1b5c7e49fc3e375bd1df88ec8c0ba066159cd1b095a996296263e87256994281

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01/06/2024, 19:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1b5c7e49fc3e375bd1df88ec8c0ba066159cd1b095a996296263e87256994281.exe
Size 625KB
Sample240601-xt72zsch33
SHA256 1b5c7e49fc3e375bd1df88ec8c0ba066159cd1b095a996296263e87256994281
MD5 4b933af8151fc84e97d305d6a6e61b76
SHA1 a61ae37274497be80db0dd9919c8459fcd5396ae
SHA512 640bbe8ae491bef61209cf6a9630f959b71e8b8638ec74499b13e358688b1e7583960cc39ffde2a70fbf696f5612ea8e2bce2a8dbf44d674be8269e7f7d32060
SSDEEP 12288:02nFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:Bn8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
2384	alg.exe
3612	DiagnosticsHub.StandardCollector.Service.exe
3900	fxssvc.exe
1820	elevation_service.exe
3216	elevation_service.exe
1548	maintenanceservice.exe
1268	msdtc.exe
4332	OSE.EXE
1044	PerceptionSimulationService.exe
4536	perfhost.exe
2856	locator.exe
4976	SensorDataService.exe
324	snmptrap.exe
2252	spectrum.exe
1512	ssh-agent.exe
2236	TieringEngineService.exe
4500	AgentService.exe
1748	vds.exe
1520	vssvc.exe
4480	wbengine.exe
3064	WmiApSrv.exe
440	SearchIndexer.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in System32 directory 37 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\wbengine.exe	1b5c7e49fc3e375bd1df88ec8c0ba066159cd1b095a996296263e87256994281.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	1b5c7e49fc3e375bd1df88ec8c0ba066159cd1b095a996296263e87256994281.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	1b5c7e49fc3e375bd1df88ec8c0ba066159cd1b095a996296263e87256994281.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	1b5c7e49fc3e375bd1df88ec8c0ba066159cd1b095a996296263e87256994281.exe
File opened for modification	C:\Windows\system32\dllhost.exe	alg.exe
File opened for modification	C:\Windows\system32\AgentService.exe	alg.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	1b5c7e49fc3e375bd1df88ec8c0ba066159cd1b095a996296263e87256994281.exe
File opened for modification	C:\Windows\system32\AgentService.exe	1b5c7e49fc3e375bd1df88ec8c0ba066159cd1b095a996296263e87256994281.exe
File opened for modification	C:\Windows\system32\vssvc.exe	1b5c7e49fc3e375bd1df88ec8c0ba066159cd1b095a996296263e87256994281.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	1b5c7e49fc3e375bd1df88ec8c0ba066159cd1b095a996296263e87256994281.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	alg.exe
File opened for modification	C:\Windows\System32\alg.exe	1b5c7e49fc3e375bd1df88ec8c0ba066159cd1b095a996296263e87256994281.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	1b5c7e49fc3e375bd1df88ec8c0ba066159cd1b095a996296263e87256994281.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	1b5c7e49fc3e375bd1df88ec8c0ba066159cd1b095a996296263e87256994281.exe
File opened for modification	C:\Windows\system32\spectrum.exe	1b5c7e49fc3e375bd1df88ec8c0ba066159cd1b095a996296263e87256994281.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	alg.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\a3652072c3136770.bin	alg.exe
File opened for modification	C:\Windows\System32\msdtc.exe	1b5c7e49fc3e375bd1df88ec8c0ba066159cd1b095a996296263e87256994281.exe
File opened for modification	C:\Windows\system32\msiexec.exe	1b5c7e49fc3e375bd1df88ec8c0ba066159cd1b095a996296263e87256994281.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	1b5c7e49fc3e375bd1df88ec8c0ba066159cd1b095a996296263e87256994281.exe
File opened for modification	C:\Windows\System32\vds.exe	1b5c7e49fc3e375bd1df88ec8c0ba066159cd1b095a996296263e87256994281.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	1b5c7e49fc3e375bd1df88ec8c0ba066159cd1b095a996296263e87256994281.exe
File opened for modification	C:\Windows\system32\locator.exe	1b5c7e49fc3e375bd1df88ec8c0ba066159cd1b095a996296263e87256994281.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	1b5c7e49fc3e375bd1df88ec8c0ba066159cd1b095a996296263e87256994281.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	1b5c7e49fc3e375bd1df88ec8c0ba066159cd1b095a996296263e87256994281.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	1b5c7e49fc3e375bd1df88ec8c0ba066159cd1b095a996296263e87256994281.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	1b5c7e49fc3e375bd1df88ec8c0ba066159cd1b095a996296263e87256994281.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	1b5c7e49fc3e375bd1df88ec8c0ba066159cd1b095a996296263e87256994281.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	1b5c7e49fc3e375bd1df88ec8c0ba066159cd1b095a996296263e87256994281.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	1b5c7e49fc3e375bd1df88ec8c0ba066159cd1b095a996296263e87256994281.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	1b5c7e49fc3e375bd1df88ec8c0ba066159cd1b095a996296263e87256994281.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\minidump-analyzer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	1b5c7e49fc3e375bd1df88ec8c0ba066159cd1b095a996296263e87256994281.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_104468\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	1b5c7e49fc3e375bd1df88ec8c0ba066159cd1b095a996296263e87256994281.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	1b5c7e49fc3e375bd1df88ec8c0ba066159cd1b095a996296263e87256994281.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	1b5c7e49fc3e375bd1df88ec8c0ba066159cd1b095a996296263e87256994281.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	1b5c7e49fc3e375bd1df88ec8c0ba066159cd1b095a996296263e87256994281.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_104468\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	1b5c7e49fc3e375bd1df88ec8c0ba066159cd1b095a996296263e87256994281.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	1b5c7e49fc3e375bd1df88ec8c0ba066159cd1b095a996296263e87256994281.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	1b5c7e49fc3e375bd1df88ec8c0ba066159cd1b095a996296263e87256994281.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	1b5c7e49fc3e375bd1df88ec8c0ba066159cd1b095a996296263e87256994281.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	1b5c7e49fc3e375bd1df88ec8c0ba066159cd1b095a996296263e87256994281.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe	alg.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	1b5c7e49fc3e375bd1df88ec8c0ba066159cd1b095a996296263e87256994281.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004fd4174d57b4da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f133394d57b4da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a06e534d57b4da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001d6d724d57b4da01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002c1ac14d57b4da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000062e0a64d57b4da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008899fd4c57b4da01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d976994c57b4da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fed1364d57b4da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000008d99b4c57b4da01	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
3612	DiagnosticsHub.StandardCollector.Service.exe
3612	DiagnosticsHub.StandardCollector.Service.exe
3612	DiagnosticsHub.StandardCollector.Service.exe
3612	DiagnosticsHub.StandardCollector.Service.exe
3612	DiagnosticsHub.StandardCollector.Service.exe
3612	DiagnosticsHub.StandardCollector.Service.exe
3612	DiagnosticsHub.StandardCollector.Service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
656	Process not Found
656	Process not Found

Suspicious use of AdjustPrivilegeToken 41 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2896	1b5c7e49fc3e375bd1df88ec8c0ba066159cd1b095a996296263e87256994281.exe
Token: SeAuditPrivilege	3900	fxssvc.exe
Token: SeRestorePrivilege	2236	TieringEngineService.exe
Token: SeManageVolumePrivilege	2236	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	4500	AgentService.exe
Token: SeBackupPrivilege	1520	vssvc.exe
Token: SeRestorePrivilege	1520	vssvc.exe
Token: SeAuditPrivilege	1520	vssvc.exe
Token: SeBackupPrivilege	4480	wbengine.exe
Token: SeRestorePrivilege	4480	wbengine.exe
Token: SeSecurityPrivilege	4480	wbengine.exe
Token: 33	440	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	440	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	440	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	440	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	440	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	440	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	440	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	440	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	440	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	440	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	440	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	440	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	440	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	440	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	440	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	440	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	440	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	440	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	440	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	440	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	440	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	440	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	440	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	440	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	440	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	440	SearchIndexer.exe
Token: SeDebugPrivilege	2384	alg.exe
Token: SeDebugPrivilege	2384	alg.exe
Token: SeDebugPrivilege	2384	alg.exe
Token: SeDebugPrivilege	3612	DiagnosticsHub.StandardCollector.Service.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 440 wrote to memory of 1804	440	SearchIndexer.exe	116
PID 440 wrote to memory of 1804	440	SearchIndexer.exe	116
PID 440 wrote to memory of 3712	440	SearchIndexer.exe	117
PID 440 wrote to memory of 3712	440	SearchIndexer.exe	117

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\1b5c7e49fc3e375bd1df88ec8c0ba066159cd1b095a996296263e87256994281.exe
"C:\Users\Admin\AppData\Local\Temp\1b5c7e49fc3e375bd1df88ec8c0ba066159cd1b095a996296263e87256994281.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2896

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2384

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3612

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:3508

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3900

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1820

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3216

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1548

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:1268

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4332

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1044

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:4536

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:2856

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4976

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:324

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2252

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1512

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:1696

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2236

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4500

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:1748

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1520

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4480

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:3064

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:440
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1804
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
  2⤵
  - Modifies data under HKEY_USERS
  PID:3712

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
Size 2.1MB
SHA256 7a41aed8dc937496b6fe473eafc88b783160da3dfef7aefa0f8e8b2f0b6dc2f6
MD5 6115fb3eda4c9a0b05a286dc365e405c
SHA1 8e20ed9fcb9663dc0026307ac0febff5920b8bab
SHA512 e7c611ffe11e2be21e70048b3dc306ae5a52b1706a1d44ccb679751d7917cee040d91de827db253ef324566e7cfa3a1bd3d06fb0cfdd5aa7c57791c6b6c7e511
SSDEEP 49152:OuYk3H5koUXfTqkkYLO/W2buywzMbOX+T7z5MgDUYmvFur31yAipQCtXxc0H:OPfTqi90bZU7dG1yfpVBlH
MD5 SHA1 SHA512 SSDEEP

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 797KB
SHA256 fc2e7399509636dc98351dd3d2d76306dd6f28e3d28d7795e108db4d0e0306c6
MD5 df3a8589e9f3c06852091a17d619efca
SHA1 5218fa4efd4ceb9c134b7e7265e67a9af4e4f9c9
SHA512 26c8818359bcfce5fca262b093922f50ce441d8fde5c89025d28a8a91e8636716ae047d618f60b53724f6d235773cf11454ee2ee2380e3a1ad9c4d3eb3e8e782
SSDEEP 24576:kidnBsuER8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:PSu+gDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 93515e1ea55f90e580f94b37ed8559840374ad0d383e50aed2edb3cb62470a0c
MD5 a739d4919ac43862373b6cd05b1e63a6
SHA1 7b04c33c0bc3120f2437a59dc164051e0537492f
SHA512 8049ec68b9323fadc29eb35a7e077de3c9e7e157ed0c18183b8bfd116638ca3e843debcc1bd93cff3f79138710937f336cc68019d006b32674bdd9f06ae6a99c
SSDEEP 24576:v+gkEVfh4CoN8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:mgkExS3gDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 4805f2d9fe47ad4b550a3ba8ed97e7f4d3574c63a88aaff352248cf3f90565e9
MD5 fcebeda903e1e22cf126589c66b2ed98
SHA1 f31bf76563b42dc66ec413a464eecae107b065b5
SHA512 35996ec9e197530c6b20c358545313578f16e55fd5460ea86a9e837c90f81e62625eb5dd12c1ab14897cc9c3c757d213e3e0be8f1fc9644291c6aa59f6f312bc
SSDEEP 24576:eBpDRmi78gkPXlyo0GxjrI8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:qNRmi78gkPX4o0GxjsgDUYmvFur31yA6
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 0168466154869412f25b0f14d8e35fd01d0f155b2afd0c4751848e6528050c13
MD5 34da11fdd7637c0e76d331c2bab1bd43
SHA1 900a2e5bbc19ced69f7372d97850d9056dfcad29
SHA512 1f5126ce7b809671f4f14e227abd4edde80c192a5cf2da0b14c369998c285476b72ae6f6df1b9dd1ead8da985a98cb3a7d261658a2a1ee20bf5bb8fae025325b
SSDEEP 24576:NLOS2oyPIXVN8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:n/yEgDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 0d76bb2fa713f34ea9213f618d63476deb422a4e31d3b4e235457b3ee86f5d20
MD5 3498e33762d5987938d234586dd8d644
SHA1 da00be223c0a7a6843b4cbf02a5f5b68f57cfbf6
SHA512 876fcfdf28185dd9fc0efad57228f3ac7cdfb2631b745a1505a396823b87e29e9638a7b3e221ffcb3286cd688c0b53ba305f3444cff2c444c165fcaa1622ef89
SSDEEP 12288:bIfXFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:bIfX8NDFKYmKOF0zr31JwAlcR3QC0OXn
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 5f08db5093fdfbcb364525e08db69154e8662ca21f780a6cb21a2ea8caa29b2c
MD5 d8d1ddbba31917631986df64253dbcd3
SHA1 5909e34a0f1947c0236fda797a3ae99654f6ee8e
SHA512 4ec2470eae2bed3d0296b5161bd4540a170c3f83bdd2ae8eb70409754566bbeffd6d1162255d38825b9a5c55c5882d3f941339e9a4b52e541d078b7386b18526
SSDEEP 24576:TJIUy8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:TJIUygDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 ffc1b4bec5c5be98476b0c4c764f2ff7606fb94e0b69f7f7a49869b6a7b56a3a
MD5 3bd257d425d8398b8f62ccd107bd8b4d
SHA1 f95b8541df291dc062b075fab84d63e849776586
SHA512 2b705f1e6357d3044e447f79a48840b26e48737f3461ba994f7a23abf29af4625eed9f2c3accbf0b0a7a4ac399d0ddaa18d7616b6d9d4b9e86257896f6255813
SSDEEP 98304:HQvGAdlCEL8c/yRNw5CQU7dG1yfpVBlH:wvyEYc/y3w8QUoiPBx
MD5 SHA1 SHA512 SSDEEP

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 ab7bb1fd761850614f009e583ac8ecd481f214d89a397379d5df973790e2c10e
MD5 c5be11fd855b41d4b68df69dca795627
SHA1 23dded441d64372a0d66a1b2a01297be2b9e3684
SHA512 4a0ed34fdd12f48e3f6ac7971d789f702271c20a60493bae980ef231386c50d72aa972c35f4579b80bd2e8e2f829c7186f89751370da81b19cd8da8ad379165a
SSDEEP 24576:AdewsAjg8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:wljggDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 5c65e93d5ca9b5504427fe8ec9e53672e3bdf46590c4130145810f718854746b
MD5 b7626f37f8d7ca2f46abf957c7a27fed
SHA1 db552a76ef0a333621bc5d2fb35aebb878e2c745
SHA512 4827ad3c0e96cc3ca1c79dcc829cc06eab7b0aa596072b18cc73c7f3c43dc805119812e5157c283635b5f7c839e1b294f3558974e79059952357d8b23d3df685
SSDEEP 196608:WUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHRUoiPBx:WUEtQevvqc2W1cpV2EI32R
MD5 SHA1 SHA512 SSDEEP

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 12895ca9bbfb08af4ef188777667062ab291cb6dfff304fc41ce3c028fef55b6
MD5 cc83d4e093ad749400a4a3a02311c3e5
SHA1 e2623e854f06802ba60752a0776381bdbb4ce5f4
SHA512 ad75e5a3075b9229363259a498a1fd55c4a6b78dffc282b74e4fcbd6545698a0abb04ff7fe9ef0f80916739d8408368498b88a1171a9acc7ddb4655e5562d8c9
SSDEEP 49152:wCbRquA/m2yL5zifFiV+XenmE3/zAgDUYmvFur31yAipQCtXxc0H:ZoqHVjnmMU7dG1yfpVBlH
MD5 SHA1 SHA512 SSDEEP

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 50b2affb9c948fe5bae44b40fe4b33ba806d53daaa202ecbff4b8bc44e0025dc
MD5 a4239c6474f0d46f7ced7f2751d38483
SHA1 30c422ad1689a2abf9b3ccc0ae26c3f174edb713
SHA512 9961d4dc594f20f7431ab35f62f37350446dca7114be72515cb23431777245e1029ee432062f6f10105fb14b120d812856113f5f9ee787687d3f47883dfb8621
SSDEEP 24576:uAhGLJIFoiwtA5l7S5398NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:uAMyFoiq5tgDUYmvFur31yAipQCtXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 845895a681d7290a83ac82583b63110a7b248f9d4d1709352dae01a9d01720ff
MD5 1577db5f0d25a77d7c6606b01e7ae74a
SHA1 4bbea54371c305bf785d7f58ce94792e29f559ab
SHA512 97a3cf6480c0d539fef2be71ef3a8399eb844f55284e485b9b10ca24739a69d1a9aef557d2a6124c0545630fc5dc268a2c7f26dcde442cb1807fe93fd3a85274
SSDEEP 24576:SwuoOWE8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:SwDOhgDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 7a1f8dbc3a649e20749875b2f828b53ea85f98df6a835490e32d2226cae9b511
MD5 0500d322f52a50602591b341f0aa9067
SHA1 6f85f8209697190463683aa17fc87a4905032d08
SHA512 5f162516277d16c72bb1ec4c067d9972b37686e15fcacaf26653ddf6e25234a2e5cdaa24c73c9d264fc74bc347af4cc89dcddcd2c90cd555bed8717479fff2b3
SSDEEP 12288:EBZ1IywFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:iZuT8NDFKYmKOF0zr31JwAlcR3QC0OXn
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
Size 5.4MB
SHA256 c47f4f44a5569f63c26200af8d6507741eccadc677ca1cddec9ebbde488e5898
MD5 dcc3f3fbed8ec3a09a7dfa448acccb10
SHA1 54e5584b026e9db580d435aab8603b531a2ec468
SHA512 875a6e43081490428351973f3661442710c20f116193f4cd44de31315c4393462c321e0c43808a69bd5d832941bbbb99cae3cf50cea8b2f81feccb300248f4e3
SSDEEP 98304:AwfhY7g/rLd7yYA3awr341g0U7dG1yfpVBlH:878yh0UoiPBx
MD5 SHA1 SHA512 SSDEEP

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe
Size 5.4MB
SHA256 729ac23a4694b3ea12116b888e40aabcef68a994605619f8faa8ac20f39cc99d
MD5 3b7c25869703335b5aace0a8c8dc5f98
SHA1 1863ac91935de2f514c4647c998f4d29d9ea3186
SHA512 d42216d12d5c8975184536e04f279b34a4739cfd2d2349f5ad22311f9a7d2598bab0b65bf3942241c7aed79fc6ff4c45a41bad7d60767c75200f9b3e037fddb0
SSDEEP 98304:XwfhY7g/rLd7yYA3awr341g0U7dG1yfpVBlH:978yh0UoiPBx
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe
Size 2.0MB
SHA256 3a70d580a49dc36d7faaaa68a785dd95ad14d275679611298719d2f9c7de703f
MD5 94ed9543834898966bce837dbb37ee26
SHA1 4b2a3464e61493fda0f8cc1051bdf9a5b210cf18
SHA512 06ed04be70446320e2f0c3064dc12552c861f4c7168a7de264cd66e3ad3a8c28eee79543848d82cb1447f44a31b389842374d1e628bb5187baee4e568a308607
SSDEEP 49152:YuXv0Ftpn5606zOEgDUYmvFur31yAipQCtXxc0H:fc56FwU7dG1yfpVBlH
MD5 SHA1 SHA512 SSDEEP

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
Size 2.2MB
SHA256 629afe06c8f7b6b97b47edc03f3c07e3ade8fa006f1a2576d35e2dbcf72d51ae
MD5 8bde91fda8e4c7c7e6a9f7959cb476c0
SHA1 0e63045988e9c6e7d4d48eaaeb4d21218d0a6540
SHA512 3f3f162e23d07dfd388ee512b60a9ca3463fcae0ce24d43a6d0b5ca856effe3d4ae63bf821a93083d2024771f635e41075e423346a8d6642b8e14e18750908d0
SSDEEP 49152:qy7mTd0GxN8jyynxHjXKUyn4GVcbDSKrNTxggDUYmvFur31yAipQCtXxc0H:xmYeyxHjWjMTZU7dG1yfpVBlH
MD5 SHA1 SHA512 SSDEEP

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe
Size 1.8MB
SHA256 660080f3fd33f1b681562ac97ebab80513dd5c1d57b27f062b30d8e75474a9a7
MD5 97e3acc290d99b96a2b3bc580de9656a
SHA1 9e8500d44b44814005e209c722f93d2b21cbb4a7
SHA512 4210f1fe3f30cdf005e423c55a7d6e6a04715b7384acd2bee0f636cbb1a3d0fd3fba189bb7040365e7630669a3cad8a5fe6d1733031c03d134e1ace6b5103167
SSDEEP 49152:TWnDci18yNNUgbYMgDUYmvFur31yAipQCtXxc0H:aIqNNoNU7dG1yfpVBlH
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 1.7MB
SHA256 98f9e2bc01a24ce7c7f712bd7df5e25cc34faaafc5dd8a1e381939365576ea87
MD5 46d7170db5a41c8d21b91c81271bd212
SHA1 cda46ccb0d77a7922270a2832b2a1cc0d6d56224
SHA512 723d82ffd7c126828588fd807beb44258d2bb346c903943b695e0b0d8a6244dd7b29d53fdcad2229878e7277254e0299176e82d33a53c2bd4ceb7dd5fa5c6705
SSDEEP 49152:sizMZm0GhamSoTgDUYmvFur31yAipQCtXxc0H:sm0UWo2U7dG1yfpVBlH
MD5 SHA1 SHA512 SSDEEP

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 30da8e1759c69c58e2eae77223e0e9f61cb71f58cfabdbc5ce58bc1729bdde00
MD5 ddcd5032ada0fc294c15e060c7b0d8ba
SHA1 241c6d8bc68e6f76f0dce48ae6d3f44306114c13
SHA512 3d9448e40efc75dd1718a41935ff894e9cbef5eb6cda37774cf1ca2ed6eae5e07306c84c023c6f67b5566b677269f5fdeebb7cf84698bbb7426f097b91c7ebe0
SSDEEP 12288:d/FCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:d/8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 a59739977280123a0151ee143399b5291f149f483c55b3d79c4c198e42647807
MD5 5f313ef1c4c543fe7e729e432e0c85ef
SHA1 4246556690eb5aff008dfc924f41e37b2cfb154b
SHA512 34825ae9f05ea6748938ead7228b23980da6c033a35e005b3c35aa2c7a39d9753a6dccdc05db5854a98f3d214b20fc5ff458b3745b955f1a81ed25627c54f9fd
SSDEEP 12288:+cFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:+c8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 e2f838f6684cedde338254bf903f3327e8a65660cd80db9b03d169ec476e490e
MD5 fee6093d628e66387d5418b5b9b0061c
SHA1 8ca61efee3d4835d49d41cd5eaedba68e00a24e1
SHA512 4cb341dbacda3f940461c2ff7e59f4aac08ea5bf7b8f4d9c6d5f8dd2911cc8830ffc771e3b8aade4f76fc00306b6637582f4403148cd3a4b39bca694f23378d0
SSDEEP 12288:WaFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:Wa8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 22a3bd29e9e6178c6f959050dc872fd61c4fc1bc2ed155763f07cead52478326
MD5 9f9a1c1e38e4175f73a5309d1c0a8720
SHA1 6edddd484608ada08643b3c30f6ba5a449758a3c
SHA512 0307493fd5aff99b6e99f90f77003971cbfa8faff4fe9b1dc157bcf8edac0d7d9e33c7f9f3f203a1e41cbbb1cc1d1775b32708ba9a2dc1ecbec780b34fb619d5
SSDEEP 12288:nVdFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:v8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 5c1759c88fa9238859fa013f766855f29756944a004b533fbd69de64edd16d3e
MD5 2c4bba647eea56e00f03d14b5b397c97
SHA1 ccc3c5e546260d5168d4253261f74b9198cc5cc3
SHA512 680919d552682086e1265804865966ece021c62f9c00dbcc447ce72cbed2bbfb31a1ed1c23e53451061412771fa6c2d0cbb1c2775697083b21b25f1d7503cbaf
SSDEEP 12288:8VFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:8V8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 aa896549e9139ba24e5543a7830e53a56215c957dbd0f0ecbf57e7a3b62ce3be
MD5 8656c3c167d5be1ad608ab7cbca7c92a
SHA1 c98870e1bd6b96cd71179f2f45d1556179a4dc29
SHA512 03d49fd54bb78096a5926a4f80ade2654220b7045d45fa7c0a607af75aa224464f7c36e744da782680e9096fae9b25ee0800908e7a7920a351bc8e9bd3c63dc6
SSDEEP 12288:uIFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:uI8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 776e9792de233ff5bac8fddd917e44f677190414372b1b5bb3a99ce38f81e091
MD5 719f90dd46a2421623ba93af1f56fdc0
SHA1 d5e7bac8afafd9df1397b8e6d76b6cb7168da941
SHA512 68b4a8d0166c2c6e49dc1d8c6fa7eec8e79881805378bc92a8139655c561454293c89aab78e9e4e2f9e672f2d169172ea8aa3ccf903d65b46e60ce5bb7acf368
SSDEEP 12288:z0FCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:z08NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 6c01d00eed28b16a337a3c51b8759b6613f0d9a76f3ab57822b8698b567cdc46
MD5 7d2ac9d58aa724c8463c3d16ffc5b58e
SHA1 e63cc00b794b608985935056c76d9ce12bf52422
SHA512 c68234cd53974204c413a34d1223334ce2db30a42b556a09fbc372b1d8f787df483fe8988b617eec9bb37a1e1d149eb91ad047910366db29d15678b3b15258f9
SSDEEP 24576:PZMSzFVSO88NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:PZMSzfYgDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 7f94429af7cc79541d029261247f0e9d60e8c22e7477cef97cce8a500206a3c8
MD5 6db3f15daa25f3753a0f3d177be82458
SHA1 4b3d4d8e105858c3f7aa19e4719cd550b9dd43f3
SHA512 70c0f9393c755e0dc36c1737f42d38fd7c4cb58fd2233d18efa9a126a36beb694b2d56fa0328d6af54df98dcd3246cf15e0453dbb490e0538ae399a38e99c0cc
SSDEEP 12288:2jFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:2j8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 ce666715614a57fa7089791061b500d5f2ee9bb4a29b831b15bccb68acc55512
MD5 05e5656cb4bfbd59c7d755ee7bbd5fbc
SHA1 bde377f5596d570618357f14384b1e616dced80d
SHA512 0815abe424fdf6b4134d619b37b8a5bc8c37d96540ff9bd91df021454c9cd428bc7008d53f5f48e5659b1ee132766070fb9612b7649c405d9496493e3f381891
SSDEEP 12288:4nFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:4n8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 ebc6a024330037c4d3f784e640ef20c127f1f6e3294b74823211fcf333059928
MD5 13a110fc47c6400b2e028c6d422810d7
SHA1 01653fbe9c56d616d3ea2b72589824b42a0b8d33
SHA512 cf4e900ef9760846ae2ba7e97aa467eea644e69ca26d55689ef37012b7420a92664ee917fae1b2ea73b94695ed786c12cb536367635c8890c4684fa4b4b6378c
SSDEEP 12288:ayPz5L8wFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:Hzyw8NDFKYmKOF0zr31JwAlcR3QC0OXn
MD5 SHA1 SHA512 SSDEEP

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 f71e1d1361f0d991ff70a029ab02d08e4ef830c3c33e997ddee8cdee5c7d077d
MD5 1646a62c7881e6dce82217c53ae77b4b
SHA1 b07bc0b7689f2fcbc4f60d2e93194c4228fd4127
SHA512 e02d012ba26c57336e9ce3e66e3df0230e06e18a95c2b93930ed9b7bf67946afbda26dfb561e81b939364fd513c597a9128317645f5186321d339e42588f4b68
SSDEEP 12288:hjFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:hj8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 97dd2e6f199e0f485e476c99a7afa7dd8a3e235763b22eeca42e9783da9fbfff
MD5 4d54af476a115e9224b1505373a4dca5
SHA1 19804a3bfd96d091051dcd906325a8dbd7a6ced0
SHA512 e99b3a2b2db5cbdbe89e968ec1e930114b9830bddcacc94de0df49f8361b9109e2bec08a043d1ca8eb3fc63c7e9dec3b0a34df6d3d588c7c3a6d869125b62360
SSDEEP 12288:WjFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:Wj8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 5587645f79ca8b2035753e0c1c77036fcfab7e2af2944697e86329fd96a33ea3
MD5 fc75f8981a4bbf76004efaec1cf66781
SHA1 906361062ef8b533394c9c7c35452abacdfa6854
SHA512 8d2e0a4548ae254b64889b4f0ee770be6331366c568fa6862f5f0b616391fd3d44fcc66d81929638dd3e8312abcb0f58dbb80d6d3946bde72e8a139cfaf56976
SSDEEP 12288:qyPz5L8wFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:3zyw8NDFKYmKOF0zr31JwAlcR3QC0OXn
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 ac44de1be7806d8a8a932c6c36cc9c65cc0b92a8edd1b56dcb68426211efbf0f
MD5 dcc704cef8a9806c14f3d00f9a990aeb
SHA1 66817d8b7a4c3424ca41ad445aa51dd7fd5950e2
SHA512 ca0e4591058d36678eac00417f76f284dfffa152aca9ba15bfa18c29cbc079904c1f2af0198792096bdb1ec33b8d0bcfef2bb34c4471d719141e9da24a8559f0
SSDEEP 24576:LTHaLl3z0zDK8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:LT6LljZgDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 5a75b139208066e024404611c8eb8696ae12102c14ff249bf572f8652f9c03c1
MD5 d845be3f773b623bdafe4e047ed727fd
SHA1 796ad19a61a98a833e9b4d3ae5162d08021c804e
SHA512 008b6dc21e85f8ea13236f9f287de72aa0a3172b4a14e94285dedc4b3f4f0781470c2de0433bb471b66142a0a8002a09ed26f3a8dd31e13e3cac4bc972b232be
SSDEEP 24576:537d9CHKy7GZW8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:J7d9CHKyaYgDUYmvFur31yAipQCtXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 79ff0aa1af581547163e49013a7365b9a470977fc1bb0dbe7ed46ac485cc5001
MD5 f3d675d5852b2f1239c7a012fcd68557
SHA1 12402965752dac3e9a9c9d133c2bd66666b7ce2c
SHA512 7dfa3f136e1b2a54f18fea961a004dd8ff11a0cba7529cbf91c307bb43fe0f2622d826f0146da80a5a0c5b97def8b394d252fe4c3d404dcbacda3531258cebae
SSDEEP 12288:C6FCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:C68NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 8e38492691f89010c3ba2de6c58aa18c15c6b32fb8ac1cfe4fbc5f031df1d103
MD5 2f39aab71e79bae6faa0a23224d80e86
SHA1 c141c2cc66c559eb217ab52b2ce29cba976771d6
SHA512 01c37cf4421ac67476731400e482b4b24d1c283096d1d32199b23854a0f14ca1cef1c657c432dfc4ea29f467296d89210bcdb6dfdbe53351ab702277d6873681
SSDEEP 24576:vcP4mcvIjkGOxhKP2l71SNKbrh/8KB78NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:kP4m4IpOO67N8KpgDUYmvFur31yAipQi
MD5 SHA1 SHA512 SSDEEP

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 701KB
SHA256 7fee2a8f47c2bc34d3303a277955254c07efdedc658100fdfcdcb24ffc0a52ec
MD5 d64fd59d92f8cdb3bf2108633d99c4f7
SHA1 dd1ffb0674a53e7d906f3f69a5e5f17428507d21
SHA512 7a83bf1ee3ac700cbb7879fa95abd91d8a8485159565495151c398bf7536b5b66772b4d723032457c0d88d37d154c6047fde522d723d4e171a7afa5f19b4a7bf
SSDEEP 12288:+UFmDDLGFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:EG8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 c0aabe6068ac9671412be0bef466a8ad7d4b9e8d6677aad394add43a655ef236
MD5 b084fa29c2b0bfe3fa6367d58e49b955
SHA1 16153f273cbf37d7b5cc1054e3fc11b07cc087e5
SHA512 362672d27c04bcf6732262ded5d16166fdbc60ad54a135e1d15d95f82d133063fdabe5cb7725725c38a95e61111d59700a478eb5a0d242444f7929742deb9ae7
SSDEEP 12288:WzFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:Wz8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 dfa3a60053596e3ab336a78b490731bd7a17791cbb870cc60a3c271a913514f7
MD5 dc8fc22640cc0e26c9b314c2fb3a6746
SHA1 b1b43918b60f1bc415cc79cdd38285e52373cbd3
SHA512 fe75ab50cc5bb72b491fc87d6e08334938d4846cddafc738e2a40f844255e37ef083b7e66ef6da981e7cf722c8ce8b40c27103e989348b0a4eeeedf1feaf9c60
SSDEEP 49152:Ma0h2GEkuAe73q3pp46zwwQVgDUYmvFur31yAipQCtXxc0H:Ma0hNYG4JwRU7dG1yfpVBlH
MD5 SHA1 SHA512 SSDEEP

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 659KB
SHA256 923315e255eff22e597fcb98487441e31ad8b01bf757f1f73f30e90da61e0758
MD5 c0772bf254dce7c924e4cafe66c1c12b
SHA1 c1fed57d476b312b22fd39151dc01fe1a859c1c7
SHA512 9c2ecefce26a9e6d770888cecc72fdd3de51f921b94f8790e121f3f8aa15503e3d753126abf986aec3b122f17016c716b3285ff22133bc284cf137c6a47d6cab
SSDEEP 12288:ChbHjfXMFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:ChbHjPM8NDFKYmKOF0zr31JwAlcR3QCx
MD5 SHA1 SHA512 SSDEEP

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 cfcf69dd3e1330aa9422d6fd428d1ebd5d16fe2a2bb7d63486bbc42b189a46c9
MD5 2ed98fe6eb2ee2573ade28f9a51805d3
SHA1 a9f2e3f3c517b44d943a36795a17dabea4d7a5bf
SHA512 a9a60c72767bbd65d661145ddc574b65ead972421db8e95a83763c481df9f46f8bfd6b90061070b21eb8b23ab436a1faa738703e5314fc9bafb9e854df6ca119
SSDEEP 24576:U3YgnJcRTk4yti+R5dpR/E8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:UIgnaTk46ppR/EgDUYmvFur31yAipQCx
MD5 SHA1 SHA512 SSDEEP

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 578KB
SHA256 f81717469244100e367090a903109c7064c13268a43d81263753b536eac75e2f
MD5 147263e6fb04af099375f088e577adc6
SHA1 da6373dd62cf66cdc2b0340d5c14f33092907f9c
SHA512 3b8c23a706c1a3552f795ce547a9f6064bf41eb82304c2ddad0bbf5f0f4b577ce7d1951706b26e6212d60f19712ba5e6becc4c0ff43b4378a596ecf76a87bb3f
SSDEEP 12288:s3FCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:s38NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 940KB
SHA256 94b246008164eb6f348aed2cd6838d3ea5c564e9002af664efa1294ca2de1b16
MD5 76fac5027786d7b56f8fcbb47d1f9fd7
SHA1 58be4399a2c51c6c0251c95508558b41d86a39b4
SHA512 55f984fbd8c46647d84d64c41c24400a260c8000ef1250fc19a02d318d1603a98e5f08bb6318ea4e5ce896efa3b0250b4f07add8a7a0699709d5b7be73e4b052
SSDEEP 24576:MpL3UTO8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:MpL3UygDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 671KB
SHA256 4f02c672e81a1facf8c3986fd2347a9865a0c3a298eb0ebaceae86ffd21d7590
MD5 31d0db5bf17660face80a0814e67af7f
SHA1 01ac6672e12ddd832bc97068884cc6d1e37854bd
SHA512 a75309889f332a125d11c31aa42edadf82eacf0e7244042441ca216929bb23510d01f990c3d6ee22b60f275e4f297ff0cbb0f2916c6b8aaeb9a3c41dd2357503
SSDEEP 12288:FpFtpOSFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:tOS8NDFKYmKOF0zr31JwAlcR3QC0OXxx
MD5 SHA1 SHA512 SSDEEP

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 b1c3935d43d2ffe48f22aded9dce83aa81c0ca3fed20ee021e78fe99674cafec
MD5 6aa35a32976f1836002e3b565d1e8052
SHA1 3b41dd0eae45582f84f280ae21d116be48117555
SHA512 8f72bfb9da4ea3a0fc402228b00af930b10d88c9ac8d629d437daee03e377f15632d2f39ab7db72041d4d6cf75ec2416f959e198b7dc5d24b03d800e63ac32b1
SSDEEP 24576:s7NM9YmZqmWMUkPjZM48Mv6bEhsj8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:s7cBWMpPjN8DbEhsgDUYmvFur31yAipZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 37069de676c887afb90c7535998e821cc6aa195fc677016b4ae3a82fb5247e1d
MD5 f420dcbdc41c6d51ecc1de34ab3decfb
SHA1 a6a9df589048258729ccc3dcf36f7a17c2c082ef
SHA512 df88b82e022fc6b694c1bae537c12031a0ee310a65a40fa0c6458b47b54d19bc25fabf70d24d9057da83948e74a626e7847b689426fbb057a9cd2aca932af374
SSDEEP 49152:rF2YuHNETovcvNYf8kmDgDUYmvFur31yAipQCtXxc0H:K6tCf8kHU7dG1yfpVBlH
MD5 SHA1 SHA512 SSDEEP

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 ec7b6fd3fce083db2ee0b13686bf9707a85b93b9156250895121315bc5e242ee
MD5 3efe8f2a1bb9e9bbd8e6da5cc834d4c7
SHA1 96f089e69d14c67c09c762dc918a6c4b37d2f21a
SHA512 380c62f212e4f56c7aa6c0f61e03226f77d158e16004048f00cbdcbcc77f8d9fe96be7ff16ed258792d84ae710efc3284b4c83c0c70ad4755950ede0dfcdcdb0
SSDEEP 24576:aAFs06+Omlf3NXEbToW8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:jFs060lVXu1gDUYmvFur31yAipQCtXxx
MD5 SHA1 SHA512 SSDEEP

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 885KB
SHA256 8363c6122ebaf4cfa26ba4536f68deab9dc2597f16c81ba93e681cb13818e880
MD5 34adea4b9950f2c076d07e68ad1b232b
SHA1 dda64794a9a58c9af14e28f23b84ef63e589f3c5
SHA512 dcafe715f5ba0fa9bce8455e0918646eec22130cf9baae3362df5e177baa9fe2829063f0b5086c1ac1776240ff37e6c99352f3ef20faf6a74593d31b97b86308
SSDEEP 24576:IJnJ5D3Wt18NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:IJnJ5DGt1gDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 0aeabc2ab60b586ea879d8b1aac54d537bb84ad2691a06079e7240c5b3f8ac7a
MD5 5af0b11ee728ca6fd12903c4f6bfad06
SHA1 5e06b55f1944e7b8ede6fbff6844d65fc2bf3aa2
SHA512 f2d4ece37519faee53e6845721c50d4b244853eb794445ec1c6a434352378e4e54a6f83b9a16811a2e99af33b93b2ef0d93ee1b438cb0f6bc503301417a53727
SSDEEP 49152:7o06DIKdwc+eQnSt65aV/gDUYmvFur31yAipQCtXxc0H:UYU7dG1yfpVBlH
MD5 SHA1 SHA512 SSDEEP

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 661KB
SHA256 488afc2ff05f49bdfeeaf0c23f917f7fb32a410fada527b8c575747ae9ecdc65
MD5 1b09180e84fb525bb4fe2ceeab6287e6
SHA1 d16ce3b18d8226e9e7d1abaa9dfa0fb0d8783c96
SHA512 8ad20bee3ed5e80fc007967cf5f8c8a7b0d19aca1ff591d78691f04cc500eb75ae13ed07667fc4c3c5d7a01966f6c105d70660a9270b448299c205b9b5100f2d
SSDEEP 12288:tEP3Rr5FCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:Or58NDFKYmKOF0zr31JwAlcR3QC0OXxx
MD5 SHA1 SHA512 SSDEEP

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 712KB
SHA256 e1e2fdd3d48829cdb87e1061c0df00be23cb600bf06a75954e0a6815b51ce9a8
MD5 74c90e7aa24d2dc321fafdd548b67987
SHA1 8af16390bab8f8d945bf5e877f1f1c822b5ff245
SHA512 124805a65da13a1344888340a0bee97bc8d38d01b757234ad43a01362bcb8771f15f10229a30af0f4dbc0c08b89ac77b7e5b1423324be58d50b38f778d1bf48b
SSDEEP 12288:yjkycFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:yIyc8NDFKYmKOF0zr31JwAlcR3QC0OXn
MD5 SHA1 SHA512 SSDEEP

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 584KB
SHA256 b8cc280c84f227fed8977f2689a6924908f688fca6fd76426490ab03aefe0683
MD5 27c4584b6e1b181bfad3df49dbd46371
SHA1 8d9c279f08c9b57e69da4c8e8317d844d6b31cd7
SHA512 6f483f3b108905537fb11db6a0b85820d3cc13d99a59545109f4b599d7098b0f6e59b1c4b83e8e54a48e74fa339ccfb60866388e4cd4325d77e4eddc1a2c792e
SSDEEP 12288:9FiFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:ji8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 7808e9e7382065bb96145cb0543ea920dd3178e4c0758c4c807a73e3c499f333
MD5 a0df8a8786fc5b1111f2767d6f54808c
SHA1 372a268ecc913ec68ba2e55f63564026ba8d2d15
SHA512 2ab4ab47a71edd77b7135c6199e87626732da4dc3908949d0086a709394ab9ff4a1197e34198757615ca61508a0d12e6342c995ca5474f18b8b470f027a92ad2
SSDEEP 24576:OQ9MxZKdcz97w3r8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:OVKXrgDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 772KB
SHA256 0057288ad7727248e3e84173a40cb1f4740fff92e7ec38214f6267d04844bff3
MD5 7266f47040be9c41ce62f358756aaa79
SHA1 09e1e709ea1cc0d98073bb58c28d76ce357c8549
SHA512 3e27042c69707867a2082a27acc71a83fd6a5e051fa407a130dd19a756059dc3fc06a95d282b562aeb3e0c29328705026734d027076cd667673459edcdad592f
SSDEEP 24576:uyocxApg8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:zocxApggDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 8d578b574a8d968e131b4ffc0be3b01a94d15f1fe14407d5a366bd3da0495a95
MD5 1122e9f5fc8750eae6c991fd17e65f3a
SHA1 58a5fa4f22241095019bdca212c804bca0c27062
SHA512 2ecf275ca7f8ffa9d83cf657401917b75c657527969ee1be8d189f184d724866442968bb3e3ebd936ae4c43d324274ab8f257cfcd76f4d122faf6084a94a510a
SSDEEP 49152:LWcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIKggDUYmvFur31yAipQCtXxc0H:70zuNIVU7dG1yfpVBlH
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 75b9a3a3ecd8540f6d7949898e14d49385e566fab08c38448a00af2aa0e1f1ac
MD5 791ba0d5c6ece51ad78b1239c5dce981
SHA1 356b4744e598cba1bfcc14de7a1f5bdd9cf55989
SHA512 9bfd9be9179f02abaf4035750506c0438f40dfc83fa41f149b500dbf2ca7bcd00c77d80b95eb57447a311c47fdd60e008024048902cce7d194646483c67f8e4d
SSDEEP 24576:U1QT7EcpfxR+N5AWAz3ooiYtjMqb58NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:pTDxR+N5YzTfjMygDUYmvFur31yAipQi
MD5 SHA1 SHA512 SSDEEP

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 877KB
SHA256 949d2a2503f9f8c38abd42e4e9a9a5f82f7886d37419e32d579c4c497dea0de3
MD5 02399071595787bbc7c9102b1f849549
SHA1 e3357660aa7627e41928f6fef44cd13e6a72caf8
SHA512 635b2f376df2f672255eaa0d5e91b778dd864e1495b50471715cf33f6724a7023db1d97a965ca68d73a99d7854b727e1a637b0fb6a57fff65476b21e66720df9
SSDEEP 24576:ITMdOz0FFS+imSLd8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:A0K+imSLdgDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 635KB
SHA256 d09cf9e545ba9567d0cc77156273db991a65ac3ad66b8ad6e421b7f3d0ec8043
MD5 acd0ed51a9ad186fa8d2216f05bd8e44
SHA1 f1672b262eade0c2dd3858f7c0c192efd0783c85
SHA512 c79ba5365974cc35d5c992a358cada2f84a5c26621f7af4f1390869934dcfc65f45e388b85e286e8418a64c8b1f7b472b99f821feca51bcea381aa31e532ac4a
SSDEEP 12288:047OFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:TO8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/324-163-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/324-439-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/440-648-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/440-282-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/1044-118-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/1044-236-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/1268-91-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Download

memory/1268-102-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/1512-188-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/1512-638-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/1520-642-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/1520-237-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/1548-89-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/1548-76-0x0000000002270000-0x00000000022D0000-memory.dmp

Download

memory/1548-84-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/1548-87-0x0000000002270000-0x00000000022D0000-memory.dmp

Download

memory/1548-82-0x0000000002270000-0x00000000022D0000-memory.dmp

Download

memory/1748-641-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/1748-233-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/1820-182-0x0000000140000000-0x000000014024B000-memory.dmp

Download

memory/1820-50-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/1820-57-0x0000000140000000-0x000000014024B000-memory.dmp

Download

memory/1820-55-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/2236-640-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/2236-207-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/2252-183-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/2252-630-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/2384-21-0x0000000000530000-0x0000000000590000-memory.dmp

Download

memory/2384-20-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/2384-12-0x0000000000530000-0x0000000000590000-memory.dmp

Download

memory/2384-101-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/2856-268-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/2856-140-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/2896-0-0x0000000010000000-0x000000001009F000-memory.dmp

Download

memory/2896-447-0x0000000010000000-0x000000001009F000-memory.dmp

Download

memory/2896-75-0x0000000010000000-0x000000001009F000-memory.dmp

Download

memory/2896-2-0x0000000000590000-0x00000000005F7000-memory.dmp

Download

memory/2896-8-0x0000000000590000-0x00000000005F7000-memory.dmp

Download

memory/3064-647-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/3064-269-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/3216-187-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/3216-64-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/3216-71-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/3216-70-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/3612-134-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/3612-33-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/3612-27-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/3612-26-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/3900-61-0x0000000000460000-0x00000000004C0000-memory.dmp

Download

memory/3900-60-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/3900-46-0x0000000000460000-0x00000000004C0000-memory.dmp

Download

memory/3900-38-0x0000000000460000-0x00000000004C0000-memory.dmp

Download

memory/3900-37-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4332-115-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/4332-224-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/4480-249-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4480-646-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4500-210-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4500-221-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4536-137-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/4536-248-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/4976-633-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4976-151-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4976-273-0x0000000140000000-0x00000001401D7000-memory.dmp

Download