8c71dc071011b0d13fdec9d632b18178fc44a5f690ee07a44bb615cafa82b2f9

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 14:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8c71dc071011b0d13fdec9d632b18178fc44a5f690ee07a44bb615cafa82b2f9.exe
Size 1.8MB
Sample240603-r73frsbc62
SHA256 8c71dc071011b0d13fdec9d632b18178fc44a5f690ee07a44bb615cafa82b2f9
MD5 9ff2b0ea5acc7346c4ef9571ab9eb47c
SHA1 5359ae514fa28dcfe1c673553903213f4d199cc6
SHA512 691d1abf60ca2497bbb78f8de11d1b1b1d2a5b283c5f0c983ad6e9789adc32c57cc13fa55f813e43e18a1332a34ca0f502d492e6da0581265b55b2a5ba0239fe
SSDEEP 49152:HKqAsadP0QiPzEz0AVISNT1JtMy2isGcnlQHPxi:HKI+P0PQQAVIx/nlS
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
4468	alg.exe
2600	DiagnosticsHub.StandardCollector.Service.exe
4616	fxssvc.exe
2360	elevation_service.exe
4172	elevation_service.exe
2780	maintenanceservice.exe
4996	msdtc.exe
1612	OSE.EXE
2684	PerceptionSimulationService.exe
3404	perfhost.exe
3492	locator.exe
4620	SensorDataService.exe
5064	snmptrap.exe
4352	spectrum.exe
3360	ssh-agent.exe
2476	TieringEngineService.exe
4476	AgentService.exe
2864	vds.exe
2404	vssvc.exe
2168	wbengine.exe
1044	WmiApSrv.exe
4652	SearchIndexer.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in System32 directory 37 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	8c71dc071011b0d13fdec9d632b18178fc44a5f690ee07a44bb615cafa82b2f9.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	alg.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	8c71dc071011b0d13fdec9d632b18178fc44a5f690ee07a44bb615cafa82b2f9.exe
File opened for modification	C:\Windows\System32\vds.exe	8c71dc071011b0d13fdec9d632b18178fc44a5f690ee07a44bb615cafa82b2f9.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	8c71dc071011b0d13fdec9d632b18178fc44a5f690ee07a44bb615cafa82b2f9.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	8c71dc071011b0d13fdec9d632b18178fc44a5f690ee07a44bb615cafa82b2f9.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	8c71dc071011b0d13fdec9d632b18178fc44a5f690ee07a44bb615cafa82b2f9.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	8c71dc071011b0d13fdec9d632b18178fc44a5f690ee07a44bb615cafa82b2f9.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	8c71dc071011b0d13fdec9d632b18178fc44a5f690ee07a44bb615cafa82b2f9.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	8c71dc071011b0d13fdec9d632b18178fc44a5f690ee07a44bb615cafa82b2f9.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\AgentService.exe	alg.exe
File opened for modification	C:\Windows\System32\alg.exe	8c71dc071011b0d13fdec9d632b18178fc44a5f690ee07a44bb615cafa82b2f9.exe
File opened for modification	C:\Windows\system32\locator.exe	8c71dc071011b0d13fdec9d632b18178fc44a5f690ee07a44bb615cafa82b2f9.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	8c71dc071011b0d13fdec9d632b18178fc44a5f690ee07a44bb615cafa82b2f9.exe
File opened for modification	C:\Windows\system32\spectrum.exe	8c71dc071011b0d13fdec9d632b18178fc44a5f690ee07a44bb615cafa82b2f9.exe
File opened for modification	C:\Windows\system32\AgentService.exe	8c71dc071011b0d13fdec9d632b18178fc44a5f690ee07a44bb615cafa82b2f9.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	8c71dc071011b0d13fdec9d632b18178fc44a5f690ee07a44bb615cafa82b2f9.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	8c71dc071011b0d13fdec9d632b18178fc44a5f690ee07a44bb615cafa82b2f9.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	8c71dc071011b0d13fdec9d632b18178fc44a5f690ee07a44bb615cafa82b2f9.exe
File opened for modification	C:\Windows\system32\vssvc.exe	8c71dc071011b0d13fdec9d632b18178fc44a5f690ee07a44bb615cafa82b2f9.exe
File opened for modification	C:\Windows\system32\wbengine.exe	8c71dc071011b0d13fdec9d632b18178fc44a5f690ee07a44bb615cafa82b2f9.exe
File opened for modification	C:\Windows\System32\msdtc.exe	8c71dc071011b0d13fdec9d632b18178fc44a5f690ee07a44bb615cafa82b2f9.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	8c71dc071011b0d13fdec9d632b18178fc44a5f690ee07a44bb615cafa82b2f9.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	8c71dc071011b0d13fdec9d632b18178fc44a5f690ee07a44bb615cafa82b2f9.exe
File opened for modification	C:\Windows\system32\dllhost.exe	alg.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\8f46c35b293b476c.bin	alg.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	DiagnosticsHub.StandardCollector.Service.exe
File created	C:\Program Files (x86)\Google\Temp\GUM8A5F.tmp\goopdateres_pl.dll	8c71dc071011b0d13fdec9d632b18178fc44a5f690ee07a44bb615cafa82b2f9.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_102250\javaw.exe	8c71dc071011b0d13fdec9d632b18178fc44a5f690ee07a44bb615cafa82b2f9.exe
File opened for modification	C:\Program Files (x86)\Google\Temp\GUM8A5F.tmp\GoogleUpdateCore.exe	8c71dc071011b0d13fdec9d632b18178fc44a5f690ee07a44bb615cafa82b2f9.exe
File opened for modification	C:\Program Files (x86)\Google\Temp\GUM8A5F.tmp\GoogleUpdateOnDemand.exe	8c71dc071011b0d13fdec9d632b18178fc44a5f690ee07a44bb615cafa82b2f9.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Install\{878BCDD2-1ABC-4948-8DA1-C8645DF0F833}\chrome_installer.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File created	C:\Program Files (x86)\Google\Temp\GUM8A5F.tmp\goopdateres_sk.dll	8c71dc071011b0d13fdec9d632b18178fc44a5f690ee07a44bb615cafa82b2f9.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	8c71dc071011b0d13fdec9d632b18178fc44a5f690ee07a44bb615cafa82b2f9.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	8c71dc071011b0d13fdec9d632b18178fc44a5f690ee07a44bb615cafa82b2f9.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	8c71dc071011b0d13fdec9d632b18178fc44a5f690ee07a44bb615cafa82b2f9.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	8c71dc071011b0d13fdec9d632b18178fc44a5f690ee07a44bb615cafa82b2f9.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	8c71dc071011b0d13fdec9d632b18178fc44a5f690ee07a44bb615cafa82b2f9.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	8c71dc071011b0d13fdec9d632b18178fc44a5f690ee07a44bb615cafa82b2f9.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	8c71dc071011b0d13fdec9d632b18178fc44a5f690ee07a44bb615cafa82b2f9.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler.exe	8c71dc071011b0d13fdec9d632b18178fc44a5f690ee07a44bb615cafa82b2f9.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	8c71dc071011b0d13fdec9d632b18178fc44a5f690ee07a44bb615cafa82b2f9.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	8c71dc071011b0d13fdec9d632b18178fc44a5f690ee07a44bb615cafa82b2f9.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	8c71dc071011b0d13fdec9d632b18178fc44a5f690ee07a44bb615cafa82b2f9.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	8c71dc071011b0d13fdec9d632b18178fc44a5f690ee07a44bb615cafa82b2f9.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	8c71dc071011b0d13fdec9d632b18178fc44a5f690ee07a44bb615cafa82b2f9.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	8c71dc071011b0d13fdec9d632b18178fc44a5f690ee07a44bb615cafa82b2f9.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	8c71dc071011b0d13fdec9d632b18178fc44a5f690ee07a44bb615cafa82b2f9.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	8c71dc071011b0d13fdec9d632b18178fc44a5f690ee07a44bb615cafa82b2f9.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	8c71dc071011b0d13fdec9d632b18178fc44a5f690ee07a44bb615cafa82b2f9.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	8c71dc071011b0d13fdec9d632b18178fc44a5f690ee07a44bb615cafa82b2f9.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	8c71dc071011b0d13fdec9d632b18178fc44a5f690ee07a44bb615cafa82b2f9.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009231fe76c5b5da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b4110278c5b5da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c78f5d77c5b5da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000039ef9d77c5b5da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d059e676c5b5da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000921eeb76c5b5da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f9423077c5b5da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b9f34077c5b5da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9933 = "MPEG-4 Audio"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9908 = "Wave Sound"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ad580577c5b5da01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000024f52177c5b5da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
2600	DiagnosticsHub.StandardCollector.Service.exe
2600	DiagnosticsHub.StandardCollector.Service.exe
2600	DiagnosticsHub.StandardCollector.Service.exe
2600	DiagnosticsHub.StandardCollector.Service.exe
2600	DiagnosticsHub.StandardCollector.Service.exe
2600	DiagnosticsHub.StandardCollector.Service.exe
2600	DiagnosticsHub.StandardCollector.Service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
664	Process not Found
664	Process not Found

Suspicious use of AdjustPrivilegeToken 41 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4040	8c71dc071011b0d13fdec9d632b18178fc44a5f690ee07a44bb615cafa82b2f9.exe
Token: SeAuditPrivilege	4616	fxssvc.exe
Token: SeRestorePrivilege	2476	TieringEngineService.exe
Token: SeManageVolumePrivilege	2476	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	4476	AgentService.exe
Token: SeBackupPrivilege	2404	vssvc.exe
Token: SeRestorePrivilege	2404	vssvc.exe
Token: SeAuditPrivilege	2404	vssvc.exe
Token: SeBackupPrivilege	2168	wbengine.exe
Token: SeRestorePrivilege	2168	wbengine.exe
Token: SeSecurityPrivilege	2168	wbengine.exe
Token: 33	4652	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4652	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4652	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4652	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4652	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4652	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4652	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4652	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4652	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4652	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4652	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4652	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4652	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4652	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4652	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4652	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4652	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4652	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4652	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4652	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4652	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4652	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4652	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4652	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4652	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4652	SearchIndexer.exe
Token: SeDebugPrivilege	4468	alg.exe
Token: SeDebugPrivilege	4468	alg.exe
Token: SeDebugPrivilege	4468	alg.exe
Token: SeDebugPrivilege	2600	DiagnosticsHub.StandardCollector.Service.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4652 wrote to memory of 1888	4652	SearchIndexer.exe	112
PID 4652 wrote to memory of 1888	4652	SearchIndexer.exe	112
PID 4652 wrote to memory of 3624	4652	SearchIndexer.exe	113
PID 4652 wrote to memory of 3624	4652	SearchIndexer.exe	113

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\8c71dc071011b0d13fdec9d632b18178fc44a5f690ee07a44bb615cafa82b2f9.exe
"C:\Users\Admin\AppData\Local\Temp\8c71dc071011b0d13fdec9d632b18178fc44a5f690ee07a44bb615cafa82b2f9.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4040

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4468

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2600

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:3708

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4616

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2360

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4172

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2780

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4996

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1612

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2684

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:3404

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:3492

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4620

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:5064

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4352

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3360

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:1928

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2476

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4476

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:2864

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2404

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2168

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:1044

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4652
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1888
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
  2⤵
  - Modifies data under HKEY_USERS
  PID:3624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
Size 2.1MB
SHA256 b35eb5e2d27e0bc50b4570e3a2e140a8e4c7951303602b08c586e70d1f431e4d
MD5 33aa998217cdc4f8637be0548a748469
SHA1 1c7889bee56efd1d48976e5f00169fef780e3c2f
SHA512 5404a67a4c7e3b5e8e55d705be99c9f6f404f68fe20cab32abdc2fe22ad736fbc5047ba40035e53afddf4fe3eb859a233efe9e38d49af00ce030da2c126e9734
SSDEEP 49152:yuYk3H5koUZfTqkkYLO/W2buywzMbOX+T7z5ZisGcnlQHPxi:yBfTqi90b9nlS
MD5 SHA1 SHA512 SSDEEP

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 797KB
SHA256 9d5bb92b7959e97e82752901bc8bd55d34799fdc6c158457af3b6adc573161d0
MD5 61438662da376c599efb5a046128b2be
SHA1 67187140d359708259bc2ee4b83adec9358059af
SHA512 416096fba04668066edc36da4ad3ccb5521aff0961aea6c14ebe707aa6c6eca16509267bf048c04eb262cd2b9c4196579224e597d648ac38894a27f661e5fbcc
SSDEEP 12288:acQiTmNJLBsunEI4+/x8J7ct3z5htUcQ1MlhrmQgwwJzt5+7fyZkCtXFiWZF/3o:ki6nBsuEI4+mIJz5IcuMlQHJxrDiSi
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 ffd739aad8635d2a7bf8a951afa701eddd1cdcb15b38056180b0555f6f3c48fb
MD5 be4d09fc2bc57a3e3f7956abadcd5eb0
SHA1 785a77873cfa702857f0a3371f82eb70d6988463
SHA512 12fb5beb26929d3673a6f6c247ba98714e4f49f504270eaf1fa6a2dd5c61c6b96e992350e7c07e2840b2938d8c2548bdd68f77c47f38c65760a818becaa449d1
SSDEEP 24576:S+gkEDfh4Cos4+mIJz5IcuMlQHJxrDiSi:XgkETSeisGcnlQHPxi
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 6b21172418a148eac9d3ec8740cd17aafdb63ae4b5bf42ef2fa840bb7951543d
MD5 89b2e9a31d1859a3fac70ff736c1f33b
SHA1 6e93e2c7b35b75a50c1cd6fd9ac40f2ae45aa551
SHA512 ecb89f2f61de2a92c5989bd27aad3f5d8c2b57e689325f8cb04fb22fb877b458e503b6c142ea7aedb99cfe8ee37231fbba55bbe34b3b922578cd8876e7d3f4bd
SSDEEP 24576:jBpDRmi78gkPXSyo0G/jrd4+mIJz5IcuMlQHJxrDiSi:lNRmi78gkPX/o0G/j5isGcnlQHPxi
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 06c0459e0ed9cfd25387b5403bc271f76a183546149a983be23529141d9a40c8
MD5 6d415bb24c6c75ef65858854a2feb60d
SHA1 11878b631b8b1cddf81e0f3b1f9096bbb9fbf428
SHA512 e9451200a774cbd4df9260a529ab0b919d4811af34503b70c1f30c6c072b6e5aac434631b05305c6c10ccbc354fb5d7d5f8eb49b03899a0d104bd53daf04734a
SSDEEP 24576:JLOS2oGPIXVs4+mIJz5IcuMlQHJxrDiSi:T/GxisGcnlQHPxi
MD5 SHA1 SHA512 SSDEEP

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 490111f219bf0160242a7080d7aa032df2e3149f032322f6bc8567f59d63f614
MD5 0d7b970f4a7b87699a5055db3417dfad
SHA1 bed0902dad60dbaee19a2abfb024ebb7421bd2cf
SHA512 da3b2004fcbfa9fcda840e0c1f72c33e1dbfde4af528d110785e2d5c75eb40ba561cfeeb6f245355fce2600506774427a7812cc7ea092d54795942af9385c7e0
SSDEEP 12288:kY+4+/x8J7ct3z5htUcQ1MlhrmQgwwJzt5+7fyZkCtXFiWZF/3o:kY+4+mIJz5IcuMlQHJxrDiSi
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 d8c6dee1c3814120b85a88071583ef25fb42f70c11942b725c1a6ead64b8004b
MD5 43be5900763ea7c07d58bb3b5ad35d7d
SHA1 859568c3d9fccd171428fa6b881d4d0be7208919
SHA512 5732d4c31ca30f27e47b7aeb026762121c74299967aaef4362f60594c00bffc2bb10ce20284cc54d9d3ffd5303e71c1c750ba3a5559895178c36e2f345850a0b
SSDEEP 12288:2eBNUbTVO86Uv4+/x8J7ct3z5htUcQ1MlhrmQgwwJzt5+7fyZkCtXFiWZF/3o:2JIUv4+mIJz5IcuMlQHJxrDiSi
MD5 SHA1 SHA512 SSDEEP

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 f575d2ab7eeb00a9f1a424c33b96f84c8531e6cf57681be5a388b643c3816f27
MD5 7a4cfc69572db646d3c4df394792f973
SHA1 8c9429b047810a2b1195e8033dc49961e44b27a2
SHA512 c2af15ba03bcb226061f462dc800827a2a1d39ada0bfbcc5609e79a807f99f579f567f02c3a4bd7f399d621979a4f410955e5eef91d8250bbec632bae160f606
SSDEEP 49152:HQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJp9DN5J8NRV3THb:HQvGAdlCEL8c/pRNw5CMnlS
MD5 SHA1 SHA512 SSDEEP

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 efa88009172121bbe4e06db17f1fd5325d89cd2755298a1fb45d44fca2dafdc1
MD5 0db4d2c4dc6db5b556db6f8e34490493
SHA1 4b5aefaab240ed7149dcaa2da36e16ed085d1a1f
SHA512 2c0fc5c37a54a77de1d366d8fe8d1c907aa7f124e90309fb60e00a51a29fb70bdd231cdd3a9ea6e0ac4b6bc7ce2fb95bf348513866810489813c1313fd611f04
SSDEEP 12288:WAwSfxL/2Dc3xDLLmt0LDQewsAjV4+/x8J7ct3z5htUcQ1MlhrmQgwwJzt5+7fyu:rwewsAjV4+mIJz5IcuMlQHJxrDiSi
MD5 SHA1 SHA512 SSDEEP

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 a7a63b77abd74f127e961697dfb7f4669ab0d3439024d0eeb6c2cf84bec01dfd
MD5 c1e7e0eee60f4e8dbcfc25aa7d094914
SHA1 db737317e0f8d4808c75ba1f0210f9fd708fb8de
SHA512 0e664fc7fe370e2bea045b3c6e36440f94611a64b4817519b1b5bcc4c83990ee3daaf83dafdfc0bf503c06bc0a010fcea127c9df7e37d92f358335fe91bd2195
SSDEEP 196608:mUEtQeTbvf2zlO12sJTv6Ja1cpVLy9IldPlbuJHLS:mUEtQevvqc2W1cpV29I32LS
MD5 SHA1 SHA512 SSDEEP

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 3bf9bec4dd915c5f224b2b442c3393089a4f77512e044c8462ae1f3d4246df57
MD5 4f5b5f635964383864b988c41bb8a5ac
SHA1 d86636176b1c72c626d68e508a56649770dc7783
SHA512 61bc7d99e6c519c6e2cc316eafa6fa342b9174414212deb03cf08d7946832be7b786b5e5c735b5c262f737e20fa12077f5d310afc147f0e2fc4a2e7fe4f15563
SSDEEP 49152:mCbRquA/m2yL5zifFiV+XenmE3/z1isGcnlQHPxi:LoqHVjnmwnlS
MD5 SHA1 SHA512 SSDEEP

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 61d38b22d47801469251fe8ad2f5b0b3f0e13caf03f63da2cc3f6daf2dc87c67
MD5 f6d44f24080c3b7df569f2d79798534a
SHA1 2388bacfc35f1e0d79ec61af3cb9b63eed9a9e74
SHA512 c72c248f746740eae4369b3b50385dff5ad098bcdcd89e10d44b1266f52d184b922ac7bd42cf0cde3a35a4989dbf7d7447780e91463a3acd20119159193c8c35
SSDEEP 24576:QAhGLmIFoiwtA5l7S5384+mIJz5IcuMlQHJxrDiSi:QAM1Foiq5MisGcnlQHPxi
MD5 SHA1 SHA512 SSDEEP

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 88dceb6363776165b5d03c6a4908662fe57dcb49c4ac3e2feabadd214bc24838
MD5 6bd15ec2862a60c3a433fddc60d90980
SHA1 6637198882f62ce976e3a2a192da9cde60fa7081
SHA512 799173e9fbfa259070caa86bea726bf95467274b6a37479500ab78a187a657ffdc6c98374c2f2af8f35a45c30296b6188c9092397891400e33d8116cd5368444
SSDEEP 12288:Smw5HEjsChNOBFgl0WDm+Cw4+/x8J7ct3z5htUcQ1MlhrmQgwwJzt5+7fyZkCtXu:LwuXOWx4+mIJz5IcuMlQHJxrDiSi
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 570164751c3ec655c57bf53245d2338d6e1cdb11662aeacda075eb2aba1c844c
MD5 c9cd73f696dab8a5348f3058a35b4168
SHA1 48cd0ff603c4466fcf6cc4513dff98d479a8d1f3
SHA512 e2f0f041468856c17a91e9c951207225c09b878b394dba97758f6db3d03036f82e264661b9cb268b8f091dc5b30d2ab4c58421ad185c5d8b541179b9f0483f4c
SSDEEP 12288:VbZ1IyF4+/x8J7ct3z5htUcQ1MlhrmQgwwJzt5+7fyZkCtXFiWZF/3o:RZuy4+mIJz5IcuMlQHJxrDiSi
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
Size 5.4MB
SHA256 e80f2c4c781de5f31489724bc6a17330275485a2da4ca9d8b28409269db8f6d4
MD5 9676de2e78ba52933a13b4a4d24a54c2
SHA1 697108106a2aacb19a221d12161a2049a788eb3c
SHA512 f80cb5d39c13aac1dcd79df4d1f7ff2a7019f5e040f8a8d7fd081246ca334085080a23246dfd82c6664bcaacb001b423ff6aa0144a2daffd329a343dc184e901
SSDEEP 49152:f0kwIi7c4xZlm5knEtw99Kn/2vim7vgv6m+yyJ/0gbvjW7yY7BHi3u7L/gBUUWLr:DwfhY7g/rLq7yYA3awr341gYnlS
MD5 SHA1 SHA512 SSDEEP

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe
Size 5.4MB
SHA256 e52d7d000def9864274177e3aab94485bf518d605540b8de39e0cafea420a115
MD5 4ec8d03e0e26969f19bf7664e8310bb8
SHA1 6648b17854135ce1a07311144fe23fff71c90110
SHA512 20ab98d9a437b9907bbd312b1d9f56e138fd4485be1cb196c9109c2ccc403f63c7781d1b4f8c23558f7d616bf7b08684d4dbdf2b9c2cae8244d75138ada6228b
SSDEEP 49152:P0kwIi7c4xZlm5knEtw99Kn/2vim7vgv6m+yyJ/0gbvjW7yY7BHi3u7L/gBUUWLr:TwfhY7g/rLq7yYA3awr341gYnlS
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe
Size 2.0MB
SHA256 d29e9688a46669ea97a4c450231dbf95b65705ad6ba023a522fffaf98210f4f4
MD5 d860787b0b0fbadcb5a4dcabbe02234a
SHA1 6f7bd074b0a04d7d5a814fbf45e8de160a23b116
SHA512 5e18a8e794c433558ed2b0c89c36b3e0e4c84887d6f14b7c7b7e2508ef8a72a77f8e0c5b5acc4a3bdb0497e5b34bb26459c34c90bcda36f86fabfd2455d10757
SSDEEP 24576:VcTyYv0FteQUG5I2kjgD6iQacAx4+mIJz5IcuMlQHJxrDiSi:VuXv0FtpP5606zOxisGcnlQHPxi
MD5 SHA1 SHA512 SSDEEP

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
Size 2.2MB
SHA256 07b7a1c59309348b6659f674a805f53a4cb9f3638dd98a9cfd32d4fbbbc15289
MD5 d18993de184723c3c9903cf80fd8fce0
SHA1 1d556d88ecfe75f715c0b6e8ff76cb144e21e484
SHA512 7bc4cc421e221e7d59050c34f609390891cdb46fed8ea1a41318c6cebb7076b0e58645845b83f07cf95d98b05e36b8c454b8af3dd75b9733827810cf221261af
SSDEEP 49152:4y7mTd0GxN8jyynlHjXKUyn4GVcbDSKrNTxVisGcnlQHPxi:nmYeylHjWjMT9nlS
MD5 SHA1 SHA512 SSDEEP

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe
Size 1.8MB
SHA256 9e80f9a93bab1d61e9eac78354821acd10ac4e9da8d26c933e6c1749cf29a272
MD5 c65f3b0d7d67640a5e27abaeb6af280f
SHA1 d7072a159af7c16b9d4568ef147591be95912dd2
SHA512 49232144e636a88df1558cb923b99db1ac20ee9b28124857e82366e091cb5bdb0d55b92091f1e60e13da57f6ea2712a76bbd05fab30b9925f7132908bd8aac51
SSDEEP 24576:s6drZn1WEci182IEUpNbJeRgUebgW816q4+mIJz5IcuMlQHJxrDiSi:sWnDci18VNNUgbYZisGcnlQHPxi
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 1.7MB
SHA256 fce1c07633d1e906f148b1bab47f05c363adc3ea4d5ccb7773de8a0386c722a2
MD5 889e10251e6e4f76703948e9af652a34
SHA1 d9be2e9ed6a25bbbdfcd142475b23eb437bf2486
SHA512 22061fa72562dc681c16c7e679e8a4f5646b9ff922c6fab3210d4d426683d0e906034b46167f087288faf7286bded4dafd6e01dacb4313d7d9aa011422e4dd07
SSDEEP 24576:Ik5lHW5EzMZupOu0G2reD+melRgTTv/1nyD4+mIJz5IcuMlQHJxrDiSi:OizMZE0GhamSoyisGcnlQHPxi
MD5 SHA1 SHA512 SSDEEP

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 42fabcd23dbb055a51d40afaab386bf9493576f17c87effb4eae763177185f7b
MD5 49981fc4199e3a0fb24387314a6469ca
SHA1 3bec5c4872ca06880d6d8de19bd00e0be31c481d
SHA512 b3c546de81454f23cb188e9feeec25c51e7f8409790608ebfc1d8b76da7cbc4225c10ccdd0daa5c143f0ab57106f22d9688fcf97aa1ea3b73b12fd946893ce70
SSDEEP 12288:KG4+/x8J7ct3z5htUcQ1MlhrmQgwwJzt5+7fyZkCtXFiWZF/3o:KG4+mIJz5IcuMlQHJxrDiSi
MD5 SHA1 SHA512 SSDEEP

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 31cfc0e7abe7fa74daa881a81c1d0b078fc277d9995d40368fac6a54b7a57169
MD5 95a5d5c9db6594d4456125dc2c138576
SHA1 2503abd53641824f4450c17cd93f88d81ba1cddf
SHA512 b7e7a718be59bdbfcfa043a0ac4b6690f4e61a5caf32012c5a34fcb143a21b77d3b8a7daac41efc82ab42e85a592065cefbbaa350fab2fec97dc229389851c10
SSDEEP 12288:6J4+/x8J7ct3z5htUcQ1MlhrmQgwwJzt5+7fyZkCtXFiWZF/3o:6J4+mIJz5IcuMlQHJxrDiSi
MD5 SHA1 SHA512 SSDEEP

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 31190bef684ffc10c8e390365f74aa2f5581471abef02dd794ce3ae864f31dc0
MD5 b491d050e436bb2ad97385131efc80bd
SHA1 4ae48bf3d785f66a3d61ad4ca83e64de46a070ec
SHA512 8600a723f4aaa369483c920b73f778aa631091e0d4a7692fcf57e9afc8eb669e1e61899bbb9b27a5eaf0d5dea7921c1d19989a8f78dbd428ff05d1954536d7e9
SSDEEP 12288:YX4+/x8J7ct3z5htUcQ1MlhrmQgwwJzt5+7fyZkCtXFiWZF/3o:YX4+mIJz5IcuMlQHJxrDiSi
MD5 SHA1 SHA512 SSDEEP

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 b5ab558b0b2405bd19fe85e17dbdcda44f0baf8af50cde20294abe082119b85a
MD5 96949478928fee0ef43dd84556c83fe6
SHA1 6f121dd60f2dba1e2277e209ecf12713f90b36e3
SHA512 d31b2a776283e5ca335f83a5945bc5b04234c9dc08e8d4af5f90e538281390a908e66ceba13e3592f744224f217cbe9bc0cc0f88f994245e641079860e736951
SSDEEP 12288:BVc4+/x8J7ct3z5htUcQ1MlhrmQgwwJzt5+7fyZkCtXFiWZF/3o:A4+mIJz5IcuMlQHJxrDiSi
MD5 SHA1 SHA512 SSDEEP

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 0c3b1c65c1a36085f71eb0a61bb22fa85333a821620b31e908851956743dcefb
MD5 1ceb17cafb786e56ca5d79027fccc0a8
SHA1 7bb6cbf577cabca9d1882610b4783ce673968787
SHA512 282f6f874d255278f0752b21ed180de9fb8de16a65476120872f1620598421b858328c1d2589a66cc4b6e2854a3cf3671db032560a4ca359392bb943560f1289
SSDEEP 12288:+U4+/x8J7ct3z5htUcQ1MlhrmQgwwJzt5+7fyZkCtXFiWZF/3o:+U4+mIJz5IcuMlQHJxrDiSi
MD5 SHA1 SHA512 SSDEEP

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 52cc20999b8954f461a0a791621c1c69984b0677d863305a8f6cb7ad86e824da
MD5 e1a2182f6b51139f0f4e0fe0d2cf1ca6
SHA1 ec7f0f6ca6a4cb0a957c0820e66f610370dc3efa
SHA512 4aec7eff192c2d4c6363740e72a2b3f31cdcb586e9d34b653b0cf7315bed821a95ea1837592db4de54a6848344d17680d9d5fe37c5098035e08a8f833904b373
SSDEEP 12288:cd4+/x8J7ct3z5htUcQ1MlhrmQgwwJzt5+7fyZkCtXFiWZF/3o:cd4+mIJz5IcuMlQHJxrDiSi
MD5 SHA1 SHA512 SSDEEP

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 2d01b72721d03d83fdbc808062bea97cf844a589029c73cb3c8d2356f1858156
MD5 23a68ac6723a7a15bc7c7ca338db27ea
SHA1 33085cb7d1ad9e279e7f7da2405eb0da25c60b4d
SHA512 5a1181c97a4483e77552a261e3dc21a688f4c8e422c73f42594ff4dd0100c30010485da0f099e653b93fd1c5b93109022f68687dcabbcbb27c5d5be5b7aec541
SSDEEP 12288:pB4+/x8J7ct3z5htUcQ1MlhrmQgwwJzt5+7fyZkCtXFiWZF/3o:pB4+mIJz5IcuMlQHJxrDiSi
MD5 SHA1 SHA512 SSDEEP

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 8882dd8c2bac56541ecf83e6cd6ebdc2adb35587500c1b7a34858a7453e09a51
MD5 db0ef8cad98a9040969c1d60df27ae01
SHA1 9a963454abd2c72c76ead04a3ed36ee4728c4702
SHA512 befd142cef92ef9613b4b7b7a4f7cfac5f60262c457cf53bf88961abbec518defe95ad5176f380181188fde307237a4cad3714c8d5de181efefe2fb63d74ca96
SSDEEP 12288:piZwbNzzFEoS2cPvyp4+/x8J7ct3z5htUcQ1MlhrmQgwwJzt5+7fyZkCtXFiWZFw:sZMJzFVSOp4+mIJz5IcuMlQHJxrDiSi
MD5 SHA1 SHA512 SSDEEP

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 6ad053c3b128fb2126fb97d12758c10aed4c62c6b39e0ce796e090fbc0e34dcf
MD5 a24bcc82897a60c62d125276bbb9ff97
SHA1 981ace75403712e7af07f1af23b6546c995595bc
SHA512 a08e590bc96df54715ffdc60c469b9f2aebd0195fb25138010860fd285c9091e885ccce9beb65e9189e7664f85eed78d958c4592f7cebb61d3a3cf2837096bdb
SSDEEP 12288:Di4+/x8J7ct3z5htUcQ1MlhrmQgwwJzt5+7fyZkCtXFiWZF/3o:Di4+mIJz5IcuMlQHJxrDiSi
MD5 SHA1 SHA512 SSDEEP

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 afc8f0aa108db1ea8a183264acb273c167e6ed34435789d473638128da3e1ee6
MD5 9095b46c5cb624fb9f53859e6e4ac079
SHA1 b97d5329f41387e2be55d464f1b74196f5337765
SHA512 262a972f74aafd06b49f1996192507fa613d4d225ba7747d6c5f9312f039af4ac6a6fe3ed732d397a50f5cf0f0bff5179bce21cab9a6c6e5feec02656bc3348e
SSDEEP 12288:Ku4+/x8J7ct3z5htUcQ1MlhrmQgwwJzt5+7fyZkCtXFiWZF/3o:Ku4+mIJz5IcuMlQHJxrDiSi
MD5 SHA1 SHA512 SSDEEP

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 c23e3292dab22ebc9c863fae4025d4da3fd61ec9133847ab9ae1ec21184102f0
MD5 bd4e93b89e67a6fa5b6665b1fab3dcc2
SHA1 6d0244b8a3f417e2152e75264dfd18204d958560
SHA512 064773a7e2902c0a9a63a2b740495801b2e239b0d69c33d50e3f50c1cf758101de7dbcd30848ae70a0c43116b7689a372f5999590294785be407690ff1827817
SSDEEP 12288:GyPz5L8F4+/x8J7ct3z5htUcQ1MlhrmQgwwJzt5+7fyZkCtXFiWZF/3o:7zyF4+mIJz5IcuMlQHJxrDiSi
MD5 SHA1 SHA512 SSDEEP

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 4d1b870ca3de996efac76472c601ed47c5f1793872ab38693270d2445b0cdcb8
MD5 19a42affb9d7b537f3cae8a9c49f6ed9
SHA1 a4b29d2698b6d70e806b39f5c45aaaa4744e6425
SHA512 0af9544cf785a2c23ed9cc61a5439f35ade1c77dc401dc3326a1d4a38b763e845cb4fec72c240377017e87b5601dd2bae1fc2c2f8c230487359364605c54bd97
SSDEEP 12288:qi4+/x8J7ct3z5htUcQ1MlhrmQgwwJzt5+7fyZkCtXFiWZF/3o:qi4+mIJz5IcuMlQHJxrDiSi
MD5 SHA1 SHA512 SSDEEP

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 44bb3191b4942bbfdf4bf73175515d20c53aced13544d986d26a967e733d1345
MD5 0a7a0a881b912f5f2a6242b1c2866e34
SHA1 8e5f24edf0b8796eeb577f8eedb467ed39fc8c6e
SHA512 3f06f24eb1262a647d00625b428a6f30f5926fb5237d898d547409397df419c3b4092ace5fb7ae16da03a268346646009614049557c185ba122a037faddabcc1
SSDEEP 12288:yi4+/x8J7ct3z5htUcQ1MlhrmQgwwJzt5+7fyZkCtXFiWZF/3o:yi4+mIJz5IcuMlQHJxrDiSi
MD5 SHA1 SHA512 SSDEEP

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 ff4111968624a2af1b22c63e43a9659d232df89546103dc72a27419014d5f75b
MD5 8755cba5dec0e3f5e8f43458a155b6ed
SHA1 795d14a0fb4463dceff3aca360c92b180f00fccf
SHA512 1df1870bc1f137afb68c97423059e1e9edd04b5d6e6f4d748b36b4c8cf368ee74ef52ae3fa90c86c2ff6a441820d25a6526a096bf364526d1fa0a44f781c2710
SSDEEP 12288:TyPz5L8F4+/x8J7ct3z5htUcQ1MlhrmQgwwJzt5+7fyZkCtXFiWZF/3o:ezyF4+mIJz5IcuMlQHJxrDiSi
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 59a38370168df46da103c94867171177af928f993794c7c53b81c2c28ad48f8a
MD5 9c9e1b94b9ef4087ff39c8b1745c4670
SHA1 3fe1760dfe04781b3028c8473defa1bc9bc1b088
SHA512 0097744662f810ace17b1da677ad6a68ce843e5ba7e841892114a908689a6ac35fb565be728634bc4fe9ee4feb061b0e8171feeb5038a40962e28edd5d1d52fd
SSDEEP 24576:5TuaLl3z0zDn4+mIJz5IcuMlQHJxrDiSi:5TdLljQisGcnlQHPxi
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 dd7130ccb23b49da1fa1d364d400dabb7d6fabc01f835377fa1a6d453dda3368
MD5 9fadd54efc453b26888bafbe4e6bb07f
SHA1 256556b23a96afa235cf59687b763209ca32103d
SHA512 496d2062be686de3ba5761f5995c386fc4f24832e7d22596ce73cfbad3c888e0048f67f3a5b561671d5d47918aca300df9e1d8ccc98181d9418697197a5a6a69
SSDEEP 24576:13xd9CHKy7GZb4+mIJz5IcuMlQHJxrDiSi:Vxd9CHKyaNisGcnlQHPxi
MD5 SHA1 SHA512 SSDEEP

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 764cf0f60088a772864e48c44a602d46312044af28bd80e9a0a2fd47ae9644bf
MD5 19b265255cb7eeefaea9cfc3b9149279
SHA1 e95100ab6d5e9f32f119c66689394d8955da03b8
SHA512 7c8749e5bc98b3054829f15f65f90638afaf210e31a8441af4074e25b8b028a6b7296ade16f4bd2f567b47cfc6ba9b7cd749ee8aa791489576a5309766bf3d5a
SSDEEP 12288:+34+/x8J7ct3z5htUcQ1MlhrmQgwwJzt5+7fyZkCtXFiWZF/3o:+34+mIJz5IcuMlQHJxrDiSi
MD5 SHA1 SHA512 SSDEEP

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 a2430ce313f3a29d1d97ea25c3bfaa589a2afaf3ecd087e893b1f19f89e6cf85
MD5 9d23ed0020ef9d3fe62bd898ccbf1df3
SHA1 6f49aa530f7ed4d603113f9192d6af669a657976
SHA512 aca25c743641df850bbc4fbc239c960dffc146d4c20579ec1d77a593d47aa96033508d125c502b4ecd62c23797ad65563a124428a7c3eb300331c2cfaa3edb69
SSDEEP 24576:NcP4mcvIjkGOxhKP2l71SNKbrh/8KB64+mIJz5IcuMlQHJxrDiSi:yP4m4IpOO67N8KAisGcnlQHPxi
MD5 SHA1 SHA512 SSDEEP

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 701KB
SHA256 3a557646cc1cd33589baa91ed67513d78df81fab9b4f2d475f43417740a2ae94
MD5 759ce950138858cba4346d34c4984bde
SHA1 83f83c6e5f122296e4a01f5507631036773cc26f
SHA512 12588cdc2658a183375f1ee3bb9a0d33714edc356bfd5c7514affeb2e227531b66d184fd7ef99823acf80efb7de43971cc838807f31983918791dfe1721725e7
SSDEEP 12288:zUFmDDLr4+/x8J7ct3z5htUcQ1MlhrmQgwwJzt5+7fyZkCtXFiWZF/3o:7r4+mIJz5IcuMlQHJxrDiSi
MD5 SHA1 SHA512 SSDEEP

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 b6beacec4656200efb2335afbb638fe8ee2505ea426b16ec133ed2f8140f7323
MD5 8f2634c1144f112f3d6593f660eaa0e0
SHA1 3750b02cb3d34f68673d9ddc3519592d3a4ba1cd
SHA512 82dc90714c38a7c406b719858b55c2cd24e2fffc12feae2e4222f2b3e69ca2ff8d3bba83280a2e2112d52cfc432b54d77715c434d468d635ef0f311b1c5713b2
SSDEEP 12288:iS4+/x8J7ct3z5htUcQ1MlhrmQgwwJzt5+7fyZkCtXFiWZF/3o:iS4+mIJz5IcuMlQHJxrDiSi
MD5 SHA1 SHA512 SSDEEP

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 1574d4add5e82c97ae0beefa4ea7ee1345bb769014b905169bfd5d92d3c380c8
MD5 5e82bf5ea335b1aa0c5b943480e04cab
SHA1 af932c0b8229db35a3b3304e2a935ac4d0805def
SHA512 d9fba1fd99b51eaf19eb7d34e3845363b7fefa683fbb562e986e632b0524f0ead60d8630d6585472870b3866fcc97c7e250839db7ed8431649de37c071e88d52
SSDEEP 49152:5a0h2GEkuAe73q3pp46zwwQUisGcnlQHPxi:5a0hNYG4Jw1nlS
MD5 SHA1 SHA512 SSDEEP

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 659KB
SHA256 7650bbd5715027b9da44617e9d393b6c7ca42f186c6f360076daa329107bc3fd
MD5 2f9c9f0ed796ff9ff8787f3e9a5a4665
SHA1 5e13043f6176236688be905b306fd5c96f10d2b8
SHA512 cd566ce5e985105342b94bdd80e6c7350e0c526d4a01e591b40a4f04449499332dce030516e76b67324be42cba752685db1e1e3bc802493fffd2f337a605e508
SSDEEP 12288:4hbHjfXZ4+/x8J7ct3z5htUcQ1MlhrmQgwwJzt5+7fyZkCtXFiWZF/3o:4hbHjPZ4+mIJz5IcuMlQHJxrDiSi
MD5 SHA1 SHA512 SSDEEP

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 e9017fe81d7124fcfbeb01a7679096ffd55a283e3a832d9b5c050bcea7f7c934
MD5 6107770bd4baf0f4f5492d54e1321f95
SHA1 da515e91e0fad86969e08c37a2dd88a19b55ecf7
SHA512 12250b65a99a6d2a7257f7cb60ac63852cdf11f4380893fe1ae40c26698923b0b169cd1962fc555b619e47e8f3f4d02871a5e3282a2d150ea79679f9cf592694
SSDEEP 24576:63YgnJcRTk4yti+R5dpR/x4+mIJz5IcuMlQHJxrDiSi:6IgnaTk46ppR/xisGcnlQHPxi
MD5 SHA1 SHA512 SSDEEP

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 578KB
SHA256 e282a8c34aeec1182f6d274919cd8faac1481c6cbd15f43e48bc19b1d7f235db
MD5 107ac43b2e84ffe62e349059f487db35
SHA1 0ce9a4f20a10f66628f6d4f589ef8d497f274c13
SHA512 02c8f7d06d4e9b3340b10288049936fb67ca59fd8bf7ba5e578f8c29582411905fdf511514de442ec590bc8b9f38285bdfd89725d160a0cea9764fbce1a75cef
SSDEEP 12288:le4+/x8J7ct3z5htUcQ1MlhrmQgwwJzt5+7fyZkCtXFiWZF/3o:le4+mIJz5IcuMlQHJxrDiSi
MD5 SHA1 SHA512 SSDEEP

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 940KB
SHA256 3e5ce0b1f2affaf816eeeacc72fe5f0990fa9dad885b80e5ed02ef7126fec550
MD5 bee2099a5476e25c6228b4e27b22e283
SHA1 3b10d95044c1d5fc7fb70527d0eacc77ee44d844
SHA512 9dec5579a2519d24121ae8c2c35c5b41a9a9fafd16bb4e51c87fcf9b6c89cd05365b47d002689d54d6da21675269b7c3e0e8273693d4fd68479484917a496752
SSDEEP 12288:hObZA4LWOsvAYFTz4+/x8J7ct3z5htUcQ1MlhrmQgwwJzt5+7fyZkCtXFiWZF/3o:WtL3UTz4+mIJz5IcuMlQHJxrDiSi
MD5 SHA1 SHA512 SSDEEP

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 671KB
SHA256 d8ccbc3d2b471b46493a8f0375bf54dfc2cf394a866cae75119bf171f53ffdb0
MD5 a13108a92e9607523c7a8c1d2ce58a42
SHA1 4c8970a03aa8b0b1e5dbe1cafaf075b882702e90
SHA512 910fb6d07a14c0986ef0eb21802beade57034f8fe9925c6339ffbf40d84b6aaf3ca3438a3a0c2aa905543adb8a22e93a4357f1f5d34c588074e0264ca75008e9
SSDEEP 12288:HpFtUOP4+/x8J7ct3z5htUcQ1MlhrmQgwwJzt5+7fyZkCtXFiWZF/3o:GOP4+mIJz5IcuMlQHJxrDiSi
MD5 SHA1 SHA512 SSDEEP

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 16ca7fbbd057da31547dfd65d0a8ea0d33050bf72cf5a2695f87c50baf3f4c98
MD5 2f94e9d9d8329f0b69596a4fd5fe0074
SHA1 1ae4108ff339b6e9d0fb85e68987045109981718
SHA512 535a4ecba32edc2b07a6083eb0759f67ae5629c9c2be97d137a5f5239b853545b16f1555301f09b08c394d1e6dba3080d33d88e683ebdf4a79b6d4d1bf54ff47
SSDEEP 24576:U7NM9YmZqmWMUkPjZM48Mv6bEhsi4+mIJz5IcuMlQHJxrDiSi:U7cBWMpPjN8DbEh5isGcnlQHPxi
MD5 SHA1 SHA512 SSDEEP

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 74a79db2befd425f35d7f963f398fce9817d6168c8aaa1a9e34c6a7a4481ec17
MD5 8b82b2e64b26cd4a91a905c6a5d0edb1
SHA1 95b36188d1914a79b31e4bec4c3e709983e54fb7
SHA512 773594a8606b02f43401b7f7940e75bafc9181c1624d2b907a31862da5fa80ff6258ed9ad3b64b2ab39e29421046df0031c4b6f66870ebd1c34d6ee7e2f13427
SSDEEP 24576:xW6BApg2YuyuNDYTabvcRvNYf8km1o4+mIJz5IcuMlQHJxrDiSi:xF2YuHNETovcvNYf8kmCisGcnlQHPxi
MD5 SHA1 SHA512 SSDEEP

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 e62d9fea065c5cb1a91ada132b49742b2a45b288226316fb95b559f648bc3604
MD5 ebfa028871391132c2b65c02ea829840
SHA1 acf5f805fe6c98bdfa47113bb1edb4d87c599447
SHA512 b832c12880c9cfc212427abf1680dbdc3345deb98aa2e32e24629aee30e643aae1bdf227568250733a2fd20e346f9f47371be0a11b0f38c007468a61fa34baac
SSDEEP 24576:oAFs06+Omlf8NXEbTob4+mIJz5IcuMlQHJxrDiSi:tFs060lYXu0isGcnlQHPxi
MD5 SHA1 SHA512 SSDEEP

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 885KB
SHA256 dca8773f000f05866b3b341e2bb538c982542542e92fc5a4e5aee0ad0050f7e3
MD5 a7c2ac733684dee19fce2dc05a8d6fb3
SHA1 07003ef51ff3f14234436d864c1410c5293d2431
SHA512 6860df3c43ade10a1db2f57a0504807226ecd935a38840a5cfc77d46a90f3467ef91871eeb9dec2ff5a7a2598c1d8c99a46676b65ae2175e70834091914ebff1
SSDEEP 12288:cCJnJ5D3VkrlzxC4+/x8J7ct3z5htUcQ1MlhrmQgwwJzt5+7fyZkCtXFiWZF/3o:hJnJ5D3Wt04+mIJz5IcuMlQHJxrDiSi
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 d2d3894f43ebdd17b2c3a3c82b141f410b4e0ec1362b09bb16f5b046a1df3ff7
MD5 8f4f0915dcff6304d26e2fe4e7154863
SHA1 f57a22a3b33a1082ff4bae7c084bb4c380c1c910
SHA512 94462e0c9516a752ba5daa04c0f6f098ce834cd79477f66401462d269dcba10764db2f7431ee81addce65c5d06642b47f61c11c19e5bece88b6eda254b90dc8f
SSDEEP 49152:3o06DIKdwc+eQnSt65aVGisGcnlQHPxi:Y0nlS
MD5 SHA1 SHA512 SSDEEP

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 661KB
SHA256 86e4bcc2723eea494af55a8e049f1cd8e23681eca93ccf1a3a957db570780ea7
MD5 a70572df5423a7640245b3e2d5cf5020
SHA1 97ab2954afb2dc3472d5b720d40e19e15f5eb5e7
SHA512 5489ae87f63d38dcdab1602ff93e72b35757f333d77aa32e4eacd2dab795e1588dfad50c214ec5f3fdc23b24977e244cfebcda1e3894b3a5ee0117ef1dc6e750
SSDEEP 12288:XEP3Rrw4+/x8J7ct3z5htUcQ1MlhrmQgwwJzt5+7fyZkCtXFiWZF/3o:crw4+mIJz5IcuMlQHJxrDiSi
MD5 SHA1 SHA512 SSDEEP

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 712KB
SHA256 f4bb66544664278a79bd893925865b19290686b027189b973f573ad7b41e8957
MD5 65d44ca6f5c7671b458ad43ff210e140
SHA1 9c3f605379f0bd7a15c2afc0661cc7847a26352a
SHA512 a972e260ee7d70c8e1f554af77f30622e4504623d239cefb17f16f5e44f0fcafd30f731fa8d573542337cedbe2681d0aea532047cae833bf248d9e1c2abbc44e
SSDEEP 12288:zjkyJ4+/x8J7ct3z5htUcQ1MlhrmQgwwJzt5+7fyZkCtXFiWZF/3o:zIyJ4+mIJz5IcuMlQHJxrDiSi
MD5 SHA1 SHA512 SSDEEP

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 584KB
SHA256 136421bafb228ea2ef01cde075919f4397b3d8f835f0766a33a63a0864643c2a
MD5 16f3672e9c4c2c5b0523ab0c26ba78f2
SHA1 98172d88fd15525ea02d4fe753aebf6b293e4e29
SHA512 9a80b84e04cb97acf12d998fe31b7f6eb522377232b1c2ed44673317e00a634076e02b1edc71f76de6f790033a960985834ac955f0d5d9e6bf2730338840a034
SSDEEP 12288:uF/4+/x8J7ct3z5htUcQ1MlhrmQgwwJzt5+7fyZkCtXFiWZF/3o:c/4+mIJz5IcuMlQHJxrDiSi
MD5 SHA1 SHA512 SSDEEP

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 d24e9258d17e4c0adb39f1ba26a7a676b8f8f96dd86488862ed788842adcd66f
MD5 ed5745408c2f1126221175fe14e6882b
SHA1 eaf083d2c9f653e0e013e1418e1dee56eab65263
SHA512 5e557d93a4c3ac06769dac453465f3db80a280f54e727aaa97a1f8ce182a3a9b4a981e95cd1ccca4bacd98ccd0bc033cf95ffb5a1534e2830966a376f8e2de3e
SSDEEP 24576:QQ9MxZKdcz97w3K4+mIJz5IcuMlQHJxrDiSi:QVKXKisGcnlQHPxi
MD5 SHA1 SHA512 SSDEEP

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 772KB
SHA256 2021e8fd2d179f7fbece10d3bf013af81cb9b53fa2cb450a71e5f3e1a352570c
MD5 9ec497ad45bc627bc5e9f6cab73dea58
SHA1 a45d66a4d04f848a10563e84a61d926bb5001446
SHA512 b4c08cd6abdcf70d0f2430dacfdc4051d775e01ba028cce4cba5fdad01c865685fa185a9bb59dff34911302ef1dd4b1c924bab6101c2555bd30a2bfe755529e7
SSDEEP 12288:iyoKo2HRple9pV4+/x8J7ct3z5htUcQ1MlhrmQgwwJzt5+7fyZkCtXFiWZF/3o:iyocxApV4+mIJz5IcuMlQHJxrDiSi
MD5 SHA1 SHA512 SSDEEP

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 4dc6b562b7178cdf3b80091bc795490585d81ef5b4523e271a59c84a58851f8c
MD5 b486a9385f2a14a32dbbf28f3988d454
SHA1 daa6575df288048a51cd1f5a2f416118edcad6dc
SHA512 6cb469c07f51c52fd9d057077b6af9891668ed45a3e250adddf222faf21390ab104aba710db2dc59fb0dc4256c8255ab25e54e887b8227b135fdf1a6909f10e0
SSDEEP 49152:fWcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIKVisGcnlQHPxi:H0zuNIRnlS
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 f589c9ca89635be6eb9db6d331412946c56ed4834ed53854edb14eade6843c9f
MD5 f3930b8dd09ea5907c1a73c30e2b6d47
SHA1 dba28c654112334cb6b65a57b0777f2149155298
SHA512 e666a030d3051a1f07682a72669739ae39637e18f1002ac32cb78811c692a3aefe95943525275043b62b6304d7b3aa7ada0ff41f24bb55ca38073ccf3a9f3edf
SSDEEP 24576:91QT7EcpfxR+N5AWAz3ooiYqjMqbw4+mIJz5IcuMlQHJxrDiSi:ITDxR+N5YzTEjMvisGcnlQHPxi
MD5 SHA1 SHA512 SSDEEP

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 877KB
SHA256 5cb4f7545d01378cbb0a6b40f9da3d240b57fa0c88ccc7e3f129d8694e01b9cd
MD5 b7f487fbaf38eb53e56f840e90268c68
SHA1 79133859a247477d8a4a9190088a841d02a23cdd
SHA512 5933a4552c190c388f9b33abf80eedbed9b040cf65df8d9b3c6b7e5df3acb3ae9fa20f31314acb26d999594e09a97d72aa0b95f7ccec8eb27eb58e2631685814
SSDEEP 24576:xTMdOz0FFS+vmSLc4+mIJz5IcuMlQHJxrDiSi:70K+vmSLcisGcnlQHPxi
MD5 SHA1 SHA512 SSDEEP

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 635KB
SHA256 992de8d733d50b5877352d67d5dcfa16dd0b648395e8d584fd58221eb639c00c
MD5 8dde6c19f66ba746c0eb72cf94fcb43f
SHA1 b22069f04061b82597ba4507643304080fb86496
SHA512 ae0ee73615ec42f1e41e2d37bea03235f38c3c570de509f2a02fa618ed0bc387772a753a5a157e1438a8de71382c23bddf55e4d3544d14ea3523a8cdf3b66137
SSDEEP 12288:D47z4+/x8J7ct3z5htUcQ1MlhrmQgwwJzt5+7fyZkCtXFiWZF/3o:Gz4+mIJz5IcuMlQHJxrDiSi
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1044-735-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/1044-331-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/1612-189-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/2168-330-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/2168-732-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/2360-319-0x0000000140000000-0x000000014024B000-memory.dmp

Download

memory/2360-125-0x0000000000530000-0x0000000000590000-memory.dmp

Download

memory/2360-129-0x0000000140000000-0x000000014024B000-memory.dmp

Download

memory/2404-299-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/2404-731-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/2476-729-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/2476-263-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/2600-102-0x0000000000580000-0x00000000005E0000-memory.dmp

Download

memory/2600-93-0x0000000000580000-0x00000000005E0000-memory.dmp

Download

memory/2600-101-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/2684-190-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/2780-151-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/2780-155-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/2780-153-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2780-147-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2780-141-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2864-291-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/2864-730-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/3360-260-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/3360-728-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/3404-255-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/3492-256-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/4040-6-0x0000000000770000-0x00000000007D6000-memory.dmp

Download

memory/4040-188-0x0000000000400000-0x00000000005DD000-memory.dmp

Download

memory/4040-0-0x0000000000400000-0x00000000005DD000-memory.dmp

Download

memory/4040-622-0x0000000000400000-0x00000000005DD000-memory.dmp

Download

memory/4040-1-0x0000000000770000-0x00000000007D6000-memory.dmp

Download

memory/4172-131-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/4172-137-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/4172-320-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/4172-150-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/4352-727-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4352-259-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4468-87-0x0000000000520000-0x0000000000580000-memory.dmp

Download

memory/4468-86-0x0000000000520000-0x0000000000580000-memory.dmp

Download

memory/4468-80-0x0000000000520000-0x0000000000580000-memory.dmp

Download

memory/4468-85-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/4468-262-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/4476-282-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4476-286-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4616-116-0x0000000000530000-0x0000000000590000-memory.dmp

Download

memory/4616-114-0x0000000000530000-0x0000000000590000-memory.dmp

Download

memory/4616-127-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4616-105-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4616-106-0x0000000000530000-0x0000000000590000-memory.dmp

Download

memory/4620-722-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4620-257-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4652-343-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4652-736-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4996-157-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/4996-167-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/5064-258-0x0000000140000000-0x0000000140096000-memory.dmp

Download