90b9e33086237f2a93e95d55b63cccd3a34b7cec6866253d66898eeaa922237b6da
SSDEEP 12288:rFYq0Sh3Dbif4YAJ93y1NrLiLtJ8nBxu7DCOzRq8DvQgqAbhIm:rgShHofe3y1sInB2COzRq8DvFqtm
MD5 SHA1 SHA512 SSDEEP

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 185860e0a57423f22108a3104423c59daedb593300e369ae8d159d62a521b924
MD5 a737033eb44d3bdeb125983f9d1bff9d
SHA1 3aaef266c998cabb320ab338fac309002411740e
SHA512 71de037bca81997e528b3e0957852146339414e3a0cb5083b84b8b7adb34081e7f35761c5efb3e44d932b8183a4aafd38f3c32bff3359ba7f54770434bfe2f9d
SSDEEP 12288:KO3Dbif4YAJ93y1NrLiLtJ8nBxu7DCOzRq8DvQgqAbhI0:KOHofe3y1sInB2COzRq8DvFqt0
MD5 SHA1 SHA512 SSDEEP

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 a8e3e6c7f93e7cfb6b4342c5f1da6fd8cdbd3ced89b329801d6190ae06efb0f7
MD5 109329b89ca50c20333dad1d396ce320
SHA1 9c9e699cfd27261955bffc58bb1e52880ec89204
SHA512 e9a3ece4c46cd365d1705ecb5b1c90dc417c296d79b19c9fd1e93c59a882a9054599a618ac35f855eb2ea0ad2840df95387c7b7e1e32a8ad09afe5938f6769ef
SSDEEP 49152:Ha0h2GEkuAe73q3pp46zwwQ+P4suIRbDv:Ha0hNYG4JwlPHn3
MD5 SHA1 SHA512 SSDEEP

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 659KB
SHA256 4da978f7ed68be54670bb35d4ae2c0dd34663310b8cdb8bc68b9fcddf95cd89b
MD5 82ccf80e2faee4aca8f3cc3bdd5bd071
SHA1 80af4143c0934d08f1fa2b5d1b4508fac9f9918b
SHA512 2d7e955a7697d1ed81db71fa3d4bd41cafc36567a51b992586672e6f909c22e06f9edbf60f7e14b4c6165bdaf79adbe25070880b008275ed59635c79e9bc912f
SSDEEP 12288:khbHjfXV3Dbif4YAJ93y1NrLiLtJ8nBxu7DCOzRq8DvQgqAbhIf:khbHjPVHofe3y1sInB2COzRq8DvFqtf
MD5 SHA1 SHA512 SSDEEP

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 263e56c6b5e88e1f1cd8615abf9b464a99ba5d9d9a1918a249f15c131533db38
MD5 c0a1351a8fcb2afb47e70d9992a0ed41
SHA1 d4769829a28d551d30ff479e96a8507b933ea4a2
SHA512 8d27a021f0d80f66af357ec7c26e74d1120c96a1040251106b0a2b2253d74aeacc67ee72d8ae1256cc325fda566bec9d0add0774e9298b139e642bc04672e66e
SSDEEP 24576:d3YgnJcRTk4yti+R5dpR/NHofe3y1sInB2COzRq8DvFqtw:dIgnaTk46ppR/5P4suIRbDv
MD5 SHA1 SHA512 SSDEEP

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 578KB
SHA256 a80935326092f4a5b66326e1f8df3a79700203979a9c62bae7f0508eeb2fa79c
MD5 faca3b60ae42eca2bff079c888c95fdd
SHA1 f8da00c13ba9bd7c196480e9743a64f0b136fb42
SHA512 39503d7394112398347741e3d886f70d118fc67a94c995617644311cfe487f71c0110139acf3e7e9124270dd6865df7515e6454bcb52b91ae0fa1c865c11d596
SSDEEP 12288:oC3Dbif4YAJ93y1NrLiLtJ8nBxu7DCOzRq8DvQgqAbhIu:oCHofe3y1sInB2COzRq8DvFqtu
MD5 SHA1 SHA512 SSDEEP

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 940KB
SHA256 b9145733978b5138515539b209a08d2e2ee3d2556a61dbd8e63b9b8885cd9e38
MD5 04ef4f11c5bccb0c63c0d5bf5d8d19c4
SHA1 110440b0761de53e247bdc40840c92fc8f7e9ac2
SHA512 6e0add1c7bc96e377a21bf11b127c900fb9212c75e8aecb36b991830e85687ee9bd6b75ef444d14bf92e8edba787f42df91ebedeb05c46736c059b8b4f2dde08
SSDEEP 24576:NpL3UT/Hofe3y1sInB2COzRq8DvFqtLk:NpL3UrP4suIRbDv
MD5 SHA1 SHA512 SSDEEP

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 671KB
SHA256 1bf678df4623cb6f0e7c10ddd8af024c8ce1c95df160c4df5e6acf8dc860d43e
MD5 dce5a588685427c34f52dfd1ed608c15
SHA1 4bdffbd81333640b16353a6cfbd4a4eebf72fe6d
SHA512 dffd6327089b6e4929d079a10e7e9e0dcc47c1c0a11c4fddc5ffdbed2edd1ecc894e221b4469acc81327996dc4e2e17c50013c376551a0a34f608889525b2ce4
SSDEEP 12288:EpFtpOz3Dbif4YAJ93y1NrLiLtJ8nBxu7DCOzRq8DvQgqAbhI+:uOzHofe3y1sInB2COzRq8DvFqt+
MD5 SHA1 SHA512 SSDEEP

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 898c07e4a520a6f087fb7038e298dca4abc59ab4fc76c3793c58a084e7348408
MD5 fe9085201e67b7c30efbd29d89ddb8d7
SHA1 71669686bf97c738590404eac8d2a596ff68750e
SHA512 0fd390dd1848a290ba65dc462092bfcc9a663d1f9ac702f13b5b46c39a1f5ccaf9436439e45fbe8e224939d9668c577edc2d53b2c77d14fcd6e3149e315031f7
SSDEEP 24576:77NM9YmZqmWMUkPjZM48Mv6bEhseHofe3y1sInB2COzRq8DvFqt4:77cBWMpPjN8DbEhxP4suIRbDv
MD5 SHA1 SHA512 SSDEEP

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 d0c91577b313cd5301c0672989d9dcaf665ddb553e36c1eb2ed3bf8fdcde5f48
MD5 59604c5c26f1ceb33c7fd9daef79fdbd
SHA1 b38b14286fbff5e201a433cac3c5e2a919f843aa
SHA512 024cf9f9c4599c6d636bb8eab0770996bd1e68e3cb7eb9ded324e2c7e1335de79c80d03d06a8708aed9007c9eac582c304e6b52bd4946cc3d054f3f751f719bf
SSDEEP 24576:PW6BApg2YuyuNDYTabvcRvNYf8km1MHofe3y1sInB2COzRq8DvFqt1:PF2YuHNETovcvNYf8kmQP4suIRbDv
MD5 SHA1 SHA512 SSDEEP

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 f5085663bfd1af5e09f4668888a307abff2bef10abf4ed25f9ee3ead5df85eae
MD5 e436e995ed741f1411db7e9f567d9ced
SHA1 39aafaaa6ad18b539c0fcd5222c03920cf2f0923
SHA512 32f672e58fd5caaf73f9b489c58fa8e034c3210ce55438eeadc7c61d531e9a9f427f950fcad2edf6d048ae29ee3c5614a879101c461573a7eb91f285fa810ab6
SSDEEP 24576:NAFs06+Omlf3NXEbToHHofe3y1sInB2COzRq8DvFqtT:CFs060lVXueP4suIRbDv
MD5 SHA1 SHA512 SSDEEP

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 885KB
SHA256 e7f341627442065844903738913c374aa4c69fea79d7b8e45a968333c3e80fc4
MD5 44f50213a450dba9d7d1f769a85eb11a
SHA1 cb792aa2f9321f2eeb13ac0f34e50a2a5724a5f9
SHA512 cfe162677f94e3223a3fdc45e6fd7e43f16336cf2a1d8e47238cba9422f7e3625d3d8195708d20ed41b31c728958b04358aa59aba7786200074604d56cbe7827
SSDEEP 24576:bJnJ5D3WtgHofe3y1sInB2COzRq8DvFqtr:bJnJ5DGteP4suIRbDv
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 9f94f55b09fa0b5ef22563de81b81347e302ec23bd5d6542efe9a1051c45e52c
MD5 88f0949b9f25ebca6ac04305782c2fed
SHA1 26ba45ebbb3c5e4698d689ee0d183949f873dd94
SHA512 a9e64baf0174ef9556291936d9c069de90e410f0a7c17869eae8b9d6681ff52cb43569544d03a5fffb27467ce0a702d85e9b2e0d11b1fe6bf5ffa5bce2035959
SSDEEP 24576:pEPohm6/7IIXdwcXrif7qQncjlP65i3VuNHofe3y1sInB2COzRq8DvFqtp:Oo06DIKdwc+eQnSt65aVUP4suIRbDv
MD5 SHA1 SHA512 SSDEEP

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 661KB
SHA256 916a42c00c2d8fba6a7306f1bc1f9d4596f0d8f81e5c9c904d160633523ca441
MD5 811048920da720687e11f62e972bc0ce
SHA1 dac9fee0c5080afe2a7322cea1fdf3548c87e92f
SHA512 4131fe819728d4d52c0c67d2e5ae69b001a00b95ad1cd5d6f7122570f92c2abfedb2af2b6ee45ee8e044c46c987b39b0fe693ddb6c3a9fd625ca11332405bf47
SSDEEP 12288:xEP3RrU3Dbif4YAJ93y1NrLiLtJ8nBxu7DCOzRq8DvQgqAbhIf:irUHofe3y1sInB2COzRq8DvFqtf
MD5 SHA1 SHA512 SSDEEP

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 712KB
SHA256 41f074e6dc13888c962d8b6813fe6ad21abf0f69ed26845208850ae47c10b4c5
MD5 d835e957ef1c1fc802c2b02a05137ebc
SHA1 00ff85f958a88213c405222279f5be6d76e15d0b
SHA512 c989410d2962f210ad22d82d79eac685a9e433d8856561f5f04da9e77fab0cf5be3a664b79e1134cc4d3a8691a4a73684ac3fa79aca4b8d05b0c3a1f234c63bc
SSDEEP 12288:CjkyF3Dbif4YAJ93y1NrLiLtJ8nBxu7DCOzRq8DvQgqAbhIC:CIyFHofe3y1sInB2COzRq8DvFqtC
MD5 SHA1 SHA512 SSDEEP

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 584KB
SHA256 ee104895eda638d7b8d9465ad6cd3ce8fd66cbf210f187359ac22708c076f678
MD5 c9ce8d2f292dece6ee73d0aee540673c
SHA1 742b368673d37506397f981a9d44ee31717f8e0a
SHA512 f5a6e45120ccb1dcbe18ebb3375fa615f12adefde6ed01b37a331b0f8986f66f97f7cd97bbd16e61e842b92c4a29f37141bc79099ab741a575ba5c5400ca0c4a
SSDEEP 12288:NFj3Dbif4YAJ93y1NrLiLtJ8nBxu7DCOzRq8DvQgqAbhI/:zjHofe3y1sInB2COzRq8DvFqt/
MD5 SHA1 SHA512 SSDEEP

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 3b473db96fe2f55303846d25552880dd9923548c9efb9ad57ce719bd10f41fd3
MD5 940d7f02d2eaff5901c3cfbde772ba7b
SHA1 620ffdf89814ed9c60781774ec4ffb73b4bc466b
SHA512 b0020723dac229ca11fef66b1c3e61b53e016f811940a3e1ce3de3b656b97f73b70513af9f9fcd1de3bc8f07db99feda63a8a87b0c1cc0c517da179f74625ae7
SSDEEP 24576:1Q9MxZKdcz97w3GHofe3y1sInB2COzRq8DvFqt3:1VKXIP4suIRbDv
MD5 SHA1 SHA512 SSDEEP

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 772KB
SHA256 eba701181519e0a96fbd75d71db475b21762f41851fa05eb2ce1fc23fe0d42b3
MD5 f10e3dbbd66f6cc9d7ec8270df33be0c
SHA1 6857ca7dc2662bcad43905a52785d29172ea7347
SHA512 605508eb55691c13d718e6ba144d26ea5ccc4c05dff6763abd7f5c9b87148ab57788c8b314e3ca3a197254f86ee5b934150a8fd3301803e8120135c3b820928c
SSDEEP 24576:lyocxApJHofe3y1sInB2COzRq8DvFqt0:4ocxAp9P4suIRbDv
MD5 SHA1 SHA512 SSDEEP

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 b44bb5fab0fd9391e5efbfc4468d9cd84823bb83de826f3d5a7a49be46a66bda
MD5 956b319286041c370353397ed32ff8b2
SHA1 cae7397991a7792b40c84648a29a6c5feeaa9a96
SHA512 6624b9ae8004e7923140af80a67115650b756d7e067a6f6046cb1f03d0167c350d4b0b2ee52a093a39eddafb38c939c96070c490f629929930e15ec64cb1da15
SSDEEP 49152:RWcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIK9P4suIRbDv:J0zuNIJPHn3
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 51262030c1450ee2ce9b7fe37ad5f35ec9ece17c1a2c845ef539b61527c86636
MD5 3ea095c186e0fd52bc008fc595e70776
SHA1 dd0694f0b2fea5e95467db4c32ac1685f4896153
SHA512 b2345b9032341c329d4facf8c190a04b655be2a9a202556b55dd90c1b8c83363361300214cd92a00a38586edc48604f28317fff74a5fbc20facbd44df934e409
SSDEEP 24576:G1QT7EcpfxR+N5AWAz3ooiYtjMqbUHofe3y1sInB2COzRq8DvFqtd:LTDxR+N5YzTfjMrP4suIRbDv
MD5 SHA1 SHA512 SSDEEP

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 877KB
SHA256 3e00aaa348b94deae5927664b22ad2b1ac4561bc36e1e10767f0920c5fedf83c
MD5 b00bef096c5301188d03d688983d03c8
SHA1 c318443d07d4073ac53f886b147081222f2a266f
SHA512 11c8cc69bfd08df3ccdbe5496ea72196982a3bc91a771f76af1acd7b8f290466d96a6504a330d00fff6583bf52d01b6dcaebf9e4565e71ed31973da3ed879442
SSDEEP 24576:fTMdOz0FFS+imSLIHofe3y1sInB2COzRq8DvFqtC:90K+imSL2P4suIRbDv
MD5 SHA1 SHA512 SSDEEP

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 635KB
SHA256 8ac1c5b314d3fcdc29c543aed4888c8a89d64e90da702205ddae2a3826ffdefa
MD5 a35141aaa8fb0a5a506225ce145f257b
SHA1 b883f07b18e4baa6e658aec46194eacf9491aef0
SHA512 20192dd9525de24b60da62a52c80e54e3388f7f434c334ee70608c4601a3968ab0094d296b7e1b42cedad3fd6535c217e29817df6b6b873f0271d9f89e2a0217
SSDEEP 12288:x47/3Dbif4YAJ93y1NrLiLtJ8nBxu7DCOzRq8DvQgqAbhIw:0/Hofe3y1sInB2COzRq8DvFqtw
MD5 SHA1 SHA512 SSDEEP

Submit Download

office2016setup.exe

Path C:\odt\office2016setup.exe
Size 5.6MB
SHA256 b62e9f591f0ba139528ed05a5736191c45e61c302064f476cf5f50d54d0c2875
MD5 d7643a12aebb11ab81887bdf7bfdcc3a
SHA1 c26ab0ef725a8cfc4e1d7006fdc1cb243602ede2
SHA512 974590fce43b9d2af8568c190dd5ddf32f34e1d6a61497369bcce4e4608cf99c89b8d3854ee6cbe96186abfbad2c03006ecb8eb6475706db7b41309fb3ec0d8d
SSDEEP 98304:x7M701RgX4iuSl1DtlEq81xZPGnzURnBh6gGL/QmvD/cTwY2h3FZPHn3:VM7pTXexZPGzURnBh6gGLF+W37P
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/368-451-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/368-241-0x0000000000A90000-0x0000000000AF0000-memory.dmp

Download

memory/368-235-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/380-230-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/380-229-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/380-225-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/380-218-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/712-189-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/712-133-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/840-475-0x000002A051DC0000-0x000002A051DD0000-memory.dmp

Download

memory/840-477-0x000002A051DD0000-0x000002A051DE0000-memory.dmp

Download

memory/840-486-0x000002A051DC0000-0x000002A051DD0000-memory.dmp

Download

memory/1284-90-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/1284-25-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/1284-32-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/1284-26-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/1452-88-0x0000000140000000-0x00000001400CA000-memory.dmp

Download

memory/1452-86-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/1452-75-0x0000000140000000-0x00000001400CA000-memory.dmp

Download

memory/1452-76-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/1452-82-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/1548-63-0x0000000000400000-0x0000000001EFA000-memory.dmp

Download

memory/1548-0-0x0000000003D40000-0x0000000003DA7000-memory.dmp

Download

memory/1548-7-0x0000000003D40000-0x0000000003DA7000-memory.dmp

Download

memory/1548-2-0x0000000000400000-0x0000000001EFA000-memory.dmp

Download

memory/1700-115-0x0000000000930000-0x0000000000990000-memory.dmp

Download

memory/1700-171-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/1700-105-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/2040-232-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/2040-172-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/2040-162-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/2244-293-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/2244-285-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/2424-485-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/2424-254-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/2424-246-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/3140-203-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/3140-144-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/3140-136-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/3284-13-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/3284-74-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/3284-19-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/3284-12-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/3564-268-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/3564-261-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/3580-212-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/3580-271-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/3580-207-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/3828-199-0x0000000000440000-0x00000000004A0000-memory.dmp

Download

memory/3828-258-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/3828-192-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/3916-99-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/3916-92-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/3916-91-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/3916-156-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/3940-65-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/3940-61-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/3940-132-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/3940-70-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/3956-37-0x0000000000D90000-0x0000000000DF0000-memory.dmp

Download

memory/3956-58-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/3956-56-0x0000000000D90000-0x0000000000DF0000-memory.dmp

Download

memory/3956-36-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/3956-43-0x0000000000D90000-0x0000000000DF0000-memory.dmp

Download

memory/4296-175-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4296-245-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4296-185-0x0000000000660000-0x00000000006C0000-memory.dmp

Download

memory/4308-273-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/4308-280-0x0000000000700000-0x0000000000760000-memory.dmp

Download

memory/4460-149-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4460-158-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/4460-215-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4736-128-0x0000000000C10000-0x0000000000C70000-memory.dmp

Download

memory/4736-184-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/4736-122-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/4964-48-0x0000000140000000-0x0000000140237000-memory.dmp

Download

memory/4964-119-0x0000000140000000-0x0000000140237000-memory.dmp

Download

memory/4964-47-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/4964-54-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download