4382b879996b81f8190f99b73691e642528fbdfd4c0c349e2769d7f117bf154a

Analysis

max time kernel
149s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
04/06/2024, 00:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4382b879996b81f8190f99b73691e642528fbdfd4c0c349e2769d7f117bf154a.exe
Size 1.8MB
Sample240604-atwydsfe96
SHA256 4382b879996b81f8190f99b73691e642528fbdfd4c0c349e2769d7f117bf154a
MD5 5f082b0e46ade509b24caa0f28dfd9f8
SHA1 a05cc82549636666e910fdf1374d52b879e1b591
SHA512 7b22ea86cd4d6e68a49c47b08d81da06785dc34dac5f82e54d15fe9d05e54e5606a504e870ce9b7d3f00b4c80188b006507e9cefc7ac20342201d268ff8ce1cf
SSDEEP 49152:Gx5SUW/cxUitIGLsF0nb+tJVYleAMz77+WAy0J209NRk8O:GvbjVkjjCAzJ30809IJ
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
1476	alg.exe
5048	DiagnosticsHub.StandardCollector.Service.exe
864	fxssvc.exe
1212	elevation_service.exe
4864	elevation_service.exe
2128	maintenanceservice.exe
4748	msdtc.exe
3900	OSE.EXE
1544	PerceptionSimulationService.exe
3724	perfhost.exe
3488	locator.exe
4404	SensorDataService.exe
4416	snmptrap.exe
3868	spectrum.exe
820	ssh-agent.exe
2928	TieringEngineService.exe
3668	AgentService.exe
5064	vds.exe
4120	vssvc.exe
3616	wbengine.exe
4736	WmiApSrv.exe
1368	SearchIndexer.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in System32 directory 37 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	4382b879996b81f8190f99b73691e642528fbdfd4c0c349e2769d7f117bf154a.exe
File opened for modification	C:\Windows\System32\msdtc.exe	4382b879996b81f8190f99b73691e642528fbdfd4c0c349e2769d7f117bf154a.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	4382b879996b81f8190f99b73691e642528fbdfd4c0c349e2769d7f117bf154a.exe
File opened for modification	C:\Windows\system32\AgentService.exe	4382b879996b81f8190f99b73691e642528fbdfd4c0c349e2769d7f117bf154a.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	4382b879996b81f8190f99b73691e642528fbdfd4c0c349e2769d7f117bf154a.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\locator.exe	4382b879996b81f8190f99b73691e642528fbdfd4c0c349e2769d7f117bf154a.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	4382b879996b81f8190f99b73691e642528fbdfd4c0c349e2769d7f117bf154a.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	4382b879996b81f8190f99b73691e642528fbdfd4c0c349e2769d7f117bf154a.exe
File opened for modification	C:\Windows\system32\AgentService.exe	alg.exe
File opened for modification	C:\Windows\System32\alg.exe	4382b879996b81f8190f99b73691e642528fbdfd4c0c349e2769d7f117bf154a.exe
File opened for modification	C:\Windows\system32\vssvc.exe	4382b879996b81f8190f99b73691e642528fbdfd4c0c349e2769d7f117bf154a.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	4382b879996b81f8190f99b73691e642528fbdfd4c0c349e2769d7f117bf154a.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	4382b879996b81f8190f99b73691e642528fbdfd4c0c349e2769d7f117bf154a.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	4382b879996b81f8190f99b73691e642528fbdfd4c0c349e2769d7f117bf154a.exe
File opened for modification	C:\Windows\system32\dllhost.exe	4382b879996b81f8190f99b73691e642528fbdfd4c0c349e2769d7f117bf154a.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	4382b879996b81f8190f99b73691e642528fbdfd4c0c349e2769d7f117bf154a.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	4382b879996b81f8190f99b73691e642528fbdfd4c0c349e2769d7f117bf154a.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	4382b879996b81f8190f99b73691e642528fbdfd4c0c349e2769d7f117bf154a.exe
File opened for modification	C:\Windows\system32\msiexec.exe	4382b879996b81f8190f99b73691e642528fbdfd4c0c349e2769d7f117bf154a.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	4382b879996b81f8190f99b73691e642528fbdfd4c0c349e2769d7f117bf154a.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\dllhost.exe	alg.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\eb3c8f9ac3136770.bin	alg.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	4382b879996b81f8190f99b73691e642528fbdfd4c0c349e2769d7f117bf154a.exe
File opened for modification	C:\Windows\system32\spectrum.exe	4382b879996b81f8190f99b73691e642528fbdfd4c0c349e2769d7f117bf154a.exe
File opened for modification	C:\Windows\System32\vds.exe	4382b879996b81f8190f99b73691e642528fbdfd4c0c349e2769d7f117bf154a.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	alg.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	alg.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	DiagnosticsHub.StandardCollector.Service.exe
File created	C:\Program Files (x86)\Google\Temp\GUM52C3.tmp\goopdateres_pt-BR.dll	4382b879996b81f8190f99b73691e642528fbdfd4c0c349e2769d7f117bf154a.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Install\{372EF552-D8CF-402C-B62E-CA3A4C643A96}\chrome_installer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File created	C:\Program Files (x86)\Google\Temp\GUM52C3.tmp\goopdateres_ms.dll	4382b879996b81f8190f99b73691e642528fbdfd4c0c349e2769d7f117bf154a.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_104468\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	4382b879996b81f8190f99b73691e642528fbdfd4c0c349e2769d7f117bf154a.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	DiagnosticsHub.StandardCollector.Service.exe
File created	C:\Program Files (x86)\Google\Temp\GUM52C3.tmp\goopdateres_sl.dll	4382b879996b81f8190f99b73691e642528fbdfd4c0c349e2769d7f117bf154a.exe
File created	C:\Program Files (x86)\Google\Temp\GUM52C3.tmp\goopdateres_sr.dll	4382b879996b81f8190f99b73691e642528fbdfd4c0c349e2769d7f117bf154a.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	DiagnosticsHub.StandardCollector.Service.exe
File created	C:\Program Files (x86)\Google\Temp\GUM52C3.tmp\psuser.dll	4382b879996b81f8190f99b73691e642528fbdfd4c0c349e2769d7f117bf154a.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\minidump-analyzer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe	DiagnosticsHub.StandardCollector.Service.exe
File created	C:\Program Files (x86)\Google\Temp\GUM52C3.tmp\goopdateres_ca.dll	4382b879996b81f8190f99b73691e642528fbdfd4c0c349e2769d7f117bf154a.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	4382b879996b81f8190f99b73691e642528fbdfd4c0c349e2769d7f117bf154a.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File created	C:\Program Files (x86)\Google\Temp\GUM52C3.tmp\goopdateres_lv.dll	4382b879996b81f8190f99b73691e642528fbdfd4c0c349e2769d7f117bf154a.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	4382b879996b81f8190f99b73691e642528fbdfd4c0c349e2769d7f117bf154a.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c539828116b6da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9926 = "M3U file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9923 = "Windows Media playlist"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d1626a8116b6da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003b119a8116b6da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000dc36668316b6da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006d5a058216b6da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b72abb8c16b6da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d42bb88216b6da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
5048	DiagnosticsHub.StandardCollector.Service.exe
5048	DiagnosticsHub.StandardCollector.Service.exe
5048	DiagnosticsHub.StandardCollector.Service.exe
5048	DiagnosticsHub.StandardCollector.Service.exe
5048	DiagnosticsHub.StandardCollector.Service.exe
5048	DiagnosticsHub.StandardCollector.Service.exe
5048	DiagnosticsHub.StandardCollector.Service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
664	Process not Found
664	Process not Found

Suspicious use of AdjustPrivilegeToken 41 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2776	4382b879996b81f8190f99b73691e642528fbdfd4c0c349e2769d7f117bf154a.exe
Token: SeAuditPrivilege	864	fxssvc.exe
Token: SeRestorePrivilege	2928	TieringEngineService.exe
Token: SeManageVolumePrivilege	2928	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	3668	AgentService.exe
Token: SeBackupPrivilege	4120	vssvc.exe
Token: SeRestorePrivilege	4120	vssvc.exe
Token: SeAuditPrivilege	4120	vssvc.exe
Token: SeBackupPrivilege	3616	wbengine.exe
Token: SeRestorePrivilege	3616	wbengine.exe
Token: SeSecurityPrivilege	3616	wbengine.exe
Token: 33	1368	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1368	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1368	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1368	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1368	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1368	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1368	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1368	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1368	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1368	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1368	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1368	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1368	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1368	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1368	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1368	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1368	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1368	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1368	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1368	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1368	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1368	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1368	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1368	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1368	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1368	SearchIndexer.exe
Token: SeDebugPrivilege	1476	alg.exe
Token: SeDebugPrivilege	1476	alg.exe
Token: SeDebugPrivilege	1476	alg.exe
Token: SeDebugPrivilege	5048	DiagnosticsHub.StandardCollector.Service.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1368 wrote to memory of 1116	1368	SearchIndexer.exe	112
PID 1368 wrote to memory of 1116	1368	SearchIndexer.exe	112
PID 1368 wrote to memory of 4952	1368	SearchIndexer.exe	113
PID 1368 wrote to memory of 4952	1368	SearchIndexer.exe	113

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\4382b879996b81f8190f99b73691e642528fbdfd4c0c349e2769d7f117bf154a.exe
"C:\Users\Admin\AppData\Local\Temp\4382b879996b81f8190f99b73691e642528fbdfd4c0c349e2769d7f117bf154a.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2776

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1476

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5048

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:4292

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:864

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1212

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4864

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2128

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4748

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3900

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1544

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:3724

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:3488

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4404

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:4416

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3868

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:820

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2928

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:3640

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3668

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:5064

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4120

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3616

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:4736

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1368
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1116
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
  2⤵
  - Modifies data under HKEY_USERS
  PID:4952

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
Size 2.1MB
SHA256 b8f5acccf58beb056cbde3f96ce77a794b8ab73be5aaa91fecf2aefc92f516e0
MD5 b9ff62d55513d28c3f3c824fa90bd8d8
SHA1 4ad1316b8dd4030b8019c1cebe86740ec6a7c923
SHA512 db612462e4c051fe4a55d7e7117f7c6a4d7bf3c3c3e5ac0a46a06e2eeb4784911f194f3db1bc2f92e45e5c56ea8d4d3952a4ebc398f7f57df87593c41d66138a
SSDEEP 49152:auYk3H5koUafTqkkYLO/W2buywzMbOX+T7z5f0J209NRk8O:aCfTqi90bj0809IJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 0214c7fa86068849a8b2af3c9330eda3d8b81cab4fc97ad62c99902376310f0b
MD5 15b2221ca39a883a6b075d9a646120a6
SHA1 8d85660b9dd974bfde32431c8411b35b4d87372b
SHA512 0b261870a0b3ebc44f15251eb2442b180dc3b7f5736db3b83cf742c8621d74715f094f044231294509c051720c80b74ba3989286310aa7fdb2f10f6a9f0c5d96
SSDEEP 12288:PcQicmNJLBsunE1NsaoJmJnw+Bt6PpMfyggc55J9jDzZHtT2V4xyLl146YogO:viBnBsuE8dmJ54/c5fNRdaNl1oogO
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 6b49ccb437f11ba958f251fcda010d8b5d44713e127da4dbfbb87477363ebde3
MD5 dbe9aedf8efd607839f020928e1f0a8a
SHA1 2170fbe23e54dcbc83d747b217cbd7cc3bed1c60
SHA512 db14823782d6f1cbe986342169729c02afa81cddb227e90c9ac57ae4aa1db57120175dc37e21bede95027f607f4f47a36aca3fff4943a82322d913bd647f7834
SSDEEP 24576:6+gkEDfh4CoYdmJ54/c5fNRdaNl1oogO:fgkETSC0J209NRk8O
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 400301d63af0f8b91582faf157211afacc7f899947281bc0730d0caa8e31f4f0
MD5 57f55a9566bb57ce71fa23b6c5e25576
SHA1 ba6239e4b7cb127e7cb821e07b242bf3cd7cf7c7
SHA512 5644f6d321a4f92c613f5723482f3683c0834f2ab701c78761f62e53802b19070f95b676918f6fb91a484c61ee40beab1018b90a23b3b2312cb62f9d9a08c9bf
SSDEEP 24576:QBpDRmi78gkPXlyo0GPjrrdmJ54/c5fNRdaNl1oogO:0NRmi78gkPX4o0GPj/0J209NRk8O
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 c3bce849451dd9c5bfe3847e08f2fdf5e252adbf7251641230d710f0ba3e99fe
MD5 8004f721191ad4815793eb575af02696
SHA1 f6fbdd04f6082aff1b4e163dc1bdb7bab3839669
SHA512 e9936b7d101b9256a890839d3e385e34d4f364d471014c5c562899708951a14f06b1d94aa1e67b338622dc43e3e503c3c1ec1627cb258299324cc31a334ba42c
SSDEEP 24576:+LOS2oPPIXVYdmJ54/c5fNRdaNl1oogO:e/P30J209NRk8O
MD5 SHA1 SHA512 SSDEEP

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 aef223b7b738c34fcd28f1414ad8714ef56ffe6a5e2263b3f07d6b2b402d665d
MD5 be5112ffc1e233d27f966b59ff6594d3
SHA1 4406cc7954c0904fc6fd8c55919b202ec4aab115
SHA512 c8769529db2966b29435c9f0bb86dbee1ca79082ea3babf448305fa6cb931fb5c3259257185072a472be5857105ac91f4f4dda4cf49f69981d898f7a8bed9bfd
SSDEEP 12288:fDrNsaoJmJnw+Bt6PpMfyggc55J9jDzZHtT2V4xyLl146YogO:fDidmJ54/c5fNRdaNl1oogO
MD5 SHA1 SHA512 SSDEEP

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 cd1d65160166d26490b6dd7675837479ab5c9968d9eb0c226690fc028eb1766e
MD5 020447b16e42eeb2b1b3d3e149f14176
SHA1 3257d9fb56b40ad6b00293df8b5a5171a21f471d
SHA512 227344e6bde1c47f8b27107aabd2d0d447cafb48255f76e26145e131aedf15c328c060f6b1fe17163e13406d69f1523c39e4be4015ca897d87f20e23cc8db1d4
SSDEEP 49152:3QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJR9DN5J8NRV3THu:3QvGAdlCEL8c/RRNw5CF0809IJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 e16729dcee26292c80a27be339afdbc37d009fe43c2ce1889581b4d829600504
MD5 3f31297294a33506b5628419fa57a6e8
SHA1 f0662235615a2783ddb8d89b3665951aa7452cf2
SHA512 d5f65f7797e4ca5f89f34205babf82ea2bf7fc878eb625a950da5f0754833a5bd1f70571ba73f52672eac3b15c66455c0ef56b36ce6d071a4d52925e13fe3f8e
SSDEEP 12288:PAwSfxL/2Dc3ZDLLmt0LDQewsAjDNsaoJmJnw+Bt6PpMfyggc55J9jDzZHtT2V4:YsewsAjKdmJ54/c5fNRdaNl1oogO
MD5 SHA1 SHA512 SSDEEP

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 02acae22fddd47cd642c435761362cf87f60ae10e79b6b1e81fd9a37b6ec0f2b
MD5 7c06cda0c6274d152cf702cd98338560
SHA1 08dde8704301a87bc215008a3592959ebb1d7222
SHA512 d4ff298af8a00dc4a7665a4600450a003ba350fbce65e1c380850d222e7ea26a9af6932e24ef93ccdc858b27aa64007379fcaea064aa48d68f97cff844287fa1
SSDEEP 196608:0UEtQeTbvf2zlO12sJTv6Ja1cpVLyRIldPlbuJHSv096:0UEtQevvqc2W1cpV2RI32A
MD5 SHA1 SHA512 SSDEEP

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 1c9817a4b2022e928d8e08d8f1b5d0b74460cea47ca387a04fa4e7d8508dff49
MD5 7dd283a1fd9d591da333287e8e936345
SHA1 a54b78d7d69036bfa1b0450cb00e841b7d95a2c2
SHA512 2cbbc7b7e42007189a03e1a7ce0034bb960014b182c2e32aae136b4ef8dbedb8df49361c40b26feaeb61b988dbf44c1973a90fd7046dcd2b90a905b2362694c5
SSDEEP 49152:xCbRquA/m2yL5zifFiV+XenmE3/zD0J209NRk8O:+oqHVjnmI0809IJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 9ea56ec398893ce54ba6b42af51bf6f0080c3f46ace14dc8aa25dfb6dc951281
MD5 81d9ada12fd1bca2e0e8d3d324d27944
SHA1 92cb7d88528024fcf02a4c062d2a26737fa695ed
SHA512 93729166a734cc39c8f2b8dfa72ed7faed1439d48c985d0626982916311e361d777efb54a530a45066bde198ef3316de83906746c874d6d0e2eab4a4c5c98ee0
SSDEEP 24576:OAhGL2IFoiwtA5l7S53xdmJ54/c5fNRdaNl1oogO:OAM1Foiq5B0J209NRk8O
MD5 SHA1 SHA512 SSDEEP

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 f02c5389e6a137f32870091314464906d6d3740d3cc6436b63baef3d4e26628e
MD5 dba94637d4bf601204eb17825e716702
SHA1 1f4ce10b3241f3dc40e5aa877e5d2168f5e44d98
SHA512 2b3cf919a5329aa3d87f671580cf49e0a1206de3fa82faa5726ba0b3571da6460a8a800aad614abe64ded0abd7f1ddb359525cc98a5b5690755639734c158417
SSDEEP 12288:Rmw5HEjsChNIBFgl0WDm+CNNsaoJmJnw+Bt6PpMfyggc55J9jDzZHtT2V4xyLl1l:MwuROW3dmJ54/c5fNRdaNl1oogO
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 71f6bed44f57a809810963118750eb1198950969340f0ec2901913c38f707d01
MD5 189805772442b805e3acb157d177caf6
SHA1 dcb9b674c92d31d7d6b1cb5e66bf75f0c7e37699
SHA512 ba42aa97c085664e71ca89ca23f04631db331cac4fd1debda1ae8c2cebec3b6b19463ef16e28f889bd6cfc5a60f35c82176063e753d4ee7d1e1d4bb5b7504693
SSDEEP 12288:iVZ1IyzNsaoJmJnw+Bt6PpMfyggc55J9jDzZHtT2V4xyLl146YogO:oZuXdmJ54/c5fNRdaNl1oogO
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
Size 5.4MB
SHA256 6d3d36221e22afbdfcb6b83997d1aaf8e9227800da3fd9872e22d0c25928278f
MD5 71179996e12e33b6bde715cf266f5a2d
SHA1 af36e9f1e73a98ae6e74109bb86a8c08be4522ef
SHA512 c048c286b8871aaa1b9e6545221f34a1e613589fd4d7f1907313015ef13e141c0435cbe0c3f2b1e3d05bbc5e4a52cad4080da7d9718f0e5bf1d63cf6baa6991a
SSDEEP 49152:30kwIi7c4xZlm5knEtw99Kn/2vim7vgv6m+yyJ/0gbvjS7yY7BHi3u7L/gBUUWLe:7wfhY7g/rLe7yYA3awr341gJ0809IJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe
Size 5.4MB
SHA256 2c55a239347aaa680e315f3cad55f09b2c362a07074bbf642f0d029b7df59af7
MD5 7a94f15f6f96438fbf992755db7b0fbb
SHA1 e63f6f665760ac5aa597bef0a411ae06c43d7327
SHA512 d5b174bd1e4a6d748224b5d2c61bd85d9ea4938dbf5e8fb7cddecf5185c32f978347e066ed83ce8cdea7f2d70e494ee09668853fd78bfda7bc504c1972cc2cbc
SSDEEP 49152:M0kwIi7c4xZlm5knEtw99Kn/2vim7vgv6m+yyJ/0gbvjS7yY7BHi3u7L/gBUUWLe:KwfhY7g/rLe7yYA3awr341gJ0809IJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe
Size 2.0MB
SHA256 4cdb641433640f648335c6e0dc335a417a0a78426959b874b7e2ccae5968f485
MD5 3a34aacbfdf903376f7e0638dc7f3fcb
SHA1 ed29aef9a59f5f2da25eca0842f6a2a6fedb3515
SHA512 ff837d83adfd4e0d3162510ec664fac1019e9e2429a2c83f33cd5e5936da7bfe11a1af6c67615f9eb69ddb0846dac9fdad5a823ea64c90b378faa4ca81a73ee7
SSDEEP 24576:ocTyYv0FteQU75I2kjgD6iQacAmdmJ54/c5fNRdaNl1oogO:ouXv0FtpK5606zOm0J209NRk8O
MD5 SHA1 SHA512 SSDEEP

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
Size 2.2MB
SHA256 04c4411337c01848da70f8d8c4ec9715a75e5ea45913888314d418fe1b2e23ff
MD5 aeb14c6525e99abe36c1276ff2cb73d6
SHA1 6ffb1f4e4e1605041d6d9707445d926e4f4fb3b2
SHA512 96a6be1f6e09b6478cf3436d26693f805293ea7b0cb9248d8d228778d6ccf740ea6bc772e5ce03671b925f3403423215ffb30d8d09da45fbf84a02e7ad3980c4
SSDEEP 49152:oy7mTd0GxN8jyynSHjXKUyn4GVcbDSKrNTxj0J209NRk8O:XmYeySHjWjMTj0809IJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe
Size 1.8MB
SHA256 fd2982e28be2210d2bd49725320979188218d90228dd672ac19cbf48594517c0
MD5 d00498e526a8f09beb15c4585833e04e
SHA1 047bd0222d9d7118943be4328b834d1a22971963
SHA512 99cd9bb1dd5698d7623e6e6cf50f31523f6f0d79a900153a60d0cc35dd88e8b2870d06dd49bb308e4a6a1d3026b9327805108e0d938bbcda3aa82116bbab9069
SSDEEP 24576:O6drZn1WEci182IEUgNbJeRgUebgW816fdmJ54/c5fNRdaNl1oogO:OWnDci18UNNUgbYe0J209NRk8O
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 1.7MB
SHA256 9fc21d0e4c2dd1386fe63c1321507283ba6ddd3638593ba0d35158c816680347
MD5 87b6c01bf12bab6ec7521cb95d9fd29c
SHA1 317b5c8666d9172197734b21afe8adfb9b15ab87
SHA512 466e2048e0176616d958e5f0a93dc9d8ea243b6a4aa6f8f2d18fbc6907174c25ac6a66e3dd857e7bb5d6ef235d0b4b1b87f45081fba5fb2c109b35c8b7d28869
SSDEEP 24576:Rk5lHW5EzMZupOR0G2reD+melRgTTv/1nyAdmJ54/c5fNRdaNl1oogO:dizMZz0GhamSoX0J209NRk8O
MD5 SHA1 SHA512 SSDEEP

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 25c9e062b9c768a8a50c5fc45afccce69ba7f8ab8df9cdd216515f4c00d222b9
MD5 bd99547867139f272579bf5fe7728f30
SHA1 d8cf6cf5fe487a7e8e9171b9b0af655d4a991a9b
SHA512 afc82120c67335923bde999a0553588f365d083151076b10b953660b04f0bedb8786b56749a1ee8f1eb1e727aa18cafa44c234fbf227d50c48f4965665c2acd4
SSDEEP 12288:rKNsaoJmJnw+Bt6PpMfyggc55J9jDzZHtT2V4xyLl146YogO:rLdmJ54/c5fNRdaNl1oogO
MD5 SHA1 SHA512 SSDEEP

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 dc28097d3b27c2b482ca4d96442d398ac5c1f232656130a3662da8dff6d96fb8
MD5 d311b49b9aa46962fb9686a582e7e0f4
SHA1 08c2ed7b5f4d6c1b36242ed107f9e0401ded1ca8
SHA512 40eb8fa727bf7c5cb1a94f7631a87aa66f0444b046b6d6e523e42d70ddeafc58f97ab4427fe9df2b78b4fbea0731de512e856a7c32f206f51ca6f49000ee3a3d
SSDEEP 12288:lHNsaoJmJnw+Bt6PpMfyggc55J9jDzZHtT2V4xyLl146YogO:lOdmJ54/c5fNRdaNl1oogO
MD5 SHA1 SHA512 SSDEEP

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 65f1fcf570404c44f0c7cbed14cd4a473e1395d4eb82e856865d67a50e0c79e4
MD5 c24c88fe5a131a3478d8cd0e852769e9
SHA1 191b2232d6bfee2e368ec475ca4f2c52d363e3c9
SHA512 12966862d772aa20173b869db8d12414369e632a667fb383a9af52bdde266ad046d0b208698d96ab49d31df343d16a34eddfeb664976fa77542cbd270299eaa6
SSDEEP 12288:XNNsaoJmJnw+Bt6PpMfyggc55J9jDzZHtT2V4xyLl146YogO:XkdmJ54/c5fNRdaNl1oogO
MD5 SHA1 SHA512 SSDEEP

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 9cab428fd2f6f83cb084a26a32d0fdbb4b92c9d3a7876b9b4c266ae9618f34cf
MD5 735343643f1976fc50d3e6cbf4d6a1a3
SHA1 506927f41c8829df5b867e066fe072efb3263779
SHA512 4cf75c36208026897b9b47ddae36d05c28a59060e654237a4c2c240aa6ac05895dbe8d7e9063d4974b9c49850b49fe2f3fe6c113e30552a222a1021e28ea7913
SSDEEP 12288:LV4NsaoJmJnw+Bt6PpMfyggc55J9jDzZHtT2V4xyLl146YogO:ndmJ54/c5fNRdaNl1oogO
MD5 SHA1 SHA512 SSDEEP

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 195054d5d65e1f053b3bc3dd03301887bd167378b6e943b6c0d6e77f19c6ad5b
MD5 33de29c872f87b4ad0fddac195e2cc41
SHA1 5d967dd6196049175fe5f7cfd73917ff2c9a76f5
SHA512 f34abc70a20bc998694c449a0bbe5b0962372a44d07bf1182cac2393fd901f1d0543416880ea2de257ee8627fa04677d2de57d2da9804af7d6f6d0c23de8af7a
SSDEEP 12288:+wNsaoJmJnw+Bt6PpMfyggc55J9jDzZHtT2V4xyLl146YogO:+ZdmJ54/c5fNRdaNl1oogO
MD5 SHA1 SHA512 SSDEEP

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 fa4cac3fef0e5bda5d6f0b5ce2d04a28392e733f10b13b440695f29a189d2764
MD5 139c4d489260e2dcfd6224022336f920
SHA1 75a092a4731d34fa8736d2370da5b25d7558c4f9
SHA512 69a6c28d6bb93da24a9b9d15dfe3b51fceea14c0672e7c720351bed679989b4b5bf6e2569adbb01d8ec17572c592981833ae671e33a81fded747a2565f8944de
SSDEEP 12288:1LNsaoJmJnw+Bt6PpMfyggc55J9jDzZHtT2V4xyLl146YogO:1CdmJ54/c5fNRdaNl1oogO
MD5 SHA1 SHA512 SSDEEP

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 dcfe0b27341d2994b495fb82b8ee656d72e4111c6791c5af20b6bedc9b0478e5
MD5 71af39ce8a5f30bceeed905ad4636a2d
SHA1 d13564a8b9468ae4ff0df4fc6eb7d908ae0f083b
SHA512 4a998c995230dcc8174d874e8deeab5f93245f1bf85a35e32374a5b932e56c58ec8ac780a4bd377615ee73380f107560a21f87f7a7777d02af1f00341d9f7da5
SSDEEP 12288:Q/NsaoJmJnw+Bt6PpMfyggc55J9jDzZHtT2V4xyLl146YogO:Q2dmJ54/c5fNRdaNl1oogO
MD5 SHA1 SHA512 SSDEEP

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 46e573c8c796b7cf6110af7fc1a7e9e58a2d19de4e2b767316fb9ef8fa3ddcd4
MD5 a564ef0d78b1af881a42b82697b2a023
SHA1 95ddea3f521716ba6517d22eca2571f22889680f
SHA512 5557345465a4f2fcf2ed0a69ef6b7be3e96cc5c0a8084bc286850c902dc45f1494172730617952182a1d4b1d5d74d690c4db87cc853e515f58906c8fb26f0aca
SSDEEP 12288:1iZwbazzFEoS2cPvynNsaoJmJnw+Bt6PpMfyggc55J9jDzZHtT2V4xyLl146YogO:4ZMyzFVSOudmJ54/c5fNRdaNl1oogO
MD5 SHA1 SHA512 SSDEEP

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 8b395bc6ed3afee76d6ac4ab1af6b680a73caa409cea20a99dafc0732c19ac02
MD5 b7ec3a362cf03ccac50c1dcc8e9b5304
SHA1 7cb4e3aac7063c7b47cad34157bb6622b0ac5812
SHA512 10fdd8a84e020cc94c4a26d1a58f273f75ba723bf8900462f020dd357d8eb4f9b4fca19cfd2b1d1c15b51103b74d1d3a84b1b0a3ef2c9818c914cfd4d7d91461
SSDEEP 12288:cWNsaoJmJnw+Bt6PpMfyggc55J9jDzZHtT2V4xyLl146YogO:cHdmJ54/c5fNRdaNl1oogO
MD5 SHA1 SHA512 SSDEEP

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 c8f4ff0769a99e3bf220c379fe929aa67d9f4999329d315acec3baf808ec2e9a
MD5 ad46e5454aaa9ef70dc7b8a65209c1e8
SHA1 f7abed9098d26c04dcc6ea9d123ee99f3c872942
SHA512 0ea1beb6e9f448eff440ca7c9f85d118cba7ead1ed9e92b50b6b3456d78d8db6c7d95726109f590ab225bd0ed9d0f7bbf20addf3727be7e672e44ac0eb92c75f
SSDEEP 12288:fSNsaoJmJnw+Bt6PpMfyggc55J9jDzZHtT2V4xyLl146YogO:fDdmJ54/c5fNRdaNl1oogO
MD5 SHA1 SHA512 SSDEEP

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 ba600e9729aa01ef35c2bcf523c23543a4a5a46e0559d14c145ad82e131ef7ee
MD5 ac6f5830a61c780bd0f57675e2cba5aa
SHA1 2cc8c30c3992972909dd6803b0983e7ffb38b19e
SHA512 a942cf4a0aa82e10a6df74a812c6b84e7499cb6c4e35400c86ff30c9a90de95971fb99bb9cff920fb058a86c5fe942bbea58e132388a62857b90e444da140abe
SSDEEP 12288:zyPz5L8zNsaoJmJnw+Bt6PpMfyggc55J9jDzZHtT2V4xyLl146YogO:+zy6dmJ54/c5fNRdaNl1oogO
MD5 SHA1 SHA512 SSDEEP

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 ba2f7c3e1b51134ce637c1c877212d6621fcd977aa508c88363708ba9180e5d0
MD5 12c9dcc599f71f0246bd69f8c8c5e71d
SHA1 fe932079345131e8cb3e204ac10ba9b4c76dfd8a
SHA512 c95b540223e7c138a5f62d1c6badea2428ee6559771299f84a32b3311885d1027f8ae08d40d1fc36e2ae2ea5c21af461f8592fc41c50691d8ad123466edc246f
SSDEEP 12288:xWNsaoJmJnw+Bt6PpMfyggc55J9jDzZHtT2V4xyLl146YogO:xHdmJ54/c5fNRdaNl1oogO
MD5 SHA1 SHA512 SSDEEP

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 ca5bc81f614bd72d1f3e8c0b3b2b7942d758c8bf88ac4e5ced4a5acc405ba9dd
MD5 3baec0d37fd3e61a5b6b7fb70f7fb23e
SHA1 a60bfd468e3a948156ed1c2be671aa4d9adf0595
SHA512 e74d91d3ab0d50478fbf8fbb311338add356d0e0f5356f5979968b3546db221633ccc70e68de7f6f288c80f6182febfa3e077a7275033df4e592ad80d34483b7
SSDEEP 12288:HWNsaoJmJnw+Bt6PpMfyggc55J9jDzZHtT2V4xyLl146YogO:HHdmJ54/c5fNRdaNl1oogO
MD5 SHA1 SHA512 SSDEEP

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 093e205f4ec799b96fd4a87c3f47ff18d3ca3ebbc09b978b0ea1e15af674a4aa
MD5 29631ef9a87100bdf27724c8f799fbf5
SHA1 1bc735241ef3105d6f1ea1a11205df3d409a3e0e
SHA512 0dd1d074071f8c35db038ac55c0d89a13f30d126ba58e862294e789a0a5a92bfeef932020760f431d466627d2049c00d7ee9bd928fdbcf919c76675115a4d4d8
SSDEEP 12288:vyPz5L8zNsaoJmJnw+Bt6PpMfyggc55J9jDzZHtT2V4xyLl146YogO:Czy6dmJ54/c5fNRdaNl1oogO
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 77f1d5e1b07046b42cd63b1256a28db792918a52c16ed33a92cad0f5be14ef81
MD5 23893b4851a4be6c57b59d5af9ea1086
SHA1 f817d222b471159ad3337ce8c10891c354f84c65
SHA512 41d17d9ae134a346b274f5e256cfcb88c2c0cf9d450ec5b8dcfba2814fd35124abc1260e5647ff8dd3d0c497677b414391f0cf99d20a2be6d82aa5d7370957e4
SSDEEP 24576:kTraLl3z0zD0dmJ54/c5fNRdaNl1oogO:kTGLljV0J209NRk8O
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 30e6344374e0c909dac2e27cb3a5496f54ace9b8ad8239db73ea930a743f8f49
MD5 1c727acdaff2c2d5b7e1316c9afa7f2c
SHA1 9cccbbb232fbbea23da17269dcfe508d3928faae
SHA512 93c49d46e457cac4ad89a8f07ed6160f60807c8c1716e4ec1d1ac313fdf999652a9ae89ba723785d6e44356c579ff189acd205458474ffa099047a3b8f6e8b84
SSDEEP 24576:93Pd9CHKy7GZIdmJ54/c5fNRdaNl1oogO:dPd9CHKyay0J209NRk8O
MD5 SHA1 SHA512 SSDEEP

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 fd27b902ce5f64a039dd1e9a1aafee00381f99b5caf70910af0d46040ab1586e
MD5 97ea1948eb4e8206b04e2090ee6272e1
SHA1 fe6f7c9756b551cccec556127c69e9cfd9ee987e
SHA512 b57cbaa38bee875ebea79aac8178cdc3d7dc125305389eec3721708fbd01288b06c0c95bdd8ccddc953e64274bc3cc98c5b2f26e3e77fc02e4f411f3957ff401
SSDEEP 12288:stNsaoJmJnw+Bt6PpMfyggc55J9jDzZHtT2V4xyLl146YogO:sEdmJ54/c5fNRdaNl1oogO
MD5 SHA1 SHA512 SSDEEP

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 caaff49b6e60830070c3abb842afcd0d0dc9c593e18363238f2444f9f1ba54c7
MD5 d5c161fab621a6c49c274fa7e65f3142
SHA1 045e2f72f7f0e0db15cfdb916f0eaa8fd0ce93d3
SHA512 b4d0b62ef11f1a32c4e258db6621cbc924bbfa13599a5949a88225243b30a96a76493e7dbefd709fed76552f1b02ab836888433aeea1852b9e1bb0356469ea8c
SSDEEP 24576:3cP4mcvIjkGOxhKP2l71SNKbrh/8KB2dmJ54/c5fNRdaNl1oogO:MP4m4IpOO67N8K00J209NRk8O
MD5 SHA1 SHA512 SSDEEP

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 3fdaf5a42d7419a1d89fe6063bb332f869a3a7fe6435558d952178b1960d4285
MD5 56066326f814e634232cde3584614211
SHA1 1cf8cecc7fb41fa836f17267abbe8e688845b4da
SHA512 da1f4f028894c8cf09586039be997a3b620b2ee8798b80c6edbc5fb99686cae1fac56c06669e5dc5c1229b3d153173c639d514382b40484997fba85270165ad2
SSDEEP 12288:cUFmDDLBNsaoJmJnw+Bt6PpMfyggc55J9jDzZHtT2V4xyLl146YogO:+YdmJ54/c5fNRdaNl1oogO
MD5 SHA1 SHA512 SSDEEP

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 c1da7f1532b5f065d7a69a578dc053559b219130955f1b8f81fb9893a625976c
MD5 5ee922aa80fdef16c924baba674f975f
SHA1 4eae14a4594e1bd12bd78a227b26ace1fa6c7f40
SHA512 c51be7edfed0355f350d8ecebfcb81824ee77fe0d05df887a7d0f6fb5f5133bd6dfee439ee027856b48c93660becda318918c9570b93e641cbe9e86be5efa4a0
SSDEEP 12288:pHNsaoJmJnw+Bt6PpMfyggc55J9jDzZHtT2V4xyLl146YogO:pOdmJ54/c5fNRdaNl1oogO
MD5 SHA1 SHA512 SSDEEP

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 70715311318d3b03624c093a1fe97fe0d7f81d0195455f5bab0319a5b3d5b274
MD5 5245ef46f4c0625019ca75960cde538d
SHA1 2245c5610d4f49f9ca61b948f11e430bae08b633
SHA512 1135e3d2cdb7c78742a4eec713b1c5c867ed3b159c550a3cd35e18409c7922f7ef7e743f6fb6b516e88dede2dd5410d3237ea83db7ff2a5331b14e2d6f30d71a
SSDEEP 49152:Ta0h2GEkuAe73q3pp46zwwQg0J209NRk8O:Ta0hNYG4Jw70809IJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 d6a7b5e12cc4ef840c670978f219aff2f0435e1ee5a824093ee8d186ec3a7078
MD5 2dae6a5c94068c139eed4f1930eba28e
SHA1 4c7950cf4291e14cc4d7cba7b3dc63cbc51aed1e
SHA512 c9d814a76a2b77af4bcb1f1f078621bdf89e3f2761763f428896fc35226f656f67bc962640591bf47a3da684783e0a97724eb3cd0b81c41e4d0b6fea204a49fc
SSDEEP 12288:/hbHjfX+NsaoJmJnw+Bt6PpMfyggc55J9jDzZHtT2V4xyLl146YogO:/hbHjPfdmJ54/c5fNRdaNl1oogO
MD5 SHA1 SHA512 SSDEEP

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 b4a179c9757d5ab3a2b1b6d93ef6b3090d037b1f24bb52e3049fcf492f870d6f
MD5 ef7610d0df35fa43f24f52b20dc070d6
SHA1 dac7270e676e625fb139f4487eb640ff143f7bd7
SHA512 a9951f52a8e6d107c02017fb820cf66970d60fea4576ac6c9e38fcb85e40d58fe5a3e8787d8f011d658b06a2f2812d14956791d001d336134fac7497e182aa99
SSDEEP 24576:03YgnJcRTk4yti+R5dpR/3dmJ54/c5fNRdaNl1oogO:0IgnaTk46ppR/30J209NRk8O
MD5 SHA1 SHA512 SSDEEP

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 41fa683fcbf630fe410d5b6e15d9932b5d16eff7dcf07743f185a35e49c4d469
MD5 28d6f28c700e7676d043525839662a38
SHA1 4df730537a214763f154494808fc7957ef39df4e
SHA512 481dcda1798aa7c036edcfa02ef3ec3cf6909ac60191e1c4a6c8320254d3fa8799735bc80d316edc005574b93801814fb4397f5dec7ac5af44dfc20f6a6c1de3
SSDEEP 12288:gLNsaoJmJnw+Bt6PpMfyggc55J9jDzZHtT2V4xyLl146YogO:gCdmJ54/c5fNRdaNl1oogO
MD5 SHA1 SHA512 SSDEEP

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.5MB
SHA256 d8d1c265d4f50e3d6a83767c7cdba7679614f1284c7d9e5272df6b37a91db825
MD5 5e70be212a1d23d2eb64492dbb9cd6b4
SHA1 0d1f589262296f8d22da9506ad9c18489f0ba961
SHA512 df7d579bc40ab008aafdf0747cf5b976974c97f6595a5b04af96222e9db385660920152d37f7ba107794a33bbb1da7dab5f14e64c0a3537af1f7a80362d8a69c
SSDEEP 12288:mObJA4LWOsvAYFTwNsaoJmJnw+Bt6PpMfyggc55J9jDzZHtT2V4xyLl146YogO:PdL3UTZdmJ54/c5fNRdaNl1oogO
MD5 SHA1 SHA512 SSDEEP

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 058b75a0875d8f2ecdcaab95fd15cd99f39f73e077cc19e3b1ebe211883cc8e2
MD5 c7e0ddfdc53f8b7ba733aa6580c007aa
SHA1 58e374421a42a62d36872bf9a97408ac3885bd68
SHA512 1250806b4dd38c4227d7d437ba9cd50dc18a403b4126a6f12a6509f12334eab40837a1ec8bd4effe03e75e13236d3e2e6fe898077e3c78ea8fd73f36a6c6ba97
SSDEEP 12288:wpFt+O0NsaoJmJnw+Bt6PpMfyggc55J9jDzZHtT2V4xyLl146YogO:JOddmJ54/c5fNRdaNl1oogO
MD5 SHA1 SHA512 SSDEEP

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 618b59758ed069bd19fb444af6e561b18e56d2c6eb4d9218ffec0d597135c30f
MD5 885627345baa25e951cbcf167054c3d3
SHA1 b6a7ea3b77c356e6a46ba20c66a692fe28e77eec
SHA512 6d83c83b7cb6985c2e21ce3f3ffaf9e1c6f4a364072f125d70ef4a07f0acccb24ef4c9784be8461fd86dd5705d8e3614d84c8b66072435351e9ae0e1eed03ec5
SSDEEP 24576:S7NM9YmZqmWMUkPjZM48Mv6bEhsedmJ54/c5fNRdaNl1oogO:S7cBWMpPjN8DbEh/0J209NRk8O
MD5 SHA1 SHA512 SSDEEP

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 3414ab74dc956b8000bed28c8f90b15541c1dccd66db21d66ae0f9c92777ef01
MD5 a03c319971a9e838852963895986708f
SHA1 d2a877dd8142d7b2961301db86660ca29ef6b029
SHA512 8bfe1468ebe29a42cf21a9a672240d7b978bf7a1f8e1f56edc950dfda02eb203feb7b0ae05a976446d36e9480a7a77ee79e6c6ea4dcd58da02572b38c9b81de4
SSDEEP 24576:WW6BApg2YuyuNDYTabvcRvNYf8km1cdmJ54/c5fNRdaNl1oogO:WF2YuHNETovcvNYf8km+0J209NRk8O
MD5 SHA1 SHA512 SSDEEP

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 4ec7726f9b0db351ba7e60a4fa42fd1b003e0d865012df7a3c690f0fe9858da0
MD5 06d0dd86e9512fa99c1e3c3847d1db37
SHA1 34fbf4fd260289feafa226c4fc4792327d3989b5
SHA512 30cfb28e622ee52ba1d6d4f45ea142e3b6da547cfb42a404275576fe00fc2278363c92181dc3f7982f641dcb353713d0992451a9f6cd2467b9fad3897a0d9d23
SSDEEP 24576:IAFs06+OmlfQNXEbToBdmJ54/c5fNRdaNl1oogO:NFs060lcXuA0J209NRk8O
MD5 SHA1 SHA512 SSDEEP

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 d1adef6f1b084821e5df95ef9c142f5d605b2d98875a0cc01bfbd1a57e72e523
MD5 819903ccbc397d74a8ecbc9edabbe883
SHA1 db451cf935ef5dafcf258a1dfd158658745c369c
SHA512 5260bbc26172b45b99e0f021dd53bccd74d972fcaad1d8347cab2bcd26daa0e25d1a0586a7d69cc9cdef771ebcb6a39a8e2139272fd6fa09032d560f7a07bd46
SSDEEP 12288:KCJnJ5D3Vkrjzx3NsaoJmJnw+Bt6PpMfyggc55J9jDzZHtT2V4xyLl146YogO:LJnJ5D3W3AdmJ54/c5fNRdaNl1oogO
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 4ac65098230d6a5f6444be0890b9569c4a953cb74c4dc784e6d3530111ed0371
MD5 1d426370523cc6d0a41f32d9baea8d30
SHA1 c1ed9dadd77b99be043628503d1ba7bf2cae7cc4
SHA512 f24e85a854f301e4a55cffa1435cd04f1e9102761450acbca8177f32b0974d2c98880d46c739f01a73e4a95d1048e3a899bf71ad641bf09ecd79dbcc39105e46
SSDEEP 24576:MEPohm6/7IIXdwcXrif7qQncjlP65i3Vu3dmJ54/c5fNRdaNl1oogO:To06DIKdwc+eQnSt65aVq0J209NRk8O
MD5 SHA1 SHA512 SSDEEP

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 c3a18f54465824a6994439e851997008acff0e29ef5f79c59adeb5df8ef232b2
MD5 0c79acf5ec4e2fcbebd534eb21f2ee5f
SHA1 b13bd51a4c694a095de9a179614269fb7478e2cb
SHA512 999e7db40d1bec971079debfe4d592671be649eb8f4f6b1dc6537541e099d2157dec1b1fba925c803c1a40a1ec7c27e5628da99c1dd341b52d22863b9a25f6ff
SSDEEP 12288:eEP3RFNNsaoJmJnw+Bt6PpMfyggc55J9jDzZHtT2V4xyLl146YogO:9FkdmJ54/c5fNRdaNl1oogO
MD5 SHA1 SHA512 SSDEEP

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.3MB
SHA256 8564d1cd0f7d7b979e0d95afa18990eebd6b05e12d24f44310b79abe7502cd9e
MD5 6a04b859ba5a76d73777d9256b18f3ba
SHA1 a5247d735a4fe5c0e8b508226a1a56c1cd235a8e
SHA512 b89301958e6ff2cdc6488656c17714e23ddb549bda88e49dcb1b5a8e48df37bbb9f3c219a465523ad1578fe06ef996caef5e1d1bb08b46774add3ada3d85e3fc
SSDEEP 12288:OjkyuNsaoJmJnw+Bt6PpMfyggc55J9jDzZHtT2V4xyLl146YogO:OIyPdmJ54/c5fNRdaNl1oogO
MD5 SHA1 SHA512 SSDEEP

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 714a2cf8239a8df23aafb0d02b48d2d7fadfdf29318f6565035823c986df29aa
MD5 fac7f6af68f40958b3af337082c47e1a
SHA1 505ce07331a953da04972bded34ddbabaa388ead
SHA512 29ebc89e93f1169be26bbb18253d1279006f41163d05c95aa76721858e8ddb1532a16a9047c5559093e5e3ad796174f89d14ad6f65899a488240b80c699cc70d
SSDEEP 12288:UnkNsaoJmJnw+Bt6PpMfyggc55J9jDzZHtT2V4xyLl146YogO:4NdmJ54/c5fNRdaNl1oogO
MD5 SHA1 SHA512 SSDEEP

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 fc53f955ad7f434e92026b8ad4f7c30ede8f690cb7fc523340100080a77c7e97
MD5 5bdd0379a296d723c25f31e8ea8c489f
SHA1 877ca11cf45cfbd681a2a248bbda39182a96ecd2
SHA512 f27a35ecfc00a49c7c7423daf5396148cc4bceb89bce4d2905d8f06567ff72902a847813133f1eca1f9caaee1f85f72ed39e527d6fa88d49dbf4db5c5ff3a407
SSDEEP 24576:4Q9MxZKdcz97w3GdmJ54/c5fNRdaNl1oogO:4VKXG0J209NRk8O
MD5 SHA1 SHA512 SSDEEP

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 fa43242fdfc81dafdd0e913990d136a502746944b7d13c81bf9c915f42726f35
MD5 47043e00730022e4c21c80be8859deae
SHA1 0e409f3931f39ae5cc43f2eaac841edef01d8fd2
SHA512 b70146508588fad99b3aef3412e9e156e886616521112797f65adda3b893f5c4b010c1136902bd9c4672766329db40545d298a92b682a70043378215be264966
SSDEEP 12288:jyoKo2dRple9pyNsaoJmJnw+Bt6PpMfyggc55J9jDzZHtT2V4xyLl146YogO:jyoc/ApjdmJ54/c5fNRdaNl1oogO
MD5 SHA1 SHA512 SSDEEP

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 b50298648b3cbb0ea433c29b87933194c86d0e80804e48d12cf8984543a26fa4
MD5 e445cc8e1b48d232ac2423846c214a59
SHA1 d29058bf5769d478dc3e59a45f19c10bb6d3a0d4
SHA512 5420b3d9984e2bb631c87122c475ad49acd07b08bc463203448b3fa74a5390d789135882f7481695dad3182650172031398b13d3029c98f482e587a3e6ee03c5
SSDEEP 49152:CWcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIKj0J209NRk8O:00zuNIn0809IJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 3a9e7842c8a661df5837012c1bed9f75b96db945c1369a00c2ee5c8cfa0d7bf0
MD5 b63ee2ba957a7a1c0a34f31604641640
SHA1 5117f8d9c9e196ed8b957c55cd08c30b1f19573a
SHA512 28f911f7164e7724a31e67494e1d47816ca720c094f73842432bc0795a7794458d3828665aedfc0375a7e9c28f7acb387e57ca8c8b83447fafdef5d4fbf98472
SSDEEP 24576:j1QT7EcpfxR+N5AWAz3ooiYsjMqbkdmJ54/c5fNRdaNl1oogO:+TDxR+N5YzTujM90J209NRk8O
MD5 SHA1 SHA512 SSDEEP

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.5MB
SHA256 458ac7daf883c3b2d282bda2c6ff7b41da95073b8b901294941f66d5dd65f951
MD5 56cfe0991737b50517d495a1cc1d6cbd
SHA1 f2ccae2b93241325e3ffce982f72df8d70cd1444
SHA512 d2e50169de854f03b959b66e9c33e50721f72eead27ce98196733853338347a652f95c08fb6dcb8badca2cabe4d3593fbcd73aa12fbe4fd77f3a5fdf8042746c
SSDEEP 24576:NTMdOz0FFS+zmSLIdmJ54/c5fNRdaNl1oogO:30K+zmSLI0J209NRk8O
MD5 SHA1 SHA512 SSDEEP

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.2MB
SHA256 45523eb9d34d86ad811f2866aa22577f747430b54be63b99ead37e0dbe1a97e8
MD5 31b284097e4b8b4cf902242dd688c1ff
SHA1 d6c73109ceb38c0db68cef1a44a4eea993ea8462
SHA512 090a19d5090cc834283b89db1af08e04714c09a416517b5007ffcc914cd80fe8673b2a0019f2d67b972c1d93594735fe35e8e3d6419060faf428c1c7c0e3957e
SSDEEP 12288:A4dwNsaoJmJnw+Bt6PpMfyggc55J9jDzZHtT2V4xyLl146YogO:JZdmJ54/c5fNRdaNl1oogO
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/820-646-0x0000000140000000-0x00000001401A2000-memory.dmp

Download

memory/820-261-0x0000000140000000-0x00000001401A2000-memory.dmp

Download

memory/864-115-0x0000000000540000-0x00000000005A0000-memory.dmp

Download

memory/864-116-0x0000000000540000-0x00000000005A0000-memory.dmp

Download

memory/864-118-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/864-106-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/864-107-0x0000000000540000-0x00000000005A0000-memory.dmp

Download

memory/1212-252-0x0000000140000000-0x000000014024B000-memory.dmp

Download

memory/1212-127-0x0000000000540000-0x00000000005A0000-memory.dmp

Download

memory/1212-129-0x0000000140000000-0x000000014024B000-memory.dmp

Download

memory/1368-766-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/1368-347-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/1476-12-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/1476-20-0x0000000140000000-0x000000014014A000-memory.dmp

Download

memory/1476-212-0x0000000140000000-0x000000014014A000-memory.dmp

Download

memory/1476-21-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/1544-199-0x0000000140000000-0x000000014014B000-memory.dmp

Download

memory/2128-273-0x0000000140000000-0x000000014016F000-memory.dmp

Download

memory/2128-149-0x00000000015E0000-0x0000000001640000-memory.dmp

Download

memory/2128-143-0x00000000015E0000-0x0000000001640000-memory.dmp

Download

memory/2128-154-0x00000000015E0000-0x0000000001640000-memory.dmp

Download

memory/2128-153-0x0000000140000000-0x000000014016F000-memory.dmp

Download

memory/2776-430-0x0000000000400000-0x00000000005D4000-memory.dmp

Download

memory/2776-1-0x0000000000760000-0x00000000007C7000-memory.dmp

Download

memory/2776-8-0x0000000000760000-0x00000000007C7000-memory.dmp

Download

memory/2776-0-0x0000000000400000-0x00000000005D4000-memory.dmp

Download

memory/2776-178-0x0000000000400000-0x00000000005D4000-memory.dmp

Download

memory/2928-713-0x0000000140000000-0x0000000140182000-memory.dmp

Download

memory/2928-275-0x0000000140000000-0x0000000140182000-memory.dmp

Download

memory/3488-325-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/3488-214-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/3616-322-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/3616-764-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/3668-277-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/3668-290-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/3724-200-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/3868-240-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/3868-629-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/3900-179-0x0000000140000000-0x0000000140170000-memory.dmp

Download

memory/3900-308-0x0000000140000000-0x0000000140170000-memory.dmp

Download

memory/4120-763-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/4120-309-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/4404-628-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4404-346-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4404-225-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4416-235-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/4416-613-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/4736-765-0x0000000140000000-0x0000000140166000-memory.dmp

Download

memory/4736-326-0x0000000140000000-0x0000000140166000-memory.dmp

Download

memory/4748-157-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/4748-166-0x0000000140000000-0x0000000140159000-memory.dmp

Download

memory/4864-272-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/4864-132-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/4864-139-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/4864-140-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/5048-102-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/5048-104-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/5048-94-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/5064-299-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/5064-760-0x0000000140000000-0x0000000140147000-memory.dmp

Download