83f53aa35ce305749679ed6bb28688b69f44e3f52be584513724faa506373a48

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 23:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
83f53aa35ce305749679ed6bb28688b69f44e3f52be584513724faa506373a48.exe
Size 849KB
Sample240603-3pw2taec72
SHA256 83f53aa35ce305749679ed6bb28688b69f44e3f52be584513724faa506373a48
MD5 5f329f9212863f827a67aae2924aedd8
SHA1 5e1c0793b77f538f0d2bdcf59b7ca98eaa7b7a61
SHA512 b472b35d9a166b67052c1704b7c49bbb11b10b2365e88c1d281f2ad203f871f5b45aaf20ec56ff19d83372f5f384a513ff7170a15eaf67142de6ffcf413ca067
SSDEEP 24576:N1vk1agfkfgaIfwIx5W+vxWJq0Q7QqtWLjXTqM:GMfgaIfwU8+pWAV7QqejX
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
1928	alg.exe
4460	DiagnosticsHub.StandardCollector.Service.exe
3732	elevation_service.exe
3452	elevation_service.exe
3040	maintenanceservice.exe
1048	OSE.EXE
4028	fxssvc.exe
2068	msdtc.exe
2220	PerceptionSimulationService.exe
4276	perfhost.exe
2888	locator.exe
4084	SensorDataService.exe
4024	snmptrap.exe
4268	spectrum.exe
2268	ssh-agent.exe
4676	TieringEngineService.exe
2920	AgentService.exe
1228	vds.exe
3896	vssvc.exe
4936	wbengine.exe
4696	WmiApSrv.exe
3788	SearchIndexer.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in System32 directory 28 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	83f53aa35ce305749679ed6bb28688b69f44e3f52be584513724faa506373a48.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\13d57f75293b476c.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	83f53aa35ce305749679ed6bb28688b69f44e3f52be584513724faa506373a48.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	83f53aa35ce305749679ed6bb28688b69f44e3f52be584513724faa506373a48.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	83f53aa35ce305749679ed6bb28688b69f44e3f52be584513724faa506373a48.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_102250\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_102250\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_102250\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000018f399da0fb6da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000083b5dcda0fb6da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000073f57ada0fb6da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e318c0da0fb6da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9923 = "Windows Media playlist"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009cea53db0fb6da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ae9278da0fb6da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e6b3fbda0fb6da01	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
4460	DiagnosticsHub.StandardCollector.Service.exe
4460	DiagnosticsHub.StandardCollector.Service.exe
4460	DiagnosticsHub.StandardCollector.Service.exe
4460	DiagnosticsHub.StandardCollector.Service.exe
4460	DiagnosticsHub.StandardCollector.Service.exe
4460	DiagnosticsHub.StandardCollector.Service.exe
3732	elevation_service.exe
3732	elevation_service.exe
3732	elevation_service.exe
3732	elevation_service.exe
3732	elevation_service.exe
3732	elevation_service.exe
3732	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
668	Process not Found
668	Process not Found

Suspicious use of AdjustPrivilegeToken 40 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1468	83f53aa35ce305749679ed6bb28688b69f44e3f52be584513724faa506373a48.exe
Token: SeDebugPrivilege	4460	DiagnosticsHub.StandardCollector.Service.exe
Token: SeTakeOwnershipPrivilege	3732	elevation_service.exe
Token: SeAuditPrivilege	4028	fxssvc.exe
Token: SeRestorePrivilege	4676	TieringEngineService.exe
Token: SeManageVolumePrivilege	4676	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	2920	AgentService.exe
Token: SeBackupPrivilege	3896	vssvc.exe
Token: SeRestorePrivilege	3896	vssvc.exe
Token: SeAuditPrivilege	3896	vssvc.exe
Token: SeBackupPrivilege	4936	wbengine.exe
Token: SeRestorePrivilege	4936	wbengine.exe
Token: SeSecurityPrivilege	4936	wbengine.exe
Token: 33	3788	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3788	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3788	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3788	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3788	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3788	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3788	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3788	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3788	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3788	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3788	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3788	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3788	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3788	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3788	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3788	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3788	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3788	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3788	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3788	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3788	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3788	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3788	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3788	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3788	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3788	SearchIndexer.exe
Token: SeDebugPrivilege	3732	elevation_service.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3788 wrote to memory of 3940	3788	SearchIndexer.exe	124
PID 3788 wrote to memory of 3940	3788	SearchIndexer.exe	124
PID 3788 wrote to memory of 4532	3788	SearchIndexer.exe	125
PID 3788 wrote to memory of 4532	3788	SearchIndexer.exe	125

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\83f53aa35ce305749679ed6bb28688b69f44e3f52be584513724faa506373a48.exe
"C:\Users\Admin\AppData\Local\Temp\83f53aa35ce305749679ed6bb28688b69f44e3f52be584513724faa506373a48.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:1468

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:1928

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4460

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3732

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3452

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3040

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1048

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:1892

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4028

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:2068

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2220

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:4276

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:2888

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4084

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:4024

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4268

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2268

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:4188

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4676

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2920

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:1228

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3896

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4936

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:4696

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3788
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3940
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:4532

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
Size 2.1MB
SHA256 f0e7132ab70cf04fc3d75793cf46fa6b19552193c7da99e2b2a01b5ba79f64ce
MD5 5a59af4d36835e3adfe8fcc0c045a7cb
SHA1 170e5de3012db66acffa8766ebb0cdcd96bb2d29
SHA512 1d47755f3d48c9457efb909a325a629ee51d87ee6f3cfd54a4d8f85994a191c304fdd4c35ffd18e9fd34542d1bd17b5478c162936fd8767a29b2423cf4f71590
SSDEEP 49152:ZuYk3H5koUXfTqkkYLO/W2buywzMbOX+T7z5W+pWAV7QqejX:ZPfTqi90bBWAV7v
MD5 SHA1 SHA512 SSDEEP

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 797KB
SHA256 42b9aa49945d754b5d648dc724bc407cefd299dd7ffd50df27e82fe28a7e7ba1
MD5 af6b47022833ffca557d8866a8610b61
SHA1 2dd02b3bb4b9a648d21e231f2bcd4e4a3481770f
SHA512 c346a85d9c47590b22a6c9259ebc5136c856d1df4ecc500530874b324dfa0d5190260624d31d885a3536fe8f46752304f28e6374a8fe1a184ec7c3779c1144d2
SSDEEP 12288:ncQiQmNJLBsunE4ZI3XPWvOYRcDRJZ4w8qIV8mQR8XZi/mWcSjpI0Tkdure6:nidnBsuE4W+vxWJq0Q7QqtWLjXTqM
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 11975a21881c1806ad6cd506baa9f86c33a814973dc35462a1f519594df3aa10
MD5 c4b37af1069e374bdc9755716bf45075
SHA1 ed93840e219acbf9eb2f7324142a057b0e83466f
SHA512 26e4b5a1671a74cce5ce7f0239346923b72a1f4359868a019c1b20af4e1383a2237768c3bc4e4c6a16cbf2d445837dd47f32a9645ead7f4044344da53d7a8e39
SSDEEP 24576:E+gkEVfh4CoMW+vxWJq0Q7QqtWLjXTqM:hgkExSr+pWAV7QqejX
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 7a75fe9827e24b82c76b036b3f29631d93acc37128407cbc24d4d5ad39876c8c
MD5 791ea5656d1ce3f0bb3ffa3c493610a6
SHA1 fc1967924a7a946eb04ca4a88849a58c28d90312
SHA512 99bc494f963a16852f58fe2c6d49f8b491e48aefc2753678330c38621f42aadb48939a66fe82703a372e155759c018d1a7742a8f35f37c13c153b914fcc689d7
SSDEEP 24576:oBpDRmi78gkPXlyo0GxjrLW+vxWJq0Q7QqtWLjXTqM:8NRmi78gkPX4o0Gxj2+pWAV7QqejX
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 f17401d86fa61ec8e56013e28a8a7142a19b2807ad77fcd6a09dad8a8d0c4fb2
MD5 a0591dd155b45c15f924da214a687506
SHA1 a93c2312097a143f2df95623ba08d63d5b7ac595
SHA512 d768135485026ecf3b17d62b8b13c0d5f7225c81f21cd67e6e6453912f803e709958036fc8c1fe2d93ba1ed877a64528ca4b433424194d05071867786773687c
SSDEEP 24576:ULOS2oyPIXVMW+vxWJq0Q7QqtWLjXTqM:s/y++pWAV7QqejX
MD5 SHA1 SHA512 SSDEEP

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 0e1f3a7b69318401ec5ad317638db6acc7bffbad6e6d3953525fb15d65c40eb0
MD5 5afa933d715e5c1a58ef10248f0e0545
SHA1 4be5b56d70303e63e44a294a83c992cdfd6ea332
SHA512 14c2a8a188271810d5276489e6778e2409ab67eeaaafca24db13b007264d87789a7c676a38c03a5bd4448116c1fa96d13e615d8d0b7d5ea4a307c71d4e658675
SSDEEP 12288:YfSZI3XPWvOYRcDRJZ4w8qIV8mQR8XZi/mWcSjpI0Tkdure6:YfSW+vxWJq0Q7QqtWLjXTqM
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 61952f50f2594f65afbdedee6f248ecfc0a9b369c0c91054fdfba3dae7a4ff21
MD5 3be1150230d22d83ad1da323ad29fe63
SHA1 802c0ea4c8859611570a543e88b44238830d40da
SHA512 9a996531ebdc52eeca82f960581c2aa1f30aea61f540f73591cfdbbf486ce96bdac1107e8dba8ef3918a4162025499bb62435ddac6840f26d4aa6f437e5210a9
SSDEEP 12288:teBNUbTVO86URZI3XPWvOYRcDRJZ4w8qIV8mQR8XZi/mWcSjpI0Tkdure6:tJIURW+vxWJq0Q7QqtWLjXTqM
MD5 SHA1 SHA512 SSDEEP

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 a5b27e20156bfa376c0b0eaa0601461282d2165ec3a9cbd9ff97beb256162f45
MD5 95c0b61b444d64fa9a5ff8e4766d9371
SHA1 9908131030334eccba4a8bb7e6ef431144092679
SHA512 b2386314140aada1b70ebec93a36ee777f2ca93c6c9f074eb201b759103892e686f8113d679beafc5c9373dd798a69d46334838025630b856d6350db9a4441a1
SSDEEP 49152:+QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THi:+QvGAdlCEL8c/yRNw5CIWAV7v
MD5 SHA1 SHA512 SSDEEP

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 6059a0f67d0b9c6e67f2459c397e2d25b6c1724115164f65a180f6404c629c2e
MD5 4c52399c72de3c8dbe85665bf02137df
SHA1 4fdbbae457914bfa61af84504c4e7d825bf7651e
SHA512 605b8e2ef3e0e37d3eea126b8256eb64f3e215fba87293443b75df5bbdfd5d408f8b0267f9f74d37c2945c64da862a17cabd99faf15e7107023f984595350233
SSDEEP 12288:WAwSfxL/2Dc34DLLmt0LDQewsAjDZI3XPWvOYRcDRJZ4w8qIV8mQR8XZi/mWcSjB:rdewsAjDW+vxWJq0Q7QqtWLjXTqM
MD5 SHA1 SHA512 SSDEEP

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 16831bccdec238722064c0d5a5af25422b89eace7f7aeaaf0c3fa732535ba434
MD5 409d7730f6614e9f1952a8e1e6fd7945
SHA1 ed950a57f455b6e5c8eef582e0010bb8e66b98df
SHA512 d970f5d4f915607c5a22b99a3e2ac0b4dc7ef382f9a5f75317624f977dce32f91e2e143a924856da1659b4528aff1cd107c2248fddc4f7720a874a40f779dc7a
SSDEEP 196608:PUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJH5v5v:PUEtQevvqc2W1cpV2EI325
MD5 SHA1 SHA512 SSDEEP

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 d66e46bbbeb4a80fdc7ca4136c4478308181ceb3ecc33317cf5c7129d65a97c4
MD5 66694f13456d1f8d70b3296273b1b884
SHA1 4366b35acc32e662e646bc443b649754005267e2
SHA512 97dc42a515a8a5d2b8326fa787986410ba67fdbffed09ca29fb96e2e568ea87039a8c79d23241f4fb02699241cce850ccf2f5bc68ced838ba105d28b6dd40ee9
SSDEEP 49152:HCbRquA/m2yL5zQfFiV+XenmE3/zy+pWAV7QqejX:QoqtVjnmsWAV7v
MD5 SHA1 SHA512 SSDEEP

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 8c89bd3d7ffe2d30606e0da67a63ac52dcaf5db9f10433c734abad56db63916c
MD5 6ccb7dfd176de5495d67c2bbd37393ee
SHA1 7ff62a5a2477a7ef00ecadf58757a04e0b68b97e
SHA512 f3c2bbc10d4d4bc4c228b527c4fad6b572f4167b5debe5b7ae72ea8ff25452e901169abb9b17a6990edaef04999a536cb688e37a45cd126ca6f504a58b0a91e7
SSDEEP 24576:VAhGLJIFoiwtA5l7S53cW+vxWJq0Q7QqtWLjXTqM:VAMyFoiq55+pWAV7QqejX
MD5 SHA1 SHA512 SSDEEP

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 e6a0e5e4fb1a9a92aa7926b43cdc7a68714ad08eee48e390c6834a6ac3ab2ac4
MD5 a14c01e813d1ead0e948a5db87fdcb13
SHA1 a27983ad72a6666a4eca7758122d74918b69586c
SHA512 f88f8b3a5e46422ca74629921c160cf25025be6c4aed9c8ba01b29c744af323a30e161a0eff0886a7a75965185f9d9e6d1ea78ecf045a71ec257aa6e701deae1
SSDEEP 12288:Lmw5HEjsChNVBFgl0WDm+CAZI3XPWvOYRcDRJZ4w8qIV8mQR8XZi/mWcSjpI0Tk2:KwuoOWfW+vxWJq0Q7QqtWLjXTqM
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 812a36f683b9d6829615c13250e273e85bb06141847b978de7cb4a097bbe2913
MD5 ac4be435717d569c8bb16e3e74d08cba
SHA1 4202e89e4afdd4716555b539fe83f3a103d5017f
SHA512 4bef8021acd18c40ba7b786e41c7e2b2b101aed29a457ffc34e894726d3333c85cfc41b6dbf715ed90b26a6077e812788c6be5805ac5902b153d9c3c94f208a3
SSDEEP 12288:PBZ1IyzZI3XPWvOYRcDRJZ4w8qIV8mQR8XZi/mWcSjpI0Tkdure6:ZZumW+vxWJq0Q7QqtWLjXTqM
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
Size 5.4MB
SHA256 4c8ae11d0bfaa572f14e714350b401a57b53d4969829b1333f11159561f36cdf
MD5 1e928753db566d289f5f1d5c40c5eb1a
SHA1 555660039ac97b51d7031576caee333ae85063c9
SHA512 55b56ee8073fbab33054f018f1f4b8264f52cf5b9a437b2139b14e03b4f966dfb5c8e5fd53dda0f6e883bb4c42ca84d8dedfc8042afb94e6fe64ac2b288e2048
SSDEEP 49152:f0kwIi7c4xZlm5knEtw99Kn/2vim7vgv6m+yyJ/0gbvjR7yY7BHi3u7L/gBUUWLS:DwfhY7g/rLd7yYA3awr341gUWAV7v
MD5 SHA1 SHA512 SSDEEP

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe
Size 5.4MB
SHA256 7c0a2b8769d4d9b464f29d39e3d469180b5d31b7f737ad867b3ac0539aa47114
MD5 7b9c37df8666f00fc09059cb4e6928ce
SHA1 7b9c624e6e6375bb99fc242867553b160d9317cf
SHA512 bfbbaea6b57a937905dd313195e2b4cc8049a2464e58e4c9e18cda2dbbe1840484672eb584b0457483d74573ec38b3b7dba41a586d0959f8dedfba3fe7c40e43
SSDEEP 49152:F0kwIi7c4xZlm5knEtw99Kn/2vim7vgv6m+yyJ/0gbvjR7yY7BHi3u7L/gBUUWLS:NwfhY7g/rLd7yYA3awr341gUWAV7v
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe
Size 2.0MB
SHA256 af1fdc647dfdda25ec75ad8f7e6214e899bc6c0f806d76e9a809b43b83197996
MD5 a401d9e28b1afdaa8e9bfcbf06d3dda2
SHA1 a23c1f120ad3819fafec3aafee3f9542b245a76c
SHA512 23f2640170cd7ef9c22387689db2a2e3aa2aba91ca623feca96541d1e06fcfc4cf5424b48f1e6ad876be789caedb105cddd18c84ba13690cf34b3c46a8891d2a
SSDEEP 24576:FcTyYv0FteQU+5I2kjgD6iQacAfW+vxWJq0Q7QqtWLjXTqM:FuXv0Ftpn5606zO++pWAV7QqejX
MD5 SHA1 SHA512 SSDEEP

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
Size 2.2MB
SHA256 c178790160fa706aaaca5230ada386877c9144902a1e5e6ff7218bb85017d6ff
MD5 dd80188cff7df75771f25a0b3ca65bf8
SHA1 4b0aa880fad4902506b94c2ac257485d08b3e4d2
SHA512 3a275e4d51cf710cc3f222a75aee4dd1a0eec51f72b81317cbf4dcf40f1248eb6bec27787b39baf06bf03e26c6183351154cc14af472b962306aec8765f057b0
SSDEEP 49152:jy7mTd0GxN8jyynxHjXKUyn4GVcbDSKrNTxS+pWAV7QqejX:+mYeyxHjWjMTBWAV7v
MD5 SHA1 SHA512 SSDEEP

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe
Size 1.8MB
SHA256 53f5c1be4a2b4e106de19e1b1f8ed4789a1b074b33f01c15910c5de01a3ba697
MD5 e382b7a7d68fe00a72b30f2d745da378
SHA1 175a3cb9488701980153ad278f100547e94f491c
SHA512 1de5a0940fed69cf555c1a72665b40b8c228c20ac9ad0bdac879e5968af180481a6f54a4267475bed8808b05338058cd034d95fe5fb99009fce7ea50d08191d1
SSDEEP 24576:66drZn1WEci182IEUeNbJeRgUebgW816+W+vxWJq0Q7QqtWLjXTqM:6WnDci18yNNUgbYW+pWAV7QqejX
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 1.7MB
SHA256 830bc2c8da51a619d81004d59be92a2358e7afebe3b85a4ad2a6865dadc20347
MD5 15567f26a24668559bc71e43426ca71d
SHA1 edde196cba54aae7897ca802fbee49297ffa6514
SHA512 99254f1dabb003129fd89510c11b6920d48bf011037f6da16edd5ab0b48ee1d31f857ac440ca126ca4aec5a3dfa20dd58dd518baa9cde2e6040d49aa599ad8d0
SSDEEP 24576:Zk5lHW5EzMZupO80G2reD+melRgTTv/1nylW+vxWJq0Q7QqtWLjXTqM:1izMZm0GhamSo/+pWAV7QqejX
MD5 SHA1 SHA512 SSDEEP

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 2d1d685e0c58ea46591fc9252a1874bb9a7176792c1c4caccdd1df172420be72
MD5 5053c00273ca321178a5516cf9ebcebc
SHA1 a21e44162c34ca05ac1a67bf9a63fc5232a7e0e8
SHA512 9b6591ff01ef305af06465ac1cfaac7742703528f8bad7feab6f289d9aba6b8ff07ed82ecb57f21b7b3429c4ddcc3194442f8e1cdc496f7bf3e19f38f42bce2b
SSDEEP 12288:CaZI3XPWvOYRcDRJZ4w8qIV8mQR8XZi/mWcSjpI0Tkdure6:CaW+vxWJq0Q7QqtWLjXTqM
MD5 SHA1 SHA512 SSDEEP

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 7780346caf0f502e3c69c8f02ba9446e0ebc4f68e824445dd98204521772fac5
MD5 c8bbe37d38faba7dec220b8690b10ce1
SHA1 9410ef2a538e3075f30f5374df4acb4ec188662f
SHA512 a357e06d62d4d836e85a1782dedb1d033f235468e165c929fe02bb2e97cc344d6c5e0f66725b6fe00de67d5d9f349b6a547e34fcbbd18ffd8c39335251c24ef4
SSDEEP 12288:KXZI3XPWvOYRcDRJZ4w8qIV8mQR8XZi/mWcSjpI0Tkdure6:KXW+vxWJq0Q7QqtWLjXTqM
MD5 SHA1 SHA512 SSDEEP

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 0e1c8230b52829255c7afdcf736e21fb58a8e878f7063133dd885ac20a961233
MD5 1e24d2991e3050bb1b10673307f84d7b
SHA1 c1f2d0ff22b49093626db36d3e134899513a3c77
SHA512 b72512ae26340347c00608f10f43967700143a88c4cd29a26915698bd6adaf4fa9d4dcf0ebb1c8964a3feaf803c1c5c064f5e20834751460ef7dff218ffaa23d
SSDEEP 12288:yZZI3XPWvOYRcDRJZ4w8qIV8mQR8XZi/mWcSjpI0Tkdure6:yZW+vxWJq0Q7QqtWLjXTqM
MD5 SHA1 SHA512 SSDEEP

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 94624ed7eb06e432390434e21abc371becbf11dd1031d9f2eeede73c9d121f11
MD5 1ded4d30c258dc73af41915a70b189db
SHA1 a131e4d641a30f959c2529534530e7dc92caa9de
SHA512 4feeed96d4fedb69072e2eab64dc93bfa6ddb82729b6aaa9f71b46d06535400e6ff4a8c74e5943ffb3e887323c936724c958296250262a0d7a98a8e4d8c7b935
SSDEEP 12288:NV8ZI3XPWvOYRcDRJZ4w8qIV8mQR8XZi/mWcSjpI0Tkdure6:UW+vxWJq0Q7QqtWLjXTqM
MD5 SHA1 SHA512 SSDEEP

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 a359941c618636a250b9a46e7e9d93231a1b2192f6f5e1b795b5eed144736779
MD5 bda08cefc1f2b4bdd60657929a1dc6c7
SHA1 036de1ecb9485d6ce9c82e888f6d1845ade0710f
SHA512 2fad56a249e0e2674475c4672c931030a200e22ef1069b67064bdd9c5617e6ff9ac2d7f51ab2364a8f94069e4b6a38be0a2cdda93f022a07f2969eafa8d89c8b
SSDEEP 12288:NUZI3XPWvOYRcDRJZ4w8qIV8mQR8XZi/mWcSjpI0Tkdure6:NUW+vxWJq0Q7QqtWLjXTqM
MD5 SHA1 SHA512 SSDEEP

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 9492e8c059d89b4cf270ff1a6951cdd929efd4f30363ebea8507489ccec1933b
MD5 512234c8639b6072df11c7c6da9429b9
SHA1 57f3afea898e22873ff7babedcac6581482d230c
SHA512 86c94df79701b4bef3b6a267db670d6d92f73112327b141f6af4bc2a56f763fa91948895af9286897300b93eccb5537c8ac948e408b8959192791c72976c218f
SSDEEP 12288:MLZI3XPWvOYRcDRJZ4w8qIV8mQR8XZi/mWcSjpI0Tkdure6:MLW+vxWJq0Q7QqtWLjXTqM
MD5 SHA1 SHA512 SSDEEP

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 908c42d0dadcba89f77f0d0ddfe5c501fb82b9e04f1705603f152ad03a974076
MD5 b7ca0bb58025d51856b1a9b55d73c25b
SHA1 3ff90ebb4614bacd3919dd9b5b249ff57367bd87
SHA512 1920a66ce163d73b5a7d468ba9de538a5776ec6556abdc082ad25d3d304be73a418f951836b48cb26dca88265a631b52174626108417ab6e33ce01f4b33aa043
SSDEEP 12288:AvZI3XPWvOYRcDRJZ4w8qIV8mQR8XZi/mWcSjpI0Tkdure6:AvW+vxWJq0Q7QqtWLjXTqM
MD5 SHA1 SHA512 SSDEEP

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 52ef8d6de1e6526c1e09809d88954fc703c8693b3b2fd1bc2d5ee7fc7605c850
MD5 5d39da6e2e38737b41ab775836ff0836
SHA1 a1499729c00a29605efb3b29f2b373e0bc7b1634
SHA512 f43ea59c85ee52a366c6f13d7a4108d48f6ad0011cd7d1cd032e60de603a327e71204fdcf2a25baec4b35495b6f73beb6fecc7f731e0b6477eb77881a2f78e0f
SSDEEP 12288:uiZwb6zzFEoS2cPvy3ZI3XPWvOYRcDRJZ4w8qIV8mQR8XZi/mWcSjpI0Tkdure6:RZMSzFVSO3W+vxWJq0Q7QqtWLjXTqM
MD5 SHA1 SHA512 SSDEEP

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 8fedb01eaccc01e28a27862cf44527d1bb9b6889a6e4936283d31d04323b6df8
MD5 6bee55bd991eb57bb56200f8338f9540
SHA1 5484e7f1317d2d85dde4fdc90079da89a910846d
SHA512 bf42acdf3849200490077a69fee29fa125008ea5be099eed2974b605773135077b313c43e1914e9d01a48ea054c9a47b2459bd146a5bbbecdccee7f2f8d88305
SSDEEP 12288:WWZI3XPWvOYRcDRJZ4w8qIV8mQR8XZi/mWcSjpI0Tkdure6:WWW+vxWJq0Q7QqtWLjXTqM
MD5 SHA1 SHA512 SSDEEP

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 8ab2f9062dab0a170b7eaaacee9b73c43e8c79a6f3c6238aea3a0367e3960502
MD5 432b6f68eaca67f88b1f1a96d74bb921
SHA1 4a27db5a1c74bd02dafd36f1592180d0f9f95550
SHA512 43d95e8fd8623ca9a989c5804894284f2f521b338a3f68d92320975e73d862736932a0d4dd00d2a86fb90c30e995a096795aae41138e3677a931c1cb14911c0f
SSDEEP 12288:0CZI3XPWvOYRcDRJZ4w8qIV8mQR8XZi/mWcSjpI0Tkdure6:0CW+vxWJq0Q7QqtWLjXTqM
MD5 SHA1 SHA512 SSDEEP

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 7fdffaf5637434cb2f440bd66d1bcd46ede06a661e72e80c655d81b961cbc162
MD5 0874e8f538bde89cf23db74f162c2fc2
SHA1 72e66efc524c0b3fadbee0cf7d95045b4f5409c9
SHA512 d7b5f01fe0bda0db505f68023c9bb4ac6df7dbc3b9270f52b7685a802505538206b044a6543a8ac599e6a434b75d018d4123d31612729b77351b37ec421c9725
SSDEEP 12288:WyPz5L8zZI3XPWvOYRcDRJZ4w8qIV8mQR8XZi/mWcSjpI0Tkdure6:rzyzW+vxWJq0Q7QqtWLjXTqM
MD5 SHA1 SHA512 SSDEEP

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 19b34f810e91353964765bd3b1089c85d23d307f9f1646ccc6412d54826da0e5
MD5 5750c76f9d073cacb4d6f82963ce334c
SHA1 d9951d9fed1f4e78f9c35c2a740a641808786263
SHA512 d14f522e6ea5b5e32b25d54fc7c24fcd30581044d27be1604c9120fb827c0739bb8b3f80b08231dff23b527318c0dae752397d7d538ba17717f8a1f45b047e49
SSDEEP 12288:UWZI3XPWvOYRcDRJZ4w8qIV8mQR8XZi/mWcSjpI0Tkdure6:UWW+vxWJq0Q7QqtWLjXTqM
MD5 SHA1 SHA512 SSDEEP

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 be3978c9fcdcf5aba7941f832241d77c3f0864ce0e8cdf015f053ecff3fe9101
MD5 154a811b409302f860aed4eed87294c9
SHA1 850be0d8e7a8700df904618b02ad3d974bad041d
SHA512 17d35819a5d0c2fd71798093efdcd8096ec9234fe790af1101961d145278b72ebe0736e40f3ea06ee0b5c7d5370dcd9902f36630dddac2d642db6e6d9f269217
SSDEEP 12288:UWZI3XPWvOYRcDRJZ4w8qIV8mQR8XZi/mWcSjpI0Tkdure6:UWW+vxWJq0Q7QqtWLjXTqM
MD5 SHA1 SHA512 SSDEEP

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 e2df16e564e9eef338c240bf4fec31106f70cfc41c9b1953dbb7105cf302f182
MD5 eb233f15316764b523c9288090ffb61b
SHA1 da6a7d9e624469c838f724145dc2553ccb5e9dc5
SHA512 8b1051ddfab4d359be3a9df81f6033aa2d67239890af95f760ef53d96210c6511850b7f27dd5ff5631bded4348f26bf2b7c6ed58e19b69efff80abe6ca561a62
SSDEEP 12288:nyPz5L8zZI3XPWvOYRcDRJZ4w8qIV8mQR8XZi/mWcSjpI0Tkdure6:KzyzW+vxWJq0Q7QqtWLjXTqM
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 a473a4e2306283cee3261180eb2c3843378478a03b6e38fb80726b0ca20c9f7e
MD5 74c0d6327277172482c81e9a4993f5c7
SHA1 fdeb1d50a2e573b6b7ebcca913af4a69769ac3d9
SHA512 aa51510909f57194fbcae2e8900b48ef89d8171edb0703404bf7f186e4baace954dcc9ebc73288be78826dea8a9b4da1d3ccf010b67a813c19ab1691120f248d
SSDEEP 24576:UTHaLl3z0zDpW+vxWJq0Q7QqtWLjXTqM:UT6Llj9+pWAV7QqejX
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 caef772f4e462a56f8308830181fa512bed7dd00ac1edf1c50446764aff1ac60
MD5 19f7e1018a9f051fde80514926771b05
SHA1 ee2f1a2820ea69bf0b59069b27ef46c0ef617454
SHA512 c62f52f5a0d42de448512d83fa4dc517024a0595e80a9dbc39e9ee42957281f64c3dfa30e91350bbaffd6efb4d35f4fbd2a79af44cab3fe1ab9beb12961e785d
SSDEEP 24576:S37d9CHKy7GZ9W+vxWJq0Q7QqtWLjXTqM:07d9CHKyaa+pWAV7QqejX
MD5 SHA1 SHA512 SSDEEP

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 9386a88cdffd77d72a359f8b73a407a6829a5418dde31d2dd74558bebcdf9a8b
MD5 51b2d86c46538c17aa9decef304b86b5
SHA1 588b3ea8e106dcfd4a35e65c8aadc883e6f807ff
SHA512 742baf15876db2fbe05ca22deef3d63456cd8ebcd788355728ffeee022411b9f90908acdd6a19eb0fa0109333eba66895dbb22442fe58809551b6cdd1222eec3
SSDEEP 12288:x5ZI3XPWvOYRcDRJZ4w8qIV8mQR8XZi/mWcSjpI0Tkdure6:x5W+vxWJq0Q7QqtWLjXTqM
MD5 SHA1 SHA512 SSDEEP

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 d1b2eae2c7963a9339cbab0af949a610337b7af37fd4781830618286929df58c
MD5 d83602b0c8b4bc24be66c7ed4f19a84b
SHA1 96276977a958712d1adb53978e5e3e61360f5a3a
SHA512 34007fd98b2cfeb2aea572f51a208bcba3df4ced41fdb62734c4fca6c7e204ba6250724b0a533a53e43ce14e444be0a77b8e859a05062c59722066f3e7281911
SSDEEP 12288:8TZI3XPWvOYRcDRJZ4w8qIV8mQR8XZi/mWcSjpI0Tkdure6:8TW+vxWJq0Q7QqtWLjXTqM
MD5 SHA1 SHA512 SSDEEP

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 c0f6d493bc793b1ad9a4a8dbdfa513e4008f936527e68a8c57fc0078caa99b6c
MD5 b3daaf9ba4bd8d96ad345adfd1ec7acc
SHA1 8b9b4200ae528f1db0c179321fe8033074c29a65
SHA512 17a06d1637f338ffde574be994925d996b80bda495f56b9f9ab16bbcde980ab191b83ffb449f1a92e14334d7f34a362c63ec2c4b892db6d4d2b8d81fc3670179
SSDEEP 12288:g4ZI3XPWvOYRcDRJZ4w8qIV8mQR8XZi/mWcSjpI0Tkdure6:g4W+vxWJq0Q7QqtWLjXTqM
MD5 SHA1 SHA512 SSDEEP

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 3a9c2ef84479645729c723d5f214264a9f24f2869509da7bc824209a8eaa297f
MD5 467b03c5098170201930fdaf9c7d4165
SHA1 5ef9e0027d04106e9e0ddb19d785d22d5f3df639
SHA512 51431840c04539a0c8b7a4b6a9de8580c0858d535eab7a5725b99b30639ed25a9bf56bc86f09dcb64b5a367ca17b71f9a1fb74d50067b050cea0d7c063a0e6af
SSDEEP 12288:zWZI3XPWvOYRcDRJZ4w8qIV8mQR8XZi/mWcSjpI0Tkdure6:zWW+vxWJq0Q7QqtWLjXTqM
MD5 SHA1 SHA512 SSDEEP

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 674c1f09e26510f3ee4ab1c0f0c4cf73d421d1c83ed8cfb70b460d07ce84c260
MD5 6db3f2089234c221286a9c8b55e463e1
SHA1 2f9f50b4833265b1f31ad66c04f4655651cdcd3f
SHA512 cfe9e5abed33d2835ee7df61588052524109eb9d4e25241394ebf08ed5b84c89e0484d4adda9af630034b4900e716253abb2b09f63bff14bdd8e65d6a4269864
SSDEEP 12288:u5ZI3XPWvOYRcDRJZ4w8qIV8mQR8XZi/mWcSjpI0Tkdure6:u5W+vxWJq0Q7QqtWLjXTqM
MD5 SHA1 SHA512 SSDEEP

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 701KB
SHA256 17aafb918855f3e4a30ba253e9f991ec443e6e9b759605542586f930bffcfbe6
MD5 6e81b5e03556f5180bdd2b9263c58886
SHA1 1effbd6529c280e275395758ea4e74c73c540817
SHA512 d8f971e6a44417d1e063a996b11f8d730356e084ae4a00755df8a224124b2fa6420539478b0c7b6b9927201c5d557d34add840b9e80a2a8f52873ee66a44c1c8
SSDEEP 12288:OUFmDDLNZI3XPWvOYRcDRJZ4w8qIV8mQR8XZi/mWcSjpI0Tkdure6:0NW+vxWJq0Q7QqtWLjXTqM
MD5 SHA1 SHA512 SSDEEP

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 71e559b218b4ad180be23f87441c719df1c8bde602ec092c4a6674b4fa530b30
MD5 8a072792e30ceb0302bb94c099b7ed97
SHA1 aaffcc5d29afe15961a261744e59ab8c5b92cd7c
SHA512 ea3016f869bce5b7b3b286a58dc704b47277c76e138378627834b8326f29420dd6db00bdeb6a805f6cd9c1afd99fdd577967b347f6d33c10a0a176d90c136783
SSDEEP 12288:qEZI3XPWvOYRcDRJZ4w8qIV8mQR8XZi/mWcSjpI0Tkdure6:qEW+vxWJq0Q7QqtWLjXTqM
MD5 SHA1 SHA512 SSDEEP

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 bed5f4a4237771dd1f4768dc53cd5de7a4ab6fef739b72163264363d68278b4f
MD5 3afe2637c4762db518a0fab1536f1fa6
SHA1 0fa5e4fe565e92632bc34fa988cc444219d95c91
SHA512 6c4f520753ed2a2c2b0fc77fe224e331285f5021272b23b3df7e1efc2c56b511659a3197b390aaebe56bff4515c6b197df1570a54ea12792128a5e9b58f42f24
SSDEEP 49152:Sa0h2GEkuAe73q3pp46zwwQP+pWAV7QqejX:Sa0hNYG4JwnWAV7v
MD5 SHA1 SHA512 SSDEEP

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 659KB
SHA256 546952f43604e298e7c58018c57f6d9361ba82d34464495776629da132f194d1
MD5 7c8bdc49e78e7d207b5c760588851d8a
SHA1 5e449557de6658181ba4da903ced41a8543ae83e
SHA512 36ee772ec4336d9c7141bf9085c34386f1c438c1768a0bdfa438b3242441dd369e6bc0b8c60643c8dea9a996d6ead08a054b17834d2ae2939124537ca2b76d63
SSDEEP 12288:VhbHjfX5ZI3XPWvOYRcDRJZ4w8qIV8mQR8XZi/mWcSjpI0Tkdure6:VhbHjP5W+vxWJq0Q7QqtWLjXTqM
MD5 SHA1 SHA512 SSDEEP

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 05431e583e52023c25de8cdd2dffe258c920c1e1481928ee3f6b0865cf523c48
MD5 6271a0605f52ad8a0ea2d0d665e7f1bf
SHA1 fe246660f2a9d70e5d81075f124e03c5cbc09f1e
SHA512 5cbfd5946da4d8bcc548366de598ca95086d6e189ca6750194795592e6acf6f027af5864029e62658676f1e91d52493a1a2de92130df47c6c96e4b4d9f14b88e
SSDEEP 24576:R3YgnJcRTk4yti+R5dBR/ZW+vxWJq0Q7QqtWLjXTqM:RIgnaTk46pBR/c+pWAV7QqejX
MD5 SHA1 SHA512 SSDEEP

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 578KB
SHA256 d1d67bc4f2e486aff5b5fdb1f0804e7c8af664e3ef4edbe6b5f363d3c69f001c
MD5 c0428e6966e5c613266ad439d19d0f94
SHA1 03b0b42cc972b7a2b229e9bf1dbf968cbe7d88ab
SHA512 4e1e94aad4305332dcd15ffeb9074d4d113247464bf75b0c88c91990721fb68cdfd85467d148a5b0bcd5086d754656fc15a1274413cd4e8a5584dbfc893243c9
SSDEEP 12288:jIZI3XPWvOYRcDRJZ4w8qIV8mQR8XZi/mWcSjpI0Tkdure6:jIW+vxWJq0Q7QqtWLjXTqM
MD5 SHA1 SHA512 SSDEEP

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 940KB
SHA256 aaaf96e190be86018f4f22afcc803f16813e36e0192a3b16e8fbabc86e0466f3
MD5 e5d1f3dae6792368249ca1678a73b193
SHA1 633df4664499bd9f8f65e99ee6752f0d80c66100
SHA512 94669dcb043a169cee07b23c4bc9740874743692989ec108e6c74c0d6cf6f881e5b593b5309391a9c82d0c012f6da6d9f3dc3e6846d8b2815196e81f6325b99f
SSDEEP 12288:5Ob9A4LWOsvAYFT7ZI3XPWvOYRcDRJZ4w8qIV8mQR8XZi/mWcSjpI0Tkdure6:upL3UT7W+vxWJq0Q7QqtWLjXTqM
MD5 SHA1 SHA512 SSDEEP

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 671KB
SHA256 279c13be75ee770b90402a4a6de31a3f61d28ae17c73da2985e8484fac31284c
MD5 933963665418c6d7b216868886cd8782
SHA1 4fa17f7cd2d358435214403a07690956d92e5460
SHA512 8909b21f3890e46068b4bb48cda801ba5e5dd671d6cc9c9b33d62e497a19f4015589df0f699fd54a8636f3063050d6d4411791d4dcec12fa85e866ed06fd80e2
SSDEEP 12288:vpFtpOfZI3XPWvOYRcDRJZ4w8qIV8mQR8XZi/mWcSjpI0Tkdure6:DOfW+vxWJq0Q7QqtWLjXTqM
MD5 SHA1 SHA512 SSDEEP

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 bff075d5f6e916c7bb539ec7b6aa51bf8a8e480720527bef42a6e974af36f8db
MD5 3c590af5532630eb6bfd3a07cca606fc
SHA1 aad7a1115e1958eb771e580a24ecc0ffe745db63
SHA512 87c5ad1b81e1d309744f17efae56d68e7c48d9aaa71e603c95d280ef21f33ddd8e4f10240f5c6010f90ab4037224797cca79e37d7b2f7850c05d0ce99405502d
SSDEEP 24576:Y7NM9YqZqmWMUkPjZM48Mv6bEhsUW+vxWJq0Q7QqtWLjXTqM:Y7cBWMpPjN8DbEhU+pWAV7QqejX
MD5 SHA1 SHA512 SSDEEP

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 f12b073c5d3bc3ccd60f377a131c7ffea1509536ccb581f02922b393f22cdb9e
MD5 815a019810bd52fc33b8e9bf9fa797ff
SHA1 7cae8050a035bad79c9f19e09927fbebd3546b41
SHA512 edadc07d6bcbc0fd54c64ff7d85ee6bd3e4c7d92a05a9b885ad56d214c4f009555d89278a6f5b506d1a3680930ba140bfd75f36ef8be91db156419cf91d82752
SSDEEP 24576:PW6BApg2YuyuNDYTabvcdvNYf8km1SW+vxWJq0Q7QqtWLjXTqM:PF2YuHNETovAvNYf8kmR+pWAV7QqejX
MD5 SHA1 SHA512 SSDEEP

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 31727f395f1416d134e7db0969f69f4e6931d194e847904a3555316f0119edcb
MD5 c2dc699a0a2a5d2590c5d84409d56be5
SHA1 44a8c53a91f340332202e6c836183113b0169933
SHA512 bee7d9cea5d405efa6a35c9c25f722e47381da4352c45eb2b721229bc2ab6605bf25c4eeea4a1b431629fb47997a1fd2881508c4af454932982d881111c3a106
SSDEEP 24576:9AFs06+Omlf3NXEbToDW+vxWJq0Q7QqtWLjXTqM:yFs060lVXuv+pWAV7QqejX
MD5 SHA1 SHA512 SSDEEP

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 885KB
SHA256 5dcc4ffd0bfad72533c38ec1a61a90bfad430ca0defb31bb74fbef4986397671
MD5 7e77c5884fbb9f9b2ad34e2a27b6f15f
SHA1 72751d566ef5589460dab6572219a9bed99ba476
SHA512 01b80edf71932e4d910d6352aaaf288750e04238be791d4f669546a9f638357b46f267c8de7f05a8358d56647c11ce22cfa90516199bd66c69a862dc4bf3a07d
SSDEEP 12288:9CJnJ5D3VkrDzx0ZI3XPWvOYRcDRJZ4w8qIV8mQR8XZi/mWcSjpI0Tkdure6:UJnJ5D3WX2W+vxWJq0Q7QqtWLjXTqM
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 b70dc06671436de9672dd5e828bed3a6ffbcfd3aa98af8e6f0d8394e2076cb51
MD5 c516c7ef892b88df56dba97eb6f7e0da
SHA1 f865e5e1b7eedaebdb4f3a9cc1ddb3864468e88c
SHA512 ecf88b99650183a5e4221fc2951def2c406766bcf4cc8bee610b906e6495d00125a49fcce0f826b1fc842ce086058bc86b855f1c0afbba6f0a144f12bc7e6169
SSDEEP 49152:/g06DIKdwc+eQnSt65aVN+pWAV7QqejX:4uWAV7v
MD5 SHA1 SHA512 SSDEEP

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 661KB
SHA256 bd72a8cc6fb078039d84505bb88a981d3f986bdc43a7c74926b53d49e290724c
MD5 6d88f015b52a1f50f80beaf0e546a855
SHA1 d1ba5635dc8c30f4049656e92d14860f8be60e05
SHA512 a10e164c837dae51244080a603ea69cfc3103cbd52932e27ee1b299fc1e7d21f7d943317afbb245c26828500c741f213954b4d7911584dc0fd1e028c760cabb5
SSDEEP 12288:xEP3Rn6ZI3XPWvOYRcDRJZ4w8qIV8mQR8XZi/mWcSjpI0Tkdure6:in6W+vxWJq0Q7QqtWLjXTqM
MD5 SHA1 SHA512 SSDEEP

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 712KB
SHA256 0b6ec0f48aba3227617ea29e5cf00bc2c4addbe5567400349eae6d2f95d868f6
MD5 805de5677c601676209676e60795adcd
SHA1 36eff4c25ba2dd4c97d0bb93559373ad4ab615d6
SHA512 1dc55aad1b5ae7d5993ce8ad2c1ef0743674fca41849a39f28f1460e8b54c564587684d992b558601608cf532555eabc0fceb5a459c263d8ae6fe1ccc168bf5b
SSDEEP 12288:8jkyRZI3XPWvOYRcDRJZ4w8qIV8mQR8XZi/mWcSjpI0Tkdure6:8IyRW+vxWJq0Q7QqtWLjXTqM
MD5 SHA1 SHA512 SSDEEP

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 584KB
SHA256 253784aeb3bf2f9d5a29fd2cab83eb0bdc6d3532c3ee9e05a4d786ad4a07fe64
MD5 f7f1cdfdc55faa67f83f90618ffc8691
SHA1 f6d23b6017a2634325ed20d9152f28ed5a0aa6d4
SHA512 4f60654ac110f4a447703f0cdaa65513653e4e38dcec6b976b911cd0d9162beaf76779bd661aa95c4240e785ccea858e498474bdfcf1d6d955828c37609d4e0b
SSDEEP 12288:xyPZI3XPWvOYRcDRJZ4w8qIV8mQR8XZi/mWcSjpI0Tkdure6:gPW+vxWJq0Q7QqtWLjXTqM
MD5 SHA1 SHA512 SSDEEP

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 8c460bb5318a183cab5de2fa56e400b19e1efbfff0bfef615304ff5d8fa2048d
MD5 f2db6f9d9ce6bd5ba99a05e265c0d675
SHA1 1b93368047ecf506f69ce5967188e3c24136a154
SHA512 a6e5514ce51514dde304b2ae78b12422cd9d1ee187696982d51b34a44fdede6111a00a9195003e06694ad0ad76a2fa5fa3b831a7694322313e9b4c9c8fddc760
SSDEEP 24576:HQ9MxZKdcz9dw3cW+vxWJq0Q7QqtWLjXTqM:HVKZJ+pWAV7QqejX
MD5 SHA1 SHA512 SSDEEP

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 772KB
SHA256 eaccac7734ca23b076039f4b9f48b50a43d49d6de948c5886cdc669df4ee0b43
MD5 17807a76d20e403b7b8bced266e4e7fe
SHA1 359ea60dc331e2d3ba409a2997d50f44edfb9606
SHA512 72ae021c2796044d7aee0a0895a4cf14cd2471757babbdad3d6b0b87c5f334b44b9290347f1fb802fcd7d9bda2f087210d973b648bec486d3ceac1ebe70f5cf2
SSDEEP 12288:QyoKo2JRple9pFZI3XPWvOYRcDRJZ4w8qIV8mQR8XZi/mWcSjpI0Tkdure6:QyocDApFW+vxWJq0Q7QqtWLjXTqM
MD5 SHA1 SHA512 SSDEEP

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 94d8cb63037ab5ac1c104f40425725edfb88c149a19d06c137be9420263e6c66
MD5 5fabca08b2cc9ccae35dcb16e0d0f2a3
SHA1 64d6e30f89df5720d6d056da021fd4a6bb9d8d46
SHA512 01f19cd812a21f358fa57d06f2cd090a6dbdc69f9f4205cf2cf3d2db28d91c6bcd8a356c043b7c188d448632cce57d3f44874855e943e525fd924e4692657660
SSDEEP 49152:0WcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IK4+pWAV7QqejX:e0zuNIZWAV7v
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 8e63ffc0e67f518d5386946e5d39e213ac5c61741e62d2ff2e626a529a7255a0
MD5 b96d7b20b4822875ffbad0bc449f4b81
SHA1 f6ccf26bfa5fcde2b5c1459866f581aea9413003
SHA512 d078e6a7ccd49fab245ef7d81e2cf9ca5f7ad53ac43cdb12540c528216b8d27ac1d214ca2bbe992a7bb5dae8506ed71af57198ec7c0e4574f91f9c1852be3c77
SSDEEP 24576:01QT7EcpfxR+N5AWAz3ooiYtjMqb6W+vxWJq0Q7QqtWLjXTqM:JTDxR+N5YzTfjMS+pWAV7QqejX
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1048-123-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/1048-68-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/1048-74-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/1228-320-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/1228-517-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/1468-26-0x0000000000400000-0x00000000004DA000-memory.dmp

Download

memory/1468-1-0x0000000002230000-0x0000000002297000-memory.dmp

Download

memory/1468-0-0x0000000000400000-0x00000000004DA000-memory.dmp

Download

memory/1468-8-0x0000000002230000-0x0000000002297000-memory.dmp

Download

memory/1928-12-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/1928-238-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/2068-251-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/2068-319-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/2220-323-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/2220-259-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/2220-265-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/2220-255-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/2268-511-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/2268-301-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/2888-331-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/2888-279-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/2920-317-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/2920-315-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/3040-64-0x0000000001A60000-0x0000000001AC0000-memory.dmp

Download

memory/3040-60-0x0000000001A60000-0x0000000001AC0000-memory.dmp

Download

memory/3040-54-0x0000000001A60000-0x0000000001AC0000-memory.dmp

Download

memory/3040-66-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/3452-50-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/3452-241-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/3452-44-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/3452-122-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/3732-33-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/3732-240-0x0000000140000000-0x000000014024B000-memory.dmp

Download

memory/3732-39-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/3732-41-0x0000000140000000-0x000000014024B000-memory.dmp

Download

memory/3788-522-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/3788-343-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/3896-324-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/3896-518-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/4024-286-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/4024-412-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/4028-246-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4028-250-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4084-284-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4084-510-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4084-336-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4268-289-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4268-509-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4276-327-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/4276-269-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/4276-270-0x0000000000520000-0x0000000000587000-memory.dmp

Download

memory/4460-16-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4460-239-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/4460-27-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4460-25-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4460-24-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/4676-312-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/4676-512-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/4696-332-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/4696-520-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/4936-328-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4936-519-0x0000000140000000-0x0000000140216000-memory.dmp

Download