17c9a7888303daf87f5cd119dbb5cd2d3511169658941e65b8b3a298d7d147cb

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
08/06/2024, 19:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
17c9a7888303daf87f5cd119dbb5cd2d3511169658941e65b8b3a298d7d147cb.exe
Size 2.8MB
Sample240608-x82thsfb71
SHA256 17c9a7888303daf87f5cd119dbb5cd2d3511169658941e65b8b3a298d7d147cb
MD5 9646d7904a123f27f834d0fbaf8bce01
SHA1 851dc03cccf41b5ccf6a2dce26e4c6134b88766d
SHA512 13d345d9536c9925f78f702a952225a7c62b74cf1b7a01b410d3fa05b93f874b9616070bbd9b9ac538e6549d24f60c7d466fcb922e783aa504c3500012fa46ae
SSDEEP 49152:4YN2skpzPXDFBjWRJTCAIHuDeeaJ98mjRC9YC2Ns+/X0h54GEewKFblI7a8K2mFp:4i2bz/5YvpI2eey98CRC4L0ZRbplI7KX
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 23 IoCs

pid	Process
412	alg.exe
224	DiagnosticsHub.StandardCollector.Service.exe
1276	fxssvc.exe
4088	install.exe
4908	elevation_service.exe
3544	elevation_service.exe
744	maintenanceservice.exe
548	msdtc.exe
1512	OSE.EXE
4648	PerceptionSimulationService.exe
2420	perfhost.exe
1656	locator.exe
3408	SensorDataService.exe
2996	snmptrap.exe
736	spectrum.exe
4588	ssh-agent.exe
1508	TieringEngineService.exe
3204	AgentService.exe
2976	vds.exe
2968	vssvc.exe
2052	wbengine.exe
624	WmiApSrv.exe
2156	SearchIndexer.exe

Loads dropped DLL 1 IoCs

pid	Process
4088	install.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in System32 directory 31 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\fxssvc.exe	alg.exe
File opened for modification	C:\Windows\system32\AgentService.exe	alg.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	17c9a7888303daf87f5cd119dbb5cd2d3511169658941e65b8b3a298d7d147cb.exe
File opened for modification	C:\Windows\System32\msdtc.exe	17c9a7888303daf87f5cd119dbb5cd2d3511169658941e65b8b3a298d7d147cb.exe
File opened for modification	C:\Windows\system32\msiexec.exe	17c9a7888303daf87f5cd119dbb5cd2d3511169658941e65b8b3a298d7d147cb.exe
File opened for modification	C:\Windows\system32\locator.exe	17c9a7888303daf87f5cd119dbb5cd2d3511169658941e65b8b3a298d7d147cb.exe
File opened for modification	C:\Windows\system32\spectrum.exe	17c9a7888303daf87f5cd119dbb5cd2d3511169658941e65b8b3a298d7d147cb.exe
File opened for modification	C:\Windows\system32\vssvc.exe	17c9a7888303daf87f5cd119dbb5cd2d3511169658941e65b8b3a298d7d147cb.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	17c9a7888303daf87f5cd119dbb5cd2d3511169658941e65b8b3a298d7d147cb.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\d02161eec8648821.bin	alg.exe
File opened for modification	C:\Windows\system32\wbengine.exe	17c9a7888303daf87f5cd119dbb5cd2d3511169658941e65b8b3a298d7d147cb.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	17c9a7888303daf87f5cd119dbb5cd2d3511169658941e65b8b3a298d7d147cb.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	17c9a7888303daf87f5cd119dbb5cd2d3511169658941e65b8b3a298d7d147cb.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	17c9a7888303daf87f5cd119dbb5cd2d3511169658941e65b8b3a298d7d147cb.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\dllhost.exe	17c9a7888303daf87f5cd119dbb5cd2d3511169658941e65b8b3a298d7d147cb.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	17c9a7888303daf87f5cd119dbb5cd2d3511169658941e65b8b3a298d7d147cb.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	17c9a7888303daf87f5cd119dbb5cd2d3511169658941e65b8b3a298d7d147cb.exe
File opened for modification	C:\Windows\System32\vds.exe	17c9a7888303daf87f5cd119dbb5cd2d3511169658941e65b8b3a298d7d147cb.exe
File opened for modification	C:\Windows\system32\dllhost.exe	alg.exe
File opened for modification	C:\Windows\System32\alg.exe	17c9a7888303daf87f5cd119dbb5cd2d3511169658941e65b8b3a298d7d147cb.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	17c9a7888303daf87f5cd119dbb5cd2d3511169658941e65b8b3a298d7d147cb.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	17c9a7888303daf87f5cd119dbb5cd2d3511169658941e65b8b3a298d7d147cb.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	17c9a7888303daf87f5cd119dbb5cd2d3511169658941e65b8b3a298d7d147cb.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	17c9a7888303daf87f5cd119dbb5cd2d3511169658941e65b8b3a298d7d147cb.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	17c9a7888303daf87f5cd119dbb5cd2d3511169658941e65b8b3a298d7d147cb.exe
File opened for modification	C:\Windows\system32\AgentService.exe	17c9a7888303daf87f5cd119dbb5cd2d3511169658941e65b8b3a298d7d147cb.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	alg.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	17c9a7888303daf87f5cd119dbb5cd2d3511169658941e65b8b3a298d7d147cb.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	17c9a7888303daf87f5cd119dbb5cd2d3511169658941e65b8b3a298d7d147cb.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe	17c9a7888303daf87f5cd119dbb5cd2d3511169658941e65b8b3a298d7d147cb.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	17c9a7888303daf87f5cd119dbb5cd2d3511169658941e65b8b3a298d7d147cb.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	17c9a7888303daf87f5cd119dbb5cd2d3511169658941e65b8b3a298d7d147cb.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	17c9a7888303daf87f5cd119dbb5cd2d3511169658941e65b8b3a298d7d147cb.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	17c9a7888303daf87f5cd119dbb5cd2d3511169658941e65b8b3a298d7d147cb.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe	17c9a7888303daf87f5cd119dbb5cd2d3511169658941e65b8b3a298d7d147cb.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	17c9a7888303daf87f5cd119dbb5cd2d3511169658941e65b8b3a298d7d147cb.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	17c9a7888303daf87f5cd119dbb5cd2d3511169658941e65b8b3a298d7d147cb.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	17c9a7888303daf87f5cd119dbb5cd2d3511169658941e65b8b3a298d7d147cb.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Install\{14DF0EF0-439C-4CF1-9E8A-D1E954BF645B}\chrome_installer.exe	17c9a7888303daf87f5cd119dbb5cd2d3511169658941e65b8b3a298d7d147cb.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	17c9a7888303daf87f5cd119dbb5cd2d3511169658941e65b8b3a298d7d147cb.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	17c9a7888303daf87f5cd119dbb5cd2d3511169658941e65b8b3a298d7d147cb.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	17c9a7888303daf87f5cd119dbb5cd2d3511169658941e65b8b3a298d7d147cb.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	17c9a7888303daf87f5cd119dbb5cd2d3511169658941e65b8b3a298d7d147cb.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	17c9a7888303daf87f5cd119dbb5cd2d3511169658941e65b8b3a298d7d147cb.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe	17c9a7888303daf87f5cd119dbb5cd2d3511169658941e65b8b3a298d7d147cb.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	17c9a7888303daf87f5cd119dbb5cd2d3511169658941e65b8b3a298d7d147cb.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	17c9a7888303daf87f5cd119dbb5cd2d3511169658941e65b8b3a298d7d147cb.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	17c9a7888303daf87f5cd119dbb5cd2d3511169658941e65b8b3a298d7d147cb.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	17c9a7888303daf87f5cd119dbb5cd2d3511169658941e65b8b3a298d7d147cb.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	17c9a7888303daf87f5cd119dbb5cd2d3511169658941e65b8b3a298d7d147cb.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	17c9a7888303daf87f5cd119dbb5cd2d3511169658941e65b8b3a298d7d147cb.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	17c9a7888303daf87f5cd119dbb5cd2d3511169658941e65b8b3a298d7d147cb.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Install\{14DF0EF0-439C-4CF1-9E8A-D1E954BF645B}\chrome_installer.exe	alg.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	17c9a7888303daf87f5cd119dbb5cd2d3511169658941e65b8b3a298d7d147cb.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c433de9cdab9da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002cf3129adab9da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9926 = "M3U file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007abde79cdab9da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003b6d719bdab9da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d77b1c9adab9da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9933 = "MPEG-4 Audio"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000095a6e599dab9da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009e2f3b9ddab9da01	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
4420	17c9a7888303daf87f5cd119dbb5cd2d3511169658941e65b8b3a298d7d147cb.exe
4420	17c9a7888303daf87f5cd119dbb5cd2d3511169658941e65b8b3a298d7d147cb.exe
4420	17c9a7888303daf87f5cd119dbb5cd2d3511169658941e65b8b3a298d7d147cb.exe
4420	17c9a7888303daf87f5cd119dbb5cd2d3511169658941e65b8b3a298d7d147cb.exe
4420	17c9a7888303daf87f5cd119dbb5cd2d3511169658941e65b8b3a298d7d147cb.exe
4420	17c9a7888303daf87f5cd119dbb5cd2d3511169658941e65b8b3a298d7d147cb.exe
4420	17c9a7888303daf87f5cd119dbb5cd2d3511169658941e65b8b3a298d7d147cb.exe
4420	17c9a7888303daf87f5cd119dbb5cd2d3511169658941e65b8b3a298d7d147cb.exe
4420	17c9a7888303daf87f5cd119dbb5cd2d3511169658941e65b8b3a298d7d147cb.exe
4420	17c9a7888303daf87f5cd119dbb5cd2d3511169658941e65b8b3a298d7d147cb.exe
4420	17c9a7888303daf87f5cd119dbb5cd2d3511169658941e65b8b3a298d7d147cb.exe
4420	17c9a7888303daf87f5cd119dbb5cd2d3511169658941e65b8b3a298d7d147cb.exe
4420	17c9a7888303daf87f5cd119dbb5cd2d3511169658941e65b8b3a298d7d147cb.exe
4420	17c9a7888303daf87f5cd119dbb5cd2d3511169658941e65b8b3a298d7d147cb.exe
4420	17c9a7888303daf87f5cd119dbb5cd2d3511169658941e65b8b3a298d7d147cb.exe
4420	17c9a7888303daf87f5cd119dbb5cd2d3511169658941e65b8b3a298d7d147cb.exe
4420	17c9a7888303daf87f5cd119dbb5cd2d3511169658941e65b8b3a298d7d147cb.exe
4420	17c9a7888303daf87f5cd119dbb5cd2d3511169658941e65b8b3a298d7d147cb.exe
4420	17c9a7888303daf87f5cd119dbb5cd2d3511169658941e65b8b3a298d7d147cb.exe
4420	17c9a7888303daf87f5cd119dbb5cd2d3511169658941e65b8b3a298d7d147cb.exe
4420	17c9a7888303daf87f5cd119dbb5cd2d3511169658941e65b8b3a298d7d147cb.exe
4420	17c9a7888303daf87f5cd119dbb5cd2d3511169658941e65b8b3a298d7d147cb.exe
4420	17c9a7888303daf87f5cd119dbb5cd2d3511169658941e65b8b3a298d7d147cb.exe
4420	17c9a7888303daf87f5cd119dbb5cd2d3511169658941e65b8b3a298d7d147cb.exe
4420	17c9a7888303daf87f5cd119dbb5cd2d3511169658941e65b8b3a298d7d147cb.exe
4420	17c9a7888303daf87f5cd119dbb5cd2d3511169658941e65b8b3a298d7d147cb.exe
4420	17c9a7888303daf87f5cd119dbb5cd2d3511169658941e65b8b3a298d7d147cb.exe
4420	17c9a7888303daf87f5cd119dbb5cd2d3511169658941e65b8b3a298d7d147cb.exe
4420	17c9a7888303daf87f5cd119dbb5cd2d3511169658941e65b8b3a298d7d147cb.exe
4420	17c9a7888303daf87f5cd119dbb5cd2d3511169658941e65b8b3a298d7d147cb.exe
4420	17c9a7888303daf87f5cd119dbb5cd2d3511169658941e65b8b3a298d7d147cb.exe
4420	17c9a7888303daf87f5cd119dbb5cd2d3511169658941e65b8b3a298d7d147cb.exe
4420	17c9a7888303daf87f5cd119dbb5cd2d3511169658941e65b8b3a298d7d147cb.exe
4420	17c9a7888303daf87f5cd119dbb5cd2d3511169658941e65b8b3a298d7d147cb.exe
4420	17c9a7888303daf87f5cd119dbb5cd2d3511169658941e65b8b3a298d7d147cb.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
660	Process not Found
660	Process not Found

Suspicious use of AdjustPrivilegeToken 45 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4420	17c9a7888303daf87f5cd119dbb5cd2d3511169658941e65b8b3a298d7d147cb.exe
Token: SeAuditPrivilege	1276	fxssvc.exe
Token: SeRestorePrivilege	1508	TieringEngineService.exe
Token: SeManageVolumePrivilege	1508	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	3204	AgentService.exe
Token: SeBackupPrivilege	2968	vssvc.exe
Token: SeRestorePrivilege	2968	vssvc.exe
Token: SeAuditPrivilege	2968	vssvc.exe
Token: SeBackupPrivilege	2052	wbengine.exe
Token: SeRestorePrivilege	2052	wbengine.exe
Token: SeSecurityPrivilege	2052	wbengine.exe
Token: 33	2156	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2156	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2156	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2156	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2156	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2156	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2156	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2156	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2156	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2156	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2156	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2156	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2156	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2156	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2156	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2156	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2156	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2156	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2156	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2156	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2156	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2156	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2156	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2156	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2156	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2156	SearchIndexer.exe
Token: SeDebugPrivilege	4420	17c9a7888303daf87f5cd119dbb5cd2d3511169658941e65b8b3a298d7d147cb.exe
Token: SeDebugPrivilege	4420	17c9a7888303daf87f5cd119dbb5cd2d3511169658941e65b8b3a298d7d147cb.exe
Token: SeDebugPrivilege	4420	17c9a7888303daf87f5cd119dbb5cd2d3511169658941e65b8b3a298d7d147cb.exe
Token: SeDebugPrivilege	4420	17c9a7888303daf87f5cd119dbb5cd2d3511169658941e65b8b3a298d7d147cb.exe
Token: SeDebugPrivilege	4420	17c9a7888303daf87f5cd119dbb5cd2d3511169658941e65b8b3a298d7d147cb.exe
Token: SeDebugPrivilege	412	alg.exe
Token: SeDebugPrivilege	412	alg.exe
Token: SeDebugPrivilege	412	alg.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4420 wrote to memory of 4088	4420	17c9a7888303daf87f5cd119dbb5cd2d3511169658941e65b8b3a298d7d147cb.exe	84
PID 4420 wrote to memory of 4088	4420	17c9a7888303daf87f5cd119dbb5cd2d3511169658941e65b8b3a298d7d147cb.exe	84
PID 2156 wrote to memory of 4248	2156	SearchIndexer.exe	108
PID 2156 wrote to memory of 4248	2156	SearchIndexer.exe	108
PID 2156 wrote to memory of 4988	2156	SearchIndexer.exe	109
PID 2156 wrote to memory of 4988	2156	SearchIndexer.exe	109

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\17c9a7888303daf87f5cd119dbb5cd2d3511169658941e65b8b3a298d7d147cb.exe
"C:\Users\Admin\AppData\Local\Temp\17c9a7888303daf87f5cd119dbb5cd2d3511169658941e65b8b3a298d7d147cb.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4420
- \??\c:\72ce44393b5f0acf76fdc1\install.exe
  c:\72ce44393b5f0acf76fdc1\.\install.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4088

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:412

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:224

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:4704

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1276

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4908

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3544

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:744

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:548

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1512

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4648

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:2420

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:1656

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3408

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:2996

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:736

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4588

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:3264

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1508

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3204

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:2976

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2968

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2052

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:624

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2156
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4248
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
  2⤵
  - Modifies data under HKEY_USERS
  PID:4988

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

eula.1031.txt

Path C:\72ce44393b5f0acf76fdc1\eula.1031.txt
Size 17KB
SHA256 a75019ac38e0d3570633fa282f3d95d20763657f4a2fe851fae52a3185d1eded
MD5 9147a93f43d8e58218ebcb15fda888c9
SHA1 8277c722ba478be8606d8429de3772b5de4e5f09
SHA512 cc9176027621a590a1d4f6e17942012023e3fabc3316bc62c4b17cd61ce76bf5cf270bd32da95dba7ddf3163e84114be1103a6f810ca1a05d914712895f09705
SSDEEP 384:Ce91JzQa6Kc6ZyaMeqFjLD+f2bTdmKMvO:Ce94aUaijLD+fiTdmKMvO
MD5 SHA1 SHA512 SSDEEP

Submit Download

install.res.1033.dll

Path C:\72ce44393b5f0acf76fdc1\install.res.1033.dll
Size 88KB
SHA256 4107f4813bc41ed6a6586d1ba01a5c3703ed60c2df060cba6791f449f3689de7
MD5 43fb29e3a676d26fcbf0352207991523
SHA1 c485159b01baa676167c414fd15f1026e3ae7c14
SHA512 ad748c63d912e194bb5be42f6db192b22f59f760e0536118dfa963fe29001e7fe635d035f31d86aa5e77a1d4f7ceabf27b03645d0037f147293af1e32eab57a4
SSDEEP 1536:s6eovWV5eiuOaMhqFgrBiAJO/CajU8HafdUafd41:s6eovWVsi1qFgrJJO/CajU8HafOafa1
MD5 SHA1 SHA512 SSDEEP

Submit Download

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
Size 2.1MB
SHA256 9badf10eae33c5c465e45ffe73358c8e76ebf43d338f4634c4f4ae2185794889
MD5 efe6d0111e4614de954f04cc2a1e7c90
SHA1 29fa8a4c88eaf13bba8b9cd17b72983e73803827
SHA512 7a96592a6a76c7d8fb6a572d7c8a15d9174990e1ea287915edc29fa25f3bacaa60b9c90abe25fbd50e0ca717ffca2751e101cff25cadf325f0fbb620394660e2
SSDEEP 49152:vuYk3H5koUXfTqkkYLO/W2buywzMbOX+T7z5IblI7a8K2mFhbrr:vPfTqi90bYlI7K2mF9
MD5 SHA1 SHA512 SSDEEP

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 636772739f95eb59f1988c8a01217a3e33be670ff9e81a5c968bfa8839274250
MD5 76b43fddb185862ac30ac7e4647e7139
SHA1 001421a929e4e67298e325dbc8bfcee620cea67c
SHA512 7d5f48d70f42abf7002bcd9b1e604b6f31266fa43ebf91136b0b215e96af67df77d2454ddc0e743481e51c0a60d1b42d5cda749accda8641ce0dfe811b1a0655
SSDEEP 24576:zidnBsuEiMbl0fitGbna8FLk2m1X2D4brr:uSuSblI7a8K2mFhbrr
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 51ba8a0aca2a5221de738fe6afbde68131c6ef639c58fe7f2f2307d5a5cb74b7
MD5 0af1329e999635f753e3bf36e45f759c
SHA1 20d4367c3c273a26afd8347a1bd99b272c2f2346
SHA512 bc0d6b2f17d76cfdab362dc458269fd25327dc6107e7f9e3b616ce450e1829ca3a023bbd67366e26f6285408e2c0ec628f84b7236bec4910c9340c1e0374f6a7
SSDEEP 24576:c+gkEVfh4CoOMbl0fitGbna8FLk2m1X2D4brr:ZgkExSPblI7a8K2mFhbrr
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 291b4782fc0d9b6fb1f85eca72ef75f0b6b4fe4acb5f3c10c7428d0528b63491
MD5 3b70fea736becd40b0b97062c9f52584
SHA1 454823096b20f3f3ca2f7ba37f73c6df03a9412a
SHA512 17a08f1f04512308448e6fde0bbacf935a5468a25b3a6338188473a83c3ca2ad1d886c041f4ee1401d66d36a1223a2eb155068bf38fc038d80e9299c04424630
SSDEEP 24576:1BpDRmi78gkPXlyo0Gxjr3Mbl0fitGbna8FLk2m1X2D4brr:/NRmi78gkPX4o0GxjoblI7a8K2mFhbrr
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 58770f785dc7088fe0b2061f9da90749801c05ed8debfa91eca10f898611daf4
MD5 734325c2a51b6ad4d444cfc56cee4526
SHA1 61eff327d05177a924f3d0a6d9e2f903f9a6cc18
SHA512 e69c54dcf23352f43ad72ba375ad37e9c3c803591abb90edbd24080d106179a1781709bd17c0b9d29b3b074169ac3f5d164a95606834d7e5acc7057eddb5c9cd
SSDEEP 24576:0LOS2oyPIXVOMbl0fitGbna8FLk2m1X2D4brr:M/yAblI7a8K2mFhbrr
MD5 SHA1 SHA512 SSDEEP

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 117e25d79c91f7e023bef4e3f2053f3be9f9d182b4b56af69d5853970f2af641
MD5 2f7d7e7ed1df345296c7faac42ece5dc
SHA1 ee737500d0f4a47f0c881ab74c6be03a42467ba7
SHA512 1d59461fe0bb8be1114a185d7fca3be52bcc24052328b1dedae12db96d89c35897705aae7ae42184dd359737f75207885afe78239e6c7badd9c30f37dc0a2f86
SSDEEP 12288:AfARSbwoqg0fitGbna8dQcLk/+cb1q86pJDlAF44bE2cSX:AfAMbl0fitGbna8FLk2m1X2D4brr
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 703632ea045ebea375a7b0cce709f93e346cb638f55a1e161cf3362e09d32e6a
MD5 ebe27e3b650ead788ad31b1700a22aa6
SHA1 76f7e993532f83eac6084f8152fad8a5648d195a
SHA512 209cceea56777a0024c21d935181a80f99a1e3d697e877d57eb7ec1933b42c2ae215695dd4b1a15151107292bef5e81eb4ea9f0fb5e7eec4f391ce5260d01aa1
SSDEEP 12288:6eBNUbTVO86UJRSbwoqg0fitGbna8dQcLk/+cb1q86pJDlAF44bE2cSX:6JIUJMbl0fitGbna8FLk2m1X2D4brr
MD5 SHA1 SHA512 SSDEEP

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 7227aadf349ba0370161f8bf1042ae289eb17df75a363f11f6acd65c599d75e7
MD5 63abf914f7aae5b5a76c275fe4291913
SHA1 4501d6ccbda14b06d3806ad4114282729e5e4201
SHA512 541bb594153b7f5f31aeeb3d37e7d68d91541cf80d2a9d8cc4431e3488b1ee7c3f8e885a010e864c5b40aa230a8767960c004b9c907f01011ab77cd0ecc61f7e
SSDEEP 49152:0QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THG:0QvGAdlCEL8c/yRNw5C9lI7K2mF9
MD5 SHA1 SHA512 SSDEEP

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 45a1a37cdc818297bf9fc4f021b7764bef387948e8030009ff441de6bb4ed96e
MD5 71bd3430e95b1079d792182bbe63ec05
SHA1 2b2f99dface97966cebae7d0d926b3b1dc178415
SHA512 491e690c351265ba662aba722267969f8d5560224b6bbb3890da3bac43ab6c8d05782bbd1be4b6ce7b1f3061aa996d481331f40af536f1bfb1a380ac2a700982
SSDEEP 24576:bdewsAjPMbl0fitGbna8FLk2m1X2D4brr:Jlj0blI7a8K2mFhbrr
MD5 SHA1 SHA512 SSDEEP

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 04ca172df8f4ef6622a34704d50153d974900cf3fada3d34fd6c94220d46342f
MD5 f6800e4865df38c7de5e8141ff0570b0
SHA1 d8d1d9697c238a4ebd480012e173b3048e7e5e7f
SHA512 179b0139103d2ffbb4cf674934b79aa9fc93e93bf77f15e733905b77ffa134ed233265d762cf8ccd12ecef9dc256d822bdc60dd014e77d827e20c1ebc031d5e0
SSDEEP 196608:UUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHQlqmX:UUEtQevvqc2W1cpV2EI32QI
MD5 SHA1 SHA512 SSDEEP

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 be1215af08014eb253f9a0b002648cefa1b3523926e89407ec7e308f5baffdb7
MD5 69be90e144589f788034ab4f32ed9090
SHA1 f0c0e29970f67e9a2019ffa5f86c42aa95c63db2
SHA512 607eabdce4e0428de45ac716e818717ca7a3d2b2e4f51b4c09db736a9b111f594717c282eb603ac25fbad33b915532135cfddcf338599da79fa7110513aa4e53
SSDEEP 49152:BCbRquA/m2yL5zTfFiV+XenmE3/zUblI7a8K2mFhbrr:uoquVjnmplI7K2mF9
MD5 SHA1 SHA512 SSDEEP

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 9d8bbd79b66fc668d868f0c1678ad7288e5a3455b33fb3fc58807134139c4e35
MD5 d987f591e7c204f9127491ca58a7d9c1
SHA1 4fd35ffb44a349f4ee0ec606c54b38e9e9f45475
SHA512 2aec855a10f19d9ca0b0037a2d0c003cebdc0599dfa55526632627388a336a5d71e5bee21a0fd0b4febb709da555a46740e1c74371380fa86a5d3006c7619d22
SSDEEP 24576:RAhGLJIFoiwtA5l7S53+Mbl0fitGbna8FLk2m1X2D4brr:RAMyFoiq5VblI7a8K2mFhbrr
MD5 SHA1 SHA512 SSDEEP

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 ed2271eb8c080cfd4cf77151a81530546cfb7af9899aa73040030f47dfc790f0
MD5 c2a2c45200deac7058b164fdec0b6189
SHA1 e434a0b03ec9eb1ef2b78fc23623f79f365ce64f
SHA512 b180ae63999675696391914099a4e5ab75ea398333a7c6b584600d7f90211f5a7fd6c36b0df56e94c44231e4ff8f6f698a839bc4aa5f2df01555918e514ee45d
SSDEEP 24576:TwuoOWTMbl0fitGbna8FLk2m1X2D4brr:TwDOhblI7a8K2mFhbrr
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 d4187304244830899212870addeaaee8d010bca8e687e2188ec215c7de566fa8
MD5 487c0f7136620fdbd014a23bd6d456ac
SHA1 6af996918b4563ac5f8f1799fa5740a5ae5cf2ea
SHA512 122b05c835dae5a5f6c8087ed810c5a1cb1fe11940eacab1e916a60f3b96d16f355d9ac96d178bf40cd9bdbfd7a47b29eb52dd66d0f4d679950bd9e3952f31cb
SSDEEP 12288:+BZ1IyfRSbwoqg0fitGbna8dQcLk/+cb1q86pJDlAF44bE2cSX:4ZusMbl0fitGbna8FLk2m1X2D4brr
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
Size 5.4MB
SHA256 6142c723f72725f7bc4593167112c0dbd674be24ba924e41ba07116bb4719385
MD5 1fe2c7b85e6808980ebeba709bd57ea4
SHA1 dbaeffa88bafedc1c947592bb078bad93f6e68db
SHA512 6fb0e49b4f1e877e4e33e471183bfa8643053faa8bcd92921f6cff6d3aeda240c4775fd25ab681197bf70a3988acaeb5f29c6aa70b3e8e0935d1cd2f15c15d3e
SSDEEP 98304:mwfhY7g/rLd7yYA3awr341gRlI7K2mF9:W78yhRlqmX
MD5 SHA1 SHA512 SSDEEP

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe
Size 5.4MB
SHA256 27d0fbbaaa2fe6a05a7794c032ece12a9a2537afbabb27cf87a0f44d9f5cdad6
MD5 1d9b16ea5e71d3d87a4b47b3af6e9c79
SHA1 7db6baa1fdaff3c268c65800bb809b253dc0369a
SHA512 dcda51f7c60276f29707c561f64f8679a513fe38fb30dc6befe04191483b51eabcc2014f885a6397850bc2204bf7f9a247c27012d8b162c92a295af7db809066
SSDEEP 98304:kwfhY7g/rLd7yYA3awr341gRlI7K2mF9:Q78yhRlqmX
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe
Size 2.0MB
SHA256 adcb7245fb69594c39aa553be5c092f6055799d5ed140a38a5dd41f4ef3e40a8
MD5 ec7c58bcb950604326be7c4b878e9716
SHA1 85a623f2db6b6d130f559a7fa22cd0a57b02e786
SHA512 79ff8580fcc27687ac8037a8286f65e50d67fb5f717e6660a960769062eb87778e9e9098422ffe2b7f137f1820f64ae5590bf661e3adffdce78e3d0eb6d83c58
SSDEEP 24576:ScTyYv0FteQU+5I2kjgD6iQacATMbl0fitGbna8FLk2m1X2D4brr:SuXv0Ftpn5606zOAblI7a8K2mFhbrr
MD5 SHA1 SHA512 SSDEEP

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
Size 2.2MB
SHA256 4fe5d39b65edde25d73eb2d9a4835e737b165f90db49573313de56e037a5f563
MD5 a6a16eb2472652b833e785699fb23f26
SHA1 fd8de6094f9454e667b907efb70fd25f0fe0cdcc
SHA512 ad53d6ad2f3c912ca1c4652e70d09b630fde964eec00412afd7ecb143b0aabdf7d867cf5ae4d255f86e666bc4a11218b79917cd7ef1e1b1de319f3b5d311668b
SSDEEP 49152:Ey7mTd0GxN8jyynxHjXKUyn4GVcbDSKrNTx0blI7a8K2mFhbrr:TmYeyxHjWjMTYlI7K2mF9
MD5 SHA1 SHA512 SSDEEP

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe
Size 1.8MB
SHA256 4db9f0528e5cf43cc7290a803753d9e419d9609aad56b49c36ed13710b93d805
MD5 af5e22ae3dfcb4090dc6aab864cdafc0
SHA1 f22058d215fa2f7d5ddb748f34b8089d1856c2a2
SHA512 bb8d49994f10134859e84f7d61b2aedde20ed504adf265fcc7400d81d424cd6fb75e99ee8531306eed4ad02aa044c754bf3493d416b269131d41d220c2bb28c8
SSDEEP 24576:A6drZn1WEci182IEUeNbJeRgUebgW816EMbl0fitGbna8FLk2m1X2D4brr:AWnDci18yNNUgbYIblI7a8K2mFhbrr
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 1.7MB
SHA256 fbb446a90b3692addc8b4bb419aef41102909283f5e2dd52797c8ad3585fa20b
MD5 e140155d78eb58a33803d262b763e1d2
SHA1 d454719bc3ffa6e6006e58c14b9c115d142d897b
SHA512 80b22d45582e28fd41ea2ed5940e9ec0cb9ff1e5ebd275df30483df8d0382ef082f40ac15b63e7b18609b6ed2546e1374f8eb1df1250ba6dc7a2c51165d588bc
SSDEEP 24576:5k5lHW5EzMZupO80G2reD+melRgTTv/1nylMbl0fitGbna8FLk2m1X2D4brr:VizMZm0GhamSozblI7a8K2mFhbrr
MD5 SHA1 SHA512 SSDEEP

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 c6f735769a321246f55b28aaaba4836bfac755a4ad1fe7a321c2690fa47eb5f3
MD5 3c254818e76da93060f973bad2eb5eb6
SHA1 299571d9950a0432cae15fd9b54a48d4dda0ff8c
SHA512 130989600cb5d3d0e90b7336d8b89c7267b6c17fd5a277b347cccb0bc05d5208db6367dd077731bf11d67b644f8e2b063a291254e3f55c4da4dc41b27f93a663
SSDEEP 12288:EIRSbwoqg0fitGbna8dQcLk/+cb1q86pJDlAF44bE2cSX:EIMbl0fitGbna8FLk2m1X2D4brr
MD5 SHA1 SHA512 SSDEEP

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 a489d5402d2d714c7b1bdd2a4b2cff84523ec870cdb4eb2f2ad2ce18764414f6
MD5 a507f02513aea3fea47c71babad694d1
SHA1 5332547fed7ecb633fb4f37b31b546c0b195d6be
SHA512 74c15c9a3917e9362a7195bf71fd8bc9d5a885dfa27b48bf6c855631f20d6e5c0b0df9718056c517e47fa7e5c46f8472a8728a2e8e7d0904b0ccbb8ee831d0d2
SSDEEP 12288:SrRSbwoqg0fitGbna8dQcLk/+cb1q86pJDlAF44bE2cSX:SrMbl0fitGbna8FLk2m1X2D4brr
MD5 SHA1 SHA512 SSDEEP

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 8756b13f6358246428ede6216e3997ea189c4e7c295f6277d0e6317acc3920d5
MD5 85345ed8a59f18a39edb8b8d322dcb7a
SHA1 ca5c33787d017f0cf2f20e118f092dad1e7a65b2
SHA512 808236c3350904696b208e9a95c1f6b361cda9b765f87dcccc6dd721a04e645d6e8379fdae7b9131238e0c32ee201d574f97a7c89df52238b19b238951fad0bd
SSDEEP 12288:ERRSbwoqg0fitGbna8dQcLk/+cb1q86pJDlAF44bE2cSX:ERMbl0fitGbna8FLk2m1X2D4brr
MD5 SHA1 SHA512 SSDEEP

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 fc107eee02de2a793fce54c626e3ad86b7df42a2d95946567c3196c7ba0a1c35
MD5 c5a04a59a51bb728b99e8862824bc2be
SHA1 c87783855dd691ddefd1283fdf8f04c7c708337e
SHA512 b9c9b7ab772419fb441821c69681d4d4ee82693646b4a408627e21bc3966bbf520e50a2e20c499183101923fb17d8da0352a4dc94aa469c7ba0c1bd289c0ddc2
SSDEEP 12288:cVeRSbwoqg0fitGbna8dQcLk/+cb1q86pJDlAF44bE2cSX:VMbl0fitGbna8FLk2m1X2D4brr
MD5 SHA1 SHA512 SSDEEP

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 9a33ca0bebea52598200f02b9a5cdb0fe37a7e1366e0c6c531fc41afadb4965b
MD5 8e087734818d8e18deb1ca8b62ff78fa
SHA1 0246fc255a0a8209c9e6f4bef517905347687ecc
SHA512 25808993afbdec89c39f4755a34f6e34cfaa5126bfd85b6a4b2af4b50e829eb0e5bb9eb3b3158405574fb5f9bbb342679ad784aa7a32e083fd9c57fa8fe0f16c
SSDEEP 12288:yWRSbwoqg0fitGbna8dQcLk/+cb1q86pJDlAF44bE2cSX:yWMbl0fitGbna8FLk2m1X2D4brr
MD5 SHA1 SHA512 SSDEEP

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 75117d4834f224817af51859fb9534b3e749fe84ba854b689de35d60b90de8ec
MD5 ed79cfd019c8943363956ead49b2c49a
SHA1 73a9db9f793a9922e755369c0b0aad053a909a40
SHA512 47a8c01216d0840f461bcc705d922aa573f9045c10cb15305bddf0d3e1b7a0c27d387f9a960e7230dd57d03974efc037195e7c9a217b5c1691a328250c8383f1
SSDEEP 12288:h3RSbwoqg0fitGbna8dQcLk/+cb1q86pJDlAF44bE2cSX:h3Mbl0fitGbna8FLk2m1X2D4brr
MD5 SHA1 SHA512 SSDEEP

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 7f1c53a45ce67fdc03dc25dfd2e2f447a2c26b6f02360827d9c5b3aef7b33f40
MD5 7c2c30ab80bd685bba7a6b699d6e46c2
SHA1 8b8174ea4fc106c185db84bb6c5e80a78c9801eb
SHA512 ddd6a1d3241bc8e411cb71f9c2166abc8e05d5a156eca355aa45ad3193beb5cd445d2c3cde7ea6d5e2166827ba3307077eb6608af91b3afccb151cdfb8733139
SSDEEP 12288:4DRSbwoqg0fitGbna8dQcLk/+cb1q86pJDlAF44bE2cSX:4DMbl0fitGbna8FLk2m1X2D4brr
MD5 SHA1 SHA512 SSDEEP

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 9022cf1d7e801012001a70b8065c95b8ad83a20e7b1fecb3da7d7c1a0af5b38f
MD5 de5c9a850e404e21d66899526784ffe6
SHA1 dab33c16c04e98118e34d6255791ccbf27cdcefb
SHA512 082a7f30ca4059a837c5689144cf88e23c991f67ca768fb3975c366e32435a10c27fad0ec5baa97a66572a4149f755333eb875fe1482a1c074510c79c7076b2b
SSDEEP 24576:EcP4mcvIjkGOxhKP2l71SNKbrh/8KB0Mbl0fitGbna8FLk2m1X2D4brr:/P4m4IpOO67N8KJblI7a8K2mFhbrr
MD5 SHA1 SHA512 SSDEEP

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 24393b59b3c87e0cf02b7fec96727916d6b61e5e4e1dafb2afeb8e1e5b05e4ca
MD5 c59cb0c867f79ff3ddb1c2455863b7ea
SHA1 3d7b62554b227b92a26279f7bdb9d520163524e1
SHA512 e00fce82b77fa1ba28fe8ea45971c58421a650eeaa241aef7c9f298aaf0171be510d3223a469b21fcbabcc8555ff1b89080731111bf07064ef3d7e5a8c8932e6
SSDEEP 12288:ZUFmDDLtRSbwoqg0fitGbna8dQcLk/+cb1q86pJDlAF44bE2cSX:ttMbl0fitGbna8FLk2m1X2D4brr
MD5 SHA1 SHA512 SSDEEP

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 2febb5c9e1995026565f11b09315aa5449cb106df5d079d64614da509b2e6969
MD5 b39f06cd9ec92ebd072d8c8ac6c6a8dd
SHA1 2f94a2946ddadd7ac153c1a0b13a202b1efdf362
SHA512 8847948709b45c9474682c54ba2f75d68502f4334c3524fbc9c78d2bb9b7aa9d782051841b671376d44a8ab2b3bf7f0a231565745f97dea095fa03fe7f4d6bdd
SSDEEP 12288:gMRSbwoqg0fitGbna8dQcLk/+cb1q86pJDlAF44bE2cSX:gMMbl0fitGbna8FLk2m1X2D4brr
MD5 SHA1 SHA512 SSDEEP

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 7c0ab6dbbbf2dec2a4a17f0d298bb1133767c1b43e791db9c757c76860699df4
MD5 6425c1760a62e428f7d0c84c4c4e3e3b
SHA1 c6976bcb1457a6f4b065a41fc1efb3d04ba18ece
SHA512 6170959a20086b34acba960e4d74c6e683f01483e420db63cbaf77838551bb471ac1e243606a1d40a0da73b70b34e21276dd6d3573e9e5410e23bbf18ed026f9
SSDEEP 49152:da0h2GEkuAe73q3pp46zwwQdblI7a8K2mFhbrr:da0hNYG4JwQlI7K2mF9
MD5 SHA1 SHA512 SSDEEP

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 323a0c6bacb7ae27017c588bebeb1b885550a5636a367e70ac2af574a567d733
MD5 b8a20a6a0f89e766472c49a339913624
SHA1 fe63778e217771c74330eeb674bd954c12cd2062
SHA512 b8e27e3a7b3069d7ff04dd08faa9c2f7b30faf2b945698a61e3975cfb601de6f0c16d2fe848aeac652f5747286cb1ef734cd224c260ba4e52d9fe647747eb8d4
SSDEEP 24576:shbHjPbMbl0fitGbna8FLk2m1X2D4brr:shbHjwblI7a8K2mFhbrr
MD5 SHA1 SHA512 SSDEEP

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 10467be5ef62ca24bebc780d3d1585413ff81cbf1f94cb509dfd034ac0b60553
MD5 58d80e74247b53be4185de781ffe58d6
SHA1 48da732151c6bbf91a7fdef0e6dd77473cf6a3d2
SHA512 d4a6028e8d3baded78dc07336c37b25cbfbe86da12c637c2c5c4187e3534a2bc365e1c8ceb4a43305d2c81a8a5a1f671c5315963aa7e8efaf248309b7492b695
SSDEEP 24576:S3YgnJcRTk4yti+R5dpR/TMbl0fitGbna8FLk2m1X2D4brr:SIgnaTk46ppR/AblI7a8K2mFhbrr
MD5 SHA1 SHA512 SSDEEP

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 d71946c936d161e2bc60d0f936cd3ed0cf40ca7d06a4bc661a23871070c0288f
MD5 e97ef5ab3cd5fc04bf405131c39120ed
SHA1 dd58f1f22c7cfb578e6f80d708d5d19ad1e04b67
SHA512 153d18066120ce24e198540303710a5ccc916b4044d368492affa0ff5a6fa2b1004b7ad6dc709557eb9f1bce6b8236722fe3546c322d6948a4ccaed27c726a3b
SSDEEP 12288:ogRSbwoqg0fitGbna8dQcLk/+cb1q86pJDlAF44bE2cSX:ogMbl0fitGbna8FLk2m1X2D4brr
MD5 SHA1 SHA512 SSDEEP

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.6MB
SHA256 0591d16cfcba3659307ff4f906e4e236b04f38089a2a784a85d9a67a7f9fe0af
MD5 534a284531db4ed3f8c6a016d5b0b080
SHA1 0ffac16054f3ca357d5c5ebc3c1aa32978c406ca
SHA512 15f1e05025b6a16931b94135f912d3d6b9c9cd7a5ed40679656f62cf884a7a126e2bb2dc9f2de638d41a8c29b6609d7e4a70f8f1d40be416beac3f7f54f9aa1c
SSDEEP 24576:UpL3UT1Mbl0fitGbna8FLk2m1X2D4brr:UpL3U+blI7a8K2mFhbrr
MD5 SHA1 SHA512 SSDEEP

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 49052838def255ba28b13cf8037f6768b91b87ba8aed7829af152d77095311b8
MD5 235d4c81cda94a0547f0ce352f413d65
SHA1 31dd9333639a3022ad14028db78151c6d043df75
SHA512 f8daf58e3198bb10c8ca551665037f1564d40c4e45c28fc6dcae35446a0f8942e4ce98897507843fa93a0268d74423d14c81416e7d30d7341135d9251926e028
SSDEEP 12288:IpFtpOpRSbwoqg0fitGbna8dQcLk/+cb1q86pJDlAF44bE2cSX:aOpMbl0fitGbna8FLk2m1X2D4brr
MD5 SHA1 SHA512 SSDEEP

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 c735c4abf819a840d44817eff06d0097c133a6448a53fa6880dd6646f7aaf57c
MD5 e5b6d095ecf7b82014ae268b722af220
SHA1 48cc16d5bd8cad2ddf1bff2462ca49f8ba6d3b67
SHA512 644e572e5dcfad94712c941f053a7efae2f988ae474c26fbb3e3c0b8ffb357a7e6240cf3850ec851db9b6bf6ced40232442a841395ffbfcf27c2e3659228d84b
SSDEEP 24576:a7NM9YmZqmWMUkPjZM48Mv6bEhs8Mbl0fitGbna8FLk2m1X2D4brr:a7cBWMpPjN8DbEhoblI7a8K2mFhbrr
MD5 SHA1 SHA512 SSDEEP

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 bff9abd7347e57532438d176d4428d6a3511d490b2b02dd8fb5bb85e909dc250
MD5 710c980b652c9cca74c5571c6ce7ab32
SHA1 2156525003231712b9119b382f5e1fbc11f37833
SHA512 c66f7d2f8d6052ad17b26ad4cc07a7e4f48326adb08893a11cd76e91374b23e18d702c3c3de7fb7fee12e326b825593f084f5f8fcd10d0f6da2b47e2d264b237
SSDEEP 49152:NF2YuHNETovcvNYf8kmjblI7a8K2mFhbrr:Y6tCf8kSlI7K2mF9
MD5 SHA1 SHA512 SSDEEP

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 a4755108749ec946ec97017d28a1f6ddb7ecb0f16967c59c800c0b347b141e91
MD5 f18af4566afe39e831a3d73ff5df785b
SHA1 f3851f8004fc26f731625c335243574932b6bdda
SHA512 6dbf730328979d6c3f6e7580873d5331ceb9659dbe8c3e06a635a6d57479214a5cc82c26d13d64257990306cde439da34884ac3b6c2cbf48a8b18d8ca26081f5
SSDEEP 24576:kAFs06+Omlf3NXEbTo9Mbl0fitGbna8FLk2m1X2D4brr:pFs060lVXu9blI7a8K2mFhbrr
MD5 SHA1 SHA512 SSDEEP

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 f66ee80ef25e76559f3d1c4377b1b85d284038eafdd88a67b3e8c445731e28cb
MD5 79a3be04aa38c9ba451c740600058a71
SHA1 7188695c08bcc397598588880f40c53071bac2d6
SHA512 182665600ad61f23d653802758844ba590d813cac625ac09450be997483e7cdf5efffbbcb05e92df67ee8bddd21cb1397ab1a53378d04cb62aae81af937c846a
SSDEEP 24576:GJnJ5D3Wt2Mbl0fitGbna8FLk2m1X2D4brr:GJnJ5DGt9blI7a8K2mFhbrr
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 b65104266a0e326a1f22948ed6b0d2be3b4608da33c93f1b0bdcf55537c5a1e2
MD5 cf2e3768675f1f8b67efa56c3c7959ac
SHA1 347ac1941cbcd878a550efde80892e711622c8b6
SHA512 faf821084b6c2a3f02fa75e8bb9f0524424343d36d847de8ea105009976bfdf40f04ae6d225a5c0acbb500afbd08482fbe87582dca525cf9c6a9d9cba4107939
SSDEEP 49152:6o06DIKdwc+eQnSt65aVXblI7a8K2mFhbrr:7llI7K2mF9
MD5 SHA1 SHA512 SSDEEP

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 34478775678980ccfbd0c008d6a88514a610e06a18df81ba798ffcd6ced9be9b
MD5 18b502b3ac150ff63593a5407c6a52e7
SHA1 7e448db092d8f676dc95cfb6d8556b68163d85dd
SHA512 5bffa287636c9e35e880734fb985c20cc44e3e809a94842a5db2cd963d0b2326ee76e026201db2c928de441efb02bd4106a7af55965461b1889f5786c99cd0ed
SSDEEP 12288:GEP3RrqRSbwoqg0fitGbna8dQcLk/+cb1q86pJDlAF44bE2cSX:FrqMbl0fitGbna8FLk2m1X2D4brr
MD5 SHA1 SHA512 SSDEEP

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.3MB
SHA256 60093846708d80560dfba2ede1cf234c535894172faf4da6c740df1b19c00d09
MD5 039c0775b40affd08ec9aa22e3c4ac68
SHA1 64ac8ef49e3134d0d1adb7c3376ea3e7182522ca
SHA512 ff608c681daa9ec5a60892450cd6b4738cff8ba958f066caeb5442a69d97a2df3c2b0ec0dc184250b53fcd8f8765527ed56d43fc1376c1c2b1fff0897b455c93
SSDEEP 12288:8jkyrRSbwoqg0fitGbna8dQcLk/+cb1q86pJDlAF44bE2cSX:8IyrMbl0fitGbna8FLk2m1X2D4brr
MD5 SHA1 SHA512 SSDEEP

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 d84cfcad77bcee8e2c8d181c5d4c3353eda27923a85ea4f1f48c95b945ca66f3
MD5 39b05d76b999912236886b8db079dde1
SHA1 d6ffc109d1fbdcfc81d2e12c1891f0d9bfd1f110
SHA512 271b9b709de042663990a22742dacabb5818127ce2fb7d82105c76f7ca2fd49e155d1a3ad1694c2a5da595479df76283eae786b6f092e199e24f2ae15104d1fc
SSDEEP 12288:wF5RSbwoqg0fitGbna8dQcLk/+cb1q86pJDlAF44bE2cSX:e5Mbl0fitGbna8FLk2m1X2D4brr
MD5 SHA1 SHA512 SSDEEP

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 e635854788c326ae946b97f8ebe34c0b1cc8fbd794d83d2dfd2f24140ce0a9bb
MD5 240693d9e615d0f8a2de4ab75eb3dc46
SHA1 bd1d6551fb5f3017c154559fbf73f1a1270ae2c1
SHA512 6d6e2899bc05d86f4abae27bdd4fe051f15e7e6d83a3dcc0b584e21c5312fda8139fb3981e48df876743475f8e027414404e27b5c8bded046da5969c04b93326
SSDEEP 24576:/Q9MxZKdcz97w3kMbl0fitGbna8FLk2m1X2D4brr:/VKXLblI7a8K2mFhbrr
MD5 SHA1 SHA512 SSDEEP

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 c430fba6beb048364c7624209132422688a250a26bd03b644d1380637a51d213
MD5 71f8ceae4d98fceec78f38a944acdeab
SHA1 bf070043059a2d358b685a02f5ea7ea04a387906
SHA512 65fac9fd35e584c9ed977e9ae7b7aebe5d5d01cbae1e5de0b19a7d7206082965df068fa4199e8beb37417be42463ee558053998a12cb6047ccf38761947921b9
SSDEEP 24576:4yocxApPMbl0fitGbna8FLk2m1X2D4brr:VocxAp0blI7a8K2mFhbrr
MD5 SHA1 SHA512 SSDEEP

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 abbfdc4e5a37d908e139bba8d10dc5a1b6b305d6196b7f3417b5bc029b31cd4f
MD5 b7ff380e66f21cef99161e2ed37d4e8b
SHA1 4791f3160f3a490ea5f7541da80068fdfc4ed10c
SHA512 75d927a8ff244476f57ec890dfdcdddb0b6bdce994c43022aa2e32c4cf03c57357575d4e5c0f44fd01ff4385bb9e24b6cf8798049b8b954814a9e0f4d9d8f1ed
SSDEEP 49152:LWcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIK0blI7a8K2mFhbrr:70zuNIElI7K2mF9
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 8b43924f3ce759e8fd479ac37e4890e97b43afeadd815db19665d2cd06d8660e
MD5 d9f759050f377428793499e96bd38893
SHA1 03ab3ad7834bce242dc5b6c9c8f5a86266348b65
SHA512 17461ad1ff6072c63ab118047de6e24a12aa1107c1af8d2d18479d06a3ba19d205f2c88170556328734e1d087432caacf6b2ef115ab4ce2ae4eabf0e7dcdf9ee
SSDEEP 24576:F1QT7EcpfxR+N5AWAz3ooiYtjMqbqMbl0fitGbna8FLk2m1X2D4brr:gTDxR+N5YzTfjM+blI7a8K2mFhbrr
MD5 SHA1 SHA512 SSDEEP

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.5MB
SHA256 1a7ea477cbefa965ecfcffe7bcdf62d689e9f4ec626acf91577c18485ffee73a
MD5 f875c897fb6c6e764a290a976d317cd5
SHA1 81892cfbbfe0bff5b1c66cd61f7ed5471b7aeffb
SHA512 969e72ebc1fe963d183b822a3473e9e5e3a240843bc2b5d62ff6b50981a4ce11030b24951f8bf87d24ea0c0c7f3ba39bd87030c6941da5c8e7710ac0d8d261ea
SSDEEP 24576:vTMdOz0FFS+imSLeMbl0fitGbna8FLk2m1X2D4brr:t0K+imSLFblI7a8K2mFhbrr
MD5 SHA1 SHA512 SSDEEP

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.3MB
SHA256 44db27c3e02030e495fa111d0afd32a54a6e4b3daf5ec22345caefdbf04ca7b1
MD5 af2e7ba8e5623732a275c84f9b8fec44
SHA1 d583433fbdc8794ccc352f262796a7040389f93a
SHA512 ca29a1b37b8421d1cfe533a9bb7e7860cbec931f167e5ec4c563992387466b87ec60049fd23d35bec8730358e0cc625aed18f9ee53138436878c67eeba5773f4
SSDEEP 12288:g471RSbwoqg0fitGbna8dQcLk/+cb1q86pJDlAF44bE2cSX:n1Mbl0fitGbna8FLk2m1X2D4brr
MD5 SHA1 SHA512 SSDEEP

Submit Download

eula.1033.txt

Path \??\c:\72ce44393b5f0acf76fdc1\eula.1033.txt
Size 9KB
SHA256 93a3c629fecfd10c1cf614714efd69b10e89cfcaf94c2609d688b27754e4ab41
MD5 99c22d4a31f4ead4351b71d6f4e5f6a1
SHA1 73207ebe59f6e1073c0d76c8835a312c367b6104
SHA512 47b7ec5fed06d6c789935e9e95ea245c7c498b859e2c0165a437a7bf0006e447c4df4beeb97484c56446f1dae547a01387bea4e884970380f37432825eb16e94
SSDEEP 192:uJXbvpB7sTAiLftIotTl7msk4apSftn7ib/:uJrYTAwKotTYszasfsb/
MD5 SHA1 SHA512 SSDEEP

Submit Download

globdata.ini

Path \??\c:\72ce44393b5f0acf76fdc1\globdata.ini
Size 1KB
SHA256 7912e3fcf2698cf4f8625e563cd8215c6668739cae18bd6f27af2d25bec5c951
MD5 0a6b586fabd072bd7382b5e24194eac7
SHA1 60e3c7215c1a40fbfb3016d52c2de44592f8ca95
SHA512 b96b0448e9f0e94a7867b6bb103979e9ef2c0e074bcb85988d450d63de6edcf21dc83bb154aafb7de524af3c3734f0bb1ba649db0408612479322e1aa85be9f4
MD5 SHA1 SHA512

Submit Download

install.exe

Path \??\c:\72ce44393b5f0acf76fdc1\install.exe
Size 835KB
SHA256 dc1ba9cb15d0808dc2d80ce13acfa0b07acdfcfe2cdf94da47e0e570e7345f6d
MD5 e015a2d8890e2a96a93ca818f834c45b
SHA1 30bda2b4464b1c41210cba367e444aed56502360
SHA512 20a80b50486e938b92f3aef85e59307f644b69dc5d1edee38038182b57caf636f5f1909959f6fafcfc2e915010d2b3d230cba8300fbc0f63ee2ee3ad8ad64123
SSDEEP 12288:dwrnIfqrQVGcRu612QHBrjjkUX1+VbFlzrSACGOi68dG9TWRzS:dwMfqQzQq2oBrjjkOMrhrEGOivI
MD5 SHA1 SHA512 SSDEEP

Submit Download

install.ini

Path \??\c:\72ce44393b5f0acf76fdc1\install.ini
Size 843B
SHA256 672621b056188f8d3fa5ab8cd3df4f95530c962af9bb11cf7c9bd1127b3c3605
MD5 0da9ab4977f3e7ba8c65734df42fdab6
SHA1 b4ed6eea276f1a7988112f3bde0bd89906237c3f
SHA512 1ef58271cdedbdc53615631cc823483f874c89c2d62e0678de9d469a82bd676eb8abd34656caa5128b7edb0eb24dbf0992e5e571a97f7782c933b2be88af3144
MD5 SHA1 SHA512

Submit Download

vc_red.msi

Path \??\c:\72ce44393b5f0acf76fdc1\vc_red.msi
Size 236KB
SHA256 be6288737ea9691f29a17202eccbc0a2e3e1b1b4bacc090ceee2436970aec240
MD5 d53737cea320b066c099894ed1780705
SHA1 d8dc8c2c761933502307a331660bd3fb7bd2c078
SHA512 0af685e4ffb9f7f2e5b28982b9cf3da4ee00e26bd05e830d5316bce277dc91dfee3fe557719ab3406ad866d1ce72644e7a5400dcd561b93d367e12eb96078ffe
SSDEEP 3072:ZZhJpq8Cy/MgpwEUxTgLTURb7qg+yCRr8x85lv2N8Cy/Eb8lXtmHWVcelSxbci8R:UgMCAkL03qg+Xr+UYgo0NiHg
MD5 SHA1 SHA512 SSDEEP

Submit Download

vcredist.bmp

Path \??\c:\72ce44393b5f0acf76fdc1\vcredist.bmp
Size 5KB
SHA256 594884a8006e24ad5b1578cd7c75aca21171bb079ebdc4f6518905bcf2237ba1
MD5 06fba95313f26e300917c6cea4480890
SHA1 31beee44776f114078fc403e405eaa5936c4bc3b
SHA512 7dca0f1ab5d3fd1ac8755142a7ca4d085bb0c2f12a7272e56159dadfa22da79ec8261815be71b9f5e7c32f6e8121ecb2443060f7db76feaf01eb193200e67dfd
SSDEEP 24:pS75l775l7aqV7j7Q55okTg2vrlgprDDcaWJQvS2PRSmob6SHSl4CiZ:pKV7j7AXgbjlLI
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/224-26-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/224-37-0x0000000140000000-0x00000001401EC000-memory.dmp

Download

memory/224-41-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/412-11-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/412-21-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/412-20-0x0000000140000000-0x00000001401ED000-memory.dmp

Download

memory/412-644-0x0000000140000000-0x00000001401ED000-memory.dmp

Download

memory/548-138-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/548-301-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/624-651-0x0000000140000000-0x0000000140209000-memory.dmp

Download

memory/624-315-0x0000000140000000-0x0000000140209000-memory.dmp

Download

memory/736-309-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/744-130-0x0000000001A60000-0x0000000001AC0000-memory.dmp

Download

memory/744-124-0x0000000001A60000-0x0000000001AC0000-memory.dmp

Download

memory/744-134-0x0000000001A60000-0x0000000001AC0000-memory.dmp

Download

memory/744-136-0x0000000140000000-0x0000000140212000-memory.dmp

Download

memory/1276-77-0x0000000000E70000-0x0000000000ED0000-memory.dmp

Download

memory/1276-87-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/1276-97-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/1276-98-0x0000000000E70000-0x0000000000ED0000-memory.dmp

Download

memory/1276-83-0x0000000000E70000-0x0000000000ED0000-memory.dmp

Download

memory/1508-311-0x0000000140000000-0x0000000140225000-memory.dmp

Download

memory/1512-302-0x0000000140000000-0x0000000140212000-memory.dmp

Download

memory/1656-305-0x0000000140000000-0x00000001401D8000-memory.dmp

Download

memory/2052-314-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/2156-316-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/2156-652-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/2420-304-0x0000000000400000-0x00000000005DA000-memory.dmp

Download

memory/2968-313-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/2976-312-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/2996-307-0x0000000140000000-0x00000001401D9000-memory.dmp

Download

memory/3204-247-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/3408-528-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3408-306-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3544-119-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/3544-650-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/3544-122-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/3544-113-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/4420-0-0x0000000001000000-0x00000000012E6000-memory.dmp

Download

memory/4420-431-0x0000000001000000-0x00000000012E6000-memory.dmp

Download

memory/4420-6-0x0000000000AB0000-0x0000000000B17000-memory.dmp

Download

memory/4420-1-0x0000000000AB0000-0x0000000000B17000-memory.dmp

Download

memory/4588-310-0x0000000140000000-0x0000000140245000-memory.dmp

Download

memory/4648-303-0x0000000140000000-0x00000001401EE000-memory.dmp

Download

memory/4908-100-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/4908-646-0x0000000140000000-0x000000014024B000-memory.dmp

Download

memory/4908-106-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/4908-111-0x0000000140000000-0x000000014024B000-memory.dmp

Download