81d6a303a9d91a48f4bee8faa608610cfdc6bd07e0fed7f561adb04fabc7a770

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
03/04/2024, 19:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
81d6a303a9d91a48f4bee8faa608610cfdc6bd07e0fed7f561adb04fabc7a770.exe
Size 716KB
Sample240403-yp5lqsbe83
SHA256 81d6a303a9d91a48f4bee8faa608610cfdc6bd07e0fed7f561adb04fabc7a770
MD5 06d6918e58280275afa47252a5c95f73
SHA1 ef87fddf898fe473215c759db3ff0403f409713d
SHA512 12147303926d9e2994f16df46e7bed28de6e50c985ad57035f32ee32f1df091464be3c91c5d20c0aa8e3b9fba9ef9a989d575b9f235e2a4fb6d460909eafb85f
SSDEEP 12288:Y3P/aK2vB+eFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHM5:Y/CKABH8NDFKYmKOF0zr31JwAlcR3QCx
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
4764	alg.exe
2020	elevation_service.exe
2128	elevation_service.exe
4656	maintenanceservice.exe
1160	OSE.EXE
2288	DiagnosticsHub.StandardCollector.Service.exe
3976	fxssvc.exe
4452	msdtc.exe
4292	PerceptionSimulationService.exe
4156	perfhost.exe
532	locator.exe
3924	SensorDataService.exe
1088	snmptrap.exe
3396	spectrum.exe
380	ssh-agent.exe
4676	TieringEngineService.exe
2180	AgentService.exe
4776	vds.exe
4796	vssvc.exe
3156	wbengine.exe
756	WmiApSrv.exe
4908	SearchIndexer.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in System32 directory 24 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	81d6a303a9d91a48f4bee8faa608610cfdc6bd07e0fed7f561adb04fabc7a770.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\8f14ae1f12d07ad8.bin	alg.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\106.0.5249.119\chrome_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_91140\java.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe	alg.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000059ceff850186da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002835a5850186da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005bbdae850186da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d8a9ba850186da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f745d7850186da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration"	SearchIndexer.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
2020	elevation_service.exe
2020	elevation_service.exe
2020	elevation_service.exe
2020	elevation_service.exe
2020	elevation_service.exe
2020	elevation_service.exe
2020	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
652	Process not Found
652	Process not Found

Suspicious use of AdjustPrivilegeToken 42 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3536	81d6a303a9d91a48f4bee8faa608610cfdc6bd07e0fed7f561adb04fabc7a770.exe
Token: SeDebugPrivilege	4764	alg.exe
Token: SeDebugPrivilege	4764	alg.exe
Token: SeDebugPrivilege	4764	alg.exe
Token: SeTakeOwnershipPrivilege	2020	elevation_service.exe
Token: SeAuditPrivilege	3976	fxssvc.exe
Token: SeRestorePrivilege	4676	TieringEngineService.exe
Token: SeManageVolumePrivilege	4676	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	2180	AgentService.exe
Token: SeBackupPrivilege	4796	vssvc.exe
Token: SeRestorePrivilege	4796	vssvc.exe
Token: SeAuditPrivilege	4796	vssvc.exe
Token: SeBackupPrivilege	3156	wbengine.exe
Token: SeRestorePrivilege	3156	wbengine.exe
Token: SeSecurityPrivilege	3156	wbengine.exe
Token: 33	4908	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4908	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4908	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4908	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4908	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4908	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4908	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4908	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4908	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4908	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4908	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4908	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4908	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4908	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4908	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4908	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4908	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4908	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4908	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4908	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4908	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4908	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4908	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4908	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4908	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4908	SearchIndexer.exe
Token: SeDebugPrivilege	2020	elevation_service.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4908 wrote to memory of 3472	4908	SearchIndexer.exe	121
PID 4908 wrote to memory of 3472	4908	SearchIndexer.exe	121
PID 4908 wrote to memory of 4672	4908	SearchIndexer.exe	122
PID 4908 wrote to memory of 4672	4908	SearchIndexer.exe	122

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\81d6a303a9d91a48f4bee8faa608610cfdc6bd07e0fed7f561adb04fabc7a770.exe
"C:\Users\Admin\AppData\Local\Temp\81d6a303a9d91a48f4bee8faa608610cfdc6bd07e0fed7f561adb04fabc7a770.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:3536

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:4764

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2020

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2128

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4656

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1160

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:2288

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:672

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3976

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4452

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4292

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:4156

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:532

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3924

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:1088

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3396

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:380

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:4732

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4676

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2180

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:4776

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4796

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3156

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:756

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4908
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3472
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
  2⤵
  - Modifies data under HKEY_USERS
  PID:4672

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
Size 2.1MB
SHA256 cf0a02f5b7a2f40e3ab27a76515aa3ad05ab9f9e91133921036b41053163542c
MD5 138a1d8d21dfc934d2ccd9d32153ccf1
SHA1 64c08ec3fea4299327f17b6eb9651a364af30211
SHA512 a24c6e7180408dbdbd1a78574e794d6b0035ec1185aa8a45748a3b1c2983cc1bbef6fe56743d66664cd8b5fb7a3ff66c810479b58ac9df0b821cd4cb05a7b0df
SSDEEP 49152:vuYk3H5koUXfTqkkYLO/W2buywzMbOX+T7z5xgDUYmvFur31yAipQCtXxc0H:vPfTqi90b0U7dG1yfpVBlH
MD5 SHA1 SHA512 SSDEEP

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 781KB
SHA256 c9142e5603e92d696fab17b9af9e6172b2a4675274b7e5329887e9d839c74a04
MD5 40c272888ce75e651f9029d26f098517
SHA1 7337feebea609732edcd544dac2aa1333356f23a
SHA512 266281fab4c44005941b9333d805ab4a4ac4fa1e5876f825aaa89d8f2d3840d93e42f74f4730e2345c21a501de10baf5327f75fcfef922ef8ecb462c486cc3c5
SSDEEP 24576:4PsJcuiw8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:4wculgDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 33a1b8e5c11e2ba7aa4c1867333acdb4b447c7ec732a30719443b5e35562da33
MD5 5fa23a9baf14d40b96695be333dd87d2
SHA1 4f4f8d9758623187d2fca22c6acd3b6ee10dd2a9
SHA512 bb179e92aff69c34d00e9b3c73cdee3796968e109528ad3a59ff2bad839f5764463a588340922ef2eb66317f02dc33197c2aed2cacd2717cd4077a8213f82c86
SSDEEP 24576:v+gkEVfh4Coc8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:mgkExSqgDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 d07180818ff0de64389a75b9f3ca0640271a25d67e3462529029ba79b048515b
MD5 50aa61994e020e885bdb6230c2e03cb9
SHA1 ec6af5434e1f89bb9712b23ce1c055cfe86b58b0
SHA512 551c3d4b769738e8776bb5a29613b0dac145c7cd23ad424f20a8942cd6212cab3a6ed5cf1fb1f1b63a5d2c0f05b43e7a5ed87a7a626188b8f23c942ef5382c43
SSDEEP 24576:EBpDRmi78gkPXlyo0Gxjrd8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:ANRmi78gkPX4o0GxjRgDUYmvFur31yA6
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 c867176482bfebb1e100b6f56aaf109a3620b00568422c67a6d45a1fda13dfec
MD5 4c3ab86e35bbb8874a53e89156cf85b8
SHA1 9cf5c0a32cf8e941f61c48f0e27bd5551f02141c
SHA512 8befd2755ee80dde0a07131229c39ee96809c32a6d3b4ea9172fb9a6bf9a2c7b22cb588ed99c670cf86d54040f335f07b242e415d88d9e4d79f0d4a606cd26fc
SSDEEP 24576:VLOS2oyPIXVc8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H://y5gDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 379206e710a9185da0608228f522d97e3970ab6de86e93afb5d23748183b8327
MD5 7b2de6f2e881666c8f5f31f1bb275f1d
SHA1 e52ce1108bb64a9e8406c28a405a1dc574233553
SHA512 9a3d56ac8cf991acc28863ec8d727647898b6b409168917f2986d126179fe91a2f71ae6c8660e571f030bdaf04e2e883d55f90393bae1ee3465af00024faeb84
SSDEEP 12288:HfKFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:HfK8NDFKYmKOF0zr31JwAlcR3QC0OXxx
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 39d0b54a053b5df9a893e3c969148f3e1649f97309a66f8992d1b6b8a65da7d6
MD5 e14fa83efc02d7b31904031f1d67e05e
SHA1 477801df2443dd10b7e1dd9a36e5c0c04cf44dde
SHA512 2e89ccd723524f67e25d20e0a7b377b45cf1944e2e470b2f2dd46fa9f4871febed4f3635d9a0bc0d08f68331bfd8ac1c0d47bc7ec4ef25c8776531cff538787a
SSDEEP 24576:rJIUz8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:rJIUzgDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 b582daa490b3100508b958484c4a91c5eec77fd4cbb7a89d8ef8ea38bc9cc447
MD5 bef478f8191370e1708fb39718cc390a
SHA1 29828e6097febb6337182a035165eead63cd044a
SHA512 44e1a3eb6e65fa0ad31e7fa08a97cda6366f1bf8eed2fc5402d1086ea729340113095ae772c37ca37539b93c254539b50e0b94a52b03520ecec26bbda795d004
SSDEEP 98304:oQvGAdlCEL8c/yRNw5CBU7dG1yfpVBlH:NvyEYc/y3w8BUoiPBx
MD5 SHA1 SHA512 SSDEEP

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 d2a73de5818b97575c74cf753d14e2c3b35041a987b72657d768ec2a7d9e0586
MD5 731dbe12da13cb66d613025eeaacf20b
SHA1 bc8ecf36b14a214e29f60d2e09d27b00e623495f
SHA512 6a49116f838d83de3fe3e735803ab3f31e1982ffd73b0ae8ca2bb70a243ada5a501e7885224496490161d5474984d105b3cf615a342c3b5815ac05ea9f697cc1
SSDEEP 24576:fdewsAjl8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:FljlgDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 1bee5b702b5933225e4071ed39f947fce8a24f1fd3251d1c034a92a7d2af61fa
MD5 ff95854c8c1773ab8f48bc9a82c5eec3
SHA1 eec5e47f26cf9e74f3aa73d67c880d3133648603
SHA512 c629eb5ec5c7806de0cc0351d3566d7282bfe53a2c5c083657ef8a2129a25a1ba7cd70f3b72e862223c8fdb808c46cbc656f88062c13a477d297a7dcf81acb0f
SSDEEP 196608:kUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJH8UoiPBx:kUEtQevvqc2W1cpV2EI328
MD5 SHA1 SHA512 SSDEEP

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 a7352d8c016aaa3eced34b851dab44047f0fb843ead255a72b322cbb05aadcbd
MD5 b2942fe71f52692ebc8b3bd658e254ba
SHA1 e1483d338d7fcc6461791d37be69563d2036e78d
SHA512 a34cfdc0c4dba7e47d5e9158066c6de438ecd9ba1634fe018cce1e9214ef08179746362e68b06241d8213650abbc603d11512349f07068267193d8e8017d07fe
SSDEEP 49152:eCbRquA/m2yL5zifFiV+XenmE3/zFgDUYmvFur31yAipQCtXxc0H:ToqHVjnmtU7dG1yfpVBlH
MD5 SHA1 SHA512 SSDEEP

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 788649b793867d7b622d348b86a0aff49fd48684a8833ec3a6c698430bd4a72b
MD5 3367b10dec8f3b83c8e326b814558ef6
SHA1 b3430c8b56fb82e31ec633ba16280152e077808f
SHA512 7396c448706f25bbda8392ba4c7ad76f044844e712ab67bbc0c661afcad27af956c8de51f3fe58f2bbef98cbb5efe2b8a8b4c73ce71a9958f1c819a50f56827f
SSDEEP 24576:BAhGLJIFoiwtA5l7S53M8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:BAMyFoiq58gDUYmvFur31yAipQCtXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 65bcf1c104b65cf0ee8fe9c657b8e887085d7ac1233a333ccaa82cafca7cf70c
MD5 6cc0bc3f9b7431c7b7cbe6690dece610
SHA1 e868a170e9769ef5823f87d753537633fdf52048
SHA512 a78951442302fda9ef05f0b7aadbb468da86f1f60a96dada9025c6cf81f3a6d1359e3bafb09c61cd0f262d61b5b3b44e7c8ea28909169bb12f72ce83e03155df
SSDEEP 24576:LwuoOW58NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:LwDOQgDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 40c1a5c830cd07eebdee645a7000403320544d82d1dfe133a8ad2e1e635a4e8a
MD5 90500b422eb4d50b521707aeae06e449
SHA1 5f8427cbcdb178b56d9a6132bcc814ab1c3bb213
SHA512 2dd0946b752dc8bd4d1196339efcab5dce6a835b718bb5b5c9345cce163a170c3149e1f155b8fc56b49052ed018dc36dcfb0a2e104186843fe37e26e541aa20d
SSDEEP 12288:oBZ1Iy1FCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:WZuG8NDFKYmKOF0zr31JwAlcR3QC0OXn
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe
Size 4.8MB
SHA256 6ae2593b5666ea352ff03ef60dffb2be9cef8c736f3fa3dee84ae10117b71ba0
MD5 2092aaff6fd569ed382f613dcf8f59b8
SHA1 f7e839a5772748d5b966de758855a89d40a83ae7
SHA512 b3a11c1692235e5c9165443bba4944bd961cb531a0c1a85e3223890c327b2a5d1c70f860a2447750a57b0cb7ae3a3407ad6d7094c7dc2816669c55df0a454368
SSDEEP 98304:hrZ4K5M+XDfiIewG+x6xZ14+U7dG1yfpVBlH:dZ4K5M6qIzv+Z11UoiPBx
MD5 SHA1 SHA512 SSDEEP

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe
Size 4.8MB
SHA256 a01f61c567d28036b1ced767325d8e207fd3c68e64b5db22b90cbaacd1a638ab
MD5 bdfbb39486dd995a2d8ea367cbb6a4a3
SHA1 e1e75341e0c11a3b2890d5d674b31aba3e7ab37a
SHA512 b4968750e0b6df3e65ca396a50f7c10fbbbb59282fea7773b38bc7fc922ec22e02c1f13aa7eff46c0c792bd5ff0d6b1f15cd16ec90ec981611e736ee3ebc6e47
SSDEEP 98304:FrZ4K5M+XDfiIewG+x6xZ14+U7dG1yfpVBlH:JZ4K5M6qIzv+Z11UoiPBx
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe
Size 2.2MB
SHA256 240b8aedb9ee92076facb1698fb8ce3f336f19acade4300b19a67903e1bf0dcf
MD5 79d489164523b64cc0bfbc8c8654eea7
SHA1 8832f0eca94e4ae1f20b37180c174cba9a86ec7b
SHA512 f0a0cfee4b857629bb4c5dc9fe291b0c5e6204777b1cfa58de17c0bc43c4c2e305be064272a9b61bf83cb97e649f0cc6859402433aee74274ed5edcb844df1d0
SSDEEP 49152:tfzabJ8llj+SWWi2mkx+X+diMgDUYmvFur31yAipQCtXxc0H:Gui2CU7dG1yfpVBlH
MD5 SHA1 SHA512 SSDEEP

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
Size 2.1MB
SHA256 e325f2157d9b176133ceb7e8a515b0965b4d4d282d75cf0ea7d2bc0a54c77865
MD5 1415bebecd7617c8c74647c8acd18a0d
SHA1 d4f1f05226821a50f1422b8523d7d9f2742fa6cf
SHA512 972707f9773b89a1466ca3a4fa344f9af4db998c950737251955827b05c9528beb7c7ed48291b0c14baebeb3bca3be46834dd58ed654ebf4d0939d2f2efe6e3c
SSDEEP 49152:Ya/3xXBSZ4K5MJ1LvTMxbfsYBYSgxu9+fw4TbgDUYmvFur31yAipQCtXxc0H:SZ4K5MJabfsYN5U7dG1yfpVBlH
MD5 SHA1 SHA512 SSDEEP

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe
Size 1.8MB
SHA256 4cd4926241a9dd25f5e809dd1ae8f2e53da4a4b5257f357d790510c0cde46ee7
MD5 c73466641eaa78edf5880afda61497e9
SHA1 a103c27c0b1bda5df4d3f8fd82686b935c3c8553
SHA512 21534631ee4a98c5eb5d0522aad60fa84250779f5a1bfae2b548516970ac58772eba52e9f285b94586ceac1016a1845554449fcc920c54833d3e7a38f340e1aa
SSDEEP 49152:QgNJtUzDu/9gKPxHC4pgDUYmvFur31yAipQCtXxc0H:ZPx2U7dG1yfpVBlH
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 1.5MB
SHA256 6bcc26e6aa9c207d329fa826d4867e9d99460ce7b96270c0effe94f3cf94ca66
MD5 15c8ac63f419e19616da098ab634da0f
SHA1 30a5a668e99b297be6f688f5a863d470214f5f87
SHA512 38e8db495fa86a60e4a208196da795efb4966827ea5c5c0cdc250ec4e7cf38c994e758e63b410fceff33905da9217b09e61f9a8e4d6f2b4f6e8d72d678db1b92
SSDEEP 49152:VOBynH1wM+v6UJxLQd7BHjdfDgDUYmvFur31yAipQCtXxc0H:Hn4LQd7L+U7dG1yfpVBlH
MD5 SHA1 SHA512 SSDEEP

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 125a0123501f66af8884cbada482b2e5992845e021cd599eedd6334f2a93dad8
MD5 397e6064ed76e49d1ce0f2d52ac07185
SHA1 b9ede027c5c8548e783bd67904e7f8bd25c3a3e5
SHA512 8ccaade0e7a8e5ea77aed42f76192bb4bb3868a5ff4f2b179b836cb7d3a41f9727c34f5d73a52d062a9611c4458f09170ef6ff66f8f0c5222dab4830848d3521
SSDEEP 12288:AiFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:Ai8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 9327203555384186401149b25365eab79f40a22359bda9ac0599f543f812c281
MD5 58250f58cbc410b4f728c9461a9ca449
SHA1 0d5ce6c12ef3f27840ed5af7af2d575f07d00a58
SHA512 7587b64b938970ad35a9ad642cf8fa2139d8d5fb64048b349629ecb0034a140493acdf6e11afd229c41e408d9c76c9c6b621cd63eab36161a5e4af47521f547d
SSDEEP 12288:UBFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:UB8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 dd4451066ffe97a1bc3f532a75d26a29da2ea0bf295f24271a0a666235580d87
MD5 c1e5c1282027c1c1ae7aa14d321239f9
SHA1 4269fadb49f4ee390c2f5b15a0001005e771158f
SHA512 b971eda3ab27ef63b1a3ed3a7b598d30f43e6f0bebedb3162c8c6701b9d14ea6c08ee56046696a4015b88d7a575da20074dcdf9c6f1a90d77fded430fc2bb429
SSDEEP 12288:8rFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:8r8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 e479641f758ebbd6ad67032e686b2e3c24c4cda9e31dca6e98f4232625ef455d
MD5 7cd4de5640d151d0106e3ae62c0547e1
SHA1 272d87e3c0e848a1c86c1f4320e21e7952713f39
SHA512 510079c7a88bddd7443c44ea00033d61a5ccc008520536c6f095500962fff79f7b5389c7df94acc65318921e7f6fcfe50e115a6e3c941b195e6c84daeed4ffd2
SSDEEP 12288:lVsFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:M8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 18be2ce0d7db4b1f2c4b4b9fb4a410102905058dcdfbcb3546059d33e2710a50
MD5 602e43f1dde853962c37b0ba2db5dbd7
SHA1 d61031ef7a4ea4e1afc6d43182a95bcab68b6ceb
SHA512 2bf5944077cd72c4cc521f587ae1dd418edbe81980882dd4e61bbe95e7344f5dac4a235aada5c5ca8ea698966e6e63c3599d0228f673fde4b9b5d3035194e951
SSDEEP 12288:HUFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:HU8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 b6de34147a12023c925f516a5d95f652e25c71dd49435c1423ae1d505811d52c
MD5 de9f2b81dd77fe6e3b35ae4e8aa4fab8
SHA1 51edb394b9a5cb9890ddbab05eda37ea58ffa8dc
SHA512 9f86e9fb8de801d84eff1a404bafc480ef7b8372da588de773312197695e3f4909336739e9f5be339226f309a27cadcfec22f00396ee12d4a23c73237c603779
SSDEEP 12288:3dFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:3d8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 fb9abd23e0cae542619c4d328cb5129b0670843251ced85a66dabea316b266fb
MD5 b8abfe5aed67090687bf2b607b58b6b7
SHA1 c011b3cd4bfea29ebb205a956a62e53f9e9200e7
SHA512 b53dd9e098723065a624db6f8e0627f3dbf32c3beb74a0a9648c85891c5359d9a8b5ec60e8c5be4bbfdab324847dfa36b7c1a5cb50949494ed8048082e7e5eb0
SSDEEP 12288:6pFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:6p8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 8383b5addd3317c841e3e49bfcb1799954f459df0e5e88ba865b1af680a398b8
MD5 b022768c4c33d1db3389d1f4c6da95cf
SHA1 01756adfcadf06ce73f9835b974b2428bb7c2094
SHA512 8434387f91c2b4d8a438456978d2c69ae41dda7a22dacb888e5d159c06d633c0898b094d6d792243c9f31277cb5f28d9f56e40233ac4af93a5576363d490a3ec
SSDEEP 24576:WZMSzFVSOh8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:WZMSzftgDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 42d774546a3622139dea5e4731e1edf2bbd3382bc01e8b666c794c1d5200cf8c
MD5 4326611b136924ab90b5572305251c81
SHA1 429328a762e59336c5e01938db89e32395566c56
SHA512 d249743758b8fb050346496c759ef559772eb038853572e92ed1e19a696cb90bf0a371edcf491f1fa9b99df24bcf7c1ea34e706b6682218a83eb23ab0d3cb307
SSDEEP 12288:IWFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:IW8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 138f92404bc9b93ddf3d8c9e6cd72d7683e3a1a82aff3f56cb6969dc41d946cf
MD5 516b3b63baf3402de3162ee87416d4d3
SHA1 2737554ea22e02df3da60a621274affdc6ad8005
SHA512 29eb005eced2b09f0cac9313dbdbe1837ad4dcc7c82f4bb4bde3ab947fb9d9121648942c9f9183bf27a2fd8a9a4b05520fca6d9ab180e7b931bf3d6efc2f57eb
SSDEEP 12288:0aFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:0a8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 748b285d0252b4279e93caf7eefd06f0fbd728e01174da762683c9110f1d659f
MD5 48183f7958bffbbe4625ba109444f48d
SHA1 4d944fc4d399810af5f1830939c5a5f87538c4ea
SHA512 418b6bbff6b41852eaae2cfb7d9340b07621beb7eab0f6c5022acad8e4a9e064944020ebf2594cb275201d40ff0ed13634e51dfcae83bcc798d0ff20ff2290b4
SSDEEP 12288:+yPz5L81FCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:jzy18NDFKYmKOF0zr31JwAlcR3QC0OXn
MD5 SHA1 SHA512 SSDEEP

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 c04abc68154f36b330bfe02ed0a6a660f6f5ce6b63087fd09f56f95dc1b14029
MD5 5976b70a40b855e5aa01ed97108f9c14
SHA1 189a959069b149f62e46449d7518874dd9c42bf8
SHA512 fdb594e9b7f0a64fbdab5c6473ad350ec80daaa67a63ddfc57e46fd2c8c9dc2d1f8a9ce9dc7d83c6238e69344882d8af0b97d955ce9d1bed4e5360e51b4dd5c1
SSDEEP 12288:tWFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:tW8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 efb4202808993ad3198716f902e2605a758dfe49c847537929b4c7e3985cddb8
MD5 ed199e3c536cf8f985917f61666cddf8
SHA1 88a8ae08b555e1308e8248037048ee0ee3fbf813
SHA512 95d4e70a52669a95fc3c0ccafc857e1bc0470e08e6bebac631b7dcfafb143e2a8ef4fd646f1b26c3d48476f23ac9c5190307237bd08fdd320f7455a21235aa80
SSDEEP 12288:HWFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:HW8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 49bb40b9bd74b10ac6d0c837863f5682e8b64ee741822f8d23c2e81e23c88ef7
MD5 b51089925c786746a1da6407b61dc59d
SHA1 6fe44fdd5c6947d7d8a66eb73c2f58eac6bb6e02
SHA512 a8cc963572e0179ee2b83dbb30f4969be50c02860370cfbb42535dfb36251fa3dee6eaadd87b02b0ee73f69606f3f50b16094ec2bafd6ab72e43793ad18ce238
SSDEEP 12288:xyPz5L81FCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:gzy18NDFKYmKOF0zr31JwAlcR3QC0OXn
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 e771d39bcbe03fc90439779ee69a6e2c8ad67ee0b62dea3da16102d3a64358aa
MD5 fc116f9236b06b530c268aab4d1f2903
SHA1 f805f9ca760c583265f2bdb0f6f16eea5e720f07
SHA512 1224d7696c674bcaf1b3d8dc359a26776f531ca774ebfc4e41ae4d314c9da94e63ce4ab415e5c5bec39c637895c7f94342880a28e22655a3277a9ff377be2300
SSDEEP 24576:YTHaLl3z0zDb8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:YT6LljYgDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 c186ade13ac77e831b92d3e82737b784b7757e4658b2e83d724dda9248f8ecdf
MD5 5e688ba59347ab42833effe3461fca56
SHA1 1f078ba7b6c1602f945c3d7a17a4bc1a01591e62
SHA512 5c31c7d6d75bf68f97b6f74538d4c02e40f5644dc6cbdafbba9fa04524f5ba6cee604dee64a63345cce5a3a42adc24b0b395e0653b2f833a8e7c6ca714070ca6
SSDEEP 24576:j37d9CHKy7GZH8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:D7d9CHKyatgDUYmvFur31yAipQCtXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 ebbd0218adf5f9a80b92c95da30120d9ce28a3af0bce7191872b7f4684c65331
MD5 d3d7bd4f758d08b9b45ce8d7ce53e145
SHA1 d8a5fd57b67688b5ab6819b2893a925da3124893
SHA512 0f1b785ac68c2853e5b78b493cbdaa5b1447a52c67ef00581ff78a9cd2fc433aa014f25c6ef45302d5de47365cb03fa579e85878633a620eaa3b85896d4d812a
SSDEEP 12288:2LFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:2L8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 f3625c22baa52ebb2ef141a88fabe3370dfbcefdb51009a9b32533c2fb9e9c0c
MD5 7a5c5b3f91882c7c4eb70eba8e09e1ba
SHA1 f71f76e989b303f643d999bfb32bae8af782282f
SHA512 8fdc3a47eaab71edf70175f2f770c40358bd744e01d18ee696747c63b5e3686fe9381941cbe58f5f1b374c422f60da1fbdc0fc659f42e2f2d3338c91b0c13c3e
SSDEEP 12288:sVFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:sV8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 f8dd60a4cb6883d5a8472ad12b8b016f4b1dab0af4f9aea3c6e3185a1d14c7d5
MD5 ba9670b2427f6c0225610c0f4fe4de99
SHA1 6fde9bbc4c29a9a8145bbccf8b80784f57a3ff68
SHA512 95e1439eeffa2f85cddc46c0e8de9f4a3c180df29597053b31c6c3c55439331e9a14eb77b15be29713413126712bdad674845fc9607ad917b730bf7d20edefff
SSDEEP 12288:uAFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:uA8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 936a908b3806f856b4b86a18d8c1b588aa07fdd25bddcf8bc5da9318e30a9791
MD5 9f2fb26f58b5ed87147023956a5920b3
SHA1 61c9cb1c0dc3b6bcbd42ffb3c0aba32b96810899
SHA512 1deaf435734fe6026e2c30c5dd8bdcc6769e31510e19eeb6de056d9538bf024b3e3f3ac8c0079b5872833067a558b95b4e5066d569ee05c74326b84e206b3877
SSDEEP 12288:2WFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:2W8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 2458b846dfdd72d633da43c0240f693e47c48a92ed6ac8f55cf6da9900f8424d
MD5 f801197987cfa7594be42c80da95e6f7
SHA1 4570f266a27f7c2d53f6c5e037261f3daf6f5f0b
SHA512 84788a2bd27b08acab57f83aee0cddd94cac9a0fa4dc29c83a83355659101ff811240f1ee86282189dbbce1c48e9c0ff2b76000f8f885516fee140d3d1e05cdc
SSDEEP 12288:HLFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:HL8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 6cc0406150b51eb68ecbcc1c8badd596eb2a00ebfd6b12d9036263e897baef74
MD5 520312f3b439457b9390beb95d56990c
SHA1 97cdbb1453fa8a803089cd0e94c4954f0f0d1cff
SHA512 84ecbbf534d1592ab371484efd9c6651c4d0beb2a63f5aa6e800d0b458ad8b04c1295272997db0447811ecd39137e156c06904b9f6ae29361ee047ad23349a4f
SSDEEP 12288:k+FCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:k+8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 696KB
SHA256 83dbad8d2b4f7f13d666f9b0aa06dae25959b433043c4f267e7cd3941cb38d84
MD5 0a8dfc0f9726f26b5c5f4fe7a382f10e
SHA1 b509738681cd23b48a47d7181c5b378da4cf3d8f
SHA512 86b88946e8b853f462deab0e889d2c5ef9f19d178979b617c3cfa5394a69b049d934f2aefb7ced7b90422fe8698f5b2fc238bd91f0564112ad6be1e76cc55b06
SSDEEP 12288:dFYq0SNFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:dgSN8NDFKYmKOF0zr31JwAlcR3QC0OXn
MD5 SHA1 SHA512 SSDEEP

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 2323b328f857b621dea601d628187580604debc67aa0be10fbe99536fa50e12f
MD5 08ef4702b321b1c2361b134f5689d2dd
SHA1 bc7e40daf6d95a7ece728a762b8c9e376358862d
SHA512 aa6afe3cd89f919ecabddc5b96a7b85d65bdc3fa25a078cafb462d577c1e20c17f5366e627e9e7580951c5ae33d5fa99beb26b3df7dfd8cfe845b100cead85e5
SSDEEP 12288:DQFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:DQ8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 fcbedf21e8b58f80f9e9454cb026aa3ccb539a2b8c3ccd8ecb96844082343007
MD5 635fe263486e2517b5e525994018a08c
SHA1 5d32cc7d98208a089de3719512eb6d9a97234c8c
SHA512 afd75d91c9294c9c8dc31984ba4425a5c4fef311254623da44fe0e33db23543353759fa93806eb219778300024415c3d68e6427c612a20094a9862b45a6394f2
SSDEEP 49152:ua0h2GEkuAe73q3pp46zwwQugDUYmvFur31yAipQCtXxc0H:ua0hNYG4JwOU7dG1yfpVBlH
MD5 SHA1 SHA512 SSDEEP

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 659KB
SHA256 16b4dcba1a89c81870eef2379078377d41ee246a5a080bb71fc5b6b209e7f3d6
MD5 d4bd40c5ed2449ebe80dd7759691b12a
SHA1 240e9a7480a02087d0c27f92a87f880420093a21
SHA512 f61e3debca5e7232bea03c5645dd2be3d428420bb66045ab8e77c0e39f16356d537193ccee176feb36007621e9c00fed3fa3de5bfc8029adcfc241201b1a5823
SSDEEP 12288:UhbHjfXXFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:UhbHjPX8NDFKYmKOF0zr31JwAlcR3QCx
MD5 SHA1 SHA512 SSDEEP

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 540ce7231423d4f09674b6939e85272d30bde266917eb963f695c0d8994499e3
MD5 7207640b8c7133badeb631c6bd8f4e4d
SHA1 1274d341b6363673a65de36006bb8eb45dc10cfb
SHA512 db583da5d34e294239b1c2fe84d38cfb3ace5493b5f5d25269dd576d0cbd61650e16078087ef3bcbae486c49eb6d48e2ec1f66c89402ce67ada6ae0f4af1f061
SSDEEP 24576:23YgnJcRTk4yti+R5dpR/f8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:2IgnaTk46ppR/fgDUYmvFur31yAipQCx
MD5 SHA1 SHA512 SSDEEP

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 578KB
SHA256 6d9a7afd4baa1024fb65dd4e45227bb52fe1e08d31cd8d89005d56838534669c
MD5 589fc406146961663ca71f3086dd5159
SHA1 9210ffd4d6a166c967789352e056a6b264745c10
SHA512 cd01ab62e2f615008eb43d86635a9d71a52e6d69b51fb2a43ec523984cab51d3a533a3b2f8d79a638b51f1099f425409173b64ccba892c9a0e8e90597f4a30a4
SSDEEP 12288:e8FCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:e88NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 940KB
SHA256 11ff95a361dfe210f35a82631b8bb7f52fa71751380b9f5c22e6b5b1c652d025
MD5 743a9b2220e78f73c782f5fd27937c3f
SHA1 51aed95afdb717526080bc18454bda7ca24c3fa4
SHA512 12a0f020fc957ba7562a53bc56455eb2625a6efb503b9b3a5fb41fdba25a13f1bf043bc70042f96ee7c1da150d69a8e895224949f2aa62e790be8d8c8c153e3a
SSDEEP 24576:jpL3UTd8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:jpL3UJgDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 671KB
SHA256 e4367372421083bed8f5eb0028489258e5db435d8466670a395a25a908baed5d
MD5 e3bbe5f50b3b2b705ebea6bc37117f96
SHA1 bc158dddea91346e3dab6793a53c97117d65fb68
SHA512 cd69212f68a2ccd9f5b9588e84e5e3b61b85ba9bc1c7c9bd94d097f540692ef4c0c3e88c3cfc0e10a2becb8acf3fcd5c5c1c6b0cee3f838f027b32438667b47a
SSDEEP 12288:9pFtpOpFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:VOp8NDFKYmKOF0zr31JwAlcR3QC0OXxx
MD5 SHA1 SHA512 SSDEEP

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 e67251fe60f5a2a05593c435262a0b5d128a1cfeb1d232d203a1219fdd6129b0
MD5 7082d00bbb7a689278fa0740452e31d9
SHA1 44e886e6aa983e8c675d29cc3555609476d8aea7
SHA512 75804208c0cf9b47d490473f85ac7a2c9e32bd2ff243896cafe8327fa6ad9915a06f63f769ca03f1808f304ea50d4dbbad1aa536a7a43f7495ce5898da79843c
SSDEEP 24576:s7NM9YmZqmWMUkPjZM48Mv6bEhsg8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:s7cBWMpPjN8DbEh3gDUYmvFur31yAipZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 d7b92447efa71a4e10cce8bbc4557d05abe157fa8decf7cd7162d9d566667ec2
MD5 4b570283857cef46956add208b8cddc0
SHA1 7efc6ef46476b349393c193e429a5300a2db81f3
SHA512 36078b0dda3400209001312722f2622bc59225f57ff9a89b8e9f8c9ef92a623cf90b5768abc878a6559f0e28d50bc685ac455f7d4a50e08fe140e9c632ada250
SSDEEP 49152:tF2YuHNETovcvNYf8kmAgDUYmvFur31yAipQCtXxc0H:46tCf8kQU7dG1yfpVBlH
MD5 SHA1 SHA512 SSDEEP

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 f0f5850b39925aeb5162987c66281f6bfa305f5d0824b796d13d97bc249c9373
MD5 cc20e5a4c9e5344c867e485b0719ff94
SHA1 dd4013bc9a27ec6be0b81708473431e5b9c4c055
SHA512 cca908d0031ed62e41f6fc384af1a547f825cfc102fbf8ee08607f3053804eff8b2dc788c2baf59ed385ed9c7d688066350d77d16f2582081f51ef1e234b2c7f
SSDEEP 24576:WAFs06+Omlf3NXEbTo18NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:/Fs060lVXuOgDUYmvFur31yAipQCtXxx
MD5 SHA1 SHA512 SSDEEP

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 885KB
SHA256 9bddae92a765ce4f06b460779cd4536d819c22c2da79a16d4537a04e330fc783
MD5 4739011b4f2b0920eb236520b0ae5dba
SHA1 8de17e18387e7e1bbe0a7df77155c776580134c8
SHA512 569770bb6dca5afdf3f2a3edc406beb9cef5e7aa33fb80efe7b772f03d74e09618436deacf5141b321c9abc67f3d4e4643e2ed88f836116ff22ec73d3369ef5e
SSDEEP 24576:VJnJ5D3WtO8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:VJnJ5DGtOgDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 19fda5710bc5fff2adb1a306f6d450267aec382688ea7b9323e0e0acc3b269cd
MD5 293c2aa4f5a5318daa4fc7a78987ed8e
SHA1 a20d575b6cf5789d945be4ea8e516d7d0fba3127
SHA512 5a3e0aea0f0f9b0a0861fc0e1634660d79cdf618f6af1e7402f2cf7dd70e319a1b26904333790e9237042b1809409cf4215e271176736eeb495157c0c294ceb1
SSDEEP 49152:Ho06DIKdwc+eQnSt65aV0gDUYmvFur31yAipQCtXxc0H:IHU7dG1yfpVBlH
MD5 SHA1 SHA512 SSDEEP

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 661KB
SHA256 cd8b33f9f2ee16a3dd9488303ae5911541f600717b0a1757264ee7b48f133527
MD5 831b8d43e376ebc9d05ef3a0107f4a61
SHA1 6b04099c1862239ca26e7c3acd6f38c2fcc4b40d
SHA512 8e64b0d6b6965979d768eeffc9a11bd79c3e3cf062618433d34ed290c30592f999981b3a4b82d8878e4cacfa53688d8e91023a8f390cd71c95f47f135c60c92f
SSDEEP 12288:5EP3RrwFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:Krw8NDFKYmKOF0zr31JwAlcR3QC0OXxx
MD5 SHA1 SHA512 SSDEEP

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 712KB
SHA256 784f67014dc093182cacdffbbd36e675c3a5c631679de0808c88f21d92d3eec8
MD5 00edd2cf72e73f22e985a3d670752d60
SHA1 72477f897656803d4a62a64a7e0e1bea3f24437c
SHA512 5397a6c0d6be320ac67e1c5dfe5de0735020e59c70b9dc7f95941fdb8c3d702b955756f2224baa2d6e2c30b070b7fa07c96174ca65bc9aa39e52adb5eb3156ce
SSDEEP 12288:5jkyHFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:5IyH8NDFKYmKOF0zr31JwAlcR3QC0OXn
MD5 SHA1 SHA512 SSDEEP

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 584KB
SHA256 63dcb7a93a4b534354d9be5782c94810fb35c8f1d7c4509dd20ea7da5e154f33
MD5 8917f3b52eef1b37a61eb88e8bdb8363
SHA1 9d86933256bcc8820d9072464e6b5335e812a026
SHA512 6b5ed396b477660fef6aecac8b369945fc80fb4fbc837c630460ecc82ed6fa01e68cd7be175e60756fe4a0a6bacbdba29c2ce2540191ac99c6e1c32d664b41c5
SSDEEP 12288:AFZFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:uZ8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 3af1be3c33a97f790814d498f96be56b3128ae2931b76f915fa4239b3d3b54ef
MD5 7d6e643c7433f0a44347ae8d29225c62
SHA1 852a0be092306b3c2546b2f1e4df9c4d81da393f
SHA512 85b0131f40254885e75463640d8b10c99a0dc0e2cafad62eedfc6d320fce069de4f8156b1966c66c372c6a34c1b57ae7bd0e60e649f5dccadfa2122bcc463755
SSDEEP 24576:XQ9MxZKdcz97w3Y8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:XVKXYgDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 772KB
SHA256 c80a4ba8bef18ec7ca9a5c152350c166f07b8a44de750d60764eb3c034055f85
MD5 9eca6ac929aad106299453074e685bcf
SHA1 9308470e519ec9fd2b5dda3b34302496d987f3ec
SHA512 be5ae5ccfd5360e230628783b0f39570a603b8dad0b9cbd2f33a2c53d7aeee9a5c427b4d74b2456a10d70c54aa1cc9928590676ebdfec7f26a0a663ef757d1b0
SSDEEP 24576:9yocxApD8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:AocxApDgDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 35711cdf236e0cf21df18b43f25ee9f89419f5acbc466cf4fdafc077dfa00d64
MD5 38f9a58ca200d9a4eaa18b2095709e1f
SHA1 d515e8bba811fb2b342d12d37d7a29b3a3612d8a
SHA512 7072d5b9f858945b934f7cc65e375454fdb346aec950f0424e531166b9007177e3eb81dbba2da017a6c49c3065db919e14e8760a204bab7bbac2bde1a808901c
SSDEEP 49152:VWcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIKDgDUYmvFur31yAipQCtXxc0H:F0zuNI6U7dG1yfpVBlH
MD5 SHA1 SHA512 SSDEEP

Submit Download

office2016setup.exe

Path C:\odt\office2016setup.exe
Size 5.6MB
SHA256 8e6c5c76ae1b1b9a43e9d10c7dcd2485c036b36abe73ebddb98b3c33c91bd0d5
MD5 2c26b083218a837b6045051c345d2936
SHA1 4e1e406e52a80d206b69438d18f96def8b076416
SHA512 7eeaf4ac8a302fc53aa878589112bb24e15943eb73ecbf4679361761a82412da6387679fd2577a5fb5c00c1a06f80cd9856d3681cb07c0bfa90c731de29a3068
SSDEEP 98304:q7M701RgX4iuSl1DtlEq81xZPGnzURnBh6gGL/QmvD/cTwY2h3FAU7dG1yfpVBlH:0M7pTXexZPGzURnBh6gGLF+W3mUoiPBx
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/380-378-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/380-368-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/380-437-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/532-323-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/532-317-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/532-381-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/756-459-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/756-451-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/1088-341-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/1088-349-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/1088-409-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/1160-67-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/1160-74-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/1160-75-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/1160-66-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/1160-241-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/2020-27-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/2020-237-0x0000000140000000-0x0000000140237000-memory.dmp

Download

memory/2020-35-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/2020-28-0x0000000140000000-0x0000000140237000-memory.dmp

Download

memory/2128-47-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/2128-238-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/2128-39-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/2128-40-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/2180-414-0x0000000000700000-0x0000000000760000-memory.dmp

Download

memory/2180-397-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/2180-404-0x0000000000700000-0x0000000000760000-memory.dmp

Download

memory/2180-411-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/2288-248-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/2288-253-0x0000000000540000-0x00000000005A0000-memory.dmp

Download

memory/2288-315-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/2288-246-0x0000000000540000-0x00000000005A0000-memory.dmp

Download

memory/3156-448-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/3156-439-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/3396-355-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/3396-363-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/3396-424-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/3536-18-0x0000000000400000-0x00000000004B8000-memory.dmp

Download

memory/3536-0-0x0000000000400000-0x00000000004B8000-memory.dmp

Download

memory/3536-7-0x0000000000A70000-0x0000000000AD7000-memory.dmp

Download

memory/3536-1-0x0000000000A70000-0x0000000000AD7000-memory.dmp

Download

memory/3924-395-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3924-327-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3924-335-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/3976-258-0x0000000000EA0000-0x0000000000F00000-memory.dmp

Download

memory/3976-268-0x0000000000EA0000-0x0000000000F00000-memory.dmp

Download

memory/3976-275-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/3976-277-0x0000000000EA0000-0x0000000000F00000-memory.dmp

Download

memory/3976-257-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4156-308-0x0000000000790000-0x00000000007F7000-memory.dmp

Download

memory/4156-366-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/4156-377-0x0000000000790000-0x00000000007F7000-memory.dmp

Download

memory/4156-302-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/4292-300-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4292-353-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/4292-290-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/4452-281-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/4452-347-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/4452-340-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/4452-273-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/4656-51-0x0000000001A60000-0x0000000001AC0000-memory.dmp

Download

memory/4656-53-0x0000000140000000-0x00000001400CA000-memory.dmp

Download

memory/4656-69-0x0000000140000000-0x00000001400CA000-memory.dmp

Download

memory/4656-64-0x0000000001A60000-0x0000000001AC0000-memory.dmp

Download

memory/4656-59-0x0000000001A60000-0x0000000001AC0000-memory.dmp

Download

memory/4676-450-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/4676-382-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/4676-391-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/4764-230-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/4764-22-0x0000000000630000-0x0000000000690000-memory.dmp

Download

memory/4764-12-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/4764-11-0x0000000000630000-0x0000000000690000-memory.dmp

Download

memory/4776-412-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4776-421-0x0000000000B50000-0x0000000000BB0000-memory.dmp

Download

memory/4796-434-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/4796-425-0x0000000140000000-0x00000001401FC000-memory.dmp

Download