ae06040c6b081cf52ea8a0a933e32917b9c0407899f5c619ab3ec11f2c306efd

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
07/04/2024, 23:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ae06040c6b081cf52ea8a0a933e32917b9c0407899f5c619ab3ec11f2c306efd.exe
Size 705KB
Sample240407-31h94aaf34
SHA256 ae06040c6b081cf52ea8a0a933e32917b9c0407899f5c619ab3ec11f2c306efd
MD5 4a6a45b8bc2e607f154929eb5dc86954
SHA1 368eaa5df38945732e5861889a3d54856f92e2d0
SHA512 9ff5552d3f213718e6a338e334a928aa0429fe6d5b6408da71270dcfb3b77442bdb6d8290321784bb73851b628069b6460854d019e59cdf089859eaaea2205cb
SSDEEP 12288:OF9B+VOiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:OF9Bh/TwSfVcYG3K/cJHlnFR+IGNe8jg
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
516	alg.exe
224	elevation_service.exe
1396	elevation_service.exe
876	maintenanceservice.exe
1704	OSE.EXE
4652	DiagnosticsHub.StandardCollector.Service.exe
2464	fxssvc.exe
1708	msdtc.exe
2376	PerceptionSimulationService.exe
692	perfhost.exe
2292	locator.exe
3172	SensorDataService.exe
1872	snmptrap.exe
3112	spectrum.exe
2020	ssh-agent.exe
676	TieringEngineService.exe
1456	AgentService.exe
1404	vds.exe
1596	vssvc.exe
4748	wbengine.exe
2536	WmiApSrv.exe
4684	SearchIndexer.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in System32 directory 24 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\9d51afe212d07ad8.bin	alg.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	ae06040c6b081cf52ea8a0a933e32917b9c0407899f5c619ab3ec11f2c306efd.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\106.0.5249.119\chrome_installer.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_91140\javaw.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_91140\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Install\{90C18CAD-5F48-47B1-8376-0F604ACAA84C}\chrome_installer.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdate.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	alg.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9926 = "M3U file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009642d7bd4789da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ecddf3bd4789da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000017eb3bd4789da01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000053c61ebe4789da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
224	elevation_service.exe
224	elevation_service.exe
224	elevation_service.exe
224	elevation_service.exe
224	elevation_service.exe
224	elevation_service.exe
224	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
668	Process not Found
668	Process not Found

Suspicious use of AdjustPrivilegeToken 42 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3560	ae06040c6b081cf52ea8a0a933e32917b9c0407899f5c619ab3ec11f2c306efd.exe
Token: SeDebugPrivilege	516	alg.exe
Token: SeDebugPrivilege	516	alg.exe
Token: SeDebugPrivilege	516	alg.exe
Token: SeTakeOwnershipPrivilege	224	elevation_service.exe
Token: SeAuditPrivilege	2464	fxssvc.exe
Token: SeRestorePrivilege	676	TieringEngineService.exe
Token: SeManageVolumePrivilege	676	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	1456	AgentService.exe
Token: SeBackupPrivilege	1596	vssvc.exe
Token: SeRestorePrivilege	1596	vssvc.exe
Token: SeAuditPrivilege	1596	vssvc.exe
Token: SeBackupPrivilege	4748	wbengine.exe
Token: SeRestorePrivilege	4748	wbengine.exe
Token: SeSecurityPrivilege	4748	wbengine.exe
Token: 33	4684	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4684	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4684	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4684	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4684	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4684	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4684	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4684	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4684	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4684	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4684	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4684	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4684	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4684	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4684	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4684	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4684	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4684	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4684	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4684	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4684	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4684	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4684	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4684	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4684	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4684	SearchIndexer.exe
Token: SeDebugPrivilege	224	elevation_service.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4684 wrote to memory of 1624	4684	SearchIndexer.exe	121
PID 4684 wrote to memory of 1624	4684	SearchIndexer.exe	121
PID 4684 wrote to memory of 3984	4684	SearchIndexer.exe	122
PID 4684 wrote to memory of 3984	4684	SearchIndexer.exe	122

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\ae06040c6b081cf52ea8a0a933e32917b9c0407899f5c619ab3ec11f2c306efd.exe
"C:\Users\Admin\AppData\Local\Temp\ae06040c6b081cf52ea8a0a933e32917b9c0407899f5c619ab3ec11f2c306efd.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:3560

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:516

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:224

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1396

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:876

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1704

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:4652

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:952

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2464

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:1708

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2376

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:692

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:2292

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3172

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:1872

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3112

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2020

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:4664

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:676

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1456

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:1404

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1596

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4748

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:2536

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4684
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1624
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
  2⤵
  - Modifies data under HKEY_USERS
  PID:3984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
Size 2.1MB
SHA256 3b4609c45da0fb907c1bfb76a94e7a5feeb02e43af834a64abd71d00724e4705
MD5 b5a435ff50d58ffa68d74ec0367c1198
SHA1 bfd7d17fe86e060879894ce8d61b59c37da682be
SHA512 78988e8dfcdb8a9231c4282705500883da74a7ec6c02133505f04a44f47e860a64944cf567a60c441bb7a833b46685c9e9e068ca441f37332f7849661d7322a5
SSDEEP 49152:9uYk3H5koUafTqkkYLO/W2buywzMbOX+T7z5RLNiXicJFFRGNzj3:9CfTqi90bN7wRGpj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 781KB
SHA256 87db3db72d419a78875f3cb5fd8447cf7c94660cb44413120a351a905f1d6176
MD5 2e33162465cea6ab6f9273aa294a873a
SHA1 1f1553966915fa382721fac0df6e53223d5b617f
SHA512 651238b7a9f7bdda5600c85223bf8465a37b5fed196c8d80d2c9b42b1256da4eef2bcdd90984a10db38859039978f0c0e17bd2dc5da166bb833aa8d70a31153a
SSDEEP 24576:4PsJcuiG/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:4wcuNLNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 0ccde6bb66ce11d9695fb598e1ca1fe2745bbb7975f4a4b2c28052880a9d4978
MD5 9c241d61984c00b149a7ace5fd2aebe3
SHA1 6ea3be06162b5433a74ac2dc7a8d398f5e431c2b
SHA512 ce1d97b70ed32f0fb278233980196160634167d8059efd3474cd6f1a58cb755fbbaf03258d06cdc52bde72a1097635735dbaca55e9148d42efffadec66cd9767
SSDEEP 24576:j+gkE1fh4Coq/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:6gkERSgLNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 29b7eee6ed4bf524d360d852bb749d6a01237e37e1c2f871e22ad9606f34e057
MD5 bc0a59db39d40ab24d7452908527e4e1
SHA1 8b7a9bf3e53b4e62bd3bccb43dd2423e80893e61
SHA512 654dcd2b1d12e195fd530ae10f12bb46249fd063a8cebf1a025492b89303de22d755e41e39af8c891d38504f5d37975b01d92aab1e9baaccc897fb1d5c1ec088
SSDEEP 24576:+BpDRmi78gkPXlyo0GPjrl/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:KNRmi78gkPX4o0GPjxLNiXicJFFRGNzb
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 d5e5cc9458157ec0951f5eca4ae26768a1bc4e64d7fa5b625d318f2c7d49060e
MD5 d14ae9a55eba4d34a45fbef882f5cf93
SHA1 417b71fbed8e03a562ffc124e3b9a7bff5cb4ff6
SHA512 98aa1320ce50ce1bcd44a87537928535c9cdda37ab8366b4df633585dcf837c49ed1bd886edf0928c414cedc90516275b319c1ef5b10c7c075690db31434a9fe
SSDEEP 24576:5LOS2oPPIXVq/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:D/PZLNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 f4274ed6f0690a37cfddd5a36e01c733f53a9fbcc966023ea2e99f9fe48fc68b
MD5 c18e1aea4646a59935366c019ceb41a2
SHA1 2b376ff68408b021e7fe71cb1b8dafd555f9df8b
SHA512 203a30347b4ba32c46d515f4ebc3173f5a9fd7dcdcd28d7ef7084048abc7579166b1729a5906c457f96d0f67eeb517c65093352dd8359d63cf3eabb465bc8432
SSDEEP 12288:9Z2iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:9ZA/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 7ed5fe816868aa51253e586367fece8f23727aabcfd4053236b09099e6ecd0e7
MD5 9ddd29fe50263ce43ff3cde8f474a353
SHA1 5986833f3a6d82dddb437dc3642a9a836d10c5c7
SHA512 9bc8d0acdcd2ccf30b9da48cd4cb40021e58f4504aa21ebb1142d806294d553e953f6fb26c01f61da238f386cf601f5997a55961aefe09a5ea41b0b89337072a
SSDEEP 24576:qJIUb/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:qJIUbLNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 fd0be14585267d5303dcec40c2ffefd480fa42731921009167a0bf6eca503039
MD5 7a6b2accef63f28749f2225e1882d9fa
SHA1 8ec515ce3b278bf117d55b168d5715ddbf6110c8
SHA512 ac7e46e9467308edd43fdf52b1caa88e11e0000f9e757414c23a0a3766f74fe8648d4e548a41f9625c8335f6e31557870c5076d89dc310cfef31f0bcd13ec706
SSDEEP 49152:nQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJR9DN5J8NRV3TH/:nQvGAdlCEL8c/RRNw5Ce7wRGpj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 56821c0ee7167a8628d1e52bd1369359f3a89fa2bc2f7fe9ffc2e891f00280e3
MD5 7c7d91aa2a857fd267e7be9aa7a52cb1
SHA1 f74299e2667463efdddc13d692eb14de47d79975
SHA512 8f11752d1de4a490dcb4035f7e361e720b98e85a6c724db0e9fea09004ef9398997e4394b861c2ef71f482fb94e0c96380c01b6156ad150bb59cf7a51524307b
SSDEEP 24576:VSewsAjN/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:wljNLNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 978d6d0683b8eca24b99accecab3452e88b252ce5ae8ea880f5c50422db4b765
MD5 5e34539d3a76afd29ed0c67fa0261d03
SHA1 9e43f2858124590f1214318a63353a478cb22a84
SHA512 9b95ca08b06a11b141947bcfe99f8112834d46a49c9b89ade0e4763ac2110c9348df433a20ad203e9fd3b7a714a9ba1757ba99d8542ec8dacd173b6ffe8a3f01
SSDEEP 196608:WUEtQeTbvf2zlO12sJTv6Ja1cpVLyRIldPlbuJHpF9:WUEtQevvqc2W1cpV2RI32v9
MD5 SHA1 SHA512 SSDEEP

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 5b52e461392cc9f160a0c074012af5c6e7597927ddcfbf2d26570aa3b5a89ae4
MD5 cba954b41a6eb2e08f30686f3e9cc128
SHA1 bc8ea2a14322e4df20a13b00cfb3f141569096e7
SHA512 01394ce2141096c389189682158bac8c81800f79e9bac7c09fbeab8fd2e8c58786883633811f4a736cea5b6c3a4fe472640481d2552e42bf09488028d2117371
SSDEEP 49152:dCbRquA/m2yL5zTfFiV+XenmE3/ztLNiXicJFFRGNzj3:aoquVjnm67wRGpj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 071bf4442da8410ba40423b31c433158b45bf520e22bc92475bffb0d118f8d5f
MD5 5f69951f35f855f0f82e44fc9652ea13
SHA1 8a7e6c04c9d98877e6cb833f5dac1cb5e31b5e8d
SHA512 817b32a435ac1f0dc9b6484fc688c3cffd7f038380e1a5eacbe39efb177d026a943f771fc6959d749e9f8a1e46f7afb8f39b61f728c11969bf9ce05685e03fff
SSDEEP 24576:pAhGL2IFoiwtA5l7S53a/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:pAM1Foiq5KLNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 9ba78d78bd0dae5715df08b50051224e167b7cf3a15f8e7a7893c1ba574cfe7a
MD5 1af9c5aa84582087eefc55e29c08c9fe
SHA1 a147b3cb1f9bc2e502b0418b848a84c2d653dbe9
SHA512 8d8eb2d807da231f8705fe23f5a20961558ddcbd05c4a01f3aafbcb91c2a6fa8a3aafde59c59c308b5abab685d9d8c04cbde3e0ff1e74134b26dfd3b568c630a
SSDEEP 24576:swuXOWZ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:swsOmLNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 7131f4fe04a23915a3189258d01a4bd1296985faf52d05706454627578e05baa
MD5 0593a253195a53cd926e66f81f5f99b4
SHA1 2018d10ff771e4de75fbb0d49f08eff36e16a1bd
SHA512 b40b5b554adeee3fe6d2d81cdf78def114dd51372f2bc4ba3b7c1367e978d6ddb8f25b92e90553161ed49a2965157a74ce6bf0ba95501195ef512461dbdabe96
SSDEEP 12288:5/Z1IyRiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:xZu0/TwSfVcYG3K/cJHlnFR+IGNe8j3w
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe
Size 4.8MB
SHA256 4d0b2f45a89853cad516490e80ed6be347ac20e741f6719d973b3358d28a4dde
MD5 7e5165bfd1a4f4f5add35ef057ed8fea
SHA1 1d3acb404d0a7d547a8a4d0d7c816502708ffe33
SHA512 713baebd18a7b61166a2bc022c36480d92c912806290ce35b07df71a27a1209d3fc8c0b5cc4fcc043f2f91518bf7a663c6ca21b5ce92dbf1ad4b9e0d5430caf5
SSDEEP 49152:vj8f3jtqiCLg9LK2hIOR+k9jdAsizqxSiZ4K5MZqkL92c6nkdmbD4iIerM1R6ZPE:YrZ4K5M+XD4iIewG+x6xZ14j7wRGpj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe
Size 4.8MB
SHA256 2ddf42f8182c39c0b2c30484cb0e3a2b4cddefce42fd23b6adb199324408eaab
MD5 761d4c16fbd445a27390dae4958bbbbc
SHA1 e5956695f0de8c2272a35b034dd7c3143c7e08ac
SHA512 3035d183ef3f65670dfe55225aac2983eb36f773946a5d4bb0771585f49ed29506a7517786f0b1b8474b0b26debe9c4e958bdee3f23c9131ef0e95d991834cd2
SSDEEP 49152:Ij8f3jtqiCLg9LK2hIOR+k9jdAsizqxSiZ4K5MZqkL92c6nkdmbD4iIerM1R6ZPE:DrZ4K5M+XD4iIewG+x6xZ14j7wRGpj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe
Size 2.2MB
SHA256 50e9720c1e99f2b82e7c6f3d14e87aaa0459b7c4c169d002802e2a40f3ea9c31
MD5 b440f45f571f21aad085c5abbfbea661
SHA1 dd26d4d4cc4835a7c19457bee6a11037f606bdb6
SHA512 1fade0b635d8d4bdea35473db73fe3a8636c1cebb892482d4233c5057cfd53dee72e76218fd77c6e5dac328b9a508848999adc1ab934901ad87c2cd490f10407
SSDEEP 49152:IfzabJ8llj+SWTi2mkx+X+diaLNiXicJFFRGNzj3:pbi237wRGpj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
Size 2.1MB
SHA256 b40c8bed5306d5f9653a8e46b16f02d6c6ed7f856b98a4dcca6d588fef39a8ca
MD5 83831920e02fcfc82a1adfcabaf22694
SHA1 60c94e31234d1891d75893dcbf0be4261340554d
SHA512 161aac33f5fd354520300a6131257d2c1305b4fd388f8553bdf8db27bc16b6c57059f4acad0237cfea5c4b3f0c9ee6193758c4daf136928a8825552911ab6ea5
SSDEEP 49152:ka/3xXBSZ4K5MJ1LvTMxbYsYBYSgxu9+fw4TDLNiXicJFFRGNzj3:GZ4K5MJabYsYNW7wRGpj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe
Size 1.8MB
SHA256 04600b0f0147770f492817d29a8d505d57d33af49f5090897ca8b2698cfe76d6
MD5 cd2944aa63e44902b1511eeb644962d4
SHA1 71e8e2d61db6a1bb62cd72df4dfd3b195d357e99
SHA512 8768e272baf8896a3da5259f66e4515fdd56f4a8b89b622695b87c208137e3e0c9e4413b9afa5e803a4e117dc39e455fa502fa0bb94bd91036f4366066146f0e
SSDEEP 49152:BgNJtUzDu/9g+PxHC4JLNiXicJFFRGNzj3:6Px77wRGpj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 1.5MB
SHA256 8247dd9f392629fce5d3ad15c58f8fe0217a3cb0561fa7c34fab907aa9ff426c
MD5 038e05dde7e69c6f8f90751985c89e88
SHA1 a2390ee7fc5d79b143fd036dac06b4f39f558ce7
SHA512 48b9bcf6e8c56f876580f6193ab0d9b953a0999a8b327647505345a20bc8096a8d3ee8494947f641d7558ed53a3fe3ec26da41d5b433882593c254c5d28f235f
SSDEEP 49152:cOBynH1wM+v6UJALQd7BHjdfrLNiXicJFFRGNzj3:AnZLQd7Lj7wRGpj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 482dde63ed70f668dfeeac466873df30a2c5445877a28aefc1f432da53fde53b
MD5 27d04da7e983abd1492c2a90edcfc3f4
SHA1 a27336bac57b0778e007b92dd6fbcdd063d70554
SHA512 f3b0c59c5d33857a7cb317fccb7b99136b718d2095d9be88320c8bbeba127c052842cd085ede1f50dfba3add4cbda4605bf028ff9884946aa8f189022f862f7a
SSDEEP 12288:TOiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:T4/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5 SHA1 SHA512 SSDEEP

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 c088748817341a8b589f568812c823d67d3d9e3db3e2e5e3efdca2501b0bba5b
MD5 177b4b26c595c60407eb46b8f418a30b
SHA1 5d86ae1a027354a5bb5a61115a9dd36470174cd0
SHA512 3bea82c9a3f25bf6e419052a6168d4efdb44717945e1c0d68138f66817079e5ac8622bf41d738566f488a3ada8cf45d9643416b5974bf9b11480e65d26a3f691
SSDEEP 12288:Z9iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Zh/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5 SHA1 SHA512 SSDEEP

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 e282695f2abaa399a1383d641d456d14f59db705c3cfdfe12dc589d494ef6243
MD5 e3237b065fa6d1766eaaf8b2b52c9e91
SHA1 af4b32331519cf6cf1be140ca7aff4646ced5018
SHA512 d0bfada5e8de65f15c6defb8b009c222c238a6d61f6ace5e9b0ff91779acfc5e6a7e134d87b4c53ddd1a547d4b7f497be7f24681a9703fc7250fdb61d54c50e3
SSDEEP 12288:3niJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:3T/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5 SHA1 SHA512 SSDEEP

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 693b9d419ac9674c689b0a5a6fdf59ad60bc4e2b1dbe596bfe21c4629023a114
MD5 eedcc53975b5a95bdf4a3c54f5dd3a99
SHA1 84b72fe44d8e17d6b6153c3193d6a347b41e4a77
SHA512 50472b40322244ce224282d79c582310b35fa45d69479fd223de3d56678d4ccc799fa7980a6a9441b0110a1e5a79a90b4638b89edad5ddd85af1cfeeb4ea4bcf
SSDEEP 12288:hVIiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:+/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5 SHA1 SHA512 SSDEEP

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 fd4b2bbfa6e097469ef685b0649006cc1d7064ee1d65100acbbc0485c0ba3bf3
MD5 aed1054802cea06f725ef5e4162dc15f
SHA1 14c83244e40857a23d77ac8d297fa3aeaf25a477
SHA512 4b28c8dbb57eef14aec79fb55a40465c256ca6ddb44da4b183eb93fc7fd72b25fe0d05bcffeb2bdf7bcec954850a717fb10da1f38839f4c551e0dbde9c3b6c92
SSDEEP 12288:RwiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Ri/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5 SHA1 SHA512 SSDEEP

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 f8fece12a82209f48aea1e0324f8b21e05d274c700d4ad2890810a311f27e2a9
MD5 3d48034ac5d65ca2e8f82a6c42e77266
SHA1 20bddf7c4fe90dc517e0ea1fbe6ea9e26d7d117a
SHA512 85a1dc2af6086ea72751b7c3e8d8afc9377f2f3f5b3eead425f3ff8f2ee0147c3b1138270e3ba496ac57a3189d8abdfd2539e48a99d10239c1cf1d689a35ab08
SSDEEP 12288:Y5iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Yl/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5 SHA1 SHA512 SSDEEP

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 edde7659874cb156d33df57c972c346c79f7db51fbfb41bb20730e21390f6542
MD5 4c85493e734ed94a80ff67e81a9c5901
SHA1 989ca9afed732f470af5ab2abad7213a31b461f6
SHA512 2c2aa8b2ef9090313eba02e4e1f9d72036dcf3a7f14196abd854c94b76677dcc4116b2f4ef4a9bfc443424e8a14b0cbda6e0fe2933008a33e44ffd6973e6cbd8
SSDEEP 12288:IFiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:IJ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5 SHA1 SHA512 SSDEEP

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 14209e773a2704ee8cceb7f95f49febcce6c04b0f6005246ca311c71f0e117bd
MD5 aded4079aee19832796fcee9178a9db4
SHA1 c81c6ee40659248b49417917c90e4bb4528b9121
SHA512 5c698ded09f7e0d35586004996d0896430f0ac4aeae4fd83c60c0feeb7703ebd7ab9ac37b06e25ad832ab974be73f635a82e6cbad62298c9316e2bef3108161e
SSDEEP 24576:kZMMzFVSOB/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:kZMMzf1LNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 291715770179ad52c9e370449e7d0af4340217df81d49c29009249b435c6bdee
MD5 b1fee082debcdbb1d49c5218ff9de5af
SHA1 d5bee7201fa500a9abad085dbb09e54efc1b2546
SHA512 9f888b5a5c87ce9ac4d23b5054bc832c10807268f53d35face0fe754fccf66a2d7a763470d274d86f3b11804151c9f67815afaff142d9d862a31215002c29e99
SSDEEP 12288:BCiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:BE/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5 SHA1 SHA512 SSDEEP

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 274f83742de494ebaf986109059451392cbbc71977c216abd1329829016137bc
MD5 1c9fc21a25f4919542d57c25db820393
SHA1 f029f52499707cebd3b74873fe472146314fc6ef
SHA512 036034d28dea7c953bfcc9e079b8f4664f1bf7c8f85c5c2dc004408fa75c5299f9f4e9367ef9b4f521bbb8f623ff35e3a06152a22ac5c905d71cd9c7ca407134
SSDEEP 12288:6miJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:6Q/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5 SHA1 SHA512 SSDEEP

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 c8e4742cd5105e2c06588a133373ae29af586dab1ef178eb0589c40a42d27260
MD5 fd7998277fc6cfc8cde77e8d0fe7c94f
SHA1 520bdb112f229564161189cff842571ea2ab096a
SHA512 4846a4f54f08437aa45a1c1c21cc92ed52d36749d5f0af50db92ad65bc67237aada8ee73b5c3437208fbabe533e2ecf0aeb9454bc41889932a05ed0dd4a46f4f
SSDEEP 12288:3yPz5L8RiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:6zyd/TwSfVcYG3K/cJHlnFR+IGNe8j3w
MD5 SHA1 SHA512 SSDEEP

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 d50cb29d875f16b33e599e3db0831fbb5cbdbac63b839294747470b826851d32
MD5 f122faab7cb1eea55cac4a626941f078
SHA1 6234ec9022eff8e1772a364ec6298e2fe7be9b1e
SHA512 4edc508d0adcf493d81b7a2ef1cf94ba35cb03c1334532b412a6d8a51ee7a3e513be27e1672bf10ba6f94e1d0f61ce29cdd4d337db7dc2e8bf2dbbc7fb7481b8
SSDEEP 12288:9CiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:9E/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5 SHA1 SHA512 SSDEEP

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 9cd8049f4ad1a22a1add709a7aa02fcaedb04a658c09d74dd3bf58f1dccd3b83
MD5 7a3e20a4ac320173c9879bd69c04beea
SHA1 4d00f0b6a10270e71febcf29fb2bf34ebcfe056f
SHA512 92d7f7531ce9c6e85be468cb2cebe34d0d53e0d98261b9966b7e6d2b6bf5d99a481cc58f233655dc459247792db091745aca3ba8602a03bf8df20a676bf53339
SSDEEP 12288:0CiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:0E/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5 SHA1 SHA512 SSDEEP

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 6f9e2cf98d06504b59172df10334852b59d889fca719b3e48fd5da4635ebe9b4
MD5 0b1fbdf8f1367336bc0cd025de1037f6
SHA1 fd18559e62046386a88fdc5894d032b13e3d7355
SHA512 5b5a4b20db3050dc966574b3bee873310bf19d467f3d852408368b24aebe8326d1437deaa09e68ec92b669f7c0810497ee7021a79d3f6e0903cfe8917e19f572
SSDEEP 12288:nyPz5L8RiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Kzyd/TwSfVcYG3K/cJHlnFR+IGNe8j3w
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 4d86ead11979ebdb96d2184107ecc5a4365074d8943adac469ecea65020b7e2a
MD5 e3d72d70f2a67fe7fd8da57266e30755
SHA1 f226ce096d4de997b38232ded4647c286a1708b0
SHA512 0ae5e8e671cd08fe557cd75dbc5e7e4ff6ca07f34527315c3f553e14ad54c2fe600a0ba75b820348e8c9db4d6c2c6083d9a045151534647bdd7f0e8de005dd2f
SSDEEP 24576:IT9aLl3z0zDD/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ITQLljOLNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 26c32ed943e717e1c7688c094d5465cd3847b3a3338ff3cb56b3b5c35b4a69a2
MD5 c7498382a6ad704e090f8ae3cd4fdcf7
SHA1 c11dce8432305210bbc9f671c2ef06ffb0fa6243
SHA512 db58b7b7a5cc7eeae50ad80542052b1a1888a814a152b4ba37c7967b665739579c43a549c57ef34a208d5a4da888076b6e73acb5e9a3a53bb92980fcb7b5551a
SSDEEP 24576:O3td9CHKy7GZn/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:Qtd9CHKya1LNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 ab70740f904be9e926a5e1ae0ce3250941b033ec4c027145f628e900c5930543
MD5 97f8bb0addb8de9ea9eadc7a09f10c1b
SHA1 6c1c171489805923f31b816174d33c1a279df993
SHA512 abe1b12fe14e49c92ac3bcfee1ccacaa994f7d84259493f8f968ccf258633e5e9d55b8f8d0f7705cdfaf847273251d0149785358e422427b3d69da8103244fb7
SSDEEP 12288:9HiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:9z/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5 SHA1 SHA512 SSDEEP

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 e2d752c1c2ba032561d92bf9e4063a81d1107bf4402415f0c4c42d8de6812a3a
MD5 21ecf27260fdf21ba9df7ffd7f2612c2
SHA1 60cd98b5902e63a27bb018a19b367b7d7227e7b4
SHA512 e2f562b098c0777508d312c80c9ca015f67caf7ff996bbc5ec68218a1b49801510e1aec6809e19e2a4aabe695c0f9c18446f3dd40cd792927481f70694d58c1d
SSDEEP 12288:qxiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:q9/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5 SHA1 SHA512 SSDEEP

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 d22e5a47fd27a9658702a7fa06611178f11e47bc208526213b3a6bbc7438d961
MD5 d510c23a9ada399dab81ce79e0eda832
SHA1 63cbb889a0a80a19a13b64ba07c41e4eda39047c
SHA512 c040969a52931350c0879856e180abfd2fc6806b202ca59b0740d3bc28123b1e30c8c5b69d02746eef90bb56f0fd322c48e4fb145ffa076edf3bf28304e4bd45
SSDEEP 12288:tsiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:tW/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5 SHA1 SHA512 SSDEEP

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 b9651a5b190fb662177029824bb8dac916cf1af7d7671a6ea3c5d483d5475d85
MD5 5eb2e3b61f3d3e803c59f4339f878a79
SHA1 dfab779b33362703525dcafe54dd6271bf7e146c
SHA512 48dae5d8fd915471b35589381eac742096ca2daac002aebf02576d2fac08517d0396be4acff04b0ed1dceba8289a07bbfd273f12bb5d954208278fa9646a4786
SSDEEP 12288:+CiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:+E/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5 SHA1 SHA512 SSDEEP

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 dea2cf31c64cf4cce8f3d3e5ac35193b75f3a2872efa25e48ab01a232dfa8855
MD5 b27a6cc5cdff2c8446d8978b532ad2a6
SHA1 009c2188346c9fc34d50be1b4e57e0b640f1ad3d
SHA512 3328ed929a39e2084bab61266169932e97da57d72c50cf32408b27d6ea43e660ab333c94d1c01b6e589844b37f06d9b7cac2193f1524afebc43de6e61d599e75
SSDEEP 12288:QHiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Qz/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5 SHA1 SHA512 SSDEEP

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 0eba030595b4cbe98d62471e9be1a3a6eeff302920a57a0c8aa5a23cdebde1eb
MD5 52555540d83aa25514942165b2a31b2b
SHA1 28022e800843309736e8d36ccd04a2f4f0be6abb
SHA512 c0840b92dd02cb71fccc5967ee03486cc7dc9c111659fe70168b81c76c8a93b76700b459ff5585d9530c95894689d4a9ef00871ce0e924e4e73b260f0239c4ec
SSDEEP 12288:xKiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:xM/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5 SHA1 SHA512 SSDEEP

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 696KB
SHA256 1ee095de148d38a1a8302a789804adca548a7e6dbfb78ad8b01a63571f6ba62e
MD5 6291be21c6d17c5f445c5249a53107c3
SHA1 c897be83fdb2f92b8b39280f5361dc29e1feaf16
SHA512 3388821a6d5884de3ca6e76b97c0c96ad4b2c843931df998f22d8f614d7b3e81960cbc6d02387f6aaec6b4fa06c3b5b3e3c073aac3e0b376a8b1197e52a1c792
SSDEEP 12288:6Fwq0SJiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:6gSV/TwSfVcYG3K/cJHlnFR+IGNe8j3w
MD5 SHA1 SHA512 SSDEEP

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 13bcacd75a04063eff6ad2e37c49b9ec63ad7560c7ffc4620bfa37e0ce0b7d90
MD5 5c9c506b6bd2480f81ab38128bde09d3
SHA1 9f4e2169e61240ba6f2cb6029ae5dfd96208407f
SHA512 cd76f8f81a478a16d9187d18064099436b0fdd94edea7537db06b3b18e97774714859569573a5f0e8ea802c2b0e0533ebed2f737bf0ead9a0508f80a8da1b99b
SSDEEP 12288:pCiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:pE/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5 SHA1 SHA512 SSDEEP

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 948929939e701f04c01898952ec2637b822837c18a57b52e3b2aae07b7e1023a
MD5 67c2dfa22dc5e14962d83ccd68451e2b
SHA1 e0afb82fa2741d8eb65e9947e50c023088c85bd6
SHA512 0d405f22ddc606949614b05156edd649d68ce1131dd520847d4289e7cd32cd24ff1e8545f79e003154818980d081e7eaaf29b230ccb9f37d16a1eea76f474e21
SSDEEP 49152:Ja0h2GEkuAe73q3pp46zwwQCLNiXicJFFRGNzj3:Ja0hNYG4JwZ7wRGpj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 659KB
SHA256 d51a5d02bab2c7d66a34793b77725fcfe9eeb4ca12321af8ba268cf0d34d0f76
MD5 a8f7a36941384a011b612b28aeac7348
SHA1 0718580f1baef8dbcc339f3cf98d93b72576c06d
SHA512 bfa0f7bfa0d64436dde8671ef509a8ffdbc42790e6e0a6cc2135bcff10de53230ec880ffcfd3639cedbf0f2be8ba3a9d4cc6e31a25e2f0b5c45abc3d01b4d454
SSDEEP 12288:JhbHjfXBiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:JhbHjPt/TwSfVcYG3K/cJHlnFR+IGNef
MD5 SHA1 SHA512 SSDEEP

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 376123713e279cff92a0d6261f57a014047dfbff345144fbe3ecb8f36477eac8
MD5 4671f04a6ff5c1168ed05d2786a8fed1
SHA1 26c438a5309aaf57266bea6006f5eb8eeae50cbd
SHA512 389ec61777a4f387f5c21f92f46d9769e6027abe505a3f56803b73181e8ff80ecea50795cbf213016c00d272a81e88ba2ab20d5aaf63582577cfb471bb9041b4
SSDEEP 24576:n3YgnJcRTk4yti+R5dpR/1/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:nIgnaTk46ppR/1LNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 578KB
SHA256 6e11aeefd8144d45b4b907af2211e29ad8a38849294d9fd46955c772d8bab90d
MD5 20255ef7bd78b84cec0acd9de312f98c
SHA1 516cb5d70b660adc52a58adfbe161d2fca612962
SHA512 46395c9f0da7080698d377bbfbb4b8a1cf266e5ffa17f9dbbe1fac5f2e89edf99935a1170612ed7e477eb9f8b3d44c7c469970a18c77734393971e71ea80ce39
SSDEEP 12288:oeiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:oo/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5 SHA1 SHA512 SSDEEP

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 940KB
SHA256 3e16c49f8178e443cef8ab9852441842ff92e680085c4507516439450fdb9d5e
MD5 8cee6ea2cdd0a811777b712943ffb1ca
SHA1 0403af0a0faeace5ce2093b5e5631cf947998401
SHA512 39988d521a192b0266bcf3f1da0eb1d74b42ad16778573034b9ecc275c483db2edf696429bf2e274da55d579ded4244db44b5934929edce3f46e617645d33272
SSDEEP 24576:/rL3UTT/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:/rL3UXLNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 671KB
SHA256 3442a3594d555933d93569f268bb86daf0ea7ff8fccc0df5b9cafc2aa2ca1d23
MD5 1de1beeaca9b38f49253ae5149761feb
SHA1 ef0ecce39ce0189bac5777cf39879645061a3922
SHA512 e370fbc7f32637a6b3e900e23d681adc052fd786f6b904aa086016de40685507cd95dd0145bc2b268acbf228351b3f7181cb89f4390584ebe9fdc3fed2b1dc31
SSDEEP 12288:6pFtYODiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:ZO3/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5 SHA1 SHA512 SSDEEP

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 436c2d6162418fe34e23ee92290685fc0d15d3e3481ae3b43fce010bccb7fc44
MD5 efb6978ca2a941b43fb37753412e0902
SHA1 d5b8e2c91b250e71ec8316890230c6b68aa1f873
SHA512 56d896409784dd0b415d85ac9d84549630d8a47ae06b474f0af8204dea27ab817233676dd607c0dddcaadeeccc5a0a5fe9459daa29f0b27b08625bd86335cb7d
SSDEEP 24576:j7NM9YmZqmWMUkPjZM48Mv6bEhsU/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:j7cBWMpPjN8DbEhNLNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 079803a56565f131825fe5beb17e9b045a3b1cbeb232614dbb54de855c38722b
MD5 54e8b7d1f675ca74a824e3a7eb4ec0f8
SHA1 693825402caa1283a1b9bdf3381630ba557721dc
SHA512 067bfb55e703460afc691557a5a238bb899c1a8737d4e575aa9809da82b0c44810fd0769e51afca8a0944f510bb2a6f7a0ec8db619572bbfb17e4925764e0795
SSDEEP 49152:9F2YuHNETovcvNYf8km0LNiXicJFFRGNzj3:I6tCf8k37wRGpj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 29ab7bd8cceaedaad1e0ac784776201d6dc76466d2ed36813f898c3aa619efcc
MD5 2028174289dbfce506e303bb6fd6dc6c
SHA1 f152d5389a503b6065a1485cd205d86c8fd3389d
SHA512 74d72ae992461c63a633132752e719055f2a6ca2e06867bb97845db8bb9fe88329233bb80c993b7f8924bc40a00c351a76f6ebb9ff6d7f03403c23dd6184435b
SSDEEP 24576:JAFs06+OmlfQNXEbTor/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:OFs060lcXuiLNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 885KB
SHA256 ad3ca5b507b5d33a59c46e53dbccc39a4f197d83e1529a0ad2d0a99c8696c74d
MD5 3b77586efd0d3da68f849db24263c146
SHA1 24b726c5097370f11726a4759c741c9cea8a1c3c
SHA512 6008d2d842896d56d179c39caba41e72b1ccc02b47c6f48f5b577b0f164ffeb7bd82a0bd0ac3f8703c19ded03f6f1d7b025b95a4d99f0a37a94677ec3b4a56ce
SSDEEP 24576:7JnJ5D3Wti/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:7JnJ5DGtiLNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 c98ba9acb1dcf84bf8807b6a157bdac72272e98ef0efcd882923688bb9e7bc32
MD5 91806187d22232cebd29fb348264d0ad
SHA1 4437c42ad9e15971ceb63beb2578226af4600038
SHA512 e63b65c88d6296936b7793cfa548f39e7c6730484ee9f973bc4b8c89b52f4467fb57ee93e1aa82a8f54f28155647f9e5f0fef8c8458d445df68538f7ba40f163
SSDEEP 49152:Ho06DIKdwc+eQnSt65aVgLNiXicJFFRGNzj3:Ie7wRGpj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 661KB
SHA256 d1b82f66b1144d484bfb00e10cec0f4e089d81fad81c7e3e78668462cacd5721
MD5 be2b801548e4d757a58f51ee157e9630
SHA1 64607b6b104a8e6f51911d2e1db059de633e9e8b
SHA512 0f85d7ca53749ad8376b43a2de18d18114b983b47174a50b6fe1a9469d8a144b93e57fe815302216db77a645b41e5f1c285bca65519c0ad20ccb5120e7ebfb55
SSDEEP 12288:9EP3Rrl2iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:erlA/TwSfVcYG3K/cJHlnFR+IGNe8j3w
MD5 SHA1 SHA512 SSDEEP

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 712KB
SHA256 a19a534ef4b4f755ecd2ef1f3e6442424976eaf45142ecf09f21ce9b6d9cae5e
MD5 1a8562f14f1f2c08d571bb1100e5c57f
SHA1 43266bce5826bb12025e58c9e16d765e19340e91
SHA512 64e03220f598eb1bac6157f16dd11ddcd16e6243fb74b70340f6c584b6f92599466e15d968d408bfe4c6f921107daebe3b6699feb5cc3909b13d8abcb608eb4f
SSDEEP 12288:7jkyRiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:7Iyd/TwSfVcYG3K/cJHlnFR+IGNe8j3w
MD5 SHA1 SHA512 SSDEEP

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 584KB
SHA256 3ea62d462696533cdee5dbd6cffd775b79782a28a02d797df0d138d919f7dcc0
MD5 626888acaa1946182f1a0804e2a57980
SHA1 2e74a7a582805c08ddaf9af392b40a3ef4b33531
SHA512 0dcc84408bb36d397b61e345002699ce55c1fcdb2ca8d194019fd37def14e45bfad824152924a34abe4bd07ac21152960ef900a5859487eff3bd1738130af853
SSDEEP 12288:tFTiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Tn/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5 SHA1 SHA512 SSDEEP

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 5e969d8749d6d03ca733bae44d913b58cca7278226a563274c087b88fd9b0036
MD5 379c3967cb62f3edcd11c61908cc052e
SHA1 370790e1a023aec71054d113d908ae5eb609753f
SHA512 b420aa72f92930194f6f81dda7b93d3cb6b1571c1bac7a34a3903d5af1c4d8c1c6d12914af4480283bc68002cf409b81613bff2edc3b1beaad9792b5b98dea2b
SSDEEP 24576:qQ9MxZKdcz97w3s/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:qVKXsLNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 772KB
SHA256 c84b5d6c783dd81a9c91561e84b6a1f6f830898b1f7f2ac07f28b0c01dfe3be1
MD5 d97801106ca8ed0f1151d0188a63e7fc
SHA1 11fa78af79bb02c4b034de8945b3ee7cc7b34291
SHA512 924d89ad215b105d085263ad09e03bb5c305fba9cd4d44f3d2fbe5e5eb72978c15c305bc4fa65d12cb9b81412183e9a9dfcf8a5a52d1b0f6daa00a68ecfdaf2d
SSDEEP 24576:ryocxApR/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:eocxApRLNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 a5788747716e36ed05829e8b3655c01edec964ae95bf151c4c4f55603804c5c1
MD5 2cff5e906f27ea48f3e0abf2ca2f705c
SHA1 0a63165f4879fff4fd84aa9b2ccdb2b621c00bd3
SHA512 7a123fdac534a5e2c1b8b8bf5cb5f0d42ebce29aa8410eb8984156cf7b89bb459d14580cd638a15d8cb2441da2c539d6b6a2aa62450040d48c77ba56378a6cb7
SSDEEP 49152:YWcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIKRLNiXicJFFRGNzj3:60zuNIl7wRGpj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

office2016setup.exe

Path C:\odt\office2016setup.exe
Size 5.6MB
SHA256 7d2ea09af8ec3ed8604d2b080fe5e8b09c474b4b1d085b18ba1b9e1c1cff4b3c
MD5 b827409dbe7775b6a88db6e9b476fce1
SHA1 579b75e71d2940bb56d7c8692b6946227a4aa0f1
SHA512 a0eaf8d0baa1533137b2835e7f65fddd34c5a576cc3bd39757b8772f5c51f27d62a60c356689d43b4c29c0f0c16b040ed5253e7f74483aca1a535f922ddfb798
SSDEEP 98304:Y7M701RgX4iuSl1DtlEq81xZPGnzURnBh6gG4/QmvD/cTwY2h3F57wRGpj3:SM7pTXexZPGzURnBh6gG4F+W3PF9
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/224-30-0x0000000140000000-0x0000000140237000-memory.dmp

Download

memory/224-236-0x0000000140000000-0x0000000140237000-memory.dmp

Download

memory/224-28-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Download

memory/224-35-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Download

memory/516-13-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/516-229-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/516-23-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/516-14-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/676-442-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/676-374-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/676-381-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/692-368-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/692-302-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/876-51-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/876-58-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/876-65-0x0000000140000000-0x00000001400CA000-memory.dmp

Download

memory/876-62-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/876-52-0x0000000140000000-0x00000001400CA000-memory.dmp

Download

memory/1396-47-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/1396-46-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/1396-237-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/1396-39-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/1396-40-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/1404-404-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/1404-412-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/1456-401-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/1456-400-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/1456-396-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/1456-386-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/1596-417-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/1596-425-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/1704-66-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/1704-68-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/1704-74-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/1704-73-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/1704-240-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/1708-344-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/1708-340-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/1708-270-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/1708-281-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/1872-403-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/1872-341-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/1872-333-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/2020-429-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/2020-369-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/2020-358-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/2292-305-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/2292-315-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2292-372-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/2376-287-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/2376-299-0x0000000000C10000-0x0000000000C70000-memory.dmp

Download

memory/2376-353-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/2464-277-0x0000000000A20000-0x0000000000A80000-memory.dmp

Download

memory/2464-275-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/2464-265-0x0000000000A20000-0x0000000000A80000-memory.dmp

Download

memory/2464-258-0x0000000000A20000-0x0000000000A80000-memory.dmp

Download

memory/2464-257-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/2536-445-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/2536-451-0x0000000000680000-0x00000000006E0000-memory.dmp

Download

memory/3112-416-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/3112-354-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/3112-345-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/3172-325-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3172-319-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3172-385-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3172-394-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3560-0-0x0000000000400000-0x00000000004B5000-memory.dmp

Download

memory/3560-1-0x00000000023B0000-0x0000000002416000-memory.dmp

Download

memory/3560-7-0x00000000023B0000-0x0000000002416000-memory.dmp

Download

memory/3560-18-0x0000000000400000-0x00000000004B5000-memory.dmp

Download

memory/4652-252-0x0000000000680000-0x00000000006E0000-memory.dmp

Download

memory/4652-312-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/4652-253-0x0000000000680000-0x00000000006E0000-memory.dmp

Download

memory/4652-246-0x0000000000680000-0x00000000006E0000-memory.dmp

Download

memory/4652-245-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/4684-456-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4748-431-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4748-438-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download