021bb4d4a238977bd5abd3d5953d22830be7d7e4dde62017f6838d90afe3ee00

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
30/05/2024, 02:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-05-30_226b5076655f7687009a58bf07c9db43_avoslocker.exe
Size 1.3MB
Sample240530-cv6v4acb33
SHA256 021bb4d4a238977bd5abd3d5953d22830be7d7e4dde62017f6838d90afe3ee00
MD5 226b5076655f7687009a58bf07c9db43
SHA1 f05fd2de015758bd798ccd4595d447311dfdd9b8
SHA512 0d85bf4c20fdc084288093f60ff9f63f8297121d782e1e781e46cd9c0923eaf91c081de6d6d7a9d6e83d968b8a91ce1ece585fb1ba605af7cf788a022770953f
SSDEEP 24576:t2zEYytjjqNSlhvpfQiIhKPtehfQ7r9qySkbged+SkQ/7Gb8NLEbeZ:tPtjtQiIhUyQd1SkFdHkQ/qoLEw
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
2264	alg.exe
4612	elevation_service.exe
1908	elevation_service.exe
4204	maintenanceservice.exe
4952	OSE.EXE
2420	DiagnosticsHub.StandardCollector.Service.exe
4856	fxssvc.exe
3928	msdtc.exe
4596	PerceptionSimulationService.exe
4940	perfhost.exe
1060	locator.exe
116	SensorDataService.exe
2588	snmptrap.exe
4348	spectrum.exe
464	ssh-agent.exe
1776	TieringEngineService.exe
4112	AgentService.exe
1448	vds.exe
1940	vssvc.exe
4904	wbengine.exe
2256	WmiApSrv.exe
4552	SearchIndexer.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in System32 directory 24 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\alg.exe	2024-05-30_226b5076655f7687009a58bf07c9db43_avoslocker.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\39ab26b0e703f493.bin	alg.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_110750\javaw.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_110750\java.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_110750\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	alg.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ffbbaac238b2da01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000039b707c338b2da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000067f986c238b2da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d285f8c338b2da01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006dacffc338b2da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000095c0f3c338b2da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
4612	elevation_service.exe
4612	elevation_service.exe
4612	elevation_service.exe
4612	elevation_service.exe
4612	elevation_service.exe
4612	elevation_service.exe
4612	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
656	Process not Found
656	Process not Found

Suspicious use of AdjustPrivilegeToken 42 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4640	2024-05-30_226b5076655f7687009a58bf07c9db43_avoslocker.exe
Token: SeDebugPrivilege	2264	alg.exe
Token: SeDebugPrivilege	2264	alg.exe
Token: SeDebugPrivilege	2264	alg.exe
Token: SeTakeOwnershipPrivilege	4612	elevation_service.exe
Token: SeAuditPrivilege	4856	fxssvc.exe
Token: SeRestorePrivilege	1776	TieringEngineService.exe
Token: SeManageVolumePrivilege	1776	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	4112	AgentService.exe
Token: SeBackupPrivilege	1940	vssvc.exe
Token: SeRestorePrivilege	1940	vssvc.exe
Token: SeAuditPrivilege	1940	vssvc.exe
Token: SeBackupPrivilege	4904	wbengine.exe
Token: SeRestorePrivilege	4904	wbengine.exe
Token: SeSecurityPrivilege	4904	wbengine.exe
Token: 33	4552	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4552	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4552	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4552	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4552	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4552	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4552	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4552	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4552	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4552	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4552	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4552	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4552	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4552	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4552	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4552	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4552	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4552	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4552	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4552	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4552	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4552	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4552	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4552	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4552	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4552	SearchIndexer.exe
Token: SeDebugPrivilege	4612	elevation_service.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4552 wrote to memory of 4216	4552	SearchIndexer.exe	119
PID 4552 wrote to memory of 4216	4552	SearchIndexer.exe	119
PID 4552 wrote to memory of 4336	4552	SearchIndexer.exe	120
PID 4552 wrote to memory of 4336	4552	SearchIndexer.exe	120

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2024-05-30_226b5076655f7687009a58bf07c9db43_avoslocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-30_226b5076655f7687009a58bf07c9db43_avoslocker.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:4640

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:2264

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4612

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1908

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4204

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4952

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:2420

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:1820

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4856

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:3928

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4596

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:4940

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:1060

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:116

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:2588

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4348

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:464

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:3504

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1776

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4112

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:1448

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1940

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4904

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:2256

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4552
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4216
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
  2⤵
  - Modifies data under HKEY_USERS
  PID:4336

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
Size 2.1MB
SHA256 6d1d3b9233048136adf5896ffaab2409ecad1bdfa907e805c30bee95001cb2aa
MD5 669cae5a49d5807cecac7797bf68c051
SHA1 8a0bef056f2bf67c156008894fee77cb78811f5c
SHA512 4d43c93684d832e3e926b7727e6d138275d0b92145514d3da06a1c9545b5de8f811f944a5a3f00da09f0a679c8274f05ea30b4b6d5b3c0cae759414e84cb384f
SSDEEP 49152:2uYk3H5koUXfTqkkYLO/W2buywzMbOX+T7z5AkQ/qoLEw:2PfTqi90bsqo4w
MD5 SHA1 SHA512 SSDEEP

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 51ac29b5631d9c50a45570c7e305ac805d92e640b5471cb40f5f8304989846cd
MD5 46fae8814608a806e11ff5a257be7e36
SHA1 c935d75aa168f8960db9e1f3bd5ed4ee31c9aaf9
SHA512 92b023c96802e7f9b30ff98629708d88bc112ed87cd2f7eafbb4e9f65de037b29de6357b97f7b9def3660d26b67bbbd8a09857d98dd9b4de9531e9500c3deb36
SSDEEP 12288:vcQirmNJLBsunEPMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:PiinBsuEkSkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 4eb5788c7b95dd571cf5179e9fbd6424364a5f4efcea49959f1d2807e22c62e8
MD5 2404ab6005b368382748fe79b58c9f98
SHA1 14c2b87370ac28e11ebc24dafcbd29df9f3a716c
SHA512 278db1d38b355f741dfca663c4dbd2cf7ebb2a6b4a64841b77d1b1d43ab2fa0d5b165e6e88c19e10a5073b56aed30c0b22105bcb81abe10d65f03eb37783822e
SSDEEP 12288:17a3iwbihym2g7XO3LWUxfh4CobMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:g+gkEDfh4CooSkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 f45eb436df9f121c99e63275da273f8a73420154e2d932a86ae057744fc2163c
MD5 62f730bb36dbc58bcc65f65514ac1df6
SHA1 317215543229b3953a4fc93a1dae921bc0967c19
SHA512 60c9203b4863843892e3c7577b229805435ed88ff08c6ceddb1ad853c83603d923cc117ac3cf2feefc63afaa31031ff2b4b46cd1bc986545be78ba471aea8524
SSDEEP 24576:kBpDRmi78gkPXlyo0GxjrBSkQ/7Gb8NLEbeZ:gNRmi78gkPX4o0GxjgkQ/qoLEw
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 b22d866fbb5e6040afe2e61d6aa799f58f4871a799d29bc3000dcf78fa3db8a4
MD5 7f0b2e95045740605974eebd2e658d09
SHA1 bbe5007c50dcbc10117aaccc1bbb515514368461
SHA512 11e9c32be6e90c075f783e528292454afe06146c7385487e65c21492598f64a564720af54b10ed1b6a971b7272071fd8b4ce17c2ffa40b7c5469b2086d118ab4
SSDEEP 12288:8fC6Aj+TN5uixZN+8rKhUdTC/wE1MD0Ca5ZIXVbMTmkJR4Do07Y86gw5CtCjX+NR:QLOS2oyPIXVoSkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 2b373e50372df60947e4124acbb04d991568498ce73658d1fbaa78b25eba144a
MD5 71c2434b8f8598cdb28a14e89b4b9d43
SHA1 837898f588a1324cc2f858fac43a06f6e5fdb193
SHA512 de46d1c528b60920fcbd19d2c5116307998e3b9b6f1bc0abeb85586d03f2958d6916d5f02aff2a7ff14e97a8e7373ba287793dd7798cd21c4d78ed7b8e856e54
SSDEEP 12288:HMVMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:HMGSkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 acf95ae30172cce13bbe1de7aa9d255a851ef729385be80cf136eb78901cc425
MD5 2070c98344a66ddf3922d5e26d29d08c
SHA1 96fb2abcc1c1261dadf4419e73e890a53bda4b24
SHA512 faf4bb78848792dbace7929c06a74ad2ed1276982676f10b81db242b552261d79e034f7c3333438de378cdd50aa4c06da600d8f0fd4a4ff371830284f0ad1fd9
SSDEEP 12288:MeBNUbTVO86UqMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:MJIUfSkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 c755ac745143956734c453048756b60a295236458f5cd2ca8cfdcdc461ce4e44
MD5 d4021a55f7284b509201368392103487
SHA1 1262118590392bc9da60aa3301418a7f834d24fe
SHA512 21dee27c3099a981015348b8d97d41923e39a52800f5a9e039f141024151128327c9d2b4ff4ed4ba07f939fde0865d34b441c111e2476c1bb82fe6f3dc7ce835
SSDEEP 49152:2QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THa:2QvGAdlCEL8c/yRNw5CVqo4w
MD5 SHA1 SHA512 SSDEEP

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 d62e7acd051db63eab4b520849a7b19f2916e82654a00f0c9c61aed1b2af9aeb
MD5 d7ce9ce145f3ff257244c35a1e9e4dab
SHA1 47e97dadbadf93d22dfb78f3ef7a16f6863b63f9
SHA512 ef8da2b5cfc3ed7a6eba1bc1dc2f38a6eab6622fc2898b6b45d8806a00de3985bbbe7fdfc8d27c7d6267b6410d8b6802dd71d4c4a4b9384572833c2b84fd9226
SSDEEP 12288:HAwSfxL/2Dc3eDLLmt0LDQewsAjQMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:g3ewsAj5SkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 48826cf0773db932ebe01dca18230c04679380e5a68e5f992975fc061c256c84
MD5 772418e5722cf39a7d92c12f78271e63
SHA1 375cedea3762e03b870941e784688fb445c20c52
SHA512 bc3b3e584f72a96bf9773442f56c4ac90d13784c0bcc5263c19b48a5bd0f0196eace5103ea382161662bfe868458da63d2ee8f6b17e1e306be23af037fec5419
SSDEEP 196608:3UEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHE:3UEtQevvqc2W1cpV2EI32E
MD5 SHA1 SHA512 SSDEEP

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 b76961ab8e7124e5b979068c40121d4ec51b98fa84cfd837760e4d0e131320ab
MD5 3928b5f9e693c50c78506342f4515fc1
SHA1 3618dc5d253ffa9a83086e28809b4e5fe5de8f82
SHA512 057c50ea74c2c50ab2f20feac4706d89e8d57baed029288bdb401ba2011e12aaef17dd59dd9f7c9690f6023c245b6bd20a64dac95d26e115b9a4aabd99b04f8f
SSDEEP 49152:0CbRquA/m2yL5zifFiV+XenmE3/z8kQ/qoLEw:doqHVjnmxqo4w
MD5 SHA1 SHA512 SSDEEP

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 ad0dfdba2c97f8c3a9259ca94cb21bc456f2116f79bcf339b9e28e9093b977f4
MD5 bfacbeb4efe5e564800b21f06b8a5cd5
SHA1 8e20e503e90048f5d743719cb08dc53b791f8e08
SHA512 8f73fecf25746e58c6cc90f37c83d55cb05ac71677c40fa657e00e6ac52a92845c3de2d80b2bc24b7863ba1eef45bd70cadfddeafe0cb3a7c52eb3b86ec3b01a
SSDEEP 24576:cAhGLJIFoiwtA5l7S53YSkQ/7Gb8NLEbeZ:cAMyFoiq5hkQ/qoLEw
MD5 SHA1 SHA512 SSDEEP

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 5aba943ea30ad234806f722ce0a694ef5ec280c5fb6a3e70ea7fe215a92fdf70
MD5 435c80cae7521e12e6a100a9e3b9e5aa
SHA1 8e55fe39fc184280326b7585a3154faa40583308
SHA512 113741dd5f44c58abe43effdc1550a2e3ffc30c12b05ab354bc5cb442aa47f5af732f4adbfed238ed270ddb3747abfa754aac64f40938bd3efc618f0bc2cd6fd
SSDEEP 12288:mmw5HEjsChN8BFgl0WDm+CHMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:/wuxOWlSkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.2MB
SHA256 7247335bd1444e65bbdd212e089d5053cb389f5adc9a2194462dc360215c2c85
MD5 e89ecf9f07fd95d680ad8d4fb729d5b9
SHA1 c2acc2b5bb9f772d77f3c2700d66bc2d99a792e7
SHA512 a3bc1f18a40c81b5999124724fad3407fbdd93be6eb0c7a8970a469c4735bb100767ce57dcec45c703a9a48b1ded427012541d3fafe9b6b93614fa66542e880d
SSDEEP 12288:54Z1IygMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:OZuKSkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
Size 5.4MB
SHA256 264d18403993619e8dce55fd4658fc31eafc1fc002fc765b09b25e9a275cc564
MD5 df8e2a78bf13bd0b4bfc5e0503b19efc
SHA1 20f7fab800229cd2a736c978cf5b3b58d5dd40b9
SHA512 4b566cc22e24868e29e13c33293e8c2f048ba60ea28eac5886fad410eeb72210d37480553285024e32bc047b8acea0193068ed87aa588edbc3577c699667d827
SSDEEP 49152:o0kwIi7c4xZlm5knEtw99Kn/2vim7vgv6m+yyJ/0gbvjR7yY7BHi3u7L/gBUUWLK:OwfhY7g/rLd7yYA3awr341gZqo4w
MD5 SHA1 SHA512 SSDEEP

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe
Size 5.4MB
SHA256 150fac658db0a26e560f4c7f509c9ed171472085d99d75f851ebe32e01f95b45
MD5 687e37030f29bf01e4e2fef3af2894fc
SHA1 16433b96d838ed1a6cfa46120ecb6a423a26ed13
SHA512 e7306f684ad44905c072b7cfd91c764884374c28a83421ed76ee7d3c4f99e7c135e69655835fe710ed9e4184a9170456aad4d44c5b653bc7a2fd92ce2fb2b72c
SSDEEP 49152:w0kwIi7c4xZlm5knEtw99Kn/2vim7vgv6m+yyJ/0gbvjR7yY7BHi3u7L/gBUUWLK:2wfhY7g/rLd7yYA3awr341gZqo4w
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe
Size 2.0MB
SHA256 f7d6a870f8621654df9f1b05b2a65a9a596c15f1f2395a0f4e6ef13d7ca2e81e
MD5 291893771b00ee66d9b7abf1347d0c14
SHA1 01a09d6e6e5a7735d3f21d81816f1943649a20de
SHA512 05f2c2bd58dfb063673c9f5cbd2f3cb1f28a7cb2f7c4a79e55f70099e22956a90fb8ff0da3c3c89fcf8b5c25c358a9be40745f1a46e936c893517b4ca7e1d66c
SSDEEP 24576:CcTyYv0FteQU+5I2kjgD6iQacAlSkQ/7Gb8NLEbeZ:CuXv0Ftpn5606zOokQ/qoLEw
MD5 SHA1 SHA512 SSDEEP

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
Size 2.2MB
SHA256 f85387fabf8146d8e60ba256f324b2f53f5c68a0e2bd9b3790bc71f2b609d4d3
MD5 281cbfa6c9f206058d9ae46913c3797e
SHA1 5a4761a1e4a8e6f8bfed65c0ad90d77cec990aa9
SHA512 d65957edb5e78040172fa5315a01f986eac40ca75e6082cdfdaeca53cc631c30fa1725526fa1d37e409f5147ef00611d654a6d2d816f70f2bd431f59bab154d6
SSDEEP 49152:+y7mTd0GxN8jyynxHjXKUyn4GVcbDSKrNTxckQ/qoLEw:1mYeyxHjWjMTsqo4w
MD5 SHA1 SHA512 SSDEEP

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe
Size 1.8MB
SHA256 fb3ae7f7cffb51894c32b2013e75abac942c68846b78eba121d91eec5a022bee
MD5 aec87e901f7dc5ba9a119ad2f89c1404
SHA1 d628f93416b39f74aa419ff4807763e2c0e16f65
SHA512 dd0e9e613ff7cc164bf68e4a83f853f9a25976c1efdaba1bc6afb1ae7fadf4d2a01c0c129476d9c148eec65bdfc8468fcb7558b264f8003f008f40dbf9930289
SSDEEP 24576:u6drZn1WEci182IEUeNbJeRgUebgW816CSkQ/7Gb8NLEbeZ:uWnDci18yNNUgbYAkQ/qoLEw
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 1.7MB
SHA256 353edd3853417876c4ae2f6063314dc4e10c0ccda35952fd80854c0e9524c6f7
MD5 1d4281a375ad6c9e21908cf09ae1c885
SHA1 f5c851c3863120d79f9ae77ead983c08ec831aee
SHA512 72181bd7e94c08abda0df2acd099f5142d12bed96979b0856edde2ee1c5a5c01884728918d75e7a5f762cdd951f46bbf1723e440639a4754737ff4860cab40a4
SSDEEP 24576:Hk5lHW5EzMZupO80G2reD+melRgTTv/1nyzSkQ/7Gb8NLEbeZ:XizMZm0GhamSoDkQ/qoLEw
MD5 SHA1 SHA512 SSDEEP

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 3edbb9c7d52ef1538affd305ae9d38237609a933f39b74fc099d711a001900cd
MD5 edbcbc0bffc3d10ef2fd6fe9685de9bf
SHA1 0acdae5f212598e0cb73fa6ff3290b613bc9316e
SHA512 c3377bca9f40ddebd7ea15823b77b408439d2285d83ca0c36dcec317cb17bb1d9522675cb4a74d8609add56b7b520855320f9ce17ff1bc30ae4be051b8ff1c86
SSDEEP 12288:JNMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:JuSkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 097ac58ce3d9f4b5a884451b914795a477bcd00642d6f6f13fa4a123a470c377
MD5 10fda5c7c1377e496284110afed89cae
SHA1 129f160a7e6b284e2e85058cfba37bca18b07d9b
SHA512 7598f31e906e9dbfeea728c3a4651a02a30a57b2f92cec8b21f70068521f4b31247bd3f3334f5a7056dfadd703e77f7bab7098028ccbd25ff80213e11066ee75
SSDEEP 12288:iMMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:idSkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 946a72ee1d9b2387d7b025dd86d7c4f642877a2f38a5c1ae995f976fc48ee179
MD5 99ef9de9bc7a51e1f4ce6296abcc6bb7
SHA1 bbd3c2cb87fc0ec95ad20598f58cb95bf5f0e9a0
SHA512 e8e71a8c9697756a31846de357226aec1191e1e1534d98520b71c2b8137f2d14baff70b9110d4128889cfeb1bee5b2266fd49b383e0cc453b03106dabf841c7c
SSDEEP 12288:1CMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:1HSkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 227794bd60d4df299d2ce5a1989973dd1451454337fdb5420f0ec7423440f123
MD5 f15ddfdb6c5dc581c187fc33f83bec85
SHA1 217f35e83998d9b125569e1a0c40e54f8703d765
SHA512 2d8c5fcea06ee7b6011aa8b3ed82c12a3b2fb39197370cd937fe174c96a1dcfdcb85c603053596197ba7d817971f7b5956ad91de7143b05e4114c4b1aef5347a
SSDEEP 12288:AVrMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:vSkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 aebbd2ef58a9f1afb913b7c678e437a9437cfb62b20cec77c9415fa710f7b5d8
MD5 ff9c354a22f06a2cbc561c6bc48301a7
SHA1 880f1f14ba836e6d08d93c78f0f8f302de641f86
SHA512 0c3428bad2376be6e9f5550e0bc501aa1339fce12a0e57f4530647bd9357ebac4a1d577abaa793a37c77f5cd8db42b0c9d41414b86a3f4250162ba9d63d2f5ec
SSDEEP 12288:LTMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:LwSkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 e2a3185ec476ce67286c8c1ec433c27cedaced0a9725112429df5055928104b5
MD5 a4e788b1cdd91a9ce689e635c1113a4f
SHA1 cda56c43c12dfcdb11f193a87abfd7d6e4e514fc
SHA512 a4d1e08c4caf695f20e729807741cf65ca97843a0d1b8926432333b424aa37d5873bfe0eb0bce72ce60b0729bf1a449122f68682d3223bce67167da5b50d31a7
SSDEEP 12288:eIMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:eBSkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 a4fa780b11fbf9678a4d071b8570e5d09617b246ab15910b83dee4db6556a283
MD5 cc17472763d47e2d46ab56b0ca5df8f6
SHA1 c24d6a9bfd0c84d1ed7cacce18c5580db3210447
SHA512 432d8a80038501f2a86e44ff244ec81f4cd06e00feb47abde8e3ddb94fbd3061a6f5934989dfe2019ef25b5076ab71225009391fb46ddd6f7961d5ff9f1dd410
SSDEEP 12288:P0MTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:PVSkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 f74eee0d579626c4a89d6d5c2c79db0c8b64e597f690e5f906026961d273c50b
MD5 691678146b17bf4bf55a14b3191ab348
SHA1 80566d3706b2b647bab1791f44da6ec8c84f67bb
SHA512 1bfa068dda91e6fc899f27aba2d320a34bc89d511162ddd71456ac9c4f50ff38457b7c0708a85049aa1fd15756b774b84e199d2f057ea0181158f67b8eaf749e
SSDEEP 12288:kiZwbQzzFEoS2cPvysMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:HZM4zFVSO9SkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 aaa6e1bec7365fd4b220a4a310d6fbb001bd460651671c34acb4e4d92c40ecc3
MD5 b85ce8f63681ecc628a270902f7959e0
SHA1 cc0d28a5df05a864a57fed4b44cc212186db06d2
SHA512 04ae86e988972c09027349b5569fc15b0229f26700fff4013fe5b0ccaa4f8d0049105659da6e28166ac0c7adb5bab15a1b59eb8884ae24486a554be7c692e4fb
SSDEEP 12288:EBMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:EaSkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 d99961250b024b9a086b10060ec19b4bb61b482246ceab4c04b10b644d03d534
MD5 9c82f9fe4dd18bdd2bb9dcd186a253ca
SHA1 2a9a031cad70512ae55785b67f4bf05203e59f40
SHA512 6dd740182073f17d581f391ccd5d3e9b865d8dc424218a5ad02c2c9062596b9110a59f4d7de5bccf44b89f4f85a1a34b55fa0ce753db9a0b77104214b320190f
SSDEEP 12288:blMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:bWSkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 042a03941607c3021c4c71d19f9dfac0207d158891a61677801ef3e39009fd2c
MD5 d9c28b4c53550ff9f02ea0eb878d27d6
SHA1 85590d7a2d26f67dc8b02407f49d961d6ad08b2d
SHA512 4d04a6376c2901b740f210ec91f4887581289598abb8bb2cd7dd83cca3464129ab4cafc095e0d587e3e1547b13f482aee02e0b94c2b10c80167ee922b3b29219
SSDEEP 12288:JyPz5L8gMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:ozyJSkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 7344680b00fae2799341932d47b4cd67052d4380bcb858a4d32c0acfa9fcdf0e
MD5 833868f6ee551bae00b1554f932add77
SHA1 536208bad3794837ff29a634922314e2816ba665
SHA512 85d2f352c37eb7f9b0f60a402919ac4db530a2b57d8fc93d084e641d6bfaeeaaee5b27c7f5012859015b4ea0030a4c03245d1826c3f5d68ce64feb3216a41708
SSDEEP 12288:yBMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:yaSkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 65e7fdcfd85e4d7937abd15433019a5a1d72e830c78136651027a1395e95ae68
MD5 1fa9f74855bb95795e03c6e7a8c1b5bc
SHA1 9e74dd5b1c951f1aeec0cd316b406633d3c1cb84
SHA512 808aed394b7cb0de032defc09451fe22004b76c888fb72f1f583bd81de7bf281cbdbbc842b5df78fcab98279d5fc0df55b819f5d560942fcc96cb5447944453c
SSDEEP 12288:cBMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:caSkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 090366ae2755639d4eae6864bf83b61b8dda8f577b97f42564880cbf88b1e641
MD5 ca6581275dfabc12f69d7622daf36ec7
SHA1 9585538a872746ff96fdd71c3949a4f88e5211fe
SHA512 0c4fae1ae0ce097d2205da9f2a82607560f7a0fb9932a902b9b04fd119fe17aa7a4e34f92ddcd59cd33fb177b73676f905def75435960625d7a092503a4290c3
SSDEEP 12288:tyPz5L8gMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:EzyJSkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 aebea9f74ca7ba6adc992ab466471e79524c8cccddbf793066394e5ebc88dba6
MD5 9092be7dbc04ebf624f2a132d71ad309
SHA1 3378b71649d89d5693e5b7d1a3363d62aa649b89
SHA512 823d7fd3393f736af8081d49661e104246178b196a99126285639b2b0a3c5e5d14ece984322a801fb9edbc3e05a3b6d32df09eda9c438f9dc6ab7c7e9c085585
SSDEEP 12288:7Cd9wWYoaLHF3z0z04PDvhyMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:2TpaLl3z0zD3SkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 a22cf0bd5875d983aa30c96cc329c5d5941bd67f4b3292105e5abbbe02568ff1
MD5 329d768623d38b5185fc7ee2477e2b01
SHA1 ebda4489a82f1ae25f19faead5d778e1c3178ddb
SHA512 eb3ead7cd9a587a7a62621aeee47842b76673e7bef58cf07d7d34fd507b44af63257f91276d884d4fad2306daca28673dfd24daf07a800b7015423a3bfbcb77f
SSDEEP 12288:ni4e7NRdTfgwCHKy7GLbbdIvPMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:n3+d9CHKy7GZLSkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 c7cd5bcab90ea92722d156e4b13a32263f9d079b4daaf044bdfad3a933d4d7bb
MD5 883addef6be014bd244d4c0177433a8a
SHA1 0352e3805b776b75733e0aeca805ef3e75726398
SHA512 631784c057f955b1d1bd7b67e64734c5214f817a1acba0f97dce10ae626ae8ef7209b0d03af77529b6e6424f851e3cb3a7841041f1863635dbeb47e2bed7cec7
SSDEEP 12288:EiMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:EnSkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 247a311ee5e17f37c821f525ac01aefbb7954542ea3150b6c33df6fe00e429c4
MD5 a9e4985476518f0edb5a8bc3f5c109ce
SHA1 8b9ec4b015a16e0580c82b4c34102f23cf50ce1e
SHA512 80cfe14d45c56d8559b7a0a310fa7e7cad6f973367098cb92f980793bf4e04da2c566bd093da4dd2805a1bdf81503ddb896ce6dfe52ad5dc8008a55df67115d1
SSDEEP 12288:SAMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:SpSkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 bc14225f4ecf9dd08d93ec7f7b453097602079405d023329a53a12cf352e07b0
MD5 4600bf56a76916324bddb842d7b71b0a
SHA1 6dccd8dd7545e0ee5d39df8c8fb8d607d4fdb3d2
SHA512 4a4943192531fde12fbfb582ed8bc815d33fbd5ffb8fa29562c18907d659fdc1499eedaab15c5f7f77871f80b8073793d59bd359881dfea8973663ede29a1346
SSDEEP 12288:rPMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:rkSkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 84c5d21013044b9e363c6f81f1615755204452c4ced74ed6bf8d48157a51df60
MD5 1d56535886166c5186c1223a4ee074d2
SHA1 406f6c8f6f249a087ff32135e0a18fc3b487af89
SHA512 58789ec77f9e0063595d781b38ccc2a1e15b5c1c92b33f1a22665618f556b1da65af2055488aaebfc1c6f083338b07b109b9480ca358c1ca21721b2d727d1890
SSDEEP 12288:OBMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:OaSkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 34fe8ec9709c1944fc165b667a1f486f26b115fd1c4561605db51a8f7f8b03d7
MD5 e99b87ec1bf129eca960ef5d125ce54f
SHA1 cbdebc51f5d736b91666935a1bc397ed58b0f46a
SHA512 cfc114174eb02ae38119b0fc8f8b4a4477200ce7eafa0e06c0944a7cdc71e4a403a5e774813458ff17039960d0ef01204f1a5bc484a1474de798e233c3f169c2
SSDEEP 12288:tiMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:tnSkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 c44343f765e949684a2890ea9121fd515c61588f8918b16a04f22f4b0f38029a
MD5 c0679f31a3acc69f904bb3281667d447
SHA1 176a68c4596d21fcc89a42cc4c54be7d833b91a0
SHA512 d29db0bed7e40ed924fac0b93deefd2262af677a01d87b18541cceca1f2f816432b3ad6b93ef16965a9dc950e8e517ba8b49602683cbae5e48552bc97e58405f
SSDEEP 12288:0JMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:0ySkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 de7d1fbe8d16077aa7e5fed8d18c6d677da79fb6b5987222cfb967e6a694c82a
MD5 a1497e869a5c14d8e9403f78f72fb026
SHA1 b3b0b2fa8efe5fabc2c2d0493bb8b73bdd04860b
SHA512 05aff0e309f081fa7fee289b662a113845095d0a0fa0c5e34c7705ddb17dae80d5bf6711727e8308e9d359c883133754aeea2757a901124246bdd56fe0b686ff
SSDEEP 12288:TTMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:TwSkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 2ab5060bd882e349bb94503015fca2a32a33f8e10bc21bdf6c4f11a368e98c38
MD5 aa77b196294d621bafa30aa1f47a1b0f
SHA1 3d3543ba2fd892c728d504ebc61f69f53ba62935
SHA512 76ccefbb6a0d8b0bc60d357bd135fe35d03997c8e177589ccef1a69d511528f38b03d3ca76038e8f7d1eb734bd210c29581c9f24ba19cd5756a5e553b65eec9f
SSDEEP 12288:JUFmDDLeMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:97SkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 0d50cd234da146e35b82ed61404e78db1199c9930cfb6189ec999548e323715a
MD5 cbbd3754f326cf98f4e3e3f6d5b263ec
SHA1 c0d893937f61a898635b97f5dc6c9a149aa438b1
SHA512 6b79b7b85967f65a3bd369184bff17be3d25541d2bdbbae86bd92b6d38f2e21b70736d2aeb336113095e267c480776d1966c5989e02078c39db5258621226dca
SSDEEP 12288:tNMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:tuSkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 66bfa80dd859ee5b7dd1acdf9f63c35f976a95dd5810d52d87a603955b48a964
MD5 d01cd19888471454f1b1335fb061f61f
SHA1 0ce814129381605fc5bb932cef047037bc640293
SHA512 b2a1f7b899d7744a9dddbbcadb6480b323e7dc821af7b174a42fe56e0b308e0753bf516ecd3b7be19b511270babccc90fa4c618e0c9acf45afa27fa8aeec9ff2
SSDEEP 49152:wa0h2GEkuAe73q3pp46zwwQFkQ/qoLEw:wa0hNYG4JwQqo4w
MD5 SHA1 SHA512 SSDEEP

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.2MB
SHA256 cf4c3e26c1ce8d8a2f70a41f202068984b36ada56c461882496ea1a5f4201a72
MD5 aefc85834c24859a6de4e3e7d0f0a65a
SHA1 c68531e8f00455b136f685be16ff21c017dc74b0
SHA512 4320e1c1b32791a21bfdc77bc0fc2dc874936bc3f57a6b6c727392a6d74c41a06da1de1ad6b00cf49c1c87e71891b7a80bdb9e6a394260b26e905915a1562cfb
SSDEEP 12288:4hbHjfXAMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:4hbHjPpSkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 66b65db12b16511762d68060cf6779515e1f94e954a308e110a8881a9fc50371
MD5 ba1f6d2f9938f37225bc94f04678d655
SHA1 30d8c4acd048266639b8ebc60a3ebe81d6d1c448
SHA512 2c635e7d591494fe07ad84358b49dc2a82990f83403214e525086c3204a8605d9f874ec99f645617be0618edbdc713722749e6fa253e47e4ea2db3ad77fa1595
SSDEEP 24576:W3YgnJcRTk4yti+R5dpR/BSkQ/7Gb8NLEbeZ:WIgnaTk46ppR/UkQ/qoLEw
MD5 SHA1 SHA512 SSDEEP

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 c872c5ffe3c0b579b9ebbb15322073d3241436b0d2a74cccdbb0a316987e1cda
MD5 ad6ee27ded3d9fb7f8aed380d638fa7b
SHA1 aedf11f0ef2ad6b64e444a15409b968d3a9d1535
SHA512 bc7bca32270d273561e51b9e8eabb9dc96b0d623c4637f4dbc9e6dc4741d1f62a9d21fa9010777995f6122f4ecf55e7619c25c5a3250ec326493030e256a1ae7
SSDEEP 12288:IRMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:IqSkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.5MB
SHA256 4e31296b40c559e3aa691eca0d8fff8f9f8889474c7cadc7eca0411b62483574
MD5 c793bcea6ee6e7bbcb524d3a0940a65d
SHA1 785943ed434f035933596b9080609d190628d65e
SHA512 e76f9c9cf29e3c40b093306a5acff7617cb705b60f4da88e190919b880310bce92f15de14c93d6643856a60b369a31530f1e852fbe50b9048a85c8069e1ad686
SSDEEP 12288:kOb3A4LWOsvAYFTqMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:JTL3UTfSkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.2MB
SHA256 334053a7d30ada4f2ede2582f7e4bc1ba02055385383e6d43f548c87836ee808
MD5 223c118a41723f99974375ff78b15a0e
SHA1 03162d7023468e567c4f635d4fd329fb0af4b740
SHA512 b7ceece232f6ed82b16b407c8d8ed56ea69cfe9aa79db8424d5721d9d85bf0dd7bf40b8db0ec303a99548c25f847723e0fc75e7da70a6d4453b9016c5c09cef0
SSDEEP 12288:9pFtIOuMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:EOLSkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 c4799c972246eabf8723d01c54e44d98c6f933b9ee76a87ebafd6a8d58dd57be
MD5 eb8199118fc1c850336fb7e7066bb55d
SHA1 c1a79c5548f46d7850c8478317336b1242335fda
SHA512 8829fb32c898efd52c3074c68c2a8668d688914b0a1e2f292dbeb5f5d82c278a65e764ea1cbe3b009de44710d42bec91eb7b69c75d73d199783e9e83fb056683
SSDEEP 24576:j7NM9YmZqmWMUkPjZM48Mv6bEhs+SkQ/7Gb8NLEbeZ:j7cBWMpPjN8DbEhMkQ/qoLEw
MD5 SHA1 SHA512 SSDEEP

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 33a39be3c91c8e7e5cde3821511c48d642f6d9d4e46031c8463113b278fa3d72
MD5 ad40caad28b9a80c57c965cb7ec2933a
SHA1 d7a12e2e97f206a2c5d54be23a98002302ef4516
SHA512 6d5fbe847bab921f130179e140b261fbc259c1b380c8127b458b2e6a6fece21a67a7d4c88566fb877050b81a1111dba31e9ef891fc0aa02129c03849e7e5af6c
SSDEEP 24576:uW6BApg2YuyuNDYTabvcRvNYf8km1QSkQ/7Gb8NLEbeZ:uF2YuHNETovcvNYf8kmnkQ/qoLEw
MD5 SHA1 SHA512 SSDEEP

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 15ed09b0d97d5a517c373f2e3d74860f5071f9d9bb9d6b91571b30290133f1b5
MD5 c5fd212537138d65858013a8d574d706
SHA1 e5466655322d395f85738f9430742b3f66287e01
SHA512 3ca6ac49a661a41936334c4a1a00451ce9b7da77372c7a00ee1c14bba62263ea7b06a95d0344d621fba5c72d0de8161ee41d6c743d6a69edfc9e45840fa686f1
SSDEEP 24576:kAFs06+Omlf3NXEbToHSkQ/7Gb8NLEbeZ:pFs060lVXulkQ/qoLEw
MD5 SHA1 SHA512 SSDEEP

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 0f08799761a6a47b7308e406612e54623ac95ea32ded7417740002e4d112dfbc
MD5 dd773bc46799df916629fbbcea55d024
SHA1 f663829b0140b11833380d3cc0718379ca5f67b9
SHA512 59a384cea7ccbad323fa078b0e2d30caa39ccd06c7da65c0b839c0db90d97e25b5095997c718d127748dee576c8f248d4d801ccc46b51261b23fa1d196e21048
SSDEEP 12288:QCJnJ5D3Vkrzzx9MTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:lJnJ5D3WH8SkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 2614505268278ab1a1ba92f92d6ecae402aeadb9de6b560961f46ffb22e2bd2c
MD5 ecb7bc3f29b9407a37a334acb3d6f69c
SHA1 88d2228a7dbf7884293651e5c0c9a83dc8137278
SHA512 4717d44da4bc1de2d1601768e1e05c1705a026e9925136917cbc5b432c383abb5d0ee46023fb0830e039ad87fe3272c1ee100eb9ff3b7aa2828047718bef3583
SSDEEP 24576:DEPohm6/7IIXdwcXrif7qQncjlP65i3VuBSkQ/7Gb8NLEbeZ:ko06DIKdwc+eQnSt65aV7kQ/qoLEw
MD5 SHA1 SHA512 SSDEEP

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.2MB
SHA256 5f91989871f7ff1bf0d5561af107ab6ac081e23b9fb05f92ab39d7d34525be32
MD5 b47323c199b4fc8806f8eec29ef6de63
SHA1 e8694ba8f7f1c1f6e9af0e2a6d12b0f19a7001d2
SHA512 0898a65b67f198fb777bb8d84e9aa30b41c46440e9dee4c353f74110c0bdf15dc4013870f401f33ba4c5fcd601c305b88c96adf778df60ae5b5904e942298947
SSDEEP 12288:eEP3R1rMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:914SkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.3MB
SHA256 006ebccda6a3e9ee020ae50c59eb6e869d5130ac0b65175c2aed889662e2da53
MD5 42484f6dc0205cf1203c494218ba2e83
SHA1 f8222f5956e52fef84bc07f6302916dc7e03bb50
SHA512 7334408c52620eae50a360ac1893c079404804b80ffe194de0e33e2ec458394d014abca1c1a900faa9fcfd64c71d3bb30018079d945029c6ed3de5b64ee5a921
SSDEEP 12288:/jkywMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:/IyZSkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 7647410cb060d37f035c80cc2f01bb62fc50df8af5f6321f62a5249741988e22
MD5 c92fb7b3b52d8b75b7a4c22a06466c16
SHA1 ea6b319e15a0f4e8e852ec713038f96300f8bd11
SHA512 5aaa59dc8820fae0eb3fbb63d843e97f4f5ed39f1e63e6cb495e567ede63d4e58bfbaf517094d1de40e3849f48fd035d747d84867c6e29f917baea4b533b585e
SSDEEP 12288:RKeMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:Q7SkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 bcd755debae1ea5411e83a28be2d7434dabe44b6f072decf63b1f9ec861b117f
MD5 5040195d1688b4298b6ba1e269215b59
SHA1 263100fe89ffced2fc73652da18a4b38041a86ae
SHA512 96619dc3851c6925de2741fd3503c2c934db1f332fb9dce62397c143e3ff8840478f6b69fac39f2e966782f3acc7a5babfb3e7f5b8b45c7746691fa4b1b60a25
SSDEEP 12288:MLQZb3C97GYnZMv5zBcKY97MD31MTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:aQ9MxZKdcz97w3mSkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.3MB
SHA256 8b93c6ecd53d0eb35702ab40d775eff7b1596751ab452c6002ec7b97f8343c2c
MD5 1fe52b28a39e1953ba86e4e2b68a2344
SHA1 50b63cbbaf0e6a8f93477b178aa9dbd6daeb4f22
SHA512 02af79c4fcacf2d537dd8ee2c2901908f06abe17abe473cc117c99c49f21bb24f8d5ee6933e81c6ecfb4b58ecd2c986629ae57fdb1e0c3ba552f384c725b1248
SSDEEP 12288:byoKo2tRple9pEMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:byocvAplSkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 289ab813bd9f561c5b7bc2503edcfd5577c5159d960108d00d84d4f8bb87a2a4
MD5 a053f589f52477f4a0330fbc6a44fe72
SHA1 7dae8d6b311719bdf6dc5b61cd2ad12d148a01aa
SHA512 7edc6896b5593c2dabebdbcbc2227f0033c4b7ebc14f09b412487e3dec1d1773d44acd7abff4e824213d4bc4cfaf569ad8dea43e6bc6112a9b5cc547d2f1d913
SSDEEP 49152:aWcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIKokQ/qoLEw:c0zuNIEqo4w
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/116-449-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/116-674-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/116-320-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/464-678-0x0000000140000000-0x0000000140199000-memory.dmp

Download

memory/464-354-0x0000000140000000-0x0000000140199000-memory.dmp

Download

memory/1060-428-0x0000000140000000-0x000000014012C000-memory.dmp

Download

memory/1060-309-0x0000000140000000-0x000000014012C000-memory.dmp

Download

memory/1448-402-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/1776-679-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/1776-375-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/1908-241-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/1908-45-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/1908-52-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/1908-43-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/1940-405-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/1940-682-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/2256-429-0x0000000140000000-0x000000014015D000-memory.dmp

Download

memory/2256-684-0x0000000140000000-0x000000014015D000-memory.dmp

Download

memory/2264-18-0x0000000000700000-0x0000000000760000-memory.dmp

Download

memory/2264-237-0x0000000140000000-0x0000000140141000-memory.dmp

Download

memory/2264-26-0x0000000140000000-0x0000000140141000-memory.dmp

Download

memory/2264-27-0x0000000000700000-0x0000000000760000-memory.dmp

Download

memory/2420-247-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/2420-253-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/2420-255-0x0000000140000000-0x0000000140140000-memory.dmp

Download

memory/2420-366-0x0000000140000000-0x0000000140140000-memory.dmp

Download

memory/2588-332-0x0000000140000000-0x000000014012D000-memory.dmp

Download

memory/2588-543-0x0000000140000000-0x000000014012D000-memory.dmp

Download

memory/3928-273-0x0000000140000000-0x0000000140150000-memory.dmp

Download

memory/3928-400-0x0000000140000000-0x0000000140150000-memory.dmp

Download

memory/4112-378-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4112-390-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4204-55-0x0000000140000000-0x0000000140166000-memory.dmp

Download

memory/4204-56-0x0000000002240000-0x00000000022A0000-memory.dmp

Download

memory/4204-68-0x0000000140000000-0x0000000140166000-memory.dmp

Download

memory/4204-66-0x0000000002240000-0x00000000022A0000-memory.dmp

Download

memory/4204-62-0x0000000002240000-0x00000000022A0000-memory.dmp

Download

memory/4348-343-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4348-675-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4552-450-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4552-686-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4596-295-0x0000000140000000-0x0000000140142000-memory.dmp

Download

memory/4596-404-0x0000000140000000-0x0000000140142000-memory.dmp

Download

memory/4612-238-0x0000000140000000-0x000000014024B000-memory.dmp

Download

memory/4612-40-0x0000000000DA0000-0x0000000000E00000-memory.dmp

Download

memory/4612-39-0x0000000140000000-0x000000014024B000-memory.dmp

Download

memory/4612-31-0x0000000000DA0000-0x0000000000E00000-memory.dmp

Download

memory/4640-16-0x0000000000400000-0x0000000000554000-memory.dmp

Download

memory/4640-6-0x0000000000AD0000-0x0000000000B36000-memory.dmp

Download

memory/4640-0-0x0000000000400000-0x0000000000554000-memory.dmp

Download

memory/4640-1-0x0000000000AD0000-0x0000000000B36000-memory.dmp

Download

memory/4856-258-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4856-259-0x0000000000EA0000-0x0000000000F00000-memory.dmp

Download

memory/4856-271-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4904-683-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4904-417-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4940-299-0x0000000000400000-0x000000000052E000-memory.dmp

Download

memory/4940-416-0x0000000000400000-0x000000000052E000-memory.dmp

Download

memory/4952-70-0x0000000140000000-0x0000000140166000-memory.dmp

Download

memory/4952-77-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/4952-242-0x0000000140000000-0x0000000140166000-memory.dmp

Download

memory/4952-72-0x00000000008C0000-0x0000000000920000-memory.dmp

Download