a5f27bebfaad7527c097d6f560c6fad42001f6734a10ec62f94a9f9f491f5ac1

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
20/05/2024, 19:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-05-20_76e4b1bdf3e3e0a2b5455f8100d20a24_avoslocker.exe
Size 1.3MB
Sample240520-xwnfcsdc74
SHA256 a5f27bebfaad7527c097d6f560c6fad42001f6734a10ec62f94a9f9f491f5ac1
MD5 76e4b1bdf3e3e0a2b5455f8100d20a24
SHA1 5bf18ffa3a67f1dd95176e48f99e3a678af11118
SHA512 fdeecbd2d8a6988992085c519e05d53cf6a8293de9859e07c742727020bce222f5e0cf3b5c28fab6c239f50502be1bb17fd8a6089f8a58ba3e508c7fac502e4b
SSDEEP 24576:u2zEYytjjqNSlhvpfQiIhKPtehfQ7r9qySkbgedT2JOt934J7Z6bQaj1BvUm9J:uPtjtQiIhUyQd1SkFdCJE3jM2ce
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
4500	alg.exe
2616	elevation_service.exe
4024	elevation_service.exe
4404	maintenanceservice.exe
2356	OSE.EXE
3120	DiagnosticsHub.StandardCollector.Service.exe
1896	fxssvc.exe
440	msdtc.exe
2524	PerceptionSimulationService.exe
3964	perfhost.exe
4220	locator.exe
1572	SensorDataService.exe
1952	snmptrap.exe
1236	spectrum.exe
1068	ssh-agent.exe
3396	TieringEngineService.exe
4708	AgentService.exe
3756	vds.exe
2204	vssvc.exe
2848	wbengine.exe
3664	WmiApSrv.exe
4760	SearchIndexer.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in System32 directory 24 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2024-05-20_76e4b1bdf3e3e0a2b5455f8100d20a24_avoslocker.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\ca6a64e492be0f3e.bin	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\caps\hdpim.db	2024-05-20_76e4b1bdf3e3e0a2b5455f8100d20a24_avoslocker.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateSetup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_91015\java.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	alg.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006610aed8e9aada01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000032faf7d8e9aada01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c8a646d9e9aada01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a0f716d9e9aada01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000084fd9ad8e9aada01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000f0fcdd8e9aada01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
2616	elevation_service.exe
2616	elevation_service.exe
2616	elevation_service.exe
2616	elevation_service.exe
2616	elevation_service.exe
2616	elevation_service.exe
2616	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
664	Process not Found
664	Process not Found

Suspicious use of AdjustPrivilegeToken 42 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4252	2024-05-20_76e4b1bdf3e3e0a2b5455f8100d20a24_avoslocker.exe
Token: SeDebugPrivilege	4500	alg.exe
Token: SeDebugPrivilege	4500	alg.exe
Token: SeDebugPrivilege	4500	alg.exe
Token: SeTakeOwnershipPrivilege	2616	elevation_service.exe
Token: SeAuditPrivilege	1896	fxssvc.exe
Token: SeRestorePrivilege	3396	TieringEngineService.exe
Token: SeManageVolumePrivilege	3396	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	4708	AgentService.exe
Token: SeBackupPrivilege	2204	vssvc.exe
Token: SeRestorePrivilege	2204	vssvc.exe
Token: SeAuditPrivilege	2204	vssvc.exe
Token: SeBackupPrivilege	2848	wbengine.exe
Token: SeRestorePrivilege	2848	wbengine.exe
Token: SeSecurityPrivilege	2848	wbengine.exe
Token: 33	4760	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4760	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4760	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4760	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4760	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4760	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4760	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4760	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4760	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4760	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4760	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4760	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4760	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4760	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4760	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4760	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4760	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4760	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4760	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4760	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4760	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4760	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4760	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4760	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4760	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4760	SearchIndexer.exe
Token: SeDebugPrivilege	2616	elevation_service.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4760 wrote to memory of 3468	4760	SearchIndexer.exe	124
PID 4760 wrote to memory of 3468	4760	SearchIndexer.exe	124
PID 4760 wrote to memory of 2004	4760	SearchIndexer.exe	125
PID 4760 wrote to memory of 2004	4760	SearchIndexer.exe	125

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2024-05-20_76e4b1bdf3e3e0a2b5455f8100d20a24_avoslocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-20_76e4b1bdf3e3e0a2b5455f8100d20a24_avoslocker.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:4252

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:4500

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2616

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4024

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4404

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2356

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:3120

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:976

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1896

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:440

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2524

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:3964

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4220

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1572

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:1952

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1236

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1068

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:3584

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3396

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4708

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:3756

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2204

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2848

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:3664

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4760
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3468
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 916 920 928 8192 924 900
  2⤵
  - Modifies data under HKEY_USERS
  PID:2004

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
Size 2.1MB
SHA256 eb9dee083ad2f11b776d92070ad30a0b3080fa72886695159f664cf34ba46900
MD5 d58d5340c1ef7195acf019ac1bc4bb5f
SHA1 c9e2fddb414c218d4d6da85b94bb0d6598ca99b7
SHA512 f3c8999d8247368e1bb44656200cb9d76efdb29693bd92682c57eec8043d047673a4882a75ee998ec2a121cb5aeef13e553d1d89edd488cc0ddb184797d8d8bc
SSDEEP 49152:quYk3H5koUXfTqkkYLO/W2buywzMbOX+T7z53JE3jM2ce:qPfTqi90b9E3Xc
MD5 SHA1 SHA512 SSDEEP

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 797KB
SHA256 2ed48055fe6b82045d160fcd5febd8a8db054f02c95caeead040e92da9046612
MD5 680fe1c3c1e6439d1d923bade1c52149
SHA1 294a80f48862aa5e7abd08b1c1eb5a7cb7ff475e
SHA512 c1943fa4101494c9eaf707e7e373cc3ff5608b0dca6824c4c8125ee65a8dd1b434471a6f9f47be7adfc13ad8777783793db12fd98f15a975ae68589c8ddf7c2d
SSDEEP 12288:KcQiQmNJLBsunEWoH/uLJOyo937vGFWxwFJI+yeuVb8r+ZP712Ii+51cjVWtVj5J:UidnBsuEd2JOt934J7Z6bQaj1BvUm9J
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 f44a7d76d6902c0eea3d352ad9bcecabf7203f6e8515b031e183142e1ad91f31
MD5 b5c2baf2f2511acff913ec357c0df20f
SHA1 8234b36a3cadea16631dd288cd23c3daa34fc00b
SHA512 5f3ab2bc15a8e7c324b28f47dda1e2b9ef47602fec519685f0b57c466f7b0169a0717c69dc16634b8f19f4a9bab0c93c8af7a5b964738746a965bdb399c4192c
SSDEEP 24576:d+gkEVfh4Co52JOt934J7Z6bQaj1BvUm9J:EgkExSyJE3jM2ce
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 02ca7a99a66274cc536308efa70a56ecae41dd8e0bcb3b255743eef97f73b099
MD5 1b4e2db4158478552ae329553ef23979
SHA1 3ec6620e7da84fafd3466a236a6532b14b05096e
SHA512 92468a33404022274f163ae82e06dab833b56411462587e7b2bca39c6b28cff2f5b4a3dc5968bcd991afeeb25088c5b12868ae6202193eccd1b85eb423e6d10c
SSDEEP 24576:GBpDRmi78gkPXlyo0Gxjr42JOt934J7Z6bQaj1BvUm9J:iNRmi78gkPX4o0GxjXJE3jM2ce
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 1d01868cb8366f28507873ca8056b754b33d7701845a75e6c514bcb6f9ac881a
MD5 0933419bdeec1f5ef08a2082569de912
SHA1 78965732085173dc82f1b004a846bd00e39b8c3a
SHA512 31e6b9cca1f10c0e28e4cabf846fe09af884d6833c093eb80fac4e639bbd56ee0b7037b64979e7d747c72e8b073e9b13b2eeb534839fb851c7fdd6f9dc41034e
SSDEEP 24576:WLOS2oyPIXV52JOt934J7Z6bQaj1BvUm9J:G/y/JE3jM2ce
MD5 SHA1 SHA512 SSDEEP

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 663ee19926ee4fbb8be8d3daea62d78fed0871670fe1a9d177ffbd470cc5e03a
MD5 a529912e3df31d62b27ecaba0c6d419a
SHA1 2098ea48fe8895e006df3f97d0f0f9949ac7b24c
SHA512 7ab59099d20ec3ebb67f9fcbf04d82b6878e0bc18a9722895a39ed160ab504b7402833091888a573a8c08cdaf7a456a5e30bcaf787d360a0b750e5d0d4549e09
SSDEEP 12288:RfwoH/uLJOyo937vGFWxwFJI+yeuVb8r+ZP712Ii+51cjVWtVj5J:Rfj2JOt934J7Z6bQaj1BvUm9J
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 925a9c1671304cc5297109f6ebe4702e344bbd7f1ef391eba0dbb37c50f67c92
MD5 e5ef92a73e2fc6f7aa7161958f744920
SHA1 37e8575f4417c1738a80b47d47c4a18b839a830c
SHA512 63b44a6dd84113ae0b3778b1ca3181387f25f87799f3d70954eda8e3ede51d626bbbfe8375af1fde231f47073a1573e4f1c156f8e110aaff3934b006e1e07ab7
SSDEEP 12288:NeBNUbTVO86UxoH/uLJOyo937vGFWxwFJI+yeuVb8r+ZP712Ii+51cjVWtVj5J:NJIUq2JOt934J7Z6bQaj1BvUm9J
MD5 SHA1 SHA512 SSDEEP

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 aebbc0afc742b3e87edeb810ced604123b2d522ac141171b66aeef27bd208b89
MD5 b81f2230649541900747301e8287caf2
SHA1 6feb3d63fbd3f6d7318d56264ef43c833e0703e7
SHA512 8c11f6e4f5d15217a25aa225fd64e4a92d434c278499822b2dbf8763bf70eed2150b64fcda3959401d5e1b424aa535fc21be60fc2859815236bad908cd5c2f78
SSDEEP 49152:EQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THI:EQvGAdlCEL8c/yRNw5CsE3Xc
MD5 SHA1 SHA512 SSDEEP

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 eb451117f0b8e781130da28dd9328d72d1a19e2ed1704c0402bd2bc013027927
MD5 58ee64f8f22c3a7a76163c3b967a7b00
SHA1 b2bbeed7509c08f8a332db359bdfccdd9954ab1c
SHA512 e9843d38f7e5ab677c5854eed1eb343f7055dee54ec2d9a5af921ea1c42a6099a279f09c94c6bdff16217deac8358573a649c7408f5939ed012c7298a73f1f06
SSDEEP 12288:bAwSfxL/2Dc34DLLmt0LDQewsAjboH/uLJOyo937vGFWxwFJI+yeuVb8r+ZP712C:EdewsAjg2JOt934J7Z6bQaj1BvUm9J
MD5 SHA1 SHA512 SSDEEP

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 6a5b55b21b8c91182f3235e41502bb665af6994ef09ee3dd5fc7e43d20726e52
MD5 0f7fa814fd2ae18f75e718ba9d058f85
SHA1 b4ae93894ef1a7c1da9790047da7e1a71575d968
SHA512 7ff147f11d234884a4cb10510080c8357332c0d048f2037f7d42f05c866262f14fecf76466a84d43b8969422c1279e525bd1bc9694901d940ce67c6c41c84e5e
SSDEEP 196608:jUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHs:jUEtQevvqc2W1cpV2EI32
MD5 SHA1 SHA512 SSDEEP

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 031ba12a9cf66e6d7f1dd54253626c917bfc16ff7314f2c2adcd3488cfc56bb7
MD5 d6744d2a931a8a286721b954a0c8be8a
SHA1 42ae514ca8b14c004d737eace0eef3cba4094b19
SHA512 94ee54e0c8796fe0f7f1f46440d9a6b9b80756c78d842a52d4e8068cdae77a32bbe054e2c30fab087b8699bb5daa3b128eae3eed31a0cc4a999e2d8c51617e85
SSDEEP 49152:iCbRquA/m2yL5zTfFiV+XenmE3/zrJE3jM2ce:noquVjnmgE3Xc
MD5 SHA1 SHA512 SSDEEP

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 8594174cb6e7fef98ca83487cf1ab93bcd4fe113e611b28aeef878e379554063
MD5 7d80390b738cd69324210e270a43d096
SHA1 89fae5b1679542d4c4546766030018dd034e60d9
SHA512 9486b98d0682f37cfaa7a80c4e79b07e4d61a841d56af0312661e8c45f0d77174b2ad1bcd715039598a44d03b32186dc25c15de3c29ba74ad2f2f373677498ad
SSDEEP 24576:xAhGLJIFoiwtA5l7S53p2JOt934J7Z6bQaj1BvUm9J:xAMyFoiq5UJE3jM2ce
MD5 SHA1 SHA512 SSDEEP

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 4657f26fe9bcc1600cf1b9938abb517f54788088d33528abac9680d57751efe5
MD5 162170f62bad93f118491ce7f3287a07
SHA1 70f6e17b8235e31c26ffefc0a92078cec49ff0ae
SHA512 9fb7c4d7bf7e1824b0afb2740193da627ce3d2a41a4d4dae4adfe2269786450cf4836301a8d81c76d7373a0ecf4b2263540c100647d0a4e9e5cb3e00c7c1199a
SSDEEP 12288:6mw5HEjsChNVBFgl0WDm+CeoH/uLJOyo937vGFWxwFJI+yeuVb8r+ZP712Ii+511:TwuoOWE2JOt934J7Z6bQaj1BvUm9J
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 f6c1e712da08cb95c1923e074b25426e231f0e6c14d13078c537b04ce5f42174
MD5 967bd4bea5f9ca73fff6a5b59e95dc9e
SHA1 1aa617c2d910c640e19162cfad3cb273e91b7058
SHA512 2fca930648d36f3156ea92e8b5c520fa631295fa3cee7f4ff90e389d8cdd38f62835bb5b840a5b20664aa473f7bdd3ae0bea44ac421c7aa85e85891ecfae55c6
SSDEEP 12288:WBZ1IyLoH/uLJOyo937vGFWxwFJI+yeuVb8r+ZP712Ii+51cjVWtVj5J:gZuP2JOt934J7Z6bQaj1BvUm9J
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
Size 5.4MB
SHA256 50a3e018e65e419f64895e316eecd5f715abddc319ff849f6c38d55c7afd2d13
MD5 29db4492e5227aa8986d6714f2c97941
SHA1 ea597be09b8d136796d6a811c674a2ec5c48265a
SHA512 80b9e2e803498a7ba81f7a7b84304d78b7ae32f3619e42f77f2c11dcfad9c5d5eeae3480dc1e6311ec24bb264be712fb420eaf48d747aa08a631c700f78fed32
SSDEEP 49152:B0kwIi7c4xZlm5knEtw99Kn/2vim7vgv6m+yyJ/0gbvjR7yY7BHi3u7L/gBUUWLY:xwfhY7g/rLd7yYA3awr341goE3Xc
MD5 SHA1 SHA512 SSDEEP

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe
Size 5.4MB
SHA256 28d6ff4bca8f8f3b49bd47e009eb6cc422dd6d43ea2998c6077ec2feba70a951
MD5 8f7ee711480ebde6c4f8a758ea9fac60
SHA1 eda87160444dfe8751b8ddde409734cdc17a48ca
SHA512 d8171ef7ed7d1456be07c05c6c4c5bad5450143303de25ff5765c3b8123f657ace94eae67f4773a95700f858fcbb3686df9feabac01f1f1b1b15b5c3a80e1359
SSDEEP 49152:g0kwIi7c4xZlm5knEtw99Kn/2vim7vgv6m+yyJ/0gbvjR7yY7BHi3u7L/gBUUWLY:GwfhY7g/rLd7yYA3awr341goE3Xc
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe
Size 2.0MB
SHA256 b328bd9626e9e55bc5f15fdee29a70ef33cd23981a08064ca953b9ef17f00657
MD5 311b99e2b15a0d5fbeddfdb19fb1d0e4
SHA1 caba117c942f81ba9cb8ba665ae0dee6a2893f20
SHA512 f24158e1a35e3a9e9afe271939d1007577a67be695f935cb0b1e6938941e7bf934500c53c9f285b130110160e3c88a4fc6d5e873ee75ab9853dbe587a9a9383b
SSDEEP 24576:rcTyYv0FteQU+5I2kjgD6iQacAE2JOt934J7Z6bQaj1BvUm9J:ruXv0Ftpn5606zO/JE3jM2ce
MD5 SHA1 SHA512 SSDEEP

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
Size 2.2MB
SHA256 d53da0aa409c07da589f22238124aaba459eff122dcb1b9d593858ae2a24d506
MD5 0d2e9a4b6bf74164074b848adc25d935
SHA1 db5ce10d5c47d88e6097c91f3ee6dc53134fcef1
SHA512 9e35656bc9926344906d6ed7fa3ac7fcf1ec34edf4b1e583382dbf4c185da9c92969c42629bf12980d73c931aca5005311a3a8d4eda62f7ffc763c1c43470cd0
SSDEEP 49152:0y7mTd0GxN8jyynxHjXKUyn4GVcbDSKrNTxLJE3jM2ce:DmYeyxHjWjMT9E3Xc
MD5 SHA1 SHA512 SSDEEP

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe
Size 1.8MB
SHA256 761e4e96bbacee1947b2e595cb7450b123cb991d35a5dabf084d2feeefaa3c34
MD5 694b95c16ef8073d15c354af9a41a0d0
SHA1 f3c0449a96aabac6c7d71b11883e8c2f70a8855e
SHA512 eedba249f0c5d066ceae8078f8ee5d951d102abfd19caea935f3418a9277e2e23be1a4b910666f68019054bd2020ef3cbe4162e6558f2c623b10f91292105f82
SSDEEP 24576:g6drZn1WEci182IEUeNbJeRgUebgW816X2JOt934J7Z6bQaj1BvUm9J:gWnDci18yNNUgbY3JE3jM2ce
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 1.7MB
SHA256 ef8ee9092c6aae62c2599c3ece675619975c198b3e707564166dd8431492ec74
MD5 5fa496f2f4afd5165e50ed25303de43b
SHA1 c3203fc31ae801a27fd81f904b7583b59aa59d52
SHA512 db6444a500c5c29bd40ead711727380714f7c5d559dd86e709c9c8cf141735cb241619e63482afbcee0e8ad89023358c1bab08c73c9ba3c859c83fc1fd689ed2
SSDEEP 24576:kk5lHW5EzMZupO80G2reD+melRgTTv/1ny22JOt934J7Z6bQaj1BvUm9J:6izMZm0GhamSo+JE3jM2ce
MD5 SHA1 SHA512 SSDEEP

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 becd46f3b75622bd75ec66950f5b2dfe6620c3f5ab3e14e48f2e6b3da55a1ec1
MD5 9631e9c5fbe4f436ec71efa2c0a7c69f
SHA1 337fc4e6c0d4921ff3bb714a6f4c8b178affb5d3
SHA512 ec8b1d022751e301b21b68642f982a9dcb4fc6500387c771b96c9474aab8f0cc3a8d715295ac7309c8f3425e05890a6c3729d364b8e89dcb9057b34e19676849
SSDEEP 12288:2YoH/uLJOyo937vGFWxwFJI+yeuVb8r+ZP712Ii+51cjVWtVj5J:272JOt934J7Z6bQaj1BvUm9J
MD5 SHA1 SHA512 SSDEEP

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 1023f99fac2d2846ffcf5c657b0e13ffa86c618ec0027cd17ece77a2e43746fe
MD5 421742f6b654aa1f1cbca04aef2cac41
SHA1 9809b137005008f61cc8d58b98bffb19116e946c
SHA512 5c9be46ade6042b635bfd1c5020d5b10b6aef4b0a55c5cdcf7de47413d903d002c4167011af6798c5b7936d8b16364c0e0a0664d1a4b7572234708af43fd74ef
SSDEEP 12288:RfoH/uLJOyo937vGFWxwFJI+yeuVb8r+ZP712Ii+51cjVWtVj5J:RM2JOt934J7Z6bQaj1BvUm9J
MD5 SHA1 SHA512 SSDEEP

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 acd6f04658598ba5213ad3e383d38e28f254f90cfeb3a57d40053885982694bd
MD5 44f00f1655ba5fff1ef64d19d85c108b
SHA1 7c6c1f8458af5cb0101360ce26e8b272dda0bb58
SHA512 8c2f3847803bb66653f8e5dcb642fb5e77ada7469f35168a41f540c3831f6567c76cc4f28fc448be0041b60872d6e114f8416b9bf08d8c6e2c3ccf8649c4e822
SSDEEP 12288:X5oH/uLJOyo937vGFWxwFJI+yeuVb8r+ZP712Ii+51cjVWtVj5J:Xi2JOt934J7Z6bQaj1BvUm9J
MD5 SHA1 SHA512 SSDEEP

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 80cdf0ef20eadb69f4cd07af9307f5639ff65a4c296b6c12b405e105b7987e1d
MD5 775baa694371549c8f149d71f8bab2d4
SHA1 7a2fdf8c803eecc97956c577622d913e897a717d
SHA512 ed343dc24ac68c4eac86585b16f0ac2e737ed86959e6d757c2f024b1c16985a811fd98739d32310c61a119c22087e90f1902ee3bdf9f43f7636f7edd5bddb1e7
SSDEEP 12288:6VKoH/uLJOyo937vGFWxwFJI+yeuVb8r+ZP712Ii+51cjVWtVj5J:M2JOt934J7Z6bQaj1BvUm9J
MD5 SHA1 SHA512 SSDEEP

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 0bc50c6831705a63b0f6d0735bdf8e4b59701c05e27a55a22dc1caad7f9e8790
MD5 e2b41affde4d213581e1b70536740e38
SHA1 30125d40762bcd924fb54dd491101a34e19572e8
SHA512 54c77c6f6b6a387bd6fcaa52ee11321d6a57300867c5324f25b1723bf74455443617c740a9ae71dc551552e47c634a55ace3ec75d47a014ffd356c87a3cc39c1
SSDEEP 12288:QCoH/uLJOyo937vGFWxwFJI+yeuVb8r+ZP712Ii+51cjVWtVj5J:Qx2JOt934J7Z6bQaj1BvUm9J
MD5 SHA1 SHA512 SSDEEP

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 e1cb7a9936657299f78ed9f9268aeda8c607b866c4f291b8149e0333861e1e7c
MD5 1e6e86386871e1ea9549217d0aeb8f45
SHA1 c19b277eecc0f1c636fcc3dd9fad074c2b0f42be
SHA512 d898e0ba1de00900bcc28f92725f63733d34aff9ce934eb700d5d3485b0b055e0d8b89a2c09fab968cc37f3c5646752b122953af0747582fdf35a18a410b5f93
SSDEEP 12288:DDoH/uLJOyo937vGFWxwFJI+yeuVb8r+ZP712Ii+51cjVWtVj5J:D42JOt934J7Z6bQaj1BvUm9J
MD5 SHA1 SHA512 SSDEEP

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 b8bdd0e8ce0152ee49e35383cb92fb65985709c56c93d0fcc4481ee989b48ba0
MD5 906a828215e2eed3a332c06521454ea8
SHA1 c5f452605e0278aa3630c30df5ee7f76bf86f48e
SHA512 fa3922c1a5c08cfdf1cb3a0baede381f3a0b7a0b3c8fcd1985122dd8445f4697e76c92e32f0409260963fe8c5ac381648a126a8dde7917eb1ae136e3cdade963
SSDEEP 12288:s3oH/uLJOyo937vGFWxwFJI+yeuVb8r+ZP712Ii+51cjVWtVj5J:s02JOt934J7Z6bQaj1BvUm9J
MD5 SHA1 SHA512 SSDEEP

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 485de3660e8abff4bad2f908933b1f5d39f77d10392a40e1d6d1e24b77ae1185
MD5 bf6d8ee85347bacd5764e46d9f497e51
SHA1 72618228b14ad0218d3495e12461b611223f0434
SHA512 63e70f98bfd88c4c7e0f03ab95c7c6057c3bbae68a0b30397990783c5c49652d09b788cf66eb8549fcf09fef073e164c23c3a2ec623189ebe8a2cd9a1c88b123
SSDEEP 24576:bZMSzFVSOs2JOt934J7Z6bQaj1BvUm9J:bZMSzfzJE3jM2ce
MD5 SHA1 SHA512 SSDEEP

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 ee69366710a7e942c4aae9e468ef4ffe2ef56605552a432cc0b9329d9d0262fc
MD5 60721c1bf822bf74f88657f39c513718
SHA1 9a82b83229a8ba508bb7385f051f857841ca8f05
SHA512 2e5b07d1151ea794f5c6b0d3fbf4699f0662f763fdd8b792bad43055c11f200f992a62dd2db4f86edc51048c156651e641c1f471c4c5c48158f98dd0d300502b
SSDEEP 12288:G0oH/uLJOyo937vGFWxwFJI+yeuVb8r+ZP712Ii+51cjVWtVj5J:Gf2JOt934J7Z6bQaj1BvUm9J
MD5 SHA1 SHA512 SSDEEP

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 3b1d01907d19075d8e37037d3cfe7ef3f368c7cced93cbac6c530ea06f63a3ae
MD5 d9d799775cba4e825dea5499a0e4e6c1
SHA1 6da370a2e817e37fd81faab4e7ab986c628a83d3
SHA512 97130d6dfb50d9a567c4cfcb13249fb056cabd1d18136845ac1467081a5d45464d4804b33aafdd6e0dc326ccacef916dd3dd46dd798a923f13383c885e90fe73
SSDEEP 12288:LgoH/uLJOyo937vGFWxwFJI+yeuVb8r+ZP712Ii+51cjVWtVj5J:Lz2JOt934J7Z6bQaj1BvUm9J
MD5 SHA1 SHA512 SSDEEP

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 d272fe42dcb50192ffdfc771755a61bd4056cadbb59f79336e2251d13677bcd7
MD5 9fd452811255fcb2c7cacf46bd955f3c
SHA1 e2e28d592016fd058a8cbe2a6838a4fd3ed19b44
SHA512 3402fbf81d7ba70e829fac8e6dcff13b62471203e4daa3c9067aa78859ad0b091812009985bfc8bd369fa70330db217c910b65340d631c1eb7b1ac1ea9c2ece6
SSDEEP 12288:eyPz5L8LoH/uLJOyo937vGFWxwFJI+yeuVb8r+ZP712Ii+51cjVWtVj5J:Dzyw2JOt934J7Z6bQaj1BvUm9J
MD5 SHA1 SHA512 SSDEEP

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 a20b4fc8bb9261fdb564a8325e625c6d42351f34df6e6d5a46cc1ed79388bb8f
MD5 14b5a9c570bde1ad8a72113275f899a4
SHA1 a5ae932c71e72446e4698d65730d5b0b1828ca1e
SHA512 6a70db0649316c51c202e0b3f84eaa453fb8b0683cb8b7a1886e031a701965c8c1091c263bad0fe43386b8d22a0964bb77ce3a1e3cfaf44afc61125df720678d
SSDEEP 12288:C0oH/uLJOyo937vGFWxwFJI+yeuVb8r+ZP712Ii+51cjVWtVj5J:Cf2JOt934J7Z6bQaj1BvUm9J
MD5 SHA1 SHA512 SSDEEP

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 ec27a95e4b2cb12251d9dea79f8d66f1610002163980bea28da1f8202816efe6
MD5 9e9486195d9984bc6d9496d7b1fc3e5e
SHA1 6fbe51159a54088b34c3d163949ff9b9f802ae5c
SHA512 575abd5a81232915c03a23e35f0f09dc4b618da92de57ec55e37242045a35a3a266d8a27ab4868deeeaacc603be3b5d7fa8e60c846c5ee0f8f1b5696f711a7e3
SSDEEP 12288:p0oH/uLJOyo937vGFWxwFJI+yeuVb8r+ZP712Ii+51cjVWtVj5J:pf2JOt934J7Z6bQaj1BvUm9J
MD5 SHA1 SHA512 SSDEEP

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 1af954127de71feb8477c858060b0bc92c55552defa96f06abac204b3c6b8900
MD5 bbfc5abb876099282dfa09ce878d3ad9
SHA1 bd885002b988ad059265ab6e1ccef51ee907bbf2
SHA512 80aea1d4608bb1faa969ca7b4d80599d4f462df11f8c140d4a7f1b358a3324fb492ff81130f9d0915ee4e3ac3196c3a43daeb986d3f44e021d7a1cedb79ccc52
SSDEEP 12288:/yPz5L8LoH/uLJOyo937vGFWxwFJI+yeuVb8r+ZP712Ii+51cjVWtVj5J:yzyw2JOt934J7Z6bQaj1BvUm9J
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 2a63862e30bc403a0e2ab6f51d7f130fa049603bd443691a6c9f0c2fa0d8ec2b
MD5 b00af2f3afb785d4e7b1f60c35154f8f
SHA1 b6e38b0d04b82a447c79881825ceaf65366270be
SHA512 a56da23714a7e7b602602a94121ba64e40c7e5eefaa9699812d63575d970933cb3960f395acc07c3d37af8aa0eeb24bbb6444e8586de07fe2283d2f8d3404a6a
SSDEEP 24576:uTHaLl3z0zDS2JOt934J7Z6bQaj1BvUm9J:uT6LljgJE3jM2ce
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 b5b2b0fee95fb4b8b4494c12d0d1cd9953492d66d78a1912983992a2c324492e
MD5 c1dbee5c56289f63d2f3c469492640d9
SHA1 9534cc3b42864c92687388e2a74a774d79ef7e18
SHA512 79688581207af6d9a1cf4239ec840fd689ec0b69a4d977c95a8ea455c279a22eb136194107862fe6122b4e432baf4bf52cda314e8870a8ef348f2a6a5aa483e5
SSDEEP 24576:837d9CHKy7GZ+2JOt934J7Z6bQaj1BvUm9J:m7d9CHKyazJE3jM2ce
MD5 SHA1 SHA512 SSDEEP

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 a017695bc1dae9fbc91b9f105700bb80aa98946985a5e821b3a711142964ea5b
MD5 afd40bca4c7ef4e09257bee93c624c69
SHA1 80db39cb8d9ad5ca64ebcbeb383962f6cdad37e5
SHA512 d7787f547d478bb88c4b3ddbfc5cd1e154bd0fd5cfa7195b822c285a758a3f169c011b4a32d7bc975d0b8133529ce3cf2f2e4f5b188992947795e3c79ccac7df
SSDEEP 12288:uZoH/uLJOyo937vGFWxwFJI+yeuVb8r+ZP712Ii+51cjVWtVj5J:uC2JOt934J7Z6bQaj1BvUm9J
MD5 SHA1 SHA512 SSDEEP

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 b7e9a4017019d1850c5166226e68bf1bf0c9392407121c362a58c9e170519d4b
MD5 a0647667a3a399e1c714462a32a09594
SHA1 c872f858e0105fe2eca545b5e9c902eb0eb94cfc
SHA512 93f768d31fac7e478b3ad5b89c01292f1772533e7b04217876f2bc7b7f36656b726306f61123572a899ac4ae734a147a94c36ad0d81b1b84ffabf076e8fabf49
SSDEEP 12288:yroH/uLJOyo937vGFWxwFJI+yeuVb8r+ZP712Ii+51cjVWtVj5J:yQ2JOt934J7Z6bQaj1BvUm9J
MD5 SHA1 SHA512 SSDEEP

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 b372ec2ed6759c0656ab8ec2416754bd66d8e89e0900d93a72d8743c72ed4f67
MD5 4967d3a8c27f44291a53bfb78e2ccbb3
SHA1 ba5a384362aef7bbea49053331d2c6567bfc4e55
SHA512 55f0b8307a462a3e0a52a77a2fcdc7fc4c82e107ed817cb13d70a182ab58c92005337ff9f9dc089372a3c380a359d4ba08d19c68b17e37ee3f1f415989945ee7
SSDEEP 12288:RWoH/uLJOyo937vGFWxwFJI+yeuVb8r+ZP712Ii+51cjVWtVj5J:Rd2JOt934J7Z6bQaj1BvUm9J
MD5 SHA1 SHA512 SSDEEP

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 69781e87a6069d93c5d244f9ba4fd6e51cf20039c6e049d9ba72493399816ee2
MD5 7b009c77b45d5cd6369a725e7a0f7c69
SHA1 bfc19787b9461991e3bcf06ef2a6efe321b83ff0
SHA512 49ac74ada48c2bda60b00f2e5fa82dced5ac51511ce004cd0bbec36a88168c2decbe5d3401c7c18d556df512d5a6b635bf0ee11b119897ad5443fd2bf0deb83b
SSDEEP 12288:00oH/uLJOyo937vGFWxwFJI+yeuVb8r+ZP712Ii+51cjVWtVj5J:0f2JOt934J7Z6bQaj1BvUm9J
MD5 SHA1 SHA512 SSDEEP

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 00ff70d5cd44e7b9d612f9a222644661e9e501ecf48689b20a6dcb1f5b1bf6bb
MD5 43a9810817ed15438aa041650e8f344a
SHA1 b488873a014dcfebf82d799eb4099cefce31494b
SHA512 6ab386ca79557d6701af1d6593bcc25e8b5b1b23c8ae4162301e454003e503fba8d784fdab8d6ee6d143cb7aeaf3532bb31890f04eae6b1ae0f651143a40df1d
SSDEEP 12288:lZoH/uLJOyo937vGFWxwFJI+yeuVb8r+ZP712Ii+51cjVWtVj5J:lC2JOt934J7Z6bQaj1BvUm9J
MD5 SHA1 SHA512 SSDEEP

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 4a2ebf54a7eb57a64f872b565293664de7da3a6bfcd8fda311e96f2e93ba3a92
MD5 fe47ba5eece2d3e9b9bde2f0b79041b7
SHA1 dca664d3289bf9dd318990d4c2e3dccfb58b73f1
SHA512 f5a7d8c1a7467913dbf678140ff50a92fc9d94bd588e64003d5035f496c8d26709f65a570ebde9259649b83af8b6582967fdedf03081f1c61576d89925e0073f
SSDEEP 12288:WMoH/uLJOyo937vGFWxwFJI+yeuVb8r+ZP712Ii+51cjVWtVj5J:WH2JOt934J7Z6bQaj1BvUm9J
MD5 SHA1 SHA512 SSDEEP

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 581KB
SHA256 13b3aef134e6d0ee92ed64416c74cbfae9fe2cbeac997f26ac440e986cd2cd5a
MD5 139d479733e5d70c0f5adbde675be6e5
SHA1 31d62839f9b45d13f9add093f4652411ebfd3a14
SHA512 004f51695085ab8a2f08b0abd60a2795368c2ba97607b3680b5b9b3b3f78b0b52e335f84c3bd1a110f4c9520a724d71d1349158dd876a1ace4ae9207aa22ffa1
SSDEEP 12288:5CoH/uLJOyo937vGFWxwFJI+yeuVb8r+ZP712Ii+51cjVWtVj5J:5x2JOt934J7Z6bQaj1BvUm9J
MD5 SHA1 SHA512 SSDEEP

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 701KB
SHA256 8a06fbf45b02255ec4ac799d4866a34ee99ba09d814b0be8ca9f556f08f164df
MD5 744f7ac856961ebe7d8260cb4d8d7dec
SHA1 424db800a7817cfeb308301ef2446f5aaeabf256
SHA512 a280f53a47765ac2d8f212a06c651039ba6dc042fffada316aaf177b492b3fc3db3cb652e1c95dcc40464f886034fb7d0ea49f058a2004eb9f6202d230afe194
SSDEEP 12288:6UFmDDL9oH/uLJOyo937vGFWxwFJI+yeuVb8r+ZP712Ii+51cjVWtVj5J:4u2JOt934J7Z6bQaj1BvUm9J
MD5 SHA1 SHA512 SSDEEP

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 5383ba95fbc13a30c48e1481c72a5ac6a78ff581f5cf61ef6b840153ca106769
MD5 adc1263cde25c14b8dea61065c2036a5
SHA1 6925ae7e27c19772cbcb46302ca775ac89af9000
SHA512 fdcf056cc7a2c7a8f567cdff1a4066685f13bdc5b594ebe4fe251a9a06f6b6a6ba149f999c05a847de78ce70b79227e7c97f8777511fd0e30a7b3e422fb0b36b
SSDEEP 12288:B4KoH/uLJOyo937vGFWxwFJI+yeuVb8r+ZP712Ii+51cjVWtVj5J:Bq2JOt934J7Z6bQaj1BvUm9J
MD5 SHA1 SHA512 SSDEEP

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 ee578b57ba80743d8269863fe222ca57170b6de7e6dd96ccf466f5806dc2c6c7
MD5 328e5656d9deae9d04a9a2f11b05b5a4
SHA1 723662ee68996e36b5997189f1692047031fb756
SHA512 f0ffb06b9448196e08ad43a398c2ee6948eb213c71cfbd2aed4f8fd93bcd0f8b54f2a120b3d1a33c5c1b87d8e10292a9a8d231d2eda4cf60201aec4278fe8cfa
SSDEEP 49152:7a0h2GEkuAe73q3pp46zwwQLJE3jM2ce:7a0hNYG4JwsE3Xc
MD5 SHA1 SHA512 SSDEEP

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 659KB
SHA256 318e32389a43ed1d81f379a0fe7a0b25e8558bb3d6fbc3dd75b10fa0e1b30c6b
MD5 522e72596b1628981a26ba4cee9de2e7
SHA1 e4c2fbd7a42678b902172640b7b45cfd573b3807
SHA512 882744d16831cd585a49b0109c272f419f42dc2e03f6a3acbd4304c926b3cb374633e2fed5c60bde80e25f520488e6630c95d83c98474c7e5f41f8935af4c8b2
SSDEEP 12288:IhbHjfXfKoH/uLJOyo937vGFWxwFJI+yeuVb8r+ZP712Ii+51cjVWtVj5J:IhbHjPR2JOt934J7Z6bQaj1BvUm9J
MD5 SHA1 SHA512 SSDEEP

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 87094a7a3343124d674ce2176182ffded8722fd85177867d63b9132cb6e25593
MD5 956d421b133b896a0b6b145aaf98c6ea
SHA1 3096d8e9b8e33512954c18cead11b7d15813e91b
SHA512 68dcfd1bbeb7ab44ef1810199fbb25975e7ab478f26cb7d56cfb81f92fde79bab831ed9cb4cb8edd10ededd42f741fc5827e5629713fae7b3493ce9ed8016772
SSDEEP 24576:Y3YgnJcRTk4yti+R5dpR/J2JOt934J7Z6bQaj1BvUm9J:YIgnaTk46ppR/EJE3jM2ce
MD5 SHA1 SHA512 SSDEEP

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 578KB
SHA256 8f4dafe4ae0abd294f7b9817bfc10b7ca70917f39c3cde9c6d15bd6195e18383
MD5 51b62c45e7c9303dd2faa012b5784d4e
SHA1 546faee8007a83dd29bdd2b50649aba9e175442b
SHA512 c4e649473fef7dc61b0c1b96df2552c58debc2473ebd05506c23c1babebac707741450ede2a72f7c6e27c39112faedbb8953fa563e5e34bbecc553b50ebe3f9c
SSDEEP 12288:LUKoH/uLJOyo937vGFWxwFJI+yeuVb8r+ZP712Ii+51cjVWtVj5J:L22JOt934J7Z6bQaj1BvUm9J
MD5 SHA1 SHA512 SSDEEP

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 940KB
SHA256 6b5233336997b0fa347992fc36cf86e57bd4b69242fb50fc96fd7961d19e0b9c
MD5 218ae9ab66e189acf5c04bfaf8f99c84
SHA1 106e98892eeba7c0aee842e06fb65b4835b0f30b
SHA512 9fb794bd26cda671119efd9de51658ff98a610e3a2e0ebd53df2eb67e1825cd9c63e5e70792ad4d19bfd5c001095794e59cb3c5b6c52d5f4c52a03df0440c804
SSDEEP 12288:uOb9A4LWOsvAYFTtKoH/uLJOyo937vGFWxwFJI+yeuVb8r+ZP712Ii+51cjVWtVT:XpL3UTH2JOt934J7Z6bQaj1BvUm9J
MD5 SHA1 SHA512 SSDEEP

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 671KB
SHA256 fd86e587b6acc7c841e1b4409cf1a201ba467f7642d38b9eda3f122c77d1df6c
MD5 ae948037b68ae1329c34f0d397078c8d
SHA1 2756d8094033c9167cd549a36d39b392371008c6
SHA512 dbf457e7b1f2cfd78d83fae1aace926b7eb882b357baa5ee471e35ed1dd5a0a514e0854f6755e1418b338cf8aefcfa3e13fe6bbb7503195d61eeb6101290fed2
SSDEEP 12288:ZpFtpOpKoH/uLJOyo937vGFWxwFJI+yeuVb8r+ZP712Ii+51cjVWtVj5J:ZOD2JOt934J7Z6bQaj1BvUm9J
MD5 SHA1 SHA512 SSDEEP

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 60386445e71778c4df2e58f3f15fb0b7391127e481d5e301e03e8f1525d29ee2
MD5 f4180774b50e3b82d059da42969be8d4
SHA1 84d9bc965b8ca56374e1dd6667141a0885006754
SHA512 077bbd7ee37039c196af34e5e42a998fbcdd269e390951b612ef9e2a140ee61971b1ca7f61128fe87a7b961d2cb4c5ba58e28f87dd83a37ab35dd5649c14459f
SSDEEP 24576:17NM9YmZqmWMUkPjZM48Mv6bEhsa2JOt934J7Z6bQaj1BvUm9J:17cBWMpPjN8DbEhMJE3jM2ce
MD5 SHA1 SHA512 SSDEEP

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 3d95041f2dc02fdbd4daad24fa65ccafbe800934e0548bf4bd8bff8c2d9f1419
MD5 040af254475eec45fa20ff8ce9ee0630
SHA1 c633920dcdd1bf8d18f7abe5d926689b168c6655
SHA512 873c7f997fa6a84ed4ca4c3bf3b4dbe86bd4950df3db6e490ce1908e90ec57b6de3d463175a0e621b7f65e6e6ac27e99a916bf6a092209c7c9ff3b715c4c3d4f
SSDEEP 24576:DW6BApg2YuyuNDYTabvcRvNYf8km1U2JOt934J7Z6bQaj1BvUm9J:DF2YuHNETovcvNYf8kmZJE3jM2ce
MD5 SHA1 SHA512 SSDEEP

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 97978969c1b2f00b1e7cb85fe32e8e3042194ba2d0b39c0f14eac72fba310e4c
MD5 d699cfefdba52747583bf0c4de59114c
SHA1 af30ab795d458ab4eb26bd3e230a06f7539e3f03
SHA512 249b90e56c166cc9433f0f6bee22bfb06a613878b3e3133fd88445847f53b3d6e9d4167df1d8883326336b040ad5fdbd153b674d2503c48b62a0e0899013f3a9
SSDEEP 24576:CAFs06+Omlf3NXEbToP2JOt934J7Z6bQaj1BvUm9J:7Fs060lVXurJE3jM2ce
MD5 SHA1 SHA512 SSDEEP

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 885KB
SHA256 f42880db218e87fd95ae04e1a05d1fadbd854a7456879d6bc2346dab4e9b3170
MD5 663d6f8f9e10f914500ba98538e4c2d0
SHA1 dcec8e07b11fa3b2740f23e6827bc73ee3f33938
SHA512 3dc18a0fd6e03b7664765dc969df3b16100fc94d96564656ee57de4d61a0a389ee3a9f416328299f1f6cda86420847e15bbb124cba7099c10cffe2ea0e6f06a7
SSDEEP 24576:GJnJ5D3WtA2JOt934J7Z6bQaj1BvUm9J:GJnJ5DGtrJE3jM2ce
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 5f01fadc52b3658db0e518419758cc2420cb226f9e270108fa86263441d02b50
MD5 13e4adc0c0788424db7170f6e5e8d8e4
SHA1 577dbc54026d81a4638056541f3c0a45b11ebe77
SHA512 1e7a50784fb2dddfbbc887635aaf3615ef1cf5246398b308cc9d6998a61d843c7bf5a64ca48e21402b7a965cd1ae28589e4d37610509112a0283bb53054e55c8
SSDEEP 24576:UEPohm6/7IIXdwcXrif7qQncjlP65i3VuJ2JOt934J7Z6bQaj1BvUm9J:7o06DIKdwc+eQnSt65aVdJE3jM2ce
MD5 SHA1 SHA512 SSDEEP

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 661KB
SHA256 1e4bc5fd7b6863b08a767cb0dc0e79dda404e27fd8ae967fb6ab279ae9817151
MD5 cd43a1d45318238916799ffe73f72bcd
SHA1 055dd0128cd135dac58ffcab7ccc13025f514bd7
SHA512 097214b3cf7a73a55f7a18ca4b2ac2725427b8e3c6b59fa6c853c386b21767812fc8eda3ca98c0957a1fdbb6a833f94c7b7c72f85552f71dd5b69e5a4ef03b85
SSDEEP 12288:HEP3RrUPoH/uLJOyo937vGFWxwFJI+yeuVb8r+ZP712Ii+51cjVWtVj5J:MrT2JOt934J7Z6bQaj1BvUm9J
MD5 SHA1 SHA512 SSDEEP

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 712KB
SHA256 9e8e36c8dcb386e22e1f5f3c9d89d5ae6d80efba51510d4809ab5dc3cce7cd48
MD5 c29959b9b390223d6312326126023707
SHA1 bf01a63b513022d5c4895ade9d0f8fe2f8488493
SHA512 da156e6062a42d82d1a5a4b6642590bd8df3ddbbdbcba5204156c6a5fb8abf8ac383369b17d15262e8c69a2b804e768b348363964c26662e608ab04ccb29b6a0
SSDEEP 12288:MjkyPKoH/uLJOyo937vGFWxwFJI+yeuVb8r+ZP712Ii+51cjVWtVj5J:MIyh2JOt934J7Z6bQaj1BvUm9J
MD5 SHA1 SHA512 SSDEEP

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 584KB
SHA256 dabdaefd1b4440a041c5f239c9243ce0ec25a3ac72a544ba383d7bd70de349ea
MD5 ff845bd7fe94748763ffa97c45eac9f9
SHA1 c88a6548fbd4a59a088b639a521a3eb0c1b73f4c
SHA512 28c3f9822d539707fec04a0e19f0455aa54640d06d3c2d11dca4c5a733b7fc18530375b503e417da57404f83c40869e3f05cb434281953e90d480119d93b7a35
SSDEEP 12288:/FZKoH/uLJOyo937vGFWxwFJI+yeuVb8r+ZP712Ii+51cjVWtVj5J:tT2JOt934J7Z6bQaj1BvUm9J
MD5 SHA1 SHA512 SSDEEP

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 715c919daa88a6cf82ffee7057c2cac3ba864c2ddbb86b6184da5cb9bda904d5
MD5 59a6b4b2b1007020deef43235438e16f
SHA1 1a9be105862b97f35006e37cfcd25c5c75c71286
SHA512 6b5baefaa1b40241c6234f1500ab5f179f22cc6c65dab283af43901487f0676a7e650370a6131985235af19f33aa37b6d809978f1f757d743ab122e1747e4333
SSDEEP 24576:QQ9MxZKdcz97w3C2JOt934J7Z6bQaj1BvUm9J:QVKXBJE3jM2ce
MD5 SHA1 SHA512 SSDEEP

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 772KB
SHA256 17d2cd8f5091b0bfe737450638789a8a7e24a50c47780b3d007c884f205f2ba4
MD5 86b81ee49092950b9fdb566b1e92e6a9
SHA1 9699b42f15a09ad38fbfb2e2defe921f29c86faf
SHA512 8b3e5b6d250f584a867be91dbdc3f24c6443e7f725cd65c05ef2768af3a0a475eb381634df79ccf102b2364408914740b98a473d90e4927baca8f88b2c33278d
SSDEEP 12288:TyoKo2HRple9pbKoH/uLJOyo937vGFWxwFJI+yeuVb8r+ZP712Ii+51cjVWtVj5J:TyocxApN2JOt934J7Z6bQaj1BvUm9J
MD5 SHA1 SHA512 SSDEEP

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 c81cd504d300de0c31cdc52bc181e3cbc2addd071e564f09a0dac7b7ac3cf9a8
MD5 b9bb843a61194fc55eaf675de84e21f4
SHA1 5c879935d07c3593737d6e3985d121e62fb45b1c
SHA512 1e3f6663cd042b6389c7031094b4c40e3deb4e4459c57f36b207e16c94b53386045c7de1edb52f11e9c6ccf1064b42b8e7013097d0d505069c4ac7c4fb8badbb
SSDEEP 49152:xWcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIKYJE3jM2ce:p0zuNIQE3Xc
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/440-386-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/440-271-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/1068-349-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/1068-591-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/1236-587-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/1236-337-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/1572-434-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/1572-590-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/1572-322-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/1896-282-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/1896-260-0x0000000000930000-0x0000000000990000-memory.dmp

Download

memory/1896-259-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/1952-332-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/1952-538-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/2204-596-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/2204-399-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/2356-72-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/2356-243-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/2356-71-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/2356-78-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/2524-398-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/2524-288-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/2616-239-0x0000000140000000-0x000000014024B000-memory.dmp

Download

memory/2616-40-0x0000000140000000-0x000000014024B000-memory.dmp

Download

memory/2616-41-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/2616-32-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/2848-410-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/2848-597-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/3120-255-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/3120-249-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/3120-248-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/3120-360-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/3396-367-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/3396-592-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/3664-422-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/3664-598-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/3756-595-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/3756-387-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/3964-301-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/4024-53-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/4024-50-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/4024-240-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/4024-44-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/4220-303-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/4220-421-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/4252-17-0x0000000000400000-0x0000000000554000-memory.dmp

Download

memory/4252-0-0x0000000000400000-0x0000000000554000-memory.dmp

Download

memory/4252-2-0x00000000006A0000-0x0000000000707000-memory.dmp

Download

memory/4252-8-0x00000000006A0000-0x0000000000707000-memory.dmp

Download

memory/4404-66-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4404-69-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/4404-56-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4404-63-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4404-62-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/4500-28-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/4500-27-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/4500-19-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/4500-238-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/4708-384-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4708-372-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4760-443-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4760-599-0x0000000140000000-0x0000000140179000-memory.dmp

Download