aaded7b9e4953dfe1d195b88f7be2b9768b020d816149caf345fd8bc65bace84

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
01/06/2024, 01:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
aaded7b9e4953dfe1d195b88f7be2b9768b020d816149caf345fd8bc65bace84.exe
Size 1.4MB
Sample240601-b689xsec48
SHA256 aaded7b9e4953dfe1d195b88f7be2b9768b020d816149caf345fd8bc65bace84
MD5 6dfc7a8611521af0c36582feda5183f0
SHA1 8c5a5103017789f82e3a98e6a6f157b97985011d
SHA512 2150decbcb1a867f5ed326e0f0f8a640f0030b45fd6b04855d13a222f25e8ab038dcdfad9fdaed9b19cd451bce58b17b991e8c71622b674770aa754657b7b9a3
SSDEEP 24576:rluO36FU23Cawqol2qDl9BL7FKyr7sBWbqreghLdSxFY:ReU2yjl24ToynwN/Fo
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
2244	alg.exe
1424	elevation_service.exe
3764	elevation_service.exe
628	maintenanceservice.exe
1952	OSE.EXE
2160	DiagnosticsHub.StandardCollector.Service.exe
1356	fxssvc.exe
2008	msdtc.exe
2364	PerceptionSimulationService.exe
1696	perfhost.exe
4180	locator.exe
4904	SensorDataService.exe
4700	snmptrap.exe
3740	spectrum.exe
1928	ssh-agent.exe
3220	TieringEngineService.exe
4532	AgentService.exe
916	vds.exe
4464	vssvc.exe
1460	wbengine.exe
4016	WmiApSrv.exe
2992	SearchIndexer.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in System32 directory 24 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\7f1f3a524a48edc7.bin	alg.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	aaded7b9e4953dfe1d195b88f7be2b9768b020d816149caf345fd8bc65bace84.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Install\{72342474-B513-4DE5-9360-4F37AA503DB7}\chrome_installer.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_95203\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\minidump-analyzer.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateSetup.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_95203\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	alg.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004c1e7abbc5b3da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d20a86bbc5b3da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000aa0140bcc5b3da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9908 = "Wave Sound"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005a41debbc5b3da01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003540fdbbc5b3da01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000004f00dbcc5b3da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000916d88bbc5b3da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9923 = "Windows Media playlist"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000042dfdbbbc5b3da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a7b8d4bbc5b3da01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e5a1ffbbc5b3da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a6e37ebbc5b3da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
1424	elevation_service.exe
1424	elevation_service.exe
1424	elevation_service.exe
1424	elevation_service.exe
1424	elevation_service.exe
1424	elevation_service.exe
1424	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
656	Process not Found
656	Process not Found

Suspicious use of AdjustPrivilegeToken 42 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1528	aaded7b9e4953dfe1d195b88f7be2b9768b020d816149caf345fd8bc65bace84.exe
Token: SeDebugPrivilege	2244	alg.exe
Token: SeDebugPrivilege	2244	alg.exe
Token: SeDebugPrivilege	2244	alg.exe
Token: SeTakeOwnershipPrivilege	1424	elevation_service.exe
Token: SeAuditPrivilege	1356	fxssvc.exe
Token: SeRestorePrivilege	3220	TieringEngineService.exe
Token: SeManageVolumePrivilege	3220	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	4532	AgentService.exe
Token: SeBackupPrivilege	4464	vssvc.exe
Token: SeRestorePrivilege	4464	vssvc.exe
Token: SeAuditPrivilege	4464	vssvc.exe
Token: SeBackupPrivilege	1460	wbengine.exe
Token: SeRestorePrivilege	1460	wbengine.exe
Token: SeSecurityPrivilege	1460	wbengine.exe
Token: 33	2992	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2992	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2992	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2992	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2992	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2992	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2992	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2992	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2992	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2992	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2992	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2992	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2992	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2992	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2992	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2992	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2992	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2992	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2992	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2992	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2992	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2992	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2992	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2992	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2992	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2992	SearchIndexer.exe
Token: SeDebugPrivilege	1424	elevation_service.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2992 wrote to memory of 4060	2992	SearchIndexer.exe	119
PID 2992 wrote to memory of 4060	2992	SearchIndexer.exe	119
PID 2992 wrote to memory of 4336	2992	SearchIndexer.exe	120
PID 2992 wrote to memory of 4336	2992	SearchIndexer.exe	120

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\aaded7b9e4953dfe1d195b88f7be2b9768b020d816149caf345fd8bc65bace84.exe
"C:\Users\Admin\AppData\Local\Temp\aaded7b9e4953dfe1d195b88f7be2b9768b020d816149caf345fd8bc65bace84.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:1528

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:2244

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1424

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3764

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:628

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1952

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:2160

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:1440

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1356

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:2008

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2364

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:1696

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4180

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4904

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:4700

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3740

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1928

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:1168

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3220

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4532

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:916

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4464

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1460

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:4016

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2992
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4060
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
  2⤵
  - Modifies data under HKEY_USERS
  PID:4336

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
Size 2.1MB
SHA256 366ff4b5c0920270e5e414b118b8b41e1e19c14fa3607af6d7038842e0b2f141
MD5 3eff8a53f900c90954378d3ee124c7c1
SHA1 7ec76201803066163bc6e242bf516b832f6d8e4c
SHA512 ecc3f0bcb858833e6cda0e42c2ef4e27226536d41c52daefbafb189f7c8e69fddda74d70e7ab2a89c44d8fc418b37a50ef6ddde0485a6d680de97177c2d1a00c
SSDEEP 49152:VuYk3H5koUafTqkkYLO/W2buywzMbOX+T7z5p2yjl24ToynwN/Fo:VCfTqi90bwyjl24M1N/Fo
MD5 SHA1 SHA512 SSDEEP

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 417e631a83041d8900db867d0820619d7cc42a42f3c20925039c7d11cd6a4ab6
MD5 f1c050670320032ab2915984d4a3dd50
SHA1 89f0fa224fd3784f001ee50d6c9e345c3a78f8c4
SHA512 94a7c6d522efe866bfde27806478cfab9bb0b59db9d3bd0f48fcc3b53877835829a639d1ed3c11fb5ceacabd0c1d35fe0000dfb3c648964576862033f53a3980
SSDEEP 24576:MiPnBsuEc23Cawqol2qDl9BL7FKyr7sBWbqreghLdSxFY:5SuT2yjl24ToynwN/Fo
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 399fc2efb9ee9e7110cd23c426ee8673627c5c4a2a3616c128195487f0d0af08
MD5 674469984e74c8db86145955add7d380
SHA1 359486f4b7e3bd4549bf2316188c25d0cb3bf448
SHA512 e30747b2ff742f0c9fb02a503581bd5c4d6f30bc9b162108de6b80f0bf8e6a13f0f24390178cb4689c9bae09ad949dede3ca6d4af8da59c545f6bd0d7f84968c
SSDEEP 24576:z+gkE1fh4CoQ23Cawqol2qDl9BL7FKyr7sBWbqreghLdSxFY:KgkERSi2yjl24ToynwN/Fo
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 d8310114163d8664fe2aeeff487e97159d013586f9725dad155a3acdb63347cf
MD5 12d0f68339fda52288035d0319c464f1
SHA1 24cded00986d7528433f7c82a9ba86d5d3f1f921
SHA512 864a8000c7d5c7797a6fe2202268f43b0d9332e3be6b66c72f874b2ac6ffd8293f98ce8d098a57af846c204781f79da4b44a98dc4b4c6ef1668155ee7a0b01ed
SSDEEP 24576:QBpDRmi78gkPXlyo0GPjrd23Cawqol2qDl9BL7FKyr7sBWbqreghLdSxFY:0NRmi78gkPX4o0GPjJ2yjl24ToynwN/C
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 8c0197c74aa0b747cad2ce9121a37f490f882d2bdc40562450230e6ab3d22170
MD5 c5e4cc651164552ad1a0d375dcb1e590
SHA1 3dda9a2e0651586339cd78bf1f12ac39b3b2b0b5
SHA512 59c3acf1fa7888fc8ee274e8ba0e3f84fa9d7a434ab36ef88176726cf819461d03087966b2632b6f96343c7f02536f9197ea0914978819b38b3b40026f351389
SSDEEP 24576:mLOS2oPPIXVQ23Cawqol2qDl9BL7FKyr7sBWbqreghLdSxFY:W/PR2yjl24ToynwN/Fo
MD5 SHA1 SHA512 SSDEEP

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 18e09644d88e3fbc13ff46aa5de7fb477254da480efa6e5a30ed55a5f78b83b3
MD5 526845a22a85fe09fc6740d4df53ea9c
SHA1 1c700ac0076f4d7fffbe78a8f6345176b63a4031
SHA512 26ffd366f4dc21e9902dfdfdc46c6ea7445f68ee7cb5e08a5831ba578bc8f0985a20a8eacf5ca0fc325c23788fa98bd9f5d7320987cfe2adf1d9675c64f1160e
SSDEEP 24576:xZC23Cawqol2qDl9BL7FKyr7sBWbqreghLdSxFY:y2yjl24ToynwN/Fo
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 fd55de41e9c775b8849c1aa3f870799d16d55835a3955d61cb68c4fce6fbefab
MD5 a6c2a0d7968a65076dd02d7bfa61523d
SHA1 fb5e4ff13df65427499eaf162d0e602979ae30b9
SHA512 fe5774020608bea30b898e5f91877721f83d8f3ec2ddecb19edd81c7a0274c72cd698b75d74f8891cc4aa58db970ca2e714a75aca6e3bb54bb01b6184ad4875e
SSDEEP 24576:BJIUv23Cawqol2qDl9BL7FKyr7sBWbqreghLdSxFY:BJIUv2yjl24ToynwN/Fo
MD5 SHA1 SHA512 SSDEEP

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 9854eeae9737c0b3d834662a994f2f3a4a0a42f3eb50bf236b0adc139ed63bcd
MD5 ed2dff684763632b044f71225aeaa2bd
SHA1 483a5c25d3067404f8082271152eb93a4f56b3ee
SHA512 61f6ddc9b6303c42ce831f84dd2b21e6397adea12a6fbb22512af20bcf6f35d1d79b7002b402197057bbd9bf09d93e429dac635418fa138ba733efbdb436da71
SSDEEP 49152:UQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJR9DN5J8NRV3THF:UQvGAdlCEL8c/RRNw5C9yjl24M1N/Fo
MD5 SHA1 SHA512 SSDEEP

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 f17659bbbf7cdb97bddab224bdc7500d23b7fcf277c1874f652dc0d46e8dbfaa
MD5 d45433f57583331a6d519c1145579ff3
SHA1 d7f01bd552099c8c8a1291d515ecf15b57543d24
SHA512 4a675de92e0dec6d32d5e7f475892580ce68205fb506dd992a22e35577d769848781d3719261361fc3fdef0e6ad4ce0afc2e5164f3f0c0b686f38b5e4f8242cb
SSDEEP 24576:8SewsAjl23Cawqol2qDl9BL7FKyr7sBWbqreghLdSxFY:Pljl2yjl24ToynwN/Fo
MD5 SHA1 SHA512 SSDEEP

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 2b5ec89649e5f23970c3188af714824acb4805fa429070c67d0585d08e3afc47
MD5 e119adaf3343b20b3cd72613ced02747
SHA1 9295728dfc052c2b24f9ca3305793ab478f8574d
SHA512 8e456dde8907cba3bd868712e9f1a5f6ad55e01b1e1eb3154d0d825a9ed77a2e1bace72186a056365e378eac4856003575cbba7ae2135f0383bef56ae1fa73bf
SSDEEP 196608:lUEtQeTbvf2zlO12sJTv6Ja1cpVLyRIldPlbuJHvlzM/F:lUEtQevvqc2W1cpV2RI32v2/
MD5 SHA1 SHA512 SSDEEP

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 5a763a2ce20431097d5994be776d399629bb91d9d083a61f9772bb9016b4d856
MD5 04ba5424b65a5c290f6e51eae2834501
SHA1 6336243cd67dd18435770a55cf5ba95c5a3f1a8a
SHA512 16602a4c289a1179c2b31b4363cbc3173e916916382e71dc4f0594a7ae1f50d54cab25e45ac79789f0f55e3af6de0eb9cbb974f7490896b880cb0f4aa38a853d
SSDEEP 49152:5CbRquA/m2yL5zTfFiV+XenmE3/zF2yjl24ToynwN/Fo:WoquVjnmhyjl24M1N/Fo
MD5 SHA1 SHA512 SSDEEP

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 4bc9eb7337f1818b5fde4efb69fc8e2f1407faf833e9a63a7b17aab40f1ab077
MD5 46162ac39421132cb0c0ac8771276328
SHA1 edca225958e9ce82ede386f25c27de7e846d81ba
SHA512 0512dcdfef5348154fc7b7490bd50657e9d944c4a5aa3a68dc4be9dc845af420b3072e808867a32b36c5138eef31080c7db77d8891d2c5667bd1702e142be31b
SSDEEP 24576:kAhGL2IFoiwtA5l7S53A23Cawqol2qDl9BL7FKyr7sBWbqreghLdSxFY:kAM1Foiq5w2yjl24ToynwN/Fo
MD5 SHA1 SHA512 SSDEEP

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 b5b55cc2893e59831ca563a1812045bb908e670ce4de5f6f9d6d9057bb6e2484
MD5 6cd12a6756ae0e98bab972af99ed624c
SHA1 45a8e4a2f762fa2acc6d26e95f8f49be81f32411
SHA512 db081712eb40af7dc65654c6a38e762ae8261325eb5ba6051f79a469886d0330b2682612873ee2a3a0a354d06bf53491b3b219b3df3be9e35065f3b57ead536a
SSDEEP 24576:bwuXOWR23Cawqol2qDl9BL7FKyr7sBWbqreghLdSxFY:bwsOs2yjl24ToynwN/Fo
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 97833f315fd8b6ec55ffcbf78944ad657c80daf9e6b24b5b22e232f5bf0a8685
MD5 6c995f1a2b6b874336c23ab06b7d51fc
SHA1 0d32238864a86d29677780da5ced387384e0ef47
SHA512 4a4c0b5e9333c15a9a8bfb8fd5f0b81fdcabc87475e1fac71c69caf428ec678800fc0885705ed6959f6c540579f9a5b3827048a936841281cd4de6c991fd889d
SSDEEP 24576:/ZuG23Cawqol2qDl9BL7FKyr7sBWbqreghLdSxFY:d2yjl24ToynwN/Fo
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
Size 5.4MB
SHA256 8bc54b05d45a047fcd93e3411584459fabd6d0ea1d2b81b1743fddedcbaea70c
MD5 783ac97fc5b7fe4cf7265d3e7a5d83f5
SHA1 1634d9c4788268d52a10239656bbe775ea0fefa8
SHA512 81166350d42decca0878a3b839bf042bb813bde558520c52a1525b1f33c82dbba4c0d59563dae1d70b623e158f0147a0dbbceda70db180a64664d80e810101fc
SSDEEP 98304:gwfhY7g/rLe7yYA3awr341gpyjl24M1N/Fo:c7Lyh8lzM/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe
Size 5.4MB
SHA256 97ca64d25b648d08c4f37fb075c1b141b2e1d9eeb6b0c5a95dd3bc25e2f9ac2b
MD5 fd534ffd41813b1529569e7334a423c1
SHA1 138d0bff1c637e353a416c12743faf8528850c00
SHA512 7ff20018bc0b5db531e1b6c2e9a50a7c39454034e31edd14c735267c9568f0d672d2f072f16bb62592bde0566b06b047995134e6b67a8a4fe9b274706ac81c6c
SSDEEP 98304:MwfhY7g/rLe7yYA3awr341gpyjl24M1N/Fo:47Lyh8lzM/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe
Size 2.0MB
SHA256 59f26d0bf912f4ef71e07ac9a672fafa3a422dea011b3d1b0a48da1d8cdb5fad
MD5 85904d95710765f2fd17447aa547d865
SHA1 83e27222fdaa6f404d3c030f663cae5e94968318
SHA512 91b60babfc51fb732756780cc56d3d6b0306b92e1ce0035b24de809021236d5e8b43d917316173c245976e5e5104ae93be59a05bec0b53597c258a875a7e9286
SSDEEP 24576:IcTyYv0FteQU75I2kjgD6iQacAR23Cawqol2qDl9BL7FKyr7sBWbqreghLdSxFY:IuXv0FtpK5606zOR2yjl24ToynwN/Fo
MD5 SHA1 SHA512 SSDEEP

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
Size 2.2MB
SHA256 629087426b7602e7bb12fb112d33ea52ce9758f99ed87d61e1ec77a5190d91fd
MD5 9fd175fb32d2a6bb2a6319be3b906899
SHA1 bd8ade9ce552c7f2f7a43e13363fd9af1bb64840
SHA512 309d89fe53df5499119a093233f48d694263fbbf1e2b9238e070eee018b34972ede9eec6355a28671a3651a56e5892187be8f95f7eafc852b9fd731d205d1fa3
SSDEEP 49152:Ky7mTd0GxN8jyynSHjXKUyn4GVcbDSKrNTxl2yjl24ToynwN/Fo:RmYeySHjWjMTwyjl24M1N/Fo
MD5 SHA1 SHA512 SSDEEP

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe
Size 1.8MB
SHA256 db356c85bd33974ba0b38987154b7a843c9740215670d0f5e390c6d7cb9d6feb
MD5 048302c29c032c7ed5c9e769da50cc16
SHA1 784c76fe5f1d20431899a0666a113187b5b444a2
SHA512 1ca38b80876fa865b8060c9029f14da726f258fd09997f6b0ca4dc9130e504b8a7c32b2943df7fedf248ba57de16e3b38c98dc42be292f07002823c40b04eb84
SSDEEP 24576:r6drZn1WEci182IEUgNbJeRgUebgW816u23Cawqol2qDl9BL7FKyr7sBWbqreghz:rWnDci18UNNUgbYp2yjl24ToynwN/Fo
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 1.7MB
SHA256 5574844572ec52f738fab1582f6cd73c736a4bf3b923b7a5f4a57e0feda97fd4
MD5 a4ea9af2915915cfc33dd93dbbaeb72f
SHA1 42ac643a50590a558987cd60984541c2bcea605b
SHA512 b9117aef180b74b8d0b00831d53b41ae578371dd2d31f73ba2e7ddaaff6309126df3625348d4a03b27227b585a48081c40db606556f9bddff9cb729c59f0a06f
SSDEEP 24576:Sk5lHW5EzMZupOR0G2reD+melRgTTv/1nyT23Cawqol2qDl9BL7FKyr7sBWbqre0:8izMZz0GhamSoG2yjl24ToynwN/Fo
MD5 SHA1 SHA512 SSDEEP

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 625433f3a9f99c09a465aeff5ccc7f4358f9741ccaec3cd5ece6640a241d1ab1
MD5 abfed5003fee4f47b29ee292e079734d
SHA1 f47b36d00b68ebbd96803b1de1cc3f72f34b1e02
SHA512 d899341b42b58ddc2bdffdb42abd486b34f43d1bd6343b90e91463e924c7ba5a540f44092a0bee4e191b56dbb67f54190296f751ab0b6340c310af34ef0e28e5
SSDEEP 24576:P623Cawqol2qDl9BL7FKyr7sBWbqreghLdSxFY:y2yjl24ToynwN/Fo
MD5 SHA1 SHA512 SSDEEP

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 31922167726b572135a31958170c57e52e82f066185cab6f2edd2700a1f5d4f2
MD5 3572d8f162c28ec78e5f7317a3dc1662
SHA1 b542a56864dd1a0aaa5e29deb3a0a9f3327dfe49
SHA512 2b300743923b48d435d89c3c9895641cae6457f56ad0bf55af4c440fca43276346691bce78048e3a47c517e6879b890a87a6184f29aac204dff97cd24c5d3c48
SSDEEP 24576:O523Cawqol2qDl9BL7FKyr7sBWbqreghLdSxFY:E2yjl24ToynwN/Fo
MD5 SHA1 SHA512 SSDEEP

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 4d7df9daafdf6075aa64b374df99801c89046ccdfeef3e2843a558564dd0e5af
MD5 be14e76466408c5b041a26f18bab49f0
SHA1 9e1000e2f78a7b69a885c7e9448ea41a4d96722f
SHA512 18c4c339ccd574c2a4b08ae47ee2b6e53a54490572adf59ca7bba83688014990a498ff5b10804cc9efb828c4faaa241ce5e41fbab70ea7ef572be368eceb9053
SSDEEP 24576:8n23Cawqol2qDl9BL7FKyr7sBWbqreghLdSxFY:w2yjl24ToynwN/Fo
MD5 SHA1 SHA512 SSDEEP

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 44a1750ae6371e696bed4283d50ef6da130ccb4a1f94883f2bea79dcd4964987
MD5 9e2275fc009116eb18881af3a19f628a
SHA1 63711fa0966b4088420da65427ab6fba8a908fb9
SHA512 350492ca806a65e939975676fe434409a613ad8f9fbf5d208ffddb1727a1b7d220996557d05d5cb4bef3ae769b0358ab77f62ee37a7110818837bde0cd465fa0
SSDEEP 24576:923Cawqol2qDl9BL7FKyr7sBWbqreghLdSxFY:92yjl24ToynwN/Fo
MD5 SHA1 SHA512 SSDEEP

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 9592202d6db8ba5532df9a2a96ee1b463a22f75a28af670d8249e9114558ec7a
MD5 03686f3bd3902ad31037999b97b64a72
SHA1 d2b9d24401e36fe129f36745985662de33fa131f
SHA512 c01d140d69b25247aec30cbdc0571895b83ea7890966b67947e22bd7e34a16ccdea67cd46450a01b26f01e9efefc8592261bdd9f5590208cabaf002c0a0dace4
SSDEEP 24576:Zo23Cawqol2qDl9BL7FKyr7sBWbqreghLdSxFY:e2yjl24ToynwN/Fo
MD5 SHA1 SHA512 SSDEEP

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 06782cfba026a384edb59ae8149c672d60f0e257f81c3976c6a9edcf9ccf0fcb
MD5 8af0dbdb3489e0b64305e6a1857b1808
SHA1 4ea8c0500ea940338da6089174d455f1ac91a285
SHA512 62753162add3a51e59130436729d85a60d82d3d842eb6cb748699f8785d462364a489ecff070cbf8dfdc9d2867ec62640655598bacba99a8e735220baf9bcc6d
SSDEEP 24576:zd23Cawqol2qDl9BL7FKyr7sBWbqreghLdSxFY:52yjl24ToynwN/Fo
MD5 SHA1 SHA512 SSDEEP

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 6ea1e043263fdcb0a41aa27fde3cd4d7cb1fdf4e4c8b52b6983ca11bbb87b206
MD5 27625a84089a9633f8f7d79cccf082c9
SHA1 d76350f56f6295088d549d88142e7f9b64fa56c7
SHA512 e860bb139f615fda21eafbe8099b060dea231bafe711342061148faf4727013298dc46c020e83cd328d9dd4efc32f6e5a7631daa82e57466f5cd80d9c481f6a4
SSDEEP 24576:tB23Cawqol2qDl9BL7FKyr7sBWbqreghLdSxFY:X2yjl24ToynwN/Fo
MD5 SHA1 SHA512 SSDEEP

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 f163bcf8f5125ec271f3bd6fc6d2bc1f7715690614d3ebad16d4016573ffd429
MD5 8d08355fc5de0899927592731e17a9b5
SHA1 f3b96f58e52e7a9655caa2d9c5efc0b4054c4615
SHA512 23324145ddfc8756dc7934840ab4bf9a65bdfcd86615692ff2350777f81a822102dc18d33f781ab49ce65e58693275ea55205f63d29f2e0e3412550a7f6276e6
SSDEEP 24576:+ZMMzFVSOZ23Cawqol2qDl9BL7FKyr7sBWbqreghLdSxFY:+ZMMzft2yjl24ToynwN/Fo
MD5 SHA1 SHA512 SSDEEP

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 6e5bbc4cac0198bcade84467bd9c0f02ba4dddd5a451066e435050d3ee5494d9
MD5 e1bb199e38620929f4c6db93620b24c0
SHA1 26ba13cb803d218930402363bda292bdd979e691
SHA512 f9035eb9e3db2ad260c6095d470ed3bf79275be1a68689e75222769da7afea378751e0f9780f7116131ccccf8d6bcfd96667325cae7e2966dfa15b470dfc40b6
SSDEEP 24576:HW23Cawqol2qDl9BL7FKyr7sBWbqreghLdSxFY:22yjl24ToynwN/Fo
MD5 SHA1 SHA512 SSDEEP

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 60ae664b40bd713d68f9fd4d61e54f6706df10ee525bb933c90a3251f0c9952f
MD5 53762b8ef8aa2f594da64ba293037b14
SHA1 d9cf6a1244474cef26347022339778ef8da9b4ca
SHA512 c64376769a6da67c7a48a9935035cfee23a00a0d925c2c6a81e12864010a306612578bc88fee0a6f2b89d2368bc588c806edb4d13ec2bcb9b635cecc6d8384c6
SSDEEP 24576:GS23Cawqol2qDl9BL7FKyr7sBWbqreghLdSxFY:d2yjl24ToynwN/Fo
MD5 SHA1 SHA512 SSDEEP

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 d79fd87d84bde91e60cbd768931b72fc394efe3f9e632223f1fe77d08ffd97e5
MD5 8b6fa6774e48c79346f91dc7bc4a7c95
SHA1 b06d472239027280a41f41e561ad0004f8adb8cf
SHA512 7c8ddc5ac30598e6aa69cdddd001b9801fc694ccd4e378c2e33cd2e63efebcfff9747361763104c8cf0e643e02cfa74616976f749eccacf1da80329f65450ec8
SSDEEP 24576:Czy123Cawqol2qDl9BL7FKyr7sBWbqreghLdSxFY:CM2yjl24ToynwN/Fo
MD5 SHA1 SHA512 SSDEEP

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 4864caf5bc799734fd71a8d7e8ffca23ed3d96f7b8e6a182badc012be9dd43f6
MD5 f4682ad77f4155f127af4d6c770519bc
SHA1 be8a6c586339dd7773ef7c84adbbceac77f150e7
SHA512 b890e57598001451ebf134aee4b85353afe872bfc23accc188c559f2d842baadcbf5559306cb1dc78ad067ffd38164f8fa32202f2907ba2d645e29b7cd1586c3
SSDEEP 24576:hW23Cawqol2qDl9BL7FKyr7sBWbqreghLdSxFY:E2yjl24ToynwN/Fo
MD5 SHA1 SHA512 SSDEEP

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 1a6a0edc2fbf5dd38a6a55725f06bdf758aebea8ba2fdaef310cda06fc6bd2bc
MD5 e2a8a00a23f0c8680c47e44e8ba566dd
SHA1 fbf472a0dd6a535dbab7e6056dcf6c88afa9c053
SHA512 da83df991532930967daee24b8170773610584f280fa74a57bf31bc5b94e9dd976d4df74e527f5ab6c5384b299d9861a93379f90b90daa89bad883342395fa30
SSDEEP 24576:OW23Cawqol2qDl9BL7FKyr7sBWbqreghLdSxFY:F2yjl24ToynwN/Fo
MD5 SHA1 SHA512 SSDEEP

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 f76eb13daf90ed7021e00ae4c12f131133ce8f5c64858d2607d4d3a455b0e26f
MD5 f931a02020a763528d9e5a56a2f517ef
SHA1 89936412e6072ca9c7e4ff3309984e2a6fba79c7
SHA512 0db77b584360fcee9dd343b38184ee11af0d4f9cd176458a13161fc743c539da69ca342f9fa2b670784c0c212b6246428171cf2eee9aa98f2efbdc4c9514fcbe
SSDEEP 24576:jzy123Cawqol2qDl9BL7FKyr7sBWbqreghLdSxFY:jM2yjl24ToynwN/Fo
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 34de4d298c0bd0847421bee05065caf22b04c113c5c371e187c17faf3f4793a6
MD5 ea8db573642efeffa40bd86ac515e934
SHA1 8a4fb9fb1ece91214316681ab4c7523d7573afa6
SHA512 c26d39a4b1ba1e6ca1b6114c44fbc953be0f8f428eacec2dcc9db96d44ac759dfc94ae8a0ce82a377e61c645fd02354e9deef207366f72b80e84f51218b154fa
SSDEEP 24576:4T9aLl3z0zDX23Cawqol2qDl9BL7FKyr7sBWbqreghLdSxFY:4TQLlj02yjl24ToynwN/Fo
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 088baae282cace1c63890b4d5a715cdade317c43c3f91f849037050ebf1fb4c6
MD5 63ae8fe446ce389672fb5e717e63bb23
SHA1 fe899f261d9b663a19ec0a71bfc18dd4c189f08a
SHA512 fa45cdd85e4f308d18d77897a10a532bc4bee177e6d671c23699bf79612c76f056ff852291461b506ebb1822c23317298e8cb052922cc7fcc335b16761437151
SSDEEP 24576:J3td9CHKy7GZb23Cawqol2qDl9BL7FKyr7sBWbqreghLdSxFY:Ztd9CHKyat2yjl24ToynwN/Fo
MD5 SHA1 SHA512 SSDEEP

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 594d987352941d7c3c4d7df9d959c8182ee21c0bc1fb3087a65cf1098b882562
MD5 ec18b45fb0afac878feda554db7dac39
SHA1 b8f801d0b544e3812295c5285a8c6c74a79a234a
SHA512 cd054a62e1697774c3f0782bc5de4b675c577ee0bf6151266e4467066086b503a521c973ea4a1d051e4d8014dadef826fbf6cba1aa1070b8ef9af513137b95d5
SSDEEP 24576:lH23Cawqol2qDl9BL7FKyr7sBWbqreghLdSxFY:l2yjl24ToynwN/Fo
MD5 SHA1 SHA512 SSDEEP

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 233fd5319dfabdac569a90911c724b0fd159bb59f0bc86cfa0cc8e32c7bde158
MD5 1f7d483d07d9a022e218fc7a08ae6a55
SHA1 ec95c80e54516f5b44e55a135a9682e8595e89f7
SHA512 51ad5409117cb6867273d28df509d5372ae9f2974412ba67d703480714e4d1beb793011da671b7fed16b496e4955baa04a5523a8a5778813f2708e742e84a380
SSDEEP 24576:aV23Cawqol2qDl9BL7FKyr7sBWbqreghLdSxFY:82yjl24ToynwN/Fo
MD5 SHA1 SHA512 SSDEEP

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 e2ac694c76da213f97a837ff8d8397dd8cdade5b4953a829ed0adede6935552e
MD5 34c34099806c5928fa5c558e4ff88f07
SHA1 eccf110cb0d81536912a9e7cd9c3a9314989714c
SHA512 e8c57168f39b40567c6dc399ee16d355d00c40563be04608ae8b76cbcac36c7a51acb09534abefb08587baf69c30035cca1f7d564241024e15ff3a9ce37afed3
SSDEEP 24576:Ac23Cawqol2qDl9BL7FKyr7sBWbqreghLdSxFY:t2yjl24ToynwN/Fo
MD5 SHA1 SHA512 SSDEEP

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 be80323e7caea2e922951c21ebba03e81f9abf7b7e5a7c4167991f19ad19b0a0
MD5 563e6f9981e500d583d52b410c6c7218
SHA1 1a99b28e950eb8036b267e098ada75f2e4320082
SHA512 e6bf584308ccb90307baf26b47f89db696b898fc53464ce1257b186ed7a3f1e28eb5573873eb902bdeb051a0edc89e6c2ec75de2bffd3e54e7d6245ddad99ded
SSDEEP 24576:JW23Cawqol2qDl9BL7FKyr7sBWbqreghLdSxFY:c2yjl24ToynwN/Fo
MD5 SHA1 SHA512 SSDEEP

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 31c99817e526c14db29ce49cb9fafc253d1d8c0f70eb08b5a57b66fd144657ae
MD5 54d9aba087a04946b974273dc18da47c
SHA1 a3e2d0de219bbb4a391df4f101d8c6eb81fdbcb8
SHA512 4ced71add4bb9452b09d0c97ed9b077280a993e8dc4e9df0d8ad665b1e54bdcb427b3637687cb8f6b62f7300b9f507ca02708f0d1ff1bab353bb6cea02d5b22c
SSDEEP 24576:NH23Cawqol2qDl9BL7FKyr7sBWbqreghLdSxFY:t2yjl24ToynwN/Fo
MD5 SHA1 SHA512 SSDEEP

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 97ea0a538085bd1e2aee63aee7f9f43f100ed5d6d2df363c1c484735153ef2bb
MD5 d07dff0f3ccb9e696bb28fea610b6226
SHA1 6ea69713c2ac43235b5456877b8a74e32092ace6
SHA512 e6e5402672c080e78a32f228a1f36515714e20d605580d54d5699a26d2714612858f6609c3d6d9bb029cba1ea5537e8378e68d8ba4d91cdf4339f217293d52d0
SSDEEP 24576:le23Cawqol2qDl9BL7FKyr7sBWbqreghLdSxFY:o2yjl24ToynwN/Fo
MD5 SHA1 SHA512 SSDEEP

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 f46a4ae392222afc0cb082359eee1b37e39facb3cd2ae70795c7907256971d3e
MD5 a70a261bd03c0e3cd00ec94165a542c9
SHA1 e58a0e80ac3d0b41b0ef47d8ed1ef56e7e761776
SHA512 7bb9c91cd49d8b87233321fd86e973c310b8b850f5a0ddb1008d5d493c28cca3247a64e75387131bdf8757f761f63e79e8653228a5a766a7eed62771575935ae
SSDEEP 24576:po23Cawqol2qDl9BL7FKyr7sBWbqreghLdSxFY:O2yjl24ToynwN/Fo
MD5 SHA1 SHA512 SSDEEP

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 760770157aa83ffba269da7f6dfccaf2c7e194a25624b8b0140d480d8766f1d3
MD5 0d738bd0462bd06791947dea4c5c9287
SHA1 288dee546564e70f9d6063c5e34412b1fbf4cb1e
SHA512 e68adf22f2445dc5f6fb881c0d8361e9ef76293bdfaae3c424e94de20c5401e81cf11c57642cc0d18ccde4ac462a1d4d95327b44f29e5e12b6560f237cd67284
SSDEEP 24576:sL23Cawqol2qDl9BL7FKyr7sBWbqreghLdSxFY:y2yjl24ToynwN/Fo
MD5 SHA1 SHA512 SSDEEP

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 27255ffa366dc5d5da338debe5f126c971245b71f216a5dd49a08a31fa62198c
MD5 a599b565aea9904d37e39ea8e9b282fc
SHA1 4cd02cd1d359bd42e2806fc53782d007aea4f00f
SHA512 254b4fbc0898aca6ebbd8b4414f84af6b3a2f1e395d3692091aee89753d3cd935daea2dd004cca6980bd4ef2b826cfb937080280b487ae56f6e664a25d48551a
SSDEEP 24576:SR23Cawqol2qDl9BL7FKyr7sBWbqreghLdSxFY:SR2yjl24ToynwN/Fo
MD5 SHA1 SHA512 SSDEEP

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 43ca136f380c30f1992b587a36ef45f7b2db64a35b1e799b618a8eaa3950b38f
MD5 a3ecc3e1027ead27bd541a1988ee52d2
SHA1 d7e7d81f2c5b8eb2c3f08f2e22bc14f832b3e49d
SHA512 13549ffcf972871a8f8fc0b1c1120a4c05cf3006e1c599d49db6a274f32fcdd72855e2725d29f7f62676d35bb98fecfb1c14e9385dc85aa0d4bb510d58096c8d
SSDEEP 49152:Oa0h2GEkuAe73q3pp46zwwQz2yjl24ToynwN/Fo:Oa0hNYG4JwPyjl24M1N/Fo
MD5 SHA1 SHA512 SSDEEP

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 2d19eac6408cf571704ec5ec3bb186f165e5a83df25b2687e1c0005a4343d0e5
MD5 7048ddb0eae86a526be6b30f31a35fdd
SHA1 fad0630bab70f188c64c649c93e7d9316ead0e40
SHA512 78b9bf3fa02de3ca77ac8709b154362d1b4a7672409761b30f79eb08c82bc6cbeded46472412da5fb1a1e57d5df7ae7614c920ecb217bbe84c238e51a35f340b
SSDEEP 24576:lhbHjP+23Cawqol2qDl9BL7FKyr7sBWbqreghLdSxFY:lhbHjm2yjl24ToynwN/Fo
MD5 SHA1 SHA512 SSDEEP

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 235cd95150d491489ea2452ef0072ae9ad39d81816e18e33f4c63aca9a3d07e8
MD5 cdc483904d92c9aa19b14c0af33899fa
SHA1 98110a4decec2f0c9e9eb5b8bd96142418991b4d
SHA512 e4eec22ee412a84f31ddce482f91d232406f0f7c3c22e9b2a18c38f8bfd6a7bd039d2cb05cf5e3140013c190849b93cb82cdde0500c8d52c96f5fc0760e7a3b9
SSDEEP 24576:k3YgnJcRTk4yti+R5dpR/W23Cawqol2qDl9BL7FKyr7sBWbqreghLdSxFY:kIgnaTk46ppR/W2yjl24ToynwN/Fo
MD5 SHA1 SHA512 SSDEEP

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 4b9a7271ab85e74c7908a3d1cbacd97d5259750d905273149e8bb22b88242951
MD5 6071ca9067060c9f9fb6a945e23c5352
SHA1 7ac5e7a23682b57ad57b03adec01b561cb4c6d6e
SHA512 faa5dae0b8873345d62545b87112effcf0c3935db9dad8306b6a86f9014b8cbc463dbb4391030cc0292824028d99183e7c944cf0ed407f7e56e827768cc6db76
SSDEEP 24576:SN23Cawqol2qDl9BL7FKyr7sBWbqreghLdSxFY:SN2yjl24ToynwN/Fo
MD5 SHA1 SHA512 SSDEEP

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.5MB
SHA256 419faf69d473b608efc5d9b3a55a3cdc743762cf610cf114e9301c64d1e83874
MD5 63be5b1ecbf3d631ccb9e112988d59ba
SHA1 74eec3f0e28d32de98486c46996e60f502494039
SHA512 c1e3734b39d25aba1d9d2905f00ef1aa5362aa1241b19b850d2b2ff7715747e151e2ccdf00d8a51254394ba14a29fcb754621bc535dd2880b36dacaebde9928d
SSDEEP 24576:5rL3UTw23Cawqol2qDl9BL7FKyr7sBWbqreghLdSxFY:5rL3UM2yjl24ToynwN/Fo
MD5 SHA1 SHA512 SSDEEP

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 30a6afb980ba636c4456c5354b053e38598ff85b8bedac60839813dd997dc7fc
MD5 a1120564333d619ae952f0fc463052f8
SHA1 9fba8a04fa13811fc75b3642bc340088a00e9f2f
SHA512 99d9eb25f7f700733c1663f707f11100939236aea5f1d0dc204ce40a703765030210718dcb1e7810d6a1bd7c4bbe523665f0f15fe8d985fcd614a1b1ab2744f2
SSDEEP 24576:nOs23Cawqol2qDl9BL7FKyr7sBWbqreghLdSxFY:nOs2yjl24ToynwN/Fo
MD5 SHA1 SHA512 SSDEEP

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 1f7a3d32e70a4632513b2e9008d9b5ea3839804c96f94bb79cf7f7095b677ac7
MD5 34319f8033110d8c3b4cfacf45d7f009
SHA1 a3839f066867115420b8606a81c4eb46aa55da40
SHA512 6702499c7078bc94f4085ea2f6d95efff84f50d35deb84844bdd8183415376ae1295c9566c91bf6387e0b92108667cfe29beae99fadee7921c01c0a812149b74
SSDEEP 24576:K7NM9YmZqmWMUkPjZM48Mv6bEhsh23Cawqol2qDl9BL7FKyr7sBWbqreghLdSxFY:K7cBWMpPjN8DbEhe2yjl24ToynwN/Fo
MD5 SHA1 SHA512 SSDEEP

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 ec2336527341dcdb77b70c757d5dcca4baa356c8dfb9df473a8bc1bb4c9bb3a5
MD5 d20bd20349a6ec0a5a7604dfa6ea81d5
SHA1 6e4b56ba6a398b33393a7c42daf57b2564744b4e
SHA512 a346ce763953d7fce67341d394cff496e97902a23708fa13c159fa3f2408d23791796821514fb7fb0236d34d5f7c978889c67df259432d414886369ee51006f1
SSDEEP 49152:PF2YuHNETovcvNYf8kmB2yjl24ToynwN/Fo:W6tCf8k1yjl24M1N/Fo
MD5 SHA1 SHA512 SSDEEP

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 cba08f0c063d2b712d6c609b1f184ae7468754779162b95fbd903e2e7a9a54a5
MD5 b0fa4977f89e87735153d7a205da60a6
SHA1 0c49aa130e3b8a7e042ad10aefe0e8fa113c3422
SHA512 74fc50e3ea918393e468486a1cce1bdf11e952beb67defbf1868d388f02233fc9e5ed3813ec7b44d944d4f760dff298fdc653285b34bd1b14ff49d9c89ffbdc7
SSDEEP 24576:3AFs06+OmlfQNXEbTo423Cawqol2qDl9BL7FKyr7sBWbqreghLdSxFY:QFs060lcXuT2yjl24ToynwN/Fo
MD5 SHA1 SHA512 SSDEEP

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 655d54576f173fd9e1eb408976b508ead13c8bad057fff7e9ba6c1347fcf6c8b
MD5 abf4dac1ebc8fc5865372df17353bd48
SHA1 1c376e7be174df6309db7106a8e313bca71870d5
SHA512 dabadfef7804e2356b22e1ccb057e412ef0c329ab481f62af34507269418a60235111831fa4349c3e2a2393f193fc813273f61f72c6d9fbc1f50885836ebd40a
SSDEEP 24576:4JnJ5D3WtT23Cawqol2qDl9BL7FKyr7sBWbqreghLdSxFY:4JnJ5DGtT2yjl24ToynwN/Fo
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 81eed1b66fb18265aafd179d9ab1e3515b328c2326af907e214595a6a236d9c8
MD5 0fe2c3ee14e262f61be8d80b8c0b27a6
SHA1 479ed786e37ec449815b8aea76012543e06d869e
SHA512 42f23459bc59701f7ef2d49595953719ecdb9767bfcb335c16995125ac64b8dc0a39cc3ba4b98192450b26ef9b58c3b98e0746ae41bec1af7b69ced225311307
SSDEEP 49152:Do06DIKdwc+eQnSt65aV12yjl24ToynwN/Fo:8myjl24M1N/Fo
MD5 SHA1 SHA512 SSDEEP

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 ebf1b3510db07c137a2b0828a6bc012424554d8c0ef170bcdd058c73c5c23dc6
MD5 6c129efca9590d204af3416ff1c82bdc
SHA1 60bbaf3d685337321b9a638232ba91d415268595
SHA512 66816daf49918a05a9a9ecb1d696a58875b983f70190df731c80e7bfb523dbc1f20e0e8f6c902a89349216b91b0cd7601a906392ffe2f921be0c7a6ce80bf62c
SSDEEP 24576:vrqV23Cawqol2qDl9BL7FKyr7sBWbqreghLdSxFY:vrM2yjl24ToynwN/Fo
MD5 SHA1 SHA512 SSDEEP

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.3MB
SHA256 91b4970820a1a3c2eb4ce86740efb2fd050cdea0db5c62a220c36acba7859611
MD5 9ceaf9e4186a10891090d5d908fc0d8f
SHA1 149f4f6ab215317fe60b61783f88e8c2bf9a3f69
SHA512 6fc0e9b3b88eb49ddf65172cfea66b707c66479316d87e9e8be76505e75745ea9e0f533e145d58fc4b6bbe73cac3939beeb9110c0385f0aec8dfc770fa9e04f3
SSDEEP 24576:GIyu23Cawqol2qDl9BL7FKyr7sBWbqreghLdSxFY:GIj2yjl24ToynwN/Fo
MD5 SHA1 SHA512 SSDEEP

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 9916cdd3260f146f5bbf88e179abadcd5541dcc6957c23d5fe54c5ee97a4f790
MD5 337f5d812f611a75ef8f45adeaaa66e9
SHA1 4521827dd07459a041f46df8a070581a5b7af1f9
SHA512 04626f61e9fa602d8deb76a8c73b74b60fecfbecc99713c55aa68f56c70fbc9e7ccb3647e16d937c26dea854802ce604ac10d3cc4e9a82ace7615738bfdbc451
SSDEEP 24576:5c23Cawqol2qDl9BL7FKyr7sBWbqreghLdSxFY:5c2yjl24ToynwN/Fo
MD5 SHA1 SHA512 SSDEEP

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 116a0f88eb8527a3f8bf54d37551a23e3cbe0144249971f5151fcad7a8e249b9
MD5 79f291316c3eb77c3325c095bd3a141f
SHA1 5f409b575c2c6f898dd74935877a1a2aa9c15204
SHA512 7b8d2d674ac1fda0589f1e1501f2ac18fa2fbecda4ac7d67672cf2c062751ea6ac4ea0066116bb3a7b691cad96567119c49048ba25f1f12bb94d75c34a498dc0
SSDEEP 24576:hQ9MxZKdcz97w3J23Cawqol2qDl9BL7FKyr7sBWbqreghLdSxFY:hVKXJ2yjl24ToynwN/Fo
MD5 SHA1 SHA512 SSDEEP

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 7d08d03eb9f2be796b456875aa468b8cc48fefda8cf87a00cb823f8b54e9eeb0
MD5 9acb16e4d9b32c518ae8039de462e431
SHA1 220aed8bf780c0c3bae2d32b392887a2e83e108b
SHA512 ef25bf0457ebf30af972b48c8a0da62f857fd911dca8f9f92a4152ccaa413963879321f4613a50f24c2eb69d1c0306eb60ed85247d5eb1df219828d4665ad7cf
SSDEEP 24576:7yocxApa23Cawqol2qDl9BL7FKyr7sBWbqreghLdSxFY:uocxApa2yjl24ToynwN/Fo
MD5 SHA1 SHA512 SSDEEP

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 eb2d43b0bdf7d7d12507482702ae524d41cc3d0149239a9af0e99e8704576789
MD5 f5659222d0510cad822cda94237488bc
SHA1 08ac045471541a13346aed46ba11fe34bd43dc7b
SHA512 d11d794dcfef63cd4069faca189334f4b9e0006e79b520267308ab1759ad4c002a9e6534b567f36bfeb91c449e7b606eef94c510e27b3fcf480de82d68459573
SSDEEP 49152:TWcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIKa2yjl24ToynwN/Fo:T0zuNIbyjl24M1N/Fo
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/628-62-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/628-236-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/628-50-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/628-59-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/628-56-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/916-600-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/916-375-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/1356-254-0x0000000000E60000-0x0000000000EC0000-memory.dmp

Download

memory/1356-268-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/1356-253-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/1424-34-0x0000000140000000-0x000000014024B000-memory.dmp

Download

memory/1424-26-0x0000000000D80000-0x0000000000DE0000-memory.dmp

Download

memory/1424-232-0x0000000140000000-0x000000014024B000-memory.dmp

Download

memory/1424-35-0x0000000000D80000-0x0000000000DE0000-memory.dmp

Download

memory/1460-602-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/1460-408-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/1528-6-0x0000000000960000-0x00000000009C7000-memory.dmp

Download

memory/1528-0-0x0000000000400000-0x0000000000613000-memory.dmp

Download

memory/1528-12-0x0000000000400000-0x0000000000613000-memory.dmp

Download

memory/1528-1-0x0000000000960000-0x00000000009C7000-memory.dmp

Download

memory/1696-294-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/1696-407-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/1928-345-0x0000000140000000-0x0000000140241000-memory.dmp

Download

memory/1928-596-0x0000000140000000-0x0000000140241000-memory.dmp

Download

memory/1952-237-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/1952-72-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/1952-70-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/1952-64-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/2008-374-0x0000000140000000-0x00000001401F8000-memory.dmp

Download

memory/2008-267-0x0000000140000000-0x00000001401F8000-memory.dmp

Download

memory/2160-356-0x0000000140000000-0x00000001401E8000-memory.dmp

Download

memory/2160-243-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2160-242-0x0000000140000000-0x00000001401E8000-memory.dmp

Download

memory/2160-249-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2244-14-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/2244-15-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/2244-231-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/2244-21-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/2364-283-0x0000000140000000-0x00000001401EA000-memory.dmp

Download

memory/2364-386-0x0000000140000000-0x00000001401EA000-memory.dmp

Download

memory/2992-606-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/2992-432-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/3220-358-0x0000000140000000-0x0000000140221000-memory.dmp

Download

memory/3220-597-0x0000000140000000-0x0000000140221000-memory.dmp

Download

memory/3740-325-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/3740-592-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/3764-38-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/3764-46-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/3764-47-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/3764-233-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/4016-419-0x0000000140000000-0x0000000140205000-memory.dmp

Download

memory/4016-603-0x0000000140000000-0x0000000140205000-memory.dmp

Download

memory/4180-297-0x0000000140000000-0x00000001401D4000-memory.dmp

Download

memory/4180-416-0x0000000140000000-0x00000001401D4000-memory.dmp

Download

memory/4464-601-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/4464-387-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/4532-368-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4532-372-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4700-322-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/4700-591-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/4904-595-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4904-308-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4904-431-0x0000000140000000-0x00000001401D7000-memory.dmp

Download