2d40fc971680e6899a6b196c67f682893fbf7c457d023cbab68a5d33c6614986

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 18:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-06-03_aa468513271dac8eb3a8f8b3e445d28c_avoslocker.exe
Size 1.3MB
Sample240603-wtmklsed7v
SHA256 2d40fc971680e6899a6b196c67f682893fbf7c457d023cbab68a5d33c6614986
MD5 aa468513271dac8eb3a8f8b3e445d28c
SHA1 94da8a8a29e71e67f144fb65b1373711a757c240
SHA512 474406b2dfd6d3f2604177538e3c0a498eb17e3dc94799c94e4e5139608b5514b435f3a794c81aff8d6fd6ce6895ec267e6472c28c3063141eed6c166032a2bd
SSDEEP 24576:32zEYytjjqNSlhvpfQiIhKPtehfQ7r9qySkbgedt7ozX0j52pMkuLoiSJVlIL290:3PtjtQiIhUyQd1SkFdm70jIpM3kiSBM8
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
5096	alg.exe
3496	elevation_service.exe
1420	elevation_service.exe
1932	maintenanceservice.exe
2532	OSE.EXE
3160	DiagnosticsHub.StandardCollector.Service.exe
3980	fxssvc.exe
3116	msdtc.exe
2000	PerceptionSimulationService.exe
2308	perfhost.exe
3700	locator.exe
3952	SensorDataService.exe
4596	snmptrap.exe
5068	spectrum.exe
3748	ssh-agent.exe
4264	TieringEngineService.exe
2228	AgentService.exe
3248	vds.exe
1320	vssvc.exe
4288	wbengine.exe
3280	WmiApSrv.exe
1848	SearchIndexer.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in System32 directory 26 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\9e6723ddd590e271.bin	alg.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2024-06-03_aa468513271dac8eb3a8f8b3e445d28c_avoslocker.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2024-06-03_aa468513271dac8eb3a8f8b3e445d28c_avoslocker.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Install\{F4DF7669-184D-4D67-991D-8B1550DDF396}\chrome_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateSetup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_95296\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\minidump-analyzer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000024b274d9e1b5da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000839bcd9e1b5da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000dafdc0d9e1b5da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9908 = "Wave Sound"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e891f1d8e1b5da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
3496	elevation_service.exe
3496	elevation_service.exe
3496	elevation_service.exe
3496	elevation_service.exe
3496	elevation_service.exe
3496	elevation_service.exe
3496	elevation_service.exe

Suspicious use of AdjustPrivilegeToken 42 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1684	2024-06-03_aa468513271dac8eb3a8f8b3e445d28c_avoslocker.exe
Token: SeDebugPrivilege	5096	alg.exe
Token: SeDebugPrivilege	5096	alg.exe
Token: SeDebugPrivilege	5096	alg.exe
Token: SeTakeOwnershipPrivilege	3496	elevation_service.exe
Token: SeAuditPrivilege	3980	fxssvc.exe
Token: SeRestorePrivilege	4264	TieringEngineService.exe
Token: SeManageVolumePrivilege	4264	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	2228	AgentService.exe
Token: SeBackupPrivilege	1320	vssvc.exe
Token: SeRestorePrivilege	1320	vssvc.exe
Token: SeAuditPrivilege	1320	vssvc.exe
Token: SeBackupPrivilege	4288	wbengine.exe
Token: SeRestorePrivilege	4288	wbengine.exe
Token: SeSecurityPrivilege	4288	wbengine.exe
Token: 33	1848	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1848	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1848	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1848	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1848	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1848	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1848	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1848	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1848	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1848	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1848	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1848	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1848	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1848	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1848	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1848	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1848	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1848	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1848	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1848	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1848	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1848	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1848	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1848	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1848	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1848	SearchIndexer.exe
Token: SeDebugPrivilege	3496	elevation_service.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1848 wrote to memory of 3432	1848	SearchIndexer.exe	119
PID 1848 wrote to memory of 3432	1848	SearchIndexer.exe	119
PID 1848 wrote to memory of 3936	1848	SearchIndexer.exe	120
PID 1848 wrote to memory of 3936	1848	SearchIndexer.exe	120

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2024-06-03_aa468513271dac8eb3a8f8b3e445d28c_avoslocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-03_aa468513271dac8eb3a8f8b3e445d28c_avoslocker.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:1684

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:5096

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3496

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1420

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1932

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2532

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:3160

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:4160

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3980

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:3116

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2000

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:2308

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:3700

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3952

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:4596

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:5068

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3748

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:4760

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4264

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2228

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:3248

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1320

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4288

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:3280

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1848
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3432
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
  2⤵
  - Modifies data under HKEY_USERS
  PID:3936

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
Size 2.1MB
SHA256 ebb1f04b955ed765e839ead210dd21d18192b5bf5d9fcec2b4c1dae9db246a2c
MD5 225675bbe197cf1c960c2aac1a6cad2c
SHA1 3b504e15a7219cf132e1f6682c61851fa2429423
SHA512 1c1fd1f994ca36d79828c3412e8277950cf23499cd92a35ea739544b9caad7d4be73e5ebad2683571d457949eba711d067cfe62f22d05abdf08dbc3e22901099
SSDEEP 49152:YuYk3H5koUXfTqkkYLO/W2buywzMbOX+T7z5x70jIpM3kiSBM29mhNq:YPfTqi90bd70uMhSBrkNq
MD5 SHA1 SHA512 SSDEEP

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 797KB
SHA256 b15a6d5a5436d3e97c292687f4aac3b7b9659b8de12a41f51247914e954ecae6
MD5 137b0305b0c48323fda12ae0e82a5cc5
SHA1 19748bc7c16f76538b5ae04d1061df04de553ca1
SHA512 c50c6d203b2708ed207a3ec8d2b5517a538cf6b5e472c6dc46ba9071eefabeb7188528aad61fb8ad3e007d37522945d82e181fe8b5e5b0747a987ca4efc3449c
SSDEEP 24576:FidnBsuEp7ozX0j52pMkuLoiSJVlIL29mhNq6:8SuL70jIpM3kiSBM29mhNq
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 b9b9fed8ca147cf11f58d4ba4fe2bda03ec90d79f0af3ed39ca0e0983f8819a9
MD5 820b38b601b61d4104ce326afdfe1c46
SHA1 a0d0152362ea5e012ba0a081aa03152b87a28832
SHA512 943483201ef866a481ffaf1af4fb230e294c43a59aee70d9758137c059ac77bbfefa990a0b864d78cf46b4017cba6a72d6af9071277bc76516fa258b9b0ba2eb
SSDEEP 24576:C+gkEVfh4CoN7ozX0j52pMkuLoiSJVlIL29mhNq6:HgkExSQ70jIpM3kiSBM29mhNq
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 8f7e0d08ef11d47e8b36038d37919802bb867f74621c4a18b8ed7dd39857dfcc
MD5 cd81e4d93fcf12a2d16d3df13c2021cd
SHA1 a799302f0fd9ad7175ec4387b5500045a140d9f3
SHA512 f5ae45ba802cece4583157a0c77e3d154acbafac988bdafc1ea4c14b86ed0cdaa5513eed3d0a6c9908c68cc67578902ae5e35eb50563e7c28a544fd039f4065c
SSDEEP 24576:BBpDRmi78gkPXlyo0Gxjro7ozX0j52pMkuLoiSJVlIL29mhNq6:TNRmi78gkPX4o0GxjR70jIpM3kiSBM2T
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 c210eb2680947ef86ae892c745a6d08bc67426d5d7b184a369648c3e6b44c170
MD5 be256e861d86f176a4c4169bfa737ee7
SHA1 e363e52b2655f610d9fc276a1e01985915d9cb1c
SHA512 94010a4bf02371a05f6bdb73d3c0db63994f2b8bfb7fd6c385a0dd6f501bef6779c1c689af4f23ad431bb063878c31283703d19b431f4ebb364b3abc0e743c8b
SSDEEP 24576:4LOS2oyPIXVN7ozX0j52pMkuLoiSJVlIL29mhNq6:A/yZ70jIpM3kiSBM29mhNq
MD5 SHA1 SHA512 SSDEEP

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 ee37cc17ed56700854deb0f285555ee8604c6e1c4bd6b22a4ecffc921d764b9c
MD5 6d852cb764b87103a77a6f3f92c0bb9f
SHA1 b35a0960cb7a67ab23375ae1147fc6903297f593
SHA512 c95471f10dbe9c965d7ee7f4f6ac8d3be14132276a8d3945354f9fdbe35648070cefeee030cd16d695f345e58e4137532d520890806c460ff8442266e4fed0b8
SSDEEP 12288:cfbgeKznl5TXJR0j3p2pVUrrQuLoWTF23JVbd0UILzXSocmKdYNq6:cfb7ozX0j52pMkuLoiSJVlIL29mhNq6
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 dcdc047be63700f9072c8247b7978d123d2149ecbb75f6fedf7dd030ec76a0ba
MD5 c5a79fa100f75e8fd236eba80d8aef68
SHA1 bf0baa18f596d5e57c96071444734dcfdd2be25a
SHA512 ab26e3f616c576592ba95766f7eb857e96649c0b18dc7d8cd093fa0801d7ca7b4ab8235b7cc471769c415cb8e898eb0c156f08abe1ffb526df5a0e457d7dca70
SSDEEP 24576:cJIU27ozX0j52pMkuLoiSJVlIL29mhNq6:cJIU370jIpM3kiSBM29mhNq
MD5 SHA1 SHA512 SSDEEP

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 0729435dbec553d78eb86921663bf9a0fdc8bcd60386bb7987e1256adbe212c5
MD5 a7049456e1adaea7716d089373ce149b
SHA1 f487b0872bbd365c5aabd35a3bfdfcf8603bc302
SHA512 50d68ce0a13f604b60c6d723a4d856e3cdf7aa8bb391853e345016ce282f98ac36f12870325932a4be93ef364849b91e2e4dd0b3e5f106fa2029faefa929e196
SSDEEP 49152:WQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THj:WQvGAdlCEL8c/yRNw5CK70uMhSBrkNq
MD5 SHA1 SHA512 SSDEEP

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 11f0fe7d791a98f264d8d38616aef0341910197dc384b147c4de3a829d954025
MD5 1cebfaf0ec31e25e835e54084c72e84d
SHA1 00cf7b6c2fc650202f8b4208822c78effb50ca24
SHA512 125621c90081ff65f965c5f6bd03e7921124d0a159acde64556141c3abd5c7b6c1d4ec4521fec93c4cfb96b41011797e1eb5638a765235a6e3eb227e326494eb
SSDEEP 24576:CdewsAjw7ozX0j52pMkuLoiSJVlIL29mhNq6:iljd70jIpM3kiSBM29mhNq
MD5 SHA1 SHA512 SSDEEP

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 259147d013940586efc138c032d9a817ee5860f43db0be6a9c8759becfeb8867
MD5 0e5af9a57f11029213a7baf2db731324
SHA1 c35f48bc692b907bc8bd334944212e6efb117fa1
SHA512 07ee58c28e1e207dff2dffe7f288b9c629551f90620fb0dd1336d5343a0f9d0c66956ecf57409f413f6ccfb3ae02312ff59b541742e1aea528c5840cf9aaf334
SSDEEP 196608:sUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHxIoQ:sUEtQevvqc2W1cpV2EI32x/
MD5 SHA1 SHA512 SSDEEP

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 6182f4e3dd3154ac0c277c9c19bca8e99ea750de6fc56d74129b24c973aa0c13
MD5 d357541e443c0be816895c3d684dd31f
SHA1 fc233dfc4828f3e45f8630162aa3671e1bb1abe5
SHA512 7c1282e7096fa26f4873b7cdbc1e4d99e5eb5c94b02bfa85cc15c98afca0119fd11caca61b6199f151d4eb3dd2811411a8780111487012c639d79b0a328ae483
SSDEEP 49152:5CbRquA/m2yL5zTfFiV+XenmE3/z970jIpM3kiSBM29mhNq:WoquVjnmW70uMhSBrkNq
MD5 SHA1 SHA512 SSDEEP

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 7eab7a1a9eeb36b82887d94bbd3f14cbac9c80d63688bcb7ec61e840e8417b65
MD5 fdcef3c451135c589165d6dd4dc4e74f
SHA1 6f1592c56320b9d157e3fa318fd26f38c7341cb1
SHA512 94882c537d3af38ffd530018059fa0c2abe19ca027f898f5bcca13a871b49270f20f5e6df9def60726552cb8dcc298d91736c2a1b0e5706a70defc54e0661889
SSDEEP 24576:WAhGLJIFoiwtA5l7S53d7ozX0j52pMkuLoiSJVlIL29mhNq6:WAMyFoiq5m70jIpM3kiSBM29mhNq
MD5 SHA1 SHA512 SSDEEP

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 e74285fcc0913337198709579d741aa43b833249c5313f1eb6b6b4590bfe44ce
MD5 4f69ea5fb050b05293ba3652fa3be5b9
SHA1 95cbf40ce76b8fbe81d4cd4fa897d892316750e0
SHA512 78f02f994461c5ecfcba7e76db4538cf9b925ee8d133edac42cc4266f59a004669ad59c1c65b2c3eceff0a3a000999b47f3bd6fc777555abea5c8bf1635857f6
SSDEEP 24576:pwuoOWc7ozX0j52pMkuLoiSJVlIL29mhNq6:pwDOy70jIpM3kiSBM29mhNq
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 3717a603f6542e4bf65aebad98eb9d3cc816e3c09f7d36127d77bfd97930eed3
MD5 8f3cb6b769ab1e8263cfbe3aabdb518d
SHA1 fc410926d986b1b5aaeb3d6aecb08d1bae5c9fac
SHA512 6aa09058708d9d48d4df59191e276c86c4ad7d32844bb2d9ae0002d2026e343ee7247c024a4c171444a41fcc501a88b4fd8795f2ba50613d58d7c5944715b495
SSDEEP 12288:6BZ1IyggeKznl5TXJR0j3p2pVUrrQuLoWTF23JVbd0UILzXSocmKdYNq6:0Zuf7ozX0j52pMkuLoiSJVlIL29mhNq6
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
Size 5.4MB
SHA256 e6b3628899020fe60413adb81d26cf22863c417c55d390b79aec1ce94ab93fe6
MD5 01d0435bd8042cb71a4b270e55b5460c
SHA1 f76413484bcad0d4dda6c3df333598d0fb78cf3c
SHA512 8828b53cb8c8dab5934f6c6e600c8c515552818f96f742f84d826f942d90614d0424995217d25551b4b00e144812c77a6a2ca5ace53c8f6a58ec17d7f6d73ac5
SSDEEP 98304:6wfhY7g/rLd7yYA3awr341gO70uMhSBrkNq:q78yh6IoQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe
Size 5.4MB
SHA256 8ffcba1f090fc66306312d689f83ff1de47465a8f4327fb62cfa52377959df67
MD5 a938d02a1d2dfffc66f7d12488609027
SHA1 b674c7fc1b0e94697ac9c5a07bf698a26d786672
SHA512 58b30e4a79227b6c598ac2f1c3fc9e292fed1cdd00f4621b3c2c954ebf05feafb0f516b0fea11f043798e4707424d1405414352909c174bef82b5847a67ee8b1
SSDEEP 98304:PwfhY7g/rLd7yYA3awr341gO70uMhSBrkNq:V78yh6IoQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe
Size 2.0MB
SHA256 538e780cedd708f09065a6601456e1e37def5d4e36fc7db8066d0cc9ed3c5081
MD5 cca24286bc736580b193f339f2840a8c
SHA1 94d5642be1394c19e45dfbab46a2f10202c9c011
SHA512 7cf8eee294ce22211186b69020324b94672931f87c474b54dd4561c971b06f4c8ba35c395bd9bd2e221c426ec9328e28f6c728d8dac10042a1fbb5ee2f80c383
SSDEEP 49152:fuXv0Ftpn5606zOZ70jIpM3kiSBM29mhNq:Wc56Fq70uMhSBrkNq
MD5 SHA1 SHA512 SSDEEP

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
Size 2.2MB
SHA256 8f07217babe53384ab6c463c28121ed07f4acbf60e3ed367e12d2d553a0bb488
MD5 f5d7b6159d23808c861b0a9edb869212
SHA1 1a40138ec11cac911ef253111ac53628eaa73765
SHA512 f5b3fde3c1e6305336d70b99ba3b27ea8817c1a947d89603bfb7901c05e5269a052aab3d9ca055e964d33ed49e3bb7ffa7318b6ad060fe404a43f86dc973f336
SSDEEP 49152:xy7mTd0GxN8jyynxHjXKUyn4GVcbDSKrNTxd70jIpM3kiSBM29mhNq:MmYeyxHjWjMTd70uMhSBrkNq
MD5 SHA1 SHA512 SSDEEP

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe
Size 1.8MB
SHA256 20add4cbe58f2f509865c4ec006b82c43b374822316560ec2ebbacbb63efa611
MD5 4cf45f845b42f76e2f34f285862318ff
SHA1 bc2484809e55b08aea509973de9c138f4df4a696
SHA512 faf08dad5250b5186f6655ef96514bf7f2a18a3a08adc6dbc9614af2c986b00cd64b49c58255415e292a93962d922ab0a413c7b57ef188919ebabc98d15618e3
SSDEEP 49152:FWnDci18yNNUgbYx70jIpM3kiSBM29mhNq:QIqNNox70uMhSBrkNq
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 1.7MB
SHA256 1872e783220a80bc32a19dec66e93d5df4e837fb9b6d11855dbb652c339d5a1d
MD5 9680058aa8c4124f6ac71b46d9d7132b
SHA1 0859eccb41445fa6e532f6ee3d148099674912bc
SHA512 a62bd066a59f71fbfdcd21c4e90d652f1751b60ac7755492d198238a00aa9be269f513a0f51451d3cdae45f6e35e7d8488f3164286899fabd6e97b66a61bf7f1
SSDEEP 49152:GizMZm0GhamSok70jIpM3kiSBM29mhNq:Gm0UWok70uMhSBrkNq
MD5 SHA1 SHA512 SSDEEP

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 dbe9e63ec552a1968d898154b896fda4b2a905e82b2a6f91cc3cb59d7f99e2c8
MD5 f1ee33e5af840f70f2c15050eacb2f59
SHA1 d8da7a3c2cd9695d41a795c987996c0d281bede0
SHA512 547e89736fd8acd94c0c96d1f24c75afc882e8eb5347f5897df0e6cb57deef689d011b8787a06cd990d7e4686df3e0798fc867ef5ff0ae9cda5d733bbff839e3
SSDEEP 12288:FzgeKznl5TXJR0j3p2pVUrrQuLoWTF23JVbd0UILzXSocmKdYNq6:Fz7ozX0j52pMkuLoiSJVlIL29mhNq6
MD5 SHA1 SHA512 SSDEEP

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 f5b068d128fbfb9cba58d4e73329e33359dc8bdb3405752997a91562c275a550
MD5 6767b0768fe5609ebecfd90daa706f73
SHA1 849d8b4b5db1bf905f5358acb796c59bcf8cf316
SHA512 6835fe46774c407014acd6b726d55be103150a19ae611675babb7a14930df0e38148d3df548e17bac4cf6078b48f6e0cb11f8e91a4cdcc2b5182c20421fc1874
SSDEEP 12288:lEgeKznl5TXJR0j3p2pVUrrQuLoWTF23JVbd0UILzXSocmKdYNq6:lE7ozX0j52pMkuLoiSJVlIL29mhNq6
MD5 SHA1 SHA512 SSDEEP

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 3abd14e5e7b6cab729383ea2c7d93b7a392fd7ed669c69dfd6658355fdff268f
MD5 1ac4c8383ea5aea19b9441c562410050
SHA1 b9a1565ac8a33c6c28803c815f070a67b0f4910d
SHA512 613ca7d330d4d29057a2ff391ef23af490bf65db513ef4ef61a857d6251b02cf9f308fb14f868d09e8436a8cb8701b9a4da47e573d47249988097735d16ff2c9
SSDEEP 12288:VOgeKznl5TXJR0j3p2pVUrrQuLoWTF23JVbd0UILzXSocmKdYNq6:VO7ozX0j52pMkuLoiSJVlIL29mhNq6
MD5 SHA1 SHA512 SSDEEP

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 a0094326760a6d01759e8901bf778090f9ca8f84e60c1dd150c56c08ae351394
MD5 d7bfb6bddfaf3cfb9bc64d00820116eb
SHA1 0d0e21f4a684431a354130e4214036133481a383
SHA512 7855ddfc14b7029b1b4818eb7cc960cda89b765a993a30c0a8390e9715426ab201e0a9a9293beac1d4d4fe91039fa57178d92b24fd689a3fdc1be09b3028180c
SSDEEP 12288:vV9geKznl5TXJR0j3p2pVUrrQuLoWTF23JVbd0UILzXSocmKdYNq6:L7ozX0j52pMkuLoiSJVlIL29mhNq6
MD5 SHA1 SHA512 SSDEEP

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 c8422454372d86b127c3aadc0b4027304de6f123860ed7a9aff10fe4407592f9
MD5 904e4830b71d75db521532a9fc8f0fb9
SHA1 b9bf10f1398ab5fb86ed19bce9885003c14b5fe4
SHA512 321d08f200fcba981380ad5e6ef25ec8e3ca7569ac7a17ebe463f69e715bca8e19d20ffd7920eeef6c9145974b3919bca2313e7456116fb79780d2388e77ab73
SSDEEP 12288:UlgeKznl5TXJR0j3p2pVUrrQuLoWTF23JVbd0UILzXSocmKdYNq6:Ul7ozX0j52pMkuLoiSJVlIL29mhNq6
MD5 SHA1 SHA512 SSDEEP

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 fa8e2ab1e19f02c823fc124a3c19945e5c5ada2fa22c4f246c9281e5506e1661
MD5 34020fc6a779b9d09de9a86d95a3e683
SHA1 cc2904dd2c7c89ef2ee3d40088d9998be4f64d08
SHA512 cf14c57f3bc38bb5bf32ee22d360abb8765855106d562e63b2bb34bcc39833377b82264274078f72ba67883e529c63a645baf1d81ad57eed5a998ff325308aa4
SSDEEP 12288:iogeKznl5TXJR0j3p2pVUrrQuLoWTF23JVbd0UILzXSocmKdYNq6:io7ozX0j52pMkuLoiSJVlIL29mhNq6
MD5 SHA1 SHA512 SSDEEP

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 ef7af673b3acd6d0612a86f53452c445252d3d2eba8926ec9eb917c1f49923ff
MD5 63dc52050c6fa48ecdf07de6889f7d31
SHA1 b2fd63ef5d70b98eac6da361fdedf33ae414296d
SHA512 e80a35936ddf43d925580d0c0079c737167adf9176f9bc175f77d4013e9db47aa7ddef147c62cba278af23bf1ecb51609cd7eca66d32118ccca83825a877a2d2
SSDEEP 12288:osgeKznl5TXJR0j3p2pVUrrQuLoWTF23JVbd0UILzXSocmKdYNq6:os7ozX0j52pMkuLoiSJVlIL29mhNq6
MD5 SHA1 SHA512 SSDEEP

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 9b1d0b72128d89dbd1592334c86be5d11d42407394f4bf8d0119b9ac72a323ba
MD5 d7c3651f48639657c94cea446f6e9074
SHA1 d59faf61f3332538cf49c8bc75e883f050ae6d28
SHA512 73e2bbf8c6b3ae154896ed2f0c37d2f466d7517ff83d7a0f12d0f55c72011d201b7331d750d0021a3e3cfbf11bfa54ed349002a0b1c8b8206f1d567b14ceb814
SSDEEP 24576:+ZMSzFVSOk7ozX0j52pMkuLoiSJVlIL29mhNq6:+ZMSzfl70jIpM3kiSBM29mhNq
MD5 SHA1 SHA512 SSDEEP

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 7a985b1eb23cf60a286b1563f2c8775f76d40b8b28c19686896e9ea0d9aac519
MD5 83860d927b8e73218dfdeade5e38a5a5
SHA1 939e218e3cd0d4ac67e6208481d289178d606fb7
SHA512 3e8430d070f4f307f1dcdbeb8253ce4fb6b79c40ba78dd24e27ae9a9de5a8a46cdfd84587d27d6b76fafdbdcd6200f833f028693e8a1d659f93a70497c7ca48c
SSDEEP 12288:6PgeKznl5TXJR0j3p2pVUrrQuLoWTF23JVbd0UILzXSocmKdYNq6:6P7ozX0j52pMkuLoiSJVlIL29mhNq6
MD5 SHA1 SHA512 SSDEEP

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 fd2a9d7f307af59284f6775dabae926b6142f808fdcad4271bb13a171e198d67
MD5 e6be4e406223009b1281305504d1b529
SHA1 3877194d4e575667a1a30b07f0787e1fb494b58a
SHA512 cc435b7fbc76127409d0c4dd97f9fa423bfb4d3b222c90d33edbf5d15308ac54abcc8fc77376cb3630fdf2c5fc19042846d7263558db6d4ba3ab08f295dd83be
SSDEEP 12288:8LgeKznl5TXJR0j3p2pVUrrQuLoWTF23JVbd0UILzXSocmKdYNq6:8L7ozX0j52pMkuLoiSJVlIL29mhNq6
MD5 SHA1 SHA512 SSDEEP

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 13bbdd77b8f049bb7be65031acfbbd1e39f519efa80c1819bb4a85003a6c464a
MD5 5738cf26051c32404475aa74b621a19c
SHA1 a33a3a46a00a329b850ad4e2dd1652e230dab7c8
SHA512 ed7afdf417a68f6157d1cb83fcaaca5a4adad172bcbc082a016b779b4e9bd3736f744d429d0d12691c0beadb19d55b7ac9cf6cad7342c60f6d1cc19c2a5408bf
SSDEEP 12288:eyPz5L8ggeKznl5TXJR0j3p2pVUrrQuLoWTF23JVbd0UILzXSocmKdYNq6:Dzyg7ozX0j52pMkuLoiSJVlIL29mhNq6
MD5 SHA1 SHA512 SSDEEP

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 6c5c1c6fb84db8f723ce476f5d19938bd77355aad38e4c78e7800a5c462d8db2
MD5 14a08701de0300fe8fca2cb704d7e295
SHA1 ef256de534e968eb419c7470a1d1efc7d7ff3d3c
SHA512 b59ebdadca85ad4e3025914ce06c6e84fd14f39a89dd7b3a23cb4e33cd5c01e01a1aa99d0641dbd671870f12081e2e17ae74134514199852f2c1c8bc08ec6e57
SSDEEP 12288:PPgeKznl5TXJR0j3p2pVUrrQuLoWTF23JVbd0UILzXSocmKdYNq6:PP7ozX0j52pMkuLoiSJVlIL29mhNq6
MD5 SHA1 SHA512 SSDEEP

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 0975fab537aa022a94274b87c8c2f443a7cb6e87345ec5dab3c32a43a523504d
MD5 281b6bb3d82280ad4d38979da8868375
SHA1 90d16ab578530988fa6862e506b5a018f8662379
SHA512 09e23c106496672f7ca714fd7cb0f0fe6ca7ab3704138289a22cc732c1216e1c4f62992de1664e04d83ef4d6240a88191c5f2b2d1e9cba60c6e9d7abe0d4eab0
SSDEEP 12288:TPgeKznl5TXJR0j3p2pVUrrQuLoWTF23JVbd0UILzXSocmKdYNq6:TP7ozX0j52pMkuLoiSJVlIL29mhNq6
MD5 SHA1 SHA512 SSDEEP

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 a4e2f2df7ffc64118d5f9a7adbba3c3bba880f9e05199a6550b07273de8aec98
MD5 78e1a8534983372c3f08da8317ffca2d
SHA1 525bb8afd73d8c55a63517eb4ed780319dd80b8a
SHA512 cc1ffcb5e428309d2928b65b359e843261ced4f0cf5ce15aad3523269ad59fea2b9a099709eb0570f4e290a68d64ceca01fd55ed5a34036d33b25eab8296a175
SSDEEP 12288:qyPz5L8ggeKznl5TXJR0j3p2pVUrrQuLoWTF23JVbd0UILzXSocmKdYNq6:3zyg7ozX0j52pMkuLoiSJVlIL29mhNq6
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 4445ff5c0bdc507dcd69dc8a60b04793676abfb9236c75170fb414e2e99db79a
MD5 24f400674b43e9bc204adbcc4d29446f
SHA1 26bb08ece85d785f8f44396b65b898bd47b7b62b
SHA512 c8d6ef0f86d7931a5bce91cf4ae178d65a7d90f046a70a780f4c1b736f2cbb27a96e95e8d2c212c1c8b01cb869846630c9e33259bf15adf9151a43003c571ae6
SSDEEP 24576:kTHaLl3z0zDe7ozX0j52pMkuLoiSJVlIL29mhNq6:kT6Llj670jIpM3kiSBM29mhNq
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 1936a7bc73bc1817f2f0dc52915f6c8ca82e927a097f49ba11f12ced2d940f57
MD5 77c086ab021482d80ca7ae211279447e
SHA1 2fb075de3b25d83526ee8ed2c583f91108944cbc
SHA512 7195630d7995eb2f8791eacc4a1c7052b4312add93ef05db3dcfd123a0120100f570c1c1e25eaf93fbca9515fad262f813dfcd2fc92b011e9e79fefd8183f150
SSDEEP 24576:W37d9CHKy7GZi7ozX0j52pMkuLoiSJVlIL29mhNq6:47d9CHKyal70jIpM3kiSBM29mhNq
MD5 SHA1 SHA512 SSDEEP

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 40e28b9817d2e2d379bfe587e94b9396ea76f08b5e54aeea9cd04ad65fd5a418
MD5 14e0ef74fdbc5774f37f931b32f4ccdf
SHA1 f9bfea606e52798f019e40121f966a62950f113f
SHA512 86cfeeb74e657440c44c927719703f52dd10f7c97d098816265e5ad42b57cf3892b78044b6d10c726ec967bffba9f6e613be83d20dde4fa5dfd487f366c5842e
SSDEEP 12288:ougeKznl5TXJR0j3p2pVUrrQuLoWTF23JVbd0UILzXSocmKdYNq6:ou7ozX0j52pMkuLoiSJVlIL29mhNq6
MD5 SHA1 SHA512 SSDEEP

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 a5442b2e3f07c272980bdb48613ed87ba0f001ad0340eebddfc8498ed0c23d83
MD5 1cd2a14c5ed98383e0f984bcf78bf087
SHA1 e32c217b50921f46d31abd00ac814c152df10127
SHA512 6d2b80a66bd557927af00ac5c96dd90edcaa3f3522550f98d36b9d4c2300220d4fdf5f09b99f56c8c55b6ed65576f259e0fd4bf198754b8c91eab2ee86d44c1e
SSDEEP 12288:PAgeKznl5TXJR0j3p2pVUrrQuLoWTF23JVbd0UILzXSocmKdYNq6:PA7ozX0j52pMkuLoiSJVlIL29mhNq6
MD5 SHA1 SHA512 SSDEEP

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 ee2ef17959e342df06e85d083ccf4b3a0164fa1678924bc60a145539c12a611a
MD5 cecceb95550fb33e94e47008965a456f
SHA1 9e51747ad0d8fec71901bcb5f89e628fbe1c97b4
SHA512 b3f9824d12353d9309b871f14e3ee4f3e710ef49c7d7d188e428062865229880b2b92835049771b93636aebcb73e5919491ec9b4f3cc19aaf92c625e9cb094b6
SSDEEP 12288:dpgeKznl5TXJR0j3p2pVUrrQuLoWTF23JVbd0UILzXSocmKdYNq6:dp7ozX0j52pMkuLoiSJVlIL29mhNq6
MD5 SHA1 SHA512 SSDEEP

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 d4c86f2f4a8d4d310bdf946629ac1e1becc7b769a25c1e9eeb4cc98d31fe898e
MD5 b64e2e80783d8c3ca607282401fab7ef
SHA1 a67c6db095a99c23b401716d4866bef0c94d908f
SHA512 6d24b6a0033ec1ce803b030e286376c95739a272e7a0a4bf5f657b51b4d6a3f1e86c8f8471ea6f89af7717aa9d9d5afd419d44690e512e6f6fdce16f57c7d6d4
SSDEEP 12288:jPgeKznl5TXJR0j3p2pVUrrQuLoWTF23JVbd0UILzXSocmKdYNq6:jP7ozX0j52pMkuLoiSJVlIL29mhNq6
MD5 SHA1 SHA512 SSDEEP

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 e905de061187496ff42b37f81b9d87a363239f8de9c15df6fd0f14d082ec0879
MD5 cfab35c745f2d3c2b4832fb7c1a2f230
SHA1 3f684007bccbb9fdc0796d62694a4e436671caa7
SHA512 4aba3f891d63f5639ebdb27321faf72f5fc787022b8fbc91d05bbbbdf1643449e1dc10dd7977f2763e8c8a246808fbfcbe1a91dd5de441ab9ccda68a235d0e28
SSDEEP 12288:WugeKznl5TXJR0j3p2pVUrrQuLoWTF23JVbd0UILzXSocmKdYNq6:Wu7ozX0j52pMkuLoiSJVlIL29mhNq6
MD5 SHA1 SHA512 SSDEEP

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 ac1545ed7514637a5fbd3c9f8d1b1a55cc06b47fd465b0aa6ffaf33064004945
MD5 6538a6dc6f7221dee15b41a24fafd761
SHA1 b1f8738fd551f4417f0ba0513c22721d81cc0983
SHA512 aea16ec7f5832fb276ba1937c1903899291fa6b95cab37d723321c0d236f8375fec109fc73bb278b805ebd85fdd8b32798a4a2be80c7d72542852c1d21b838b2
SSDEEP 12288:aXgeKznl5TXJR0j3p2pVUrrQuLoWTF23JVbd0UILzXSocmKdYNq6:aX7ozX0j52pMkuLoiSJVlIL29mhNq6
MD5 SHA1 SHA512 SSDEEP

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 701KB
SHA256 a846e83df570b747344c9eb51d1ae3d4d4306fcc2a7192cdcddc4595eb9bf5f5
MD5 edffafe518621be7663d4754d7bfb6a5
SHA1 0fa8118a98797eb0f532b429881c03f73fbf3c8f
SHA512 be0e73689154c007a67a7397ad552429f85eb4feddd4ade1bad6a28f3d85dc2d26548d6b689b43b4c5507a602422dfa6d25a67f97309aff3b4aff81fc9268be4
SSDEEP 12288:lUFmDDLygeKznl5TXJR0j3p2pVUrrQuLoWTF23JVbd0UILzXSocmKdYNq6:xy7ozX0j52pMkuLoiSJVlIL29mhNq6
MD5 SHA1 SHA512 SSDEEP

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 541215fbb95a27f8d25803aecfdc23241abaa94249f9f3f706b472684989e9e9
MD5 0d744d3742a096f4dcc15edbcb9595d3
SHA1 873465cb7bd145a249f6f68cc7d7103de7916c8f
SHA512 e05c7b81ef92d154515b14b6ec2227865f49545117a3d722edd1c3e91d6212e7f5a81a2c79ce10c1446b0e19f5b85fe105ba87bbf7b7f6bd3d53e334868771fc
SSDEEP 12288:OVgeKznl5TXJR0j3p2pVUrrQuLoWTF23JVbd0UILzXSocmKdYNq6:OV7ozX0j52pMkuLoiSJVlIL29mhNq6
MD5 SHA1 SHA512 SSDEEP

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 f573a576fde10587977ac90e40ad52e048cfd8131362466ba8d056f467dc7130
MD5 673143f8e1df32e9394e4e3512632ed1
SHA1 8aba2b4212b4348827c1a5d46ddc67728d4ff75c
SHA512 3a9c66fd920f3060b61740e2947e969d63b7a414dc26755178a04df4429bcb5f8357f39f15af1454bc53fec50705c0a2ab5efb58a68df2c7556f463c996ed90c
SSDEEP 49152:xa0h2GEkuAe73q3pp46zwwQs70jIpM3kiSBM29mhNq:xa0hNYG4JwX70uMhSBrkNq
MD5 SHA1 SHA512 SSDEEP

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 659KB
SHA256 397c291fd250a65c3c37fbd3030d4b864f3049cb37a22ca666b0f59980b8c6d4
MD5 7d5cfbd3bbbb500901f21da70b250558
SHA1 d1978de700e8f5d88f5a52864a606d159dfa2d37
SHA512 dbd6449d1517f6900057db45dea3080c1f6fabf9d318cafb7dd3715b2f23d1ffce430004c701006b059cbd9096f79086ac518baad230d12a5e1b095abf6003c5
SSDEEP 12288:ZhbHjfXageKznl5TXJR0j3p2pVUrrQuLoWTF23JVbd0UILzXSocmKdYNq6:ZhbHjPa7ozX0j52pMkuLoiSJVlIL29m7
MD5 SHA1 SHA512 SSDEEP

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 7fd7b2c5fd7996210c9e710d1b7b09f0936cf42c05ba67d158f18701128862bc
MD5 7ab8c49fddd34d8062dad16116b225b0
SHA1 bf044c6ec64d9ab08bab2f46410744bd91ea0b3f
SHA512 174dbae92e44b6c98dc87172224b0c0fc67fada13e6f2740f82dfcbc3b97a4fd8edf41364d023fd54985cae762ec2359a913e76b4cb0abdeb21c13a7515168d2
SSDEEP 24576:83YgnJcRTk4yti+R5dpR/C7ozX0j52pMkuLoiSJVlIL29mhNq6:8IgnaTk46ppR/T70jIpM3kiSBM29mhNq
MD5 SHA1 SHA512 SSDEEP

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 578KB
SHA256 996aec3252751aed65ae1d184115f5390074e7e42eb3f4b79d0642e961fe81f6
MD5 ea01fc8e50e2be032c5f309fef9ebca7
SHA1 c6f28100fad79faed6349b261ce7af3045930c3a
SHA512 23b1749a1f036d41c7c7c2a5c0be8fc24e70cf62aa29d4411e2cb0a3606a97c10bb93acd20af2e3e04874a5ca758b0df1c456772978b0af9c427f5fa172952b2
SSDEEP 12288:KpgeKznl5TXJR0j3p2pVUrrQuLoWTF23JVbd0UILzXSocmKdYNq6:Kp7ozX0j52pMkuLoiSJVlIL29mhNq6
MD5 SHA1 SHA512 SSDEEP

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 940KB
SHA256 c6184287b8532764b8824ca29fa4544711bcfe84e7820f5a2affb36f1adc34b9
MD5 f645d8f1cde9e0b1052f5c787499d7aa
SHA1 3e5f5a0b093437cec199723996cf8e3c5843df77
SHA512 ff047564d698397b8ed66faba3caa04457e9a0ce5511be841b10ad8494cc0b44985755085583e70217e2e7daf1001ee1300ee106948b754ec774ce46c60137e9
SSDEEP 24576:bpL3UTU7ozX0j52pMkuLoiSJVlIL29mhNq6:bpL3Ul70jIpM3kiSBM29mhNq
MD5 SHA1 SHA512 SSDEEP

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 671KB
SHA256 08c4d71afe9cbaae4a657866c2e5791caedc333072ed46f717659339212d50ff
MD5 4fbaa95dc2c28d7788ab033eaed2162f
SHA1 881c8f134418a633ce2ff32edb7c3598b4889888
SHA512 2145c417d0aa2c8675f7d069406bf219d9dfbbb3585d06642cdee6bc1d5ff60d79fd1f5d0c191479c3764007f4e39f6e46d7f0506111a4faa7aca789b76c5536
SSDEEP 12288:xpFtpO4geKznl5TXJR0j3p2pVUrrQuLoWTF23JVbd0UILzXSocmKdYNq6:BO47ozX0j52pMkuLoiSJVlIL29mhNq6
MD5 SHA1 SHA512 SSDEEP

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 f6592d5f9db89c4d120f762060ef9d923a6432373c2fa98162021721912d4cef
MD5 bf7e0bc8cabd3347548ebbe220473519
SHA1 2810501d96185d76441b8179b028f0d222cb0b05
SHA512 a0bdb3cab1e0114a7830fb21ef8b474d185d613290f0fa7ee38459b7fa751a0991eb9c3c40eb13cd0680c8597ac50cc3645b405600a7f13c3a12986a9e9778ed
SSDEEP 24576:u7NM9YmZqmWMUkPjZM48Mv6bEhsl7ozX0j52pMkuLoiSJVlIL29mhNq6:u7cBWMpPjN8DbEhL70jIpM3kiSBM29ma
MD5 SHA1 SHA512 SSDEEP

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 93085f48341349edf3e2da1166a15b89392a0c6dcd18537ec1a04a9fa268a15d
MD5 45e1f864e140c4db13f457b663e00641
SHA1 908b5ae27412951ca55a51fffa18ef8c762546e7
SHA512 d18c99c7b0fca0507b2b1ba64f08170a98a7d0815d5ce70ccf0411fb2afe7746437e1810295ffc37446bb13c71c49f9efadeead9044be8fd0e1de284fa553776
SSDEEP 49152:5F2YuHNETovcvNYf8kme70jIpM3kiSBM29mhNq:s6tCf8kF70uMhSBrkNq
MD5 SHA1 SHA512 SSDEEP

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 647ebece2c0ad6e9019702f6ff54266a34b8fe18dec05f88404a55e8bab3c0d8
MD5 a8a3b88f722e325b0251446e8423b81e
SHA1 e75b1f25bf60c855f8a7b2998a73ef19df2eb8dd
SHA512 ab49d7ab248229b4da8d9b9c8537add9aead5ace3710cc7197d97b3529479f598d0e06b964ac912eb0b37af609f13ca8b218ccf4cf80bd21ce5045af9f063f53
SSDEEP 24576:qAFs06+Omlf3NXEbTos7ozX0j52pMkuLoiSJVlIL29mhNq6:zFs060lVXuM70jIpM3kiSBM29mhNq
MD5 SHA1 SHA512 SSDEEP

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 885KB
SHA256 309f4b15c278555379efacd41e53c2f0416244ae65d07d8d50e9e334120d2369
MD5 18d50c7ede7479df04460493f4210d00
SHA1 f3027b8688a5c2d89ab3ebf66001427bd6b89110
SHA512 c56820f11823f04c8bb0c1eff635c934d51cef735238e8c442dc12ceae3b77e165ad9579e13a313d5c1f5f11be0bbd86f15193abbde7878439f79ef59787adb9
SSDEEP 24576:AJnJ5D3Wtn7ozX0j52pMkuLoiSJVlIL29mhNq6:AJnJ5DGtM70jIpM3kiSBM29mhNq
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 05c07951f04e666da7a2fa102ba147c8bcedb9c18f0dd2d32be2777c8b2c75e4
MD5 be7a9da2d8bd840f5cc5a1b8ba554812
SHA1 44d49379eb1af348cb5b0d969694f9458d77ac41
SHA512 19d088ab8863c378e190e494c3c9c69f3c5b4ea34ce5898cd45fa4a12e63a994120fee9e365f74a9f63779274f185282be077656401746e81fd80055800f976d
SSDEEP 49152:Jo06DIKdwc+eQnSt65aV670jIpM3kiSBM29mhNq:eo70uMhSBrkNq
MD5 SHA1 SHA512 SSDEEP

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 661KB
SHA256 6aebe8710355fca2ab8f8230c54fbb39b052e6c6f2ef0f3fd759ad74a6ba1728
MD5 2da53b2a5cb83d29694190d6d5f83d42
SHA1 55b0b6afbef95bb6ac8ad72df7c451d6741743b5
SHA512 ea767fa4b68bd0374cd9ddba502e88fe8c25de812e430eb64dc0319eef479fbdcf2bcc5f358229578f1992586d2a071d392db3d41c3f03359823dc0e8bf78234
SSDEEP 12288:kEP3RrUgeKznl5TXJR0j3p2pVUrrQuLoWTF23JVbd0UILzXSocmKdYNq6:frU7ozX0j52pMkuLoiSJVlIL29mhNq6
MD5 SHA1 SHA512 SSDEEP

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 712KB
SHA256 a250ebeeaf42585da7d294a965208ece20b818d9e8626519bad57d15aeee8f8f
MD5 022b40447aaf0a06abb3b27de4f7ee68
SHA1 0855f4444bfbb1bc169510166c1c03abb993ac9c
SHA512 632414095173202c1ec61a10f9a482a5d00e305b9c48c14c7493e66eb6d770bba3679070cedbb76e75985d5e15fc7a37e30ae69c17ae3fe303fb7ededfb83aee
SSDEEP 12288:hjkyKgeKznl5TXJR0j3p2pVUrrQuLoWTF23JVbd0UILzXSocmKdYNq6:hIyK7ozX0j52pMkuLoiSJVlIL29mhNq6
MD5 SHA1 SHA512 SSDEEP

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 584KB
SHA256 154cd78de326904feaac59c4779301effc83ac4c3e39a245374dc36d62be4bd2
MD5 b76d376db8230425e6003ae193fdab7b
SHA1 5ca57f0772949b218bdd157ab8505b8744ed39b4
SHA512 118067a95e51026aaf667dcc7bddc7ebdd602c4895b656c910e2236c1bff89a9b96faab8ed42e0df3079958f843e947d1a1d407699f8128c14848b0f1bd32e64
SSDEEP 12288:9FogeKznl5TXJR0j3p2pVUrrQuLoWTF23JVbd0UILzXSocmKdYNq6:jo7ozX0j52pMkuLoiSJVlIL29mhNq6
MD5 SHA1 SHA512 SSDEEP

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 93e7d08f34a5cbdf88cf2f056aeddb3387376754a2e3497dd768032e94d0d25a
MD5 c428e4c0b4fcbf1103f8ce7b2020c3d7
SHA1 f744a9e0dce8b905b64d0a209e8457d51c46212e
SHA512 e3bca615c00005295fe3c1eef615b149a976960f58c44cd904778420d4ea74a97b8976679ef5287f0347afeb5b0f5e13dcc23673270994d83d39850a375935d2
SSDEEP 24576:dQ9MxZKdcz97w3d7ozX0j52pMkuLoiSJVlIL29mhNq6:dVKX270jIpM3kiSBM29mhNq
MD5 SHA1 SHA512 SSDEEP

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 772KB
SHA256 92eb1bc2e3686131492560ab383c794a39b5cd851da5f0df88ea9ae6f00b8895
MD5 450109732f465e9535151eea72dba428
SHA1 fca4d6a2228829bf039e7fe7d3f9af6cdb21f86b
SHA512 094fdd5d625b221d28f0712a7c1ea94ebb95c57bc1314d06e3760e275284aa86da66a87f117781f7dcd8cbec0134489a4b1a449bdb387bf65fcccaa5189b9558
SSDEEP 24576:ryocxApu7ozX0j52pMkuLoiSJVlIL29mhNq6:eocxApP70jIpM3kiSBM29mhNq
MD5 SHA1 SHA512 SSDEEP

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 412eb3b25c35dc6672c4498aef6f50e3c6bacf718da2ab8b0579d100246732ee
MD5 aea0c1bbc15af4921ced37124a8b8e3c
SHA1 dab188eca32d17c816d44b4fc876986a6a5a54c8
SHA512 b56c6eddfff30a658028e7f5958dcd9e26eccf92d9f3e73767dbdf924372706978002fad0f17d25fa4674bca6a030cef32d647343e81341ab7be31651c155bf1
SSDEEP 49152:8WcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIKP70jIpM3kiSBM29mhNq:20zuNIj70uMhSBrkNq
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 1464b67636623d95bd13a8c447b447406eeb6a5bd39a7eb0cec31c3f4f3c6bf5
MD5 1e4ad5b48ee07f875c206a06789392c2
SHA1 871b9604a42c9839abb3709e0ac506b57ca0de38
SHA512 9a98f6c20f82e6c6095d696f7687212e27c24e83e7cf250a31f3c7522144109e18176eefdd629cf3b1a16d5b4fa8591afd371e7a73fd1121122e4f7b3c6f8486
SSDEEP 24576:51QT7EcpfxR+N5AWAz3ooiYtjMqbU7ozX0j52pMkuLoiSJVlIL29mhNq6:sTDxR+N5YzTfjM870jIpM3kiSBM29mhc
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1320-626-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/1320-398-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/1420-242-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/1420-44-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/1420-53-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/1420-52-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/1684-0-0x0000000000400000-0x0000000000554000-memory.dmp

Download

memory/1684-29-0x0000000000400000-0x0000000000554000-memory.dmp

Download

memory/1684-6-0x0000000002210000-0x0000000002277000-memory.dmp

Download

memory/1684-1-0x0000000002210000-0x0000000002277000-memory.dmp

Download

memory/1848-630-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/1848-442-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/1932-69-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/1932-67-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/1932-56-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/1932-62-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/1932-63-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2000-285-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/2000-397-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/2228-379-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/2228-383-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/2308-300-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/2532-72-0x0000000000440000-0x00000000004A0000-memory.dmp

Download

memory/2532-71-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/2532-78-0x0000000000440000-0x00000000004A0000-memory.dmp

Download

memory/2532-243-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/3116-273-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/3116-385-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/3160-363-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/3160-248-0x0000000000540000-0x00000000005A0000-memory.dmp

Download

memory/3160-254-0x0000000000540000-0x00000000005A0000-memory.dmp

Download

memory/3160-247-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/3248-625-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/3248-394-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/3280-429-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/3280-628-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/3496-32-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/3496-239-0x0000000140000000-0x000000014024B000-memory.dmp

Download

memory/3496-40-0x0000000140000000-0x000000014024B000-memory.dmp

Download

memory/3496-41-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/3700-302-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/3700-420-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/3748-618-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/3748-348-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/3952-321-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3952-441-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3952-621-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3980-258-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/3980-271-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4264-368-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/4264-622-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/4288-409-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4288-627-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4596-616-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/4596-325-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/5068-617-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/5068-344-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/5096-238-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/5096-11-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/5096-20-0x0000000000580000-0x00000000005E0000-memory.dmp

Download

memory/5096-12-0x0000000000580000-0x00000000005E0000-memory.dmp

Download