5ecc1fa39ea2b9214caebddbe53abbd3f00398368bb41e626390d65bc902ab2e

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
07/04/2024, 19:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5ecc1fa39ea2b9214caebddbe53abbd3f00398368bb41e626390d65bc902ab2e.exe
Size 706KB
Sample240407-xpgdgaca72
SHA256 5ecc1fa39ea2b9214caebddbe53abbd3f00398368bb41e626390d65bc902ab2e
MD5 44d3bfdd172bb1eba87e7bec5dbd45a2
SHA1 9e2381369f0ff3f185a2a285f6eeb64e35dee818
SHA512 9024d5f342df6bbd4adae385d34f870511adce065b6599e9430d265e049801e287728a27c55bcce1ce9a793d05e8c00038444309a38ce16ffa449e5b72c18888
SSDEEP 12288:uFiB+tmiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:uFiBB/TwSfVcYG3K/cJHlnFR+IGNe8jg
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
544	alg.exe
4108	elevation_service.exe
2168	elevation_service.exe
4208	maintenanceservice.exe
3220	OSE.EXE
1308	DiagnosticsHub.StandardCollector.Service.exe
3580	fxssvc.exe
4612	msdtc.exe
1896	PerceptionSimulationService.exe
316	perfhost.exe
4452	locator.exe
4008	SensorDataService.exe
1268	snmptrap.exe
4020	spectrum.exe
5092	ssh-agent.exe
1372	TieringEngineService.exe
4436	AgentService.exe
4852	vds.exe
4520	vssvc.exe
1788	wbengine.exe
4536	WmiApSrv.exe
3688	SearchIndexer.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in System32 directory 24 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\e4c0b8cf205991d4.bin	alg.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	5ecc1fa39ea2b9214caebddbe53abbd3f00398368bb41e626390d65bc902ab2e.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\minidump-analyzer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\106.0.5249.119\chrome_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\minidump-analyzer.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ef2b423a1e89da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000005a373381e89da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000770576381e89da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001379aa381e89da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9923 = "Windows Media playlist"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ba2c7d381e89da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a4de6e381e89da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000044cc5b381e89da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000f2456391e89da01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d980b5391e89da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
4108	elevation_service.exe
4108	elevation_service.exe
4108	elevation_service.exe
4108	elevation_service.exe
4108	elevation_service.exe
4108	elevation_service.exe
4108	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
656	Process not Found
656	Process not Found

Suspicious use of AdjustPrivilegeToken 42 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1780	5ecc1fa39ea2b9214caebddbe53abbd3f00398368bb41e626390d65bc902ab2e.exe
Token: SeDebugPrivilege	544	alg.exe
Token: SeDebugPrivilege	544	alg.exe
Token: SeDebugPrivilege	544	alg.exe
Token: SeTakeOwnershipPrivilege	4108	elevation_service.exe
Token: SeAuditPrivilege	3580	fxssvc.exe
Token: SeRestorePrivilege	1372	TieringEngineService.exe
Token: SeManageVolumePrivilege	1372	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	4436	AgentService.exe
Token: SeBackupPrivilege	4520	vssvc.exe
Token: SeRestorePrivilege	4520	vssvc.exe
Token: SeAuditPrivilege	4520	vssvc.exe
Token: SeBackupPrivilege	1788	wbengine.exe
Token: SeRestorePrivilege	1788	wbengine.exe
Token: SeSecurityPrivilege	1788	wbengine.exe
Token: 33	3688	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3688	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3688	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3688	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3688	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3688	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3688	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3688	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3688	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3688	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3688	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3688	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3688	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3688	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3688	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3688	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3688	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3688	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3688	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3688	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3688	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3688	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3688	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3688	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3688	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3688	SearchIndexer.exe
Token: SeDebugPrivilege	4108	elevation_service.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3688 wrote to memory of 620	3688	SearchIndexer.exe	121
PID 3688 wrote to memory of 620	3688	SearchIndexer.exe	121
PID 3688 wrote to memory of 4740	3688	SearchIndexer.exe	122
PID 3688 wrote to memory of 4740	3688	SearchIndexer.exe	122

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\5ecc1fa39ea2b9214caebddbe53abbd3f00398368bb41e626390d65bc902ab2e.exe
"C:\Users\Admin\AppData\Local\Temp\5ecc1fa39ea2b9214caebddbe53abbd3f00398368bb41e626390d65bc902ab2e.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:1780

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:544

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4108

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2168

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4208

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3220

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:1308

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:4500

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3580

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4612

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1896

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:316

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4452

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4008

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:1268

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4020

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5092

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:4904

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1372

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4436

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:4852

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4520

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1788

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:4536

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3688
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:620
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
  2⤵
  - Modifies data under HKEY_USERS
  PID:4740

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
Size 2.1MB
SHA256 12059d19a5ad8fd94143ba9574b9cf215875a41f1413b444d42a21de0fb33e03
MD5 95f93919c3c5841527a1bf1d2347605a
SHA1 ad9b44c7c9c69603e372128eab9859194f35b8d2
SHA512 1c3324d4c560b31c2bd3f0daeaefdd5ec3d5044f70dddcbaf250f5aa931e4e66db03d468cb99db572830a14f96d90231f3dc16545d81a5893aaa168e11ef4648
SSDEEP 49152:2uYk3H5koUafTqkkYLO/W2buywzMbOX+T7z59LNiXicJFFRGNzj3:2CfTqi90bZ7wRGpj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 781KB
SHA256 d883b4f20666d669b5acafb4c2765673232e5d5df33ef019ce1e6f93396b25c8
MD5 a625b40a1247a7c6154bc08ed428eaa7
SHA1 9c0e2927acc0b45b789b04388a510b4e3aea17ad
SHA512 51dba8f6ab8358a93dad31a02af298f49bc38ecbd6152d7d591e1b69ed5958cd0da204c07d51c2c8fd6a951497110b52f99d9e7445474cc89be48131b37fb017
SSDEEP 24576:hPsJcuii/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:hwcuZLNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 aad3b973c0428f89b5192cbd2183fb08389e86749ecfdd0483086a5e9b8f7d1d
MD5 4f95f3bf2b482410c81c3b0249427381
SHA1 255fc57037b5eb7c69a220bb8a4e33061fe59c8e
SHA512 1c4beee8e9bb5d6c4a9ae8676cc957d4eea68deae692b76afe630d85368c3be42f6e11f79d1e76e847b75cddaefe678f0ddf8ac02ea01eb44a64a16eb9f1af7d
SSDEEP 24576:A+gkE1fh4Co2/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:tgkERS0LNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 530378dfb9ce085380079e25c8dd26b52c8019fd12dc18ed8edf1670d125936d
MD5 0a0e06c60210350dda26fa12d8ef5832
SHA1 fe90a369cf280ad7d6daddaeab996cd8f81a4619
SHA512 293170fa66ee1e11605cbc6cd4bdd96e1d8da7bdd664ed7b3103534faeeabf2b82a41562aea6c1acb25390134a551279c2d03d1bfd96dd3122e3ed9f2768738d
SSDEEP 24576:VBpDRmi78gkPXlyo0GPjrx/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:fNRmi78gkPX4o0GPjdLNiXicJFFRGNzb
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 5a66df345511b67e6f009e6a3a5d4df19d03e3870370b459c1b702ad27b8780c
MD5 0b0e2af6273701fa852a9ec0b18096d3
SHA1 447bc4a2edcea953da956afd6a51352a9464ae5d
SHA512 2c40e0498e5c4cf893bb43d78f8418ebb42e5feea5be5261d8c7ece637adc4c0a3538e2f7c3e227be48301afea4d9072054616c8cdfe885af80e6f8e8792f11c
SSDEEP 24576:sLOS2oPPIXV2/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:0/PFLNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 e8814bef73c145383db38c1660a32d66427ae1701b16d06353775ea82aa98c1e
MD5 624dd962f4f0de0972635dcdd561b7a5
SHA1 7edf9b9b434da6c0a0a1576676be0487a0788061
SHA512 99dfeb57e175befa6a2d8b36351bd2a576fb4aedf9777390253a34f1b552b23061714cc20f2f0b88fe8dcdfc3ac5b2791d6be5dd5c84feb75ca129754b637d23
SSDEEP 12288:zZyiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:zZU/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 189384c535d6ac35607d6b25664bea745fa9f35ff4d931011e073d0feaf75e80
MD5 d85525b34aeede1406850cca6733b265
SHA1 c8a9b1477a03c5b244d09dedc22065f7172e1ab5
SHA512 c41a07a1fb26d16ba4ba1db3af8e897bbb1824b8fe5af8bae95cdc1524c9e817f967394d76b77236eddf633ac6caddf478225902b47077e6b5cb0316b4ac489a
SSDEEP 24576:RJIUP/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:RJIUPLNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 14dcaf28b0934408b4ca0a0724d0932d82be4b8a289cb65c3f1d52456b7cb024
MD5 065527977c3ea9698c3b8d827c4508a4
SHA1 67cd0bc79c6a376c7901a5d377d29ed68c39a9c1
SHA512 ef4630ed3fad4d3ce3106bcd6affcc79e9fd716865e8d98479531dc57b663e47908abddd05c84694095d8b1e2cf22a95dd8fc336d2972aa0f49945ff074626c6
SSDEEP 49152:PQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJR9DN5J8NRV3THL:PQvGAdlCEL8c/RRNw5C67wRGpj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 7490112f9580f1363fb841b4f3b57c30bdc4bc9117e03abea827b41d5b8a709e
MD5 9dddc1b2b9a3b83aae1eff60e975a26c
SHA1 245b3318f51f7dba4a93518e3e2828cc1b932e77
SHA512 4a89deef2d3908135c227fbfd714fc443d397033b855e3399c622683822ebb963f6ddbabae76a207827d935dbda4f291547c682f2d87c0cd0e4f86c594eca59b
SSDEEP 24576:5SewsAjZ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:kljZLNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 0f153ead14e42766898ad277295238b8b2a911bedf980c7bb3e80d3a61f1a1d3
MD5 923aef4516cde9ee3e3f222d11cc8aad
SHA1 6b2f321f94b38b1db2ca77a85b0e633670be21a9
SHA512 60cd778b6931dc0039f3a98319fb0e01481d9e557e1e2fcca83ef21265ee272d888fdd3b4aa4b83879a4915306f1395908813e3cdc046c19dc109527465ad2df
SSDEEP 196608:YUEtQeTbvf2zlO12sJTv6Ja1cpVLyRIldPlbuJHlF9:YUEtQevvqc2W1cpV2RI3279
MD5 SHA1 SHA512 SSDEEP

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 d84d6ef433d735c78d2b5d8199d5ad5ed27ffe62c517323a1d462419d80dd02a
MD5 81cec96f28351236f82d4180f8dc8414
SHA1 e0e356ab8b0bbabc2a06aff96266728d8e5fc296
SHA512 86c6282bd65cb3622fe0e8e4629d9f064fd18256fe65257e6c11a6dab3ee95f22b92ed63108e550f851122d02589374ffc501c9c7a790eaa20f3a4888322bce1
SSDEEP 49152:uCbRquA/m2yL5zTfFiV+XenmE3/z5LNiXicJFFRGNzj3:DoquVjnmG7wRGpj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 fae6eb9faff98492657ea1afc2f847ef01128167625fce1b212beb372ff29a24
MD5 016affd69d21830bddc4fa14f0af9259
SHA1 0970472b40ca5dcca8fdc4c6423eb25732e7ae5c
SHA512 fe35641ae8fe7613816905bb3aee1ed0d06f13ef24e70621d7e585452ca53cdb51c7dbb677340c690169169fb557edb3f350b8fdf7b8fac3de539e05b90fdbbf
SSDEEP 24576:aAhGL2IFoiwtA5l7S53m/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:aAM1Foiq5WLNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 8f70d67056fe4c4c0f9e2148344f10605c02ef1a56e1e330bdb595e6758b9a40
MD5 8a7b17910e55ff13b8ee4d0d10cc2028
SHA1 043fd3e3ecd20a118d5b1af62c92ca60c6d86124
SHA512 ee48c0ec1f69c2f6f509d0620f1a5a68877323facd510a82e0c16ffe97827566feefb7130e2adbb25beba81314b6610ba1592a7d720f8381504c610c9671efea
SSDEEP 24576:ewuXOWF/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ewsOCLNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 3bee5fed3fd11c67d165e1ee9ca47f11b2719f5d81cfe39640841360dffbddf6
MD5 0484cb9aac3b394269efd0238bbcf126
SHA1 4365e376aa08cf49f5fe3eaea4cd1ccd35eec27a
SHA512 a4ee188f2da616baa3eb0dcdca3d0978eb29dcf7482aa6a3b1d87c5be7fd62eea0d548e9029aba72bab5b846471d05bd4f15d2fdb0328941e4f8a3dd8d7b7987
SSDEEP 12288:v/Z1IyliJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:nZuo/TwSfVcYG3K/cJHlnFR+IGNe8j3w
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe
Size 4.8MB
SHA256 4ea8024de7b1130ba8cc1b033e6f22e9793074789f3bd58804abfca7e3c765ec
MD5 31cddf73f5ebdd5019bd09de3ae33be8
SHA1 ffecbb697a8114edb11479dc6236036cb951504b
SHA512 3ba3a25e312f985da73a4ac56d6a60cf8a5dc9e9760aa135448135941dce46c47bdca25d5901c0495525fcad6ce45e687b1a289e90e73799866a5c8f73584d78
SSDEEP 49152:Rj8f3jtqiCLg9LK2hIOR+k9jdAsizqxSiZ4K5MZqkL92c6nkdmbD4iIerM1R6ZPI:arZ4K5M+XD4iIewG+x6xZ1437wRGpj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe
Size 4.8MB
SHA256 c0ce106d3dd8bbcd2bea345316589f68efdb6b44060dc682b498196c84fd0f5f
MD5 6d8ee520270c2433c0b0107a6b020184
SHA1 56b93b5e7e9e2e23a43e1f62113a59ae40f6a2a5
SHA512 caf03c5ab9ede5ac4798c96683250fda34056f9f6929edc72b21d299e054239d625d1a7c006a5c47a38b83059bcf678e1973eafa177ecf671892d5f1dea8f698
SSDEEP 49152:wj8f3jtqiCLg9LK2hIOR+k9jdAsizqxSiZ4K5MZqkL92c6nkdmbD4iIerM1R6ZPI:brZ4K5M+XD4iIewG+x6xZ1437wRGpj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe
Size 2.2MB
SHA256 5581c7e20993deda4862c3170f5df3aaebe17077c2e37272a0c4e2b9dc69b31e
MD5 02d4217213efb5c71670272cff99fef8
SHA1 3a68602896ccc8fe2cdcf92e3d597b21017287d8
SHA512 0fa3321e625b712deb0b6f508ee712af3f66d097f1e7a2acb4178d146aca57c852069443f403258ce6453799071086ad03b4f952ce771c66ddc5eb7e9827c8f9
SSDEEP 49152:PfzabJ8llj+SWTi2mkx+X+dimLNiXicJFFRGNzj3:Ebi2b7wRGpj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
Size 2.1MB
SHA256 e8f4429142682f8f83c012f8434f98a85ac92b67272c763048bc0f8b8019045b
MD5 c80e9fe9a6eeeb65b34fc2bef60a9cd6
SHA1 f357525425e23f00966a474ed03ffb2fac6dcd39
SHA512 306faf7f751293ad188f3357c49f80ba8b8d0076bcc571c166f5b7f61b9b94c4b5c3a2e28dcdcedeccc57182eb0fc312396c225421d9b1a7e26931b68ac321e0
SSDEEP 49152:pa/3xXBSZ4K5MJ1LvTMxbYsYBYSgxu9+fw4TXLNiXicJFFRGNzj3:ZZ4K5MJabYsYNy7wRGpj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe
Size 1.8MB
SHA256 e283b46da0aab42c480100931bb0d0dd8727be9087f68f7ec56768f6b022a639
MD5 d27c74edb0e6e9e0a75cb291d0c32bd0
SHA1 20b1d2d26a15f92aa594ade3f6ed3ba74df41bbb
SHA512 666d5604e698797053caaa423ec8193f4753ce4cc66016167338d0ef4559a282950480451dfabb5e376b7bef0ac275a0ad86a1104cc80098b67b03cb4c665f2e
SSDEEP 49152:CgNJtUzDu/9g+PxHC41LNiXicJFFRGNzj3:rPxv7wRGpj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 1.5MB
SHA256 2040cb4e3636186c00d56be97777a746727757ec01b00bf33b285567548e3437
MD5 640120c7a9cb9e6e8e4158766d4e2773
SHA1 5c1fc84dd70944ae757f5c1ffa689679b3931630
SHA512 8d9360383613d0d9d6c6dfc50c9a118b33ced296d281c00bc70d6747e56140d60a5959c50b3fb2736dee76e39c0ca684d6b65be70044b1bc533031ed66a1a718
SSDEEP 49152:3OBynH1wM+v6UJALQd7BHjdffLNiXicJFFRGNzj3:pnZLQd7L37wRGpj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 4e4f7706a0c7fc64123562d1072a887b14643338ebf2ad62ac0269b6162ac1c8
MD5 63b7b5c10ef3bbcf6d187db956d5789e
SHA1 c883802bf3838a2538b2ce8b14196130564c2842
SHA512 055c7a1c03a0f1c2b436d156f279b7eb89ebdda6002f60b2fa529ea1457b5ed943a32b124df8c04ad6ebe1d95ec7b4801ac3dfecf30878b5f33f5078f9dd13e4
SSDEEP 12288:kqiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:ks/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5 SHA1 SHA512 SSDEEP

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 3b8a70197f1cf910641e558e8472d062237f35c2549efe495b484f457c6dd2f9
MD5 2f00661e12bcfc402bbcdfc5859665e2
SHA1 a69bbe63134f4b32a541bc7f37c4d12915f9bbc6
SHA512 195a5ea90f47c7dc485dc56b1b6e8eecc58ddf2509aee3cab089503f6fa9ef8cc4d9b6c11976e4ccae81dbee5ebb76bbe502cbf257f2c7d7290422445e41b839
SSDEEP 12288:lhiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:lN/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5 SHA1 SHA512 SSDEEP

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 b1a6d571fe9f32b7a10f3f33c66e895f5804674f44d0089e9e794666cd33b1b6
MD5 5cb974a36b53c4c6a9cfc98ec1e7fbc0
SHA1 1ec31bc0d774f7e0173b64e55062b09b8609e625
SHA512 84f2a549cf01c2dff1988a8528b8e541efa816a8480fe244d18b97a5987e751385d9c76e82b6f05a6e4b9e8f396558cf1cc9cea4c77ccc6ec0c283225a04b7b3
SSDEEP 12288:fTiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:fn/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5 SHA1 SHA512 SSDEEP

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 d9fbd2657acd14fc8466069cd5ea47fa5c8a1cdb2511b556cfd16a7a172269af
MD5 160968f700fa4303c9ea6102dc8b573e
SHA1 810bdc5d61402513f08f0d92283f96a41337c686
SHA512 8fedb6874c68e216d3b11ea71797c3f72a6b97a1559d69ca38d3159f9458be013af080672d8993d8a9de022a33ae7364e8b5bcc5bc466d64d4fe5d2e31a25340
SSDEEP 12288:WV8iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:h/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5 SHA1 SHA512 SSDEEP

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 3d8c4a8ab3bfebe1041fecb7b13004f00f0b335aff2434329708fa9064436986
MD5 9cbe79d4225fbd1c7ae5717d0419fb51
SHA1 a4085a3cbe15a0b8dd2caa82106dadd9905c9d89
SHA512 2ade412c6a1f08fa1528ffaba470311622a1f2112a961151c844efdd1df1a1eea071d6f1327689adb51c62ea856c7ec7885f89ea1e0555de15d440ef835d642b
SSDEEP 12288:akiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:au/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5 SHA1 SHA512 SSDEEP

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 9c2ccfc3d1e50ece92205c00fa4c496ff0779452fa13704e2bfae375d5ab6999
MD5 06ac6bafa0e9b0cad3bd2fb0d78e3fd1
SHA1 d06e50462c8e9c76fe2227ea69aba8868d660bbb
SHA512 9f81c1e5abc52bfb7fa1f3c8d9077175ad64a76f47789fd9aa254f370d238cb6023d77f5bce09eec5febc9e2cfd42a13735dc07af2a5f7179ed975bc22a77764
SSDEEP 12288:htiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:hx/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5 SHA1 SHA512 SSDEEP

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 0849962832d39e38bbd94e7a6a970753825f08702345503afdd46a678f9163a9
MD5 091595472424081cbffe5916bcaf31fd
SHA1 2f3e12bd728baf0f2286c1fb1aed8bf064270f70
SHA512 02212fc514c478961f6133b2cc21f110f6d4126b06b808d40897edafdf9e32aa6cbdb8ce9dbd0a299758bc223255d8c7b1738ac0995dc72179c828af18bae2b0
SSDEEP 12288:LpiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:L1/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5 SHA1 SHA512 SSDEEP

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 a2571db052b777835d633a28df0d9393aaf55b7f41f9390500f80a7b529cf58d
MD5 6caafde3f8192df6c6974e7e58643539
SHA1 3ce343324642e21640cbb7a4eac657c36c43128c
SHA512 f2b750cc4b618c2d9a3cea80d8e12c57cd2f45ceb7595d1449178aafaf30eac1bfa724459267b09bc15e84420e585492f65176cd058e40bbabab61d64d770af1
SSDEEP 24576:kZMMzFVSOt/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:kZMMzfBLNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 f97a5008aef4f8cd6f181d29f45267daab423e6339f8fd301984026d4b7ae06c
MD5 fdd880fdb0fbe847bbddb3242808a9e8
SHA1 0bc6092c8744a5bf4dfeed12ff979bacb039a07c
SHA512 22d8b6b023cd06574aac2378da203098618355445c59427c66be7bff2cf3ceff33d41478ecd1ad59e038034fd6b30d49820f25d8b9e182b4abfb5c10e7abf1fa
SSDEEP 12288:XOiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:X4/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5 SHA1 SHA512 SSDEEP

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 6778998fe159b3992a7597628151917d806960b19f25a831d8c83dcb0a26b82a
MD5 68ee152d6406efef7a605cc90c3cbf70
SHA1 69c14b589f283bcaade3c497931946b7ea1418fd
SHA512 ab7a3452cb6dba21e59a134e90851c10dc83174dfcee70cac2fc74744cb23cbed03440b06927cf6700eea9f612e1bc11c3113e5dd154327421cbfa73f1b87bd3
SSDEEP 12288:9iiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:9k/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5 SHA1 SHA512 SSDEEP

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 5df18cc14ce8febafa5e1a54fc6b6082f38cdfeb280a9f04600933fba9ac6128
MD5 13402a292080fd235dd4dff3b44153f7
SHA1 a501e783764a09db2390c472a3ba08ac8cc1dd6c
SHA512 4b5dc69284b2563f66f96f48926a585e6561f2171c0a332c1961955863cc2e7025cde6332bc289333e53a9c15c80bc92110373fc73571bee063681de5ca88cd3
SSDEEP 12288:AyPz5L8liJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:xzyp/TwSfVcYG3K/cJHlnFR+IGNe8j3w
MD5 SHA1 SHA512 SSDEEP

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 7c95d8b7f66ef798eaa1f7d352958d044d003efc1b046621281b835bd8b486ca
MD5 dcf7cff66b1c4b5ec1fc1fee1713f54e
SHA1 2fcc8f2aa133e371484f5ad529a2e11320a11a56
SHA512 914a9ea6d30e84d260b2d22e1aeb4e9b9ec654ee63532c2c1113f031bf4c5752c91879b91232a911582c5c9f23a2dc876f0066b57da998ed95bb63936ca6672e
SSDEEP 12288:FOiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:F4/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5 SHA1 SHA512 SSDEEP

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 63794fda01f69b1a4f6791a2b453ccdfc1443ef0505aa9cf4b09bb9ce362646e
MD5 10bccd6845430e90d77f7ee26921d996
SHA1 217b4310e73eb6edfba4c0eb2fb416203b2ed138
SHA512 092c66cf037360828f64909763daeb23f4b79800307a953725a611f07f0ccfed2e567a042c84f3b14fc843c9c380241244de4aec2811a9e28c01ae42711c643e
SSDEEP 12288:UOiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:U4/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5 SHA1 SHA512 SSDEEP

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 e1176b16ed18aebf5e5af632a3cb52a101e7654b68c4b3401cec160e0090b982
MD5 668b378f8d3550794848babf525b89b8
SHA1 a5d9df911ebb14cc32b5247c6788cb443c1e584a
SHA512 1006aebd6b87ca23b5d22573f8012e3ed9eceb08a821c2b9de1036c205816cee11bc01c254327ed4e389e5fe1391a78520886b062b1911889b7736bdea881af0
SSDEEP 12288:GyPz5L8liJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:7zyp/TwSfVcYG3K/cJHlnFR+IGNe8j3w
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 9a4571aa7191c9f0706c5b76207407ba1149fb9467d3c94216770c121d6a7f0c
MD5 91bbd6b72141dbf41b5a8c9509381938
SHA1 dc5f152395d2bba009779eb5c4a484413097d235
SHA512 88975871d05f311b303c220178641000de1dfbb5b3a4374c8122f3ede9b2224546858c22f733f55ba19d1fb3f9da33f7453c04b730284ccf4c28115a1edc4121
SSDEEP 24576:nT9aLl3z0zDX/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:nTQLljqLNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 5ba01ecbf5e9092a68ac36408f265e1d6ecf5a7f7c80e47653291371c39a208a
MD5 a17598f84a70f1a43bf0ce6690cf3fa2
SHA1 0ec66f94140402efda4216722a8f747ab9663774
SHA512 c2b0f2c859bfa1dafdfc08abce2ffc691439eadb2c882c7613935b81446121e640a0be28e3291ed3e3fd37e3f1330dad056b1b0ed848af0a506ef91094137d86
SSDEEP 24576:63td9CHKy7GZL/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ctd9CHKyaBLNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 1519b54ede7b9535b302bdda49cc1ebf39b89ba5c6a965854c1a83145337eae5
MD5 7f247dca0c8dd487a457138d478dccf0
SHA1 becaefcd70f9eb11e86836006bad581409f3dfbc
SHA512 10c1a35dd80968d2a2d4def123f6b109fc4c9c07de79e392ac1d5602ac7c80ced47c1ac020674999cab5cf42ee89c0d0cd4003bbf33503a85840083e2bfc3b79
SSDEEP 12288:dziJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:dH/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5 SHA1 SHA512 SSDEEP

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 469326824b0d0e813b08b699b3704e0dbc4f6f18f370b227bdc41b3c9924d5a9
MD5 0748f036095522559885ac4c623318f6
SHA1 fffedbe0ded395dea9eb9ff5deb547f96b5500e6
SHA512 3ff176bced9f22be7a6de16aba65db6069b82e85ab9dfc3a0055920fc18f4324a0cdbc8cd29c27f52595a37a6222a039948468e05acf7e0545941b7c7634e1ed
SSDEEP 12288:hFiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:hJ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5 SHA1 SHA512 SSDEEP

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 2b548b5bce2503a50202bc5369fce3112593eb280fe2eeba9fb737dc5bc63e9c
MD5 a21d2539ee1247832aa116657c60135c
SHA1 5eb288d005ef8f4ffe4f0d084ef0f987fe0ca103
SHA512 187eb856423e6a62c6341efd8a07ef5bb876564422126207a79d58d44f4ce04a3e7db9915a409787f6440cee637281f59d353939923132b838294862d943ab30
SSDEEP 12288:pgiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:py/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5 SHA1 SHA512 SSDEEP

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 cbb1bdf6f7095aba980502df5e432c6954a9e62e92e699eb63700975f530406c
MD5 a07bf8f13d9c1cf42e87ba43e8ecddcf
SHA1 8da8a420f8abc201cda6ddec5c8d5d3ecdd19d5b
SHA512 66c9989371f08b898dfc341e7bc2b9b54244ff95620ede84dec3d90b83b57334ddb1472e95630ca2da765ec8c16b409183dcb83ee1836253beecb25fd65d4268
SSDEEP 12288:dOiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:d4/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5 SHA1 SHA512 SSDEEP

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 218727e77c5ed4315d461ebae8026645df3f373484e447e9c04336885f58d821
MD5 13120b421f97afd91fbc2e967447943f
SHA1 c0db470f37f44322640510dee5f51edef644180a
SHA512 094ea6a5a975308a3b7c62f7e522063bed9cb7bcee92d87008384676c2998bf8bd9ad972598ae2b9fdec2b7b648c835be4eabf2d5eea744a3269314dc94c9fcf
SSDEEP 12288:iziJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:iH/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5 SHA1 SHA512 SSDEEP

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 18ecc68a7694d7ca9291b80625757f62d6f7112fa6f146b025f5c4c7184c1176
MD5 b1cddc9e183db28928b31d8913e30b79
SHA1 e4d01cfa260534f758f004f661bf41a9446bcfb6
SHA512 41cfa2fc6e2856c567a2581230d8542b38ea2191c0dc7735035faaef95f3ce5786feab1db36cfde4f0f5e4b59ee84ddfc507ae9ef9666cf219f578bc3a9b947c
SSDEEP 12288:2WiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:2g/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5 SHA1 SHA512 SSDEEP

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 696KB
SHA256 871e5ebb0f121a441ee06aa129c78c0af83a37e5bfcce3a21b70ecf28311d6bd
MD5 6d9022aabf30ba154263a2da258db445
SHA1 3f99b0f0919e5c7b1c68931b8887daab094ac6a0
SHA512 5cf2903357c67f2da6784e7e1fa871ea3d5e19b556a3e92e0ae242469583bfb385dc8c1662232f88384ce93e7ad134cb829bf784732706d1fe05f18bbeef5abc
SSDEEP 12288:eFwq0S9iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:egSh/TwSfVcYG3K/cJHlnFR+IGNe8j3w
MD5 SHA1 SHA512 SSDEEP

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 052bbea2150320389e50d442de0076972aa027d3cc1b29b0ae63065a0e20e030
MD5 e3051e393f673b09db0855da261b26e5
SHA1 04086382635c73576f83156ecd5fbe3325d8b52f
SHA512 2e1c63dfdb2a077501848c7066bc5f9681fc506e673309c6fa0bbc60988ea4cf961ff0a2791a25c1efb4a37d1caf13e361f2acfc18f98285901c24929ba1db8c
SSDEEP 12288:TdiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:TB/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5 SHA1 SHA512 SSDEEP

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 871385192943ba066c19512b51d678e1db04694f5b6954890b931b82f9984db2
MD5 fdfd61314c96d6fffe70479a2c78bc1b
SHA1 406f3d0999c00bbf58fd7eb653075318117d3d9a
SHA512 07cb673060dd50c460fae66f2143745af633b4fde1171ec46c1272f360dcef6c4847d0e814408a499eb596856ba3f576273e062f8c14f6144c564bde9984c47c
SSDEEP 49152:qa0h2GEkuAe73q3pp46zwwQvLNiXicJFFRGNzj3:qa0hNYG4Jw07wRGpj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 659KB
SHA256 926ef0ff7df19331b13768fe06387e5533cb10bb3d38104687343897ec768d04
MD5 17c13ec4ae649ef0f416278aa3458cd7
SHA1 46e4a0c51927387287a2019f27dab514590f0cd3
SHA512 a8de66ebd306882cad8638bafed93cb88f82560326a6276711ceab3eb8cb230ace16263ebf532ba14410449fcbbd6fd3854d5c65371faba6d5b0eb328af5ef27
SSDEEP 12288:fhbHjfX+iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:fhbHjPI/TwSfVcYG3K/cJHlnFR+IGNef
MD5 SHA1 SHA512 SSDEEP

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 cb0406dc4f1b0249a2e95be7dc7fce1cbe0c2dce524d355e8bf6cb8872c6e615
MD5 3447e6c18595bcc403d4ea9c77f7e10d
SHA1 7ebb7be6df5247dbddb2c50fa129488e0c058c82
SHA512 60704b58a648da7ee02f98aca5714ea49882a7b23ffb9861892734a2fe8d87af3fef90ed5d12ae09d27d19e8491e6e15a328d8e27f63277e1dfd0fe490d507f0
SSDEEP 24576:Y3YgnJcRTk4yti+R5dpR/w/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:YIgnaTk46ppR/wLNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 578KB
SHA256 b73a37f313abbf0de4e1347c4b95c785983a416dc9feda235575cfe63da0be89
MD5 d9d8808185c671e7a45df6ba09e3ef51
SHA1 fe88ee0ed9900c90076db0c57ad8d0fb97710ba6
SHA512 e1741c940ed45eb59554128ddf58b4aad6c8d2fd16e0adb570d17b217eb104d77d3a66808f7b2367fa39f366e024966d4e0dd973064f872ff9387ae2fe753419
SSDEEP 12288:BpiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:B1/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5 SHA1 SHA512 SSDEEP

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 940KB
SHA256 1d2f7191783f5b116feda514e42f563fa50dc4b3251c1e38498c41eb34b5ef51
MD5 bf217142cf726ac8f58026de5b9d318a
SHA1 75fb357454f42bc993f086061dc7a6c444cd57dc
SHA512 ccebe14842b3598dc8374d0be1836e73bd76bda2b49a9a5350e9ed56b7b0de6c5302927547abb31cc86dcbae137d5e3bdb2952afe43b7769fd67ca3df01b814b
SSDEEP 24576:mrL3UTW/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:mrL3U6LNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 671KB
SHA256 d59d6f75f0114bc15c03333c39cf8abd565eb979364e8f8e60a27a0f8373eb69
MD5 4317780731c362f24ac4660dd8347a82
SHA1 c27b7e19263f74b76a74375613e1e5844256c8a4
SHA512 01729f71e9d5493b44ec3e9cbe371cfc134403962a1469c0db41ffa627084525010c319292061e763f959b79f5ba097753211e1b5fbae9ae80e4b24509bf8f95
SSDEEP 12288:spFtYOoiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:3Oa/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5 SHA1 SHA512 SSDEEP

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 dc42bdf6f540d0d3ce3e305931c336ce7352208c43ab38a8b4b6c1c03485dd7b
MD5 756c353d872d34fdd544494fec6c19fe
SHA1 1a7b13f9d093c22723fe0d1514892622da041497
SHA512 6c4b5d35379574c76ab3c0e1da2720a428811953f63cccaab9f5d5f7f2059fbd8dfce4b5f94c6ccaf99e7992512ca6c7e11bb933b6b87311b52e9a922dd54bda
SSDEEP 24576:x7NM9YmZqmWMUkPjZM48Mv6bEhsR/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:x7cBWMpPjN8DbEhoLNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 1e85de984f110314f23fa205b745c718523693414f811f2310365f3d0da0d7cb
MD5 bfe088b7c856941c2e13f014c99e052a
SHA1 0155b090fd840bd68da0e38d8062a869c7722443
SHA512 afe150b5c182ce8bbe454f4eca53c9c7b7dcd30e9b12c6015ba9be11ed803a0acb1dfca2bff5e7f4ff5a7523e0c94f054a755a7c66de82d4d83833c4f4938c90
SSDEEP 49152:HF2YuHNETovcvNYf8kmxLNiXicJFFRGNzj3:e6tCf8ka7wRGpj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 33f43e345d0e40c570f5e78ccf341dd20785491cb882eadb1a7015c108dbc4ca
MD5 ba666be8695d9b57fbf0f40539a1442a
SHA1 059d53f7fa0178794b5a82427fa92aa58e405856
SHA512 afe3eb3367c79caaab076b2cdb260321bd24525794158ad6553840e0740cbe80c66ba6d581ce094a00d983ecca04446c8bb390f9117a3354104fa30b56add160
SSDEEP 24576:kAFs06+OmlfQNXEbTou/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:pFs060lcXuPLNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 885KB
SHA256 df1eb8c436ae1cd083d73dffb35afc724d49b43f09fcf2cae631ac7718a33478
MD5 39e188ccb99739eae48875cbedb45513
SHA1 e821754ec9ebe932fe8c9a8b8c4683f0ac73c012
SHA512 4394510b198e9946cf49ca705b56d1da26fd7517ec4449331fc868eaabe8d55816d9edb1790dea5b531287536c6b418ece55d8b15006c607541e8fea8f926780
SSDEEP 24576:2JnJ5D3WtP/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:2JnJ5DGtPLNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 a30f31bf3974a3553d3c4b8195bf03df1468a2f619315420fac0abee805891c0
MD5 0a61057da44cb5e027559dbd6180540b
SHA1 ca24bf55b3c41072fa92e54f31e0ea0d01daf85a
SHA512 b1d58acd4a16f3999f46651aa7c4cce9cdbd40e0e943b1124b93f5035dfb5c42160aae09c30678021549114786a2d8af3769d2bfac449949812d5a5011a28e03
SSDEEP 49152:Lo06DIKdwc+eQnSt65aVtLNiXicJFFRGNzj3:EL7wRGpj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 661KB
SHA256 b57481d800b00a9c1879c29767865747bf2d90591b53052d88a68d25c1c4befa
MD5 10c5a9e8b71e9c62b3177f0723246200
SHA1 90e09a6c3dc5583092ddea0e33c30058a7859f49
SHA512 ac18b1bb423f4bd6b3dbd048b85b484bbcb114d20b08c14a1762c44f90adb67d3e426f9424c4fba31db7a371ccce9dd4ac00f06dc8349ed7330cdad7178a9685
SSDEEP 12288:sEP3RrriJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:nr//TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5 SHA1 SHA512 SSDEEP

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 712KB
SHA256 68a55e556f463df7b766b3b60677eb5aff78807ca8b469df2af84ae15b0e8dbc
MD5 297f5f8a1fd5fd07a8dd4b5b39174eb4
SHA1 9d3bcc2263da861bd53666dd9ec4b5ff657156bd
SHA512 f290a1864746eaef8ab7c81ac0e93f46627378c1c8d6d3641df401838b1b4d433d83128053306b58927067e8bd7aa999caf3a2b24c819b0a80088a0f1a1c5bdb
SSDEEP 12288:ojkyOiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:oIy4/TwSfVcYG3K/cJHlnFR+IGNe8j3w
MD5 SHA1 SHA512 SSDEEP

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 584KB
SHA256 415afe53f4c21022979a1a92b769a5278825c98ea1e7e51155bcabfa468d7d68
MD5 9c7bc4d9bd16808af9839222205fa232
SHA1 e4465f98781e3f44cf0cf78ef89bdae2c0745c9c
SHA512 828c8161359a10c1d7b3b0c69e4883fd1b3e547b9ca070a6c12ca03653da36d7d24bcd55368726d22c066c653bc8d52add4c111e69e0192cf097829222bf35a1
SSDEEP 12288:EF4iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:CK/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5 SHA1 SHA512 SSDEEP

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 c956907215144171497a4027394856eb0a8365647b2b829ac1a5c226a9d9afa3
MD5 8c6876dba0f4a22e95153822d3446f4e
SHA1 30dfdc66a6c13bfa6279bcfa02149e0e72781c87
SHA512 9ecfd5734bfa0b385c6fd292781b3a7cf4c3198b1c22f71b00a50ae5388c34a1a2f370d4e30368ecaa9869047f69d0f93f1c5b2b22a19c2809471ee9ca95e731
SSDEEP 24576:lQ9MxZKdcz97w3p/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:lVKXpLNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 772KB
SHA256 651bdc75b4b1e7bc8f57f6449c999a1ee11259c38af47d4de3cac4da0e93e1a0
MD5 e2f51cd67f6762b9509b241ff5d9430e
SHA1 701535d236c87812ef8d9aa8da282a7b263f5cc3
SHA512 19724fdd3bc9a0f0b1c2669a92efdc055c815c01434430aa5102c55a2beac3e9fef1663c5e0e0d0f123080296f9994c3a6ee1b5340f6e59b9ac26b0e6567dfd6
SSDEEP 24576:FyocxAps/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:YocxApsLNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 65e199a6781b7fbfce3e575e2a7fe4badb45ae73e9f34060eb38488d1107772f
MD5 e181c8d46b7def9b51e7c9b5f597830e
SHA1 da7f2513c7538e98bdeb6346c8533cb64f6245a1
SHA512 adbab7316cfe1b519a91bc706f135274108d00a60e3d57943c9c31e3a0de59ab3ac48f78bd94e075f427174d5b6cdc6f3ca54480bb94f4d87e3629346b467c85
SSDEEP 49152:lWcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIKsLNiXicJFFRGNzj3:V0zuNIg7wRGpj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

office2016setup.exe

Path C:\odt\office2016setup.exe
Size 5.6MB
SHA256 dcdc622b8c08e3c2b07811e7ac6f6286846d581e94de97c4fe74b50ff799eb59
MD5 f880b71711d3dc64671e2295beea8786
SHA1 cb14fa47ac33a8cbcd98bf34f5eff72942d26027
SHA512 52b79d2df8f6dd666812482961241b40670aab645590655982bbd53a453d7394decc7f28682b1150c471cd7d75fead8e1ea51b038d831afa51c716f090b0d11e
SSDEEP 98304:C7M701RgX4iuSl1DtlEq81xZPGnzURnBh6gG4/QmvD/cTwY2h3Fl7wRGpj3:sM7pTXexZPGzURnBh6gG4F+W3DF9
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/316-301-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/316-365-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/544-11-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/544-12-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/544-229-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/544-22-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/544-23-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/1268-340-0x0000000000610000-0x0000000000670000-memory.dmp

Download

memory/1268-330-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/1268-399-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/1308-245-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/1308-252-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/1308-313-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/1372-372-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/1372-379-0x0000000000630000-0x0000000000690000-memory.dmp

Download

memory/1372-439-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/1780-1-0x0000000002390000-0x00000000023F6000-memory.dmp

Download

memory/1780-6-0x0000000002390000-0x00000000023F6000-memory.dmp

Download

memory/1780-7-0x0000000002390000-0x00000000023F6000-memory.dmp

Download

memory/1780-18-0x0000000000400000-0x00000000004B5000-memory.dmp

Download

memory/1780-0-0x0000000000400000-0x00000000004B5000-memory.dmp

Download

memory/1788-427-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/1788-435-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/1896-287-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/1896-351-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/1896-295-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/2168-237-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/2168-39-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/2168-46-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/2168-40-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/3220-73-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3220-66-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3220-74-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3220-68-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/3220-240-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/3580-275-0x0000000000930000-0x0000000000990000-memory.dmp

Download

memory/3580-272-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/3580-256-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/3580-264-0x0000000000930000-0x0000000000990000-memory.dmp

Download

memory/3580-257-0x0000000000930000-0x0000000000990000-memory.dmp

Download

memory/3688-454-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/3688-462-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/4008-318-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4008-326-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/4008-383-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4020-343-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4020-413-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4020-353-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4108-236-0x0000000140000000-0x0000000140237000-memory.dmp

Download

memory/4108-28-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/4108-29-0x0000000140000000-0x0000000140237000-memory.dmp

Download

memory/4108-35-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/4208-61-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4208-65-0x0000000140000000-0x00000001400CA000-memory.dmp

Download

memory/4208-51-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4208-50-0x0000000140000000-0x00000001400CA000-memory.dmp

Download

memory/4208-58-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4436-403-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/4436-400-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4436-393-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/4436-386-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4452-370-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/4452-314-0x0000000000630000-0x0000000000690000-memory.dmp

Download

memory/4452-304-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/4520-414-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/4520-423-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/4536-442-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/4536-448-0x0000000000580000-0x00000000005E0000-memory.dmp

Download

memory/4612-282-0x0000000000610000-0x0000000000670000-memory.dmp

Download

memory/4612-271-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/4612-339-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/4740-546-0x00000138CB3A0000-0x00000138CB3B0000-memory.dmp

Download

memory/4852-409-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4852-402-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4852-545-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/5092-426-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/5092-367-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/5092-357-0x0000000140000000-0x0000000140102000-memory.dmp

Download