18c415b6d347c5ff74458f3aea911fde9e1798b6819c01e38126fc19e5a81268

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
08/06/2024, 19:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
18c415b6d347c5ff74458f3aea911fde9e1798b6819c01e38126fc19e5a81268.exe
Size 771KB
Sample240608-ya7sjsfh95
SHA256 18c415b6d347c5ff74458f3aea911fde9e1798b6819c01e38126fc19e5a81268
MD5 fad41d3e530332a5ff56037221aa1fdd
SHA1 53cd4ac27a374a266b8ebbf91762581714761d0b
SHA512 8191f24264e9ea506015d0cafe63caab531023291599b73fab6c61e57d8f633df3bac97e8fd76fe75ba1a5b5fea0847a3e2c996e7a63becf13a0236421b5c92c
SSDEEP 12288:62Y+FUBbDFaBfvfoPDct6SlxlwkJJrqQoUhTFfPLgpRtHmr/UNvp8hMoZUDNh:6n+qBlayDcMkqQpRQmr/UN4MbN
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
4504	alg.exe
3596	DiagnosticsHub.StandardCollector.Service.exe
2984	elevation_service.exe
3540	elevation_service.exe
3828	maintenanceservice.exe
2120	OSE.EXE
4956	fxssvc.exe
4848	msdtc.exe
4080	PerceptionSimulationService.exe
2768	perfhost.exe
1904	locator.exe
1816	SensorDataService.exe
1496	snmptrap.exe
948	spectrum.exe
3148	ssh-agent.exe
2604	TieringEngineService.exe
4852	AgentService.exe
4356	vds.exe
1424	vssvc.exe
4308	wbengine.exe
4164	WmiApSrv.exe
3048	SearchIndexer.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in System32 directory 28 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	18c415b6d347c5ff74458f3aea911fde9e1798b6819c01e38126fc19e5a81268.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\85b1a430c8648821.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	18c415b6d347c5ff74458f3aea911fde9e1798b6819c01e38126fc19e5a81268.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	18c415b6d347c5ff74458f3aea911fde9e1798b6819c01e38126fc19e5a81268.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\dllhost.exe	18c415b6d347c5ff74458f3aea911fde9e1798b6819c01e38126fc19e5a81268.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\minidump-analyzer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	DiagnosticsHub.StandardCollector.Service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_96109\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d86d5552dbb9da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000092832a52dbb9da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009c456d52dbb9da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000012099152dbb9da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d86d5552dbb9da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003dab3152dbb9da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000033a3eb52dbb9da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000581d8552dbb9da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
3596	DiagnosticsHub.StandardCollector.Service.exe
3596	DiagnosticsHub.StandardCollector.Service.exe
3596	DiagnosticsHub.StandardCollector.Service.exe
3596	DiagnosticsHub.StandardCollector.Service.exe
3596	DiagnosticsHub.StandardCollector.Service.exe
3596	DiagnosticsHub.StandardCollector.Service.exe
2984	elevation_service.exe
2984	elevation_service.exe
2984	elevation_service.exe
2984	elevation_service.exe
2984	elevation_service.exe
2984	elevation_service.exe
2984	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
660	Process not Found
660	Process not Found

Suspicious use of AdjustPrivilegeToken 40 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4480	18c415b6d347c5ff74458f3aea911fde9e1798b6819c01e38126fc19e5a81268.exe
Token: SeDebugPrivilege	3596	DiagnosticsHub.StandardCollector.Service.exe
Token: SeTakeOwnershipPrivilege	2984	elevation_service.exe
Token: SeAuditPrivilege	4956	fxssvc.exe
Token: SeRestorePrivilege	2604	TieringEngineService.exe
Token: SeManageVolumePrivilege	2604	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	4852	AgentService.exe
Token: SeBackupPrivilege	1424	vssvc.exe
Token: SeRestorePrivilege	1424	vssvc.exe
Token: SeAuditPrivilege	1424	vssvc.exe
Token: SeBackupPrivilege	4308	wbengine.exe
Token: SeRestorePrivilege	4308	wbengine.exe
Token: SeSecurityPrivilege	4308	wbengine.exe
Token: 33	3048	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3048	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3048	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3048	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3048	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3048	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3048	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3048	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3048	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3048	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3048	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3048	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3048	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3048	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3048	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3048	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3048	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3048	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3048	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3048	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3048	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3048	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3048	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3048	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3048	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3048	SearchIndexer.exe
Token: SeDebugPrivilege	2984	elevation_service.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3048 wrote to memory of 1584	3048	SearchIndexer.exe	114
PID 3048 wrote to memory of 1584	3048	SearchIndexer.exe	114
PID 3048 wrote to memory of 1792	3048	SearchIndexer.exe	115
PID 3048 wrote to memory of 1792	3048	SearchIndexer.exe	115

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\18c415b6d347c5ff74458f3aea911fde9e1798b6819c01e38126fc19e5a81268.exe
"C:\Users\Admin\AppData\Local\Temp\18c415b6d347c5ff74458f3aea911fde9e1798b6819c01e38126fc19e5a81268.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:4480

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:4504

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3596

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2984

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3540

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:3828

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2120

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:2648

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4956

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4848

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4080

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:2768

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:1904

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1816

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:1496

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:948

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3148

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:2128

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2604

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4852

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:4356

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1424

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4308

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:4164

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3048
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1584
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 804 808 816 8192 812 788
  2⤵
  - Modifies data under HKEY_USERS
  PID:1792

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
Size 2.1MB
SHA256 78603e1e8f3d51cd525b5ad1e4591ccb44c4d7b38152d281f3837f526cba44d8
MD5 4c630b3333e34f5b9ea1865f0c7f54ac
SHA1 0668b41189134130f367309101bda3bc8164c4b0
SHA512 bd856cf7f58f534ebb91103a138450ce156a404b42a33e785807afd9b13f4ce6007205272f0e52ae4d4e6eeae787b6fffa099da758835fe6ecbb9f186e52e0e2
SSDEEP 49152:5uYk3H5koUXfTqkkYLO/W2buywzMbOX+T7z557DcMlQpRQQMKMZ:5PfTqi90b93zlQpRQQY
MD5 SHA1 SHA512 SSDEEP

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 797KB
SHA256 0640fd10a385499ac1515f1544f2e788e6b50af29fead48852570edb585c789c
MD5 0277aa0e6bd52eabc8fcf06c46f8d7ef
SHA1 8ecdaabce0ccc50ab2a22ee3b3f0349a7f0c5571
SHA512 c6b7b85cfdc2f9934786e4d38bffd9e70bbd00ee89a16cb39b3ce4d9815603a696a6b72fdb80843222444a147c8ee8ee18ad5a823a625d0182e1b3a139458d55
SSDEEP 12288:ecQiQmNJLBsunEQDFaBfvfoPDct6SlxlwkJJrqQoUhTFfPLgpRtHmr/UNvp8hMoK:QidnBsuE0ayDcMkqQpRQmr/UN4MbN
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 e1c3fd27f2bcdcf3ffb2787c11c86bbeacfb54b4399b0154a7317f3f09a03c5d
MD5 54e5b0bbbae46a788b2d63b50317f150
SHA1 da46c1e0f00929ede606f5f6f791fbd0427cc341
SHA512 3dbd79d0f49b76ecedaa549e1becfd2bfc37d81ef401ed226c1df7ef350194b1e367962efcc32fb5164f9f9c5d2a59abcb9d490e49c8c1e4cb97df8f2be4c726
SSDEEP 24576:q+gkEVfh4CoQayDcMkqQpRQmr/UN4MbN:PgkExS+7DcMlQpRQQMKMZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 190973bea6b61ac5314366d100adf4d52caa06e5363d2032b8a5a7591d1361b0
MD5 d001c1b3549aac897799863e0e05c278
SHA1 4aab0134fc5c57bbbb7a5b8590fc8eecb69213e6
SHA512 3d808e6f7e0cfdd25302c7c775cde3da58f84aa49877d97453b52ee8b1a96a7fe9e2bbef401415ad0b7d97a3d8f3886b050253dc7a897c82ab5263234f9a7423
SSDEEP 24576:oBpDRmi78gkPXlyo0GxjrlayDcMkqQpRQmr/UN4MbN:8NRmi78gkPX4o0GxjZ7DcMlQpRQQMKMZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 76ce8441da0d4bd1533a92ede9730e0d4db29f380fac36de3aea7735d3b26ce3
MD5 47f4f4d86841bdc75cf40820454a913d
SHA1 54a14e1fa05e10dc4ed5c04a4abe8d315a613db8
SHA512 f8db108910ccbcc0ff2c40dc59bc174cfd0d0478d08f96f3991314d33da58ab317ae6aa8ba1318e9f36138673537aa797d8dd62629951f49ab2ace38dc286079
SSDEEP 24576:XLOS2oyPIXVQayDcMkqQpRQmr/UN4MbN:B/yR7DcMlQpRQQMKMZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 503b35a701d30f087a280e961deb8d64e6b0d211a8074b50269a6a2a071224db
MD5 748e4aacb4ef03f3a4b76c9e11eb892c
SHA1 97513d19c94d7d8153df9d66a6f8797ba3e56feb
SHA512 43df3eca4fcef79545a29d087f59667da0c93fcfa8e5d655221d5add2f2aab2381c9e294d2c366374ac4370dbde874e57040a9886ac9058d2c7e0f13069c320e
SSDEEP 12288:WfiDFaBfvfoPDct6SlxlwkJJrqQoUhTFfPLgpRtHmr/UNvp8hMoZUDNh:WfeayDcMkqQpRQmr/UN4MbN
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 2189ff9c7259eb8903625be097959f7c0c23fd29b39fc533c7386c2a48ce5c26
MD5 ab764c3ed15ca24b919d257fc7849d88
SHA1 fdf3983e0d49d5b401ad328b1ae74ca571154b92
SHA512 f8cc9faab4d559aea84817e594c6dc7fd1ef6cfda566a749cd208aca3883cd72fcbaf91995231013b3c6c20ba58b73ceb3ca74a2ee24fcdbafd0961330f40f85
SSDEEP 12288:zeBNUbTVO86URDFaBfvfoPDct6SlxlwkJJrqQoUhTFfPLgpRtHmr/UNvp8hMoZUk:zJIUDayDcMkqQpRQmr/UN4MbN
MD5 SHA1 SHA512 SSDEEP

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 39ca9139f7b9e97658ef72341c151869c8792f3ec41adddc3fb5c12a1ae465cd
MD5 8060e583ddef29ca84aacef716e4a787
SHA1 6eaa0548d4df02204bda3b2d4f11eda815c87239
SHA512 0adeb91c1b2a58ea9ed7dff14a69d098329fb3dcb2efc286dade8a89fc201c40d233551b1a1f711a438d14716d81c2290f5161d6ca80e8f6f534d7925deea734
SSDEEP 49152:GQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3TH9:GQvGAdlCEL8c/yRNw5CM3zlQpRQQY
MD5 SHA1 SHA512 SSDEEP

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 325cfdfc4fa358c84b8141087f4a6ac3f3aee5447a2d088ea030ee9e57daa2f0
MD5 d99987e4103ff3cd20000defa81e06f3
SHA1 6247973129b006efd9403d080b98afe84e768ee1
SHA512 bea67c45775e87915d9f01d8b0e33d4b08247414940ba47bfe6910cc5df66e077f8ea3b431df7575e19955682ee42187ca7b3e01ce711357efe8bb7886273e65
SSDEEP 12288:UAwSfxL/2Dc34DLLmt0LDQewsAjzDFaBfvfoPDct6SlxlwkJJrqQoUhTFfPLgpRI:pdewsAj9ayDcMkqQpRQmr/UN4MbN
MD5 SHA1 SHA512 SSDEEP

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 bb3712449c2754e4372773fd4f62f8d9427a0e73809d3d9a4c4e7200c9985f0d
MD5 17a51ec99c7dbdca472c2832b4c2ccef
SHA1 849ae7dc148ae5d7e40b1738c1f153af510d089a
SHA512 dd38ad5680edb2ffe26567e4de45df16e0bcbd352d5eac7f85d5e2bb8be375a8b4950d6823a460386b72b4746cf55f293ecca5c0afc4e6bbba0a9962a855b4de
SSDEEP 196608:VUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJH13uQQ:VUEtQevvqc2W1cpV2EI3213
MD5 SHA1 SHA512 SSDEEP

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 a42455863ae32a40e751bd2c1136767d00f30a5b02db874d135ce875d3551a3e
MD5 a7ef29165dc1aeb11c339cdbc3733c65
SHA1 837afe1e9a386fbae18e0730308ce249b2099f1c
SHA512 733989bae668c5e2d950f13f0ed2a06e6dac746a4858d15ea6e4fb0ddfc70e9ff6cbb814c3ec7f81ebc11b073d6f741ae1366f12bdfb6d7f532a05d6fb03dea3
SSDEEP 49152:kCbRquA/m2yL5zLfFiV+XenmE3/zd7DcMlQpRQQMKMZ:toq2VjnmA3zlQpRQQY
MD5 SHA1 SHA512 SSDEEP

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 3fd400d86e9087232212e2fb12a9741d536fdeb5f7382b75501788c9a832bf2a
MD5 eff1e1431f976b1ac7d6d050538df9bf
SHA1 1ce6f77be1ce063a2a54cb695e7e031c5f269132
SHA512 9947e3e6cfa97ec01d2db64dd12fbae538e52a5685adbc1648de6b27cf8d93df0831f6a5c0912d1f9c425b5b4cc06a9278ea5625aa24db635de7c67871270467
SSDEEP 24576:fAhGLJIFoiwtA5l7S53gayDcMkqQpRQmr/UN4MbN:fAMyFoiq5w7DcMlQpRQQMKMZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 8509848c29c4dfa3c08e18767e00c803db392d224cbc3757bf00f1db1172fec6
MD5 8176da898c2594a248c81c425d64b1b7
SHA1 cfd10be990ecb022b99b6d9862e64db2aca891ee
SHA512 e0892b8974c4e72044976e2d859147185aa26f4129572934fbd2859f57ebfa7d5ea6a47ba34f9095044d40c8dd8174454dd83133951bbe3c253f6e5822211058
SSDEEP 12288:kmw5HEjsChNVBFgl0WDm+CYDFaBfvfoPDct6SlxlwkJJrqQoUhTFfPLgpRtHmr/g:BwuoOWRayDcMkqQpRQmr/UN4MbN
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 12d7363856ed07152e6f92f28a3466df240667bb2acdf12871a2682d47e4216b
MD5 9ec60114eda8f500462e0587ef9e7cac
SHA1 c8af5af58755b7ddf3dc635e0df9593a95739e29
SHA512 b4178330f05c1f733634c11302fb3d0e490bedcfbc9d506f92001e916972d5badee6fa7d92bf63c693119a6f5803d0810bc2da18525838b1ddc1e4e277786f09
SSDEEP 12288:dBZ1IyDDFaBfvfoPDct6SlxlwkJJrqQoUhTFfPLgpRtHmr/UNvp8hMoZUDNs:7ZuKayDcMkqQpRQmr/UN4MbN
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
Size 5.4MB
SHA256 217a325b551ca3991137917c3d35c4bf457e6b7cc106f5bfdc0c69e30e3858a6
MD5 f10ddf72b091833a61f16accd0cc2db3
SHA1 fdbc488fc060557ca7cbf776120ce4046e54cb91
SHA512 fb7b0cf1d50da0ee010dfa5cfbf4a7d30d55a33e430806c10153500e76305457b1982649f51678659f7c9b38b50195af8b9852add6e04ea7eab08eabdf14bfb2
SSDEEP 98304:gwfhY7g/rLd7yYA3awr341go3zlQpRQQY:c78yho3uQQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe
Size 5.4MB
SHA256 b08e96bde57bb85b58d29b8ac08c978900a1e1269ca7002f8ee54ca8c7956d71
MD5 c5f2e2c4f8fc79fd7aea8e37ff2e87c6
SHA1 bdb89bf64d043fd1dbdd10055b9dc28cc46e3548
SHA512 45bb4d2cb3adf7d774a988055c08224227f0ea237b22a74bc2df4c8434d91e3ff8fb3d33a190816a37770350df107c21a3331fb40043fc8ddae83e9bf3580653
SSDEEP 98304:jwfhY7g/rLd7yYA3awr341go3zlQpRQQY:578yho3uQQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe
Size 2.0MB
SHA256 82cb6fb3723ef41bf56080ad4c3abef2a4131f2d8657e08ce9e70754f69bec99
MD5 795c703fc0bf7f0b60dffb266604881c
SHA1 13033e0d7f6ac4ab20f4a4e7b30ddbda6bba929a
SHA512 525f5df3019ff994575586bc6e0a0f3a67c97f17823355de8a7c8a7eec765fe883220dd8004a25b7cc3dd9cbb132a9ab9b17b906b7a3b682ed5f8964fd566dd8
SSDEEP 24576:dcTyYv0FteQU+5I2kjgD6iQacARayDcMkqQpRQmr/UN4MbN:duXv0Ftpn5606zOR7DcMlQpRQQMKMZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
Size 2.2MB
SHA256 344171e64f6651b9caa3e71619d8d8bf3e0fa5fba9e79c72823f5e5b2d90e2a2
MD5 e26a036bb6b41e2be325f06129f55591
SHA1 f312328db53b72a8615472a7fde27d1e107f7cf6
SHA512 ea27bb52bfe11a3ed9e2e1d90b7d71d562d89a7cc14a7a8829604f623e0eef1c8b75e4b7e29d9759d2f3cf097fc0fc7c91ea202eb0b7223b8b04a1ceca89f030
SSDEEP 49152:By7mTd0GxN8jyynxHjXKUyn4GVcbDSKrNTx97DcMlQpRQQMKMZ:cmYeyxHjWjMT93zlQpRQQY
MD5 SHA1 SHA512 SSDEEP

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe
Size 1.8MB
SHA256 61e8d8d480ecd1fa9b7f560527d90a5f3a845494d3b05a8b2e67fa19f13d1b5d
MD5 47e86be77c7254eb30537a53736f83ba
SHA1 add6f3e27ffae139bc7c3849a27732fca1e65c56
SHA512 1190e43f8df5e71c21503ebec145f2a4ae8561531a9a04388faed0e6888bcde0d5c41c656e22674604d5b6d0fd489a3d8df86c24fdd8d7f0a9051d999c924419
SSDEEP 24576:K6drZn1WEci182IEUeNbJeRgUebgW816CayDcMkqQpRQmr/UN4MbN:KWnDci18yNNUgbY57DcMlQpRQQMKMZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 1.7MB
SHA256 8e9e0567a618030db54d38e574ddca863574229349b46fb6421bd261b7ffcc78
MD5 6f046b50ecaff8b41c8418953dc619f5
SHA1 0215294da4a356d590d860c43c1165280d14f100
SHA512 669ff2c33a598c11a9ffbbea93d5c411ab419caedf483b2b1ee93db17788f192555f9cc3180474036f22889fa8f2e75de63d7886b8d866ca1c21ec6867e5d935
SSDEEP 24576:3k5lHW5EzMZupO80G2reD+melRgTTv/1nyPayDcMkqQpRQmr/UN4MbN:nizMZm0GhamSoK7DcMlQpRQQMKMZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 b0a47547976162868bae7b7f9a34ef16cd52275ac0e083225558c1260731ad64
MD5 0f68471c179b9f415c7cc0e69d03bb65
SHA1 17dbec11aa7f3b4ca94b2db2797e962142b41293
SHA512 b221c820b8b85d6d1980c09c9cbc4705baa90fd3f225d3967aa687e94c51e712c327003a061671972aaad6932f5cefd4f4bb794ade0ed5e8d036095039f56ed4
SSDEEP 12288:oKDFaBfvfoPDct6SlxlwkJJrqQoUhTFfPLgpRtHmr/UNvp8hMoZUDNn:omayDcMkqQpRQmr/UN4MbN
MD5 SHA1 SHA512 SSDEEP

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 c9cc5ae7f557de245982f18cf9f2cbbd76e86ade3b6079882289b8d2c6061469
MD5 1321d7c5538f608bded837637abef9a7
SHA1 cd593f899f3b2e355361717d15b2898385896e0d
SHA512 1a3b9c631cc06da20784fd23346fde72f7c72bb05de7b9cc2b16d29830cdbfed9384c0d2efa006b9965964cd9a620d3b9a2c86e475d764698f5d0d54aeef5578
SSDEEP 12288:sfDFaBfvfoPDct6SlxlwkJJrqQoUhTFfPLgpRtHmr/UNvp8hMoZUDNn:spayDcMkqQpRQmr/UN4MbN
MD5 SHA1 SHA512 SSDEEP

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 e7e1aa0f5fb5ad54d82b9e87c3a9629fd1306ceb75461e75fc69dd9aaface00e
MD5 1092e669665ed70807bcfa939f299962
SHA1 78e1f7e4d05ba53c32d079279ef56dddf7e5726e
SHA512 bd21ca84acc00b90e2d22fea101cc8bbe5124812c3cd650ab732912ccef53a5ce6a8e9adfe7f54cd85b8c79f533744ea54ecc01155a0a5be925bf9ffebcc6f38
SSDEEP 12288:2ZDFaBfvfoPDct6SlxlwkJJrqQoUhTFfPLgpRtHmr/UNvp8hMoZUDNn:2LayDcMkqQpRQmr/UN4MbN
MD5 SHA1 SHA512 SSDEEP

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 282428419338682c3180678f9a0555206e5cea089d537962a600bb4aa4a3d260
MD5 404b463b28311f23dc89fc3e21a88b38
SHA1 26ebfcfbac8a6256fe9fecc138afe54ac4ba15ca
SHA512 9d8da022524b0866fda9b7dc172551106c53dc5c2e84fa4cf9cabf39ecdecfb12b69277774d124347d86d36376f19e958770a950df64fdf76be23425cbc6cef7
SSDEEP 12288:HV8DFaBfvfoPDct6SlxlwkJJrqQoUhTFfPLgpRtHmr/UNvp8hMoZUDN4:WayDcMkqQpRQmr/UN4MbN
MD5 SHA1 SHA512 SSDEEP

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 04c07f71c29d2998f3e31ced1e633a2ad0cbfd664c63c3e229edc766f08aa62f
MD5 3655b58a719754e1c340e87e4980f975
SHA1 0f633b09a4210e3542870e0bb400617dc7fe1f7f
SHA512 e5f85adf6381bdf37713f6ffda81a0b29deea395b6fe56a9e3644f00edafc0e79dd938ada7bd53f22313619d00211c7df29e1fa85f1c561b26213506a22abe03
SSDEEP 12288:dUDFaBfvfoPDct6SlxlwkJJrqQoUhTFfPLgpRtHmr/UNvp8hMoZUDNn:d4ayDcMkqQpRQmr/UN4MbN
MD5 SHA1 SHA512 SSDEEP

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 f27e9a90170c1eb4d51e332491c1b817e57a0e28628a36469449fcd5d6f0f916
MD5 3123b43f459379fdbcc416a12f141020
SHA1 9f30e05ac216290cdac064830c9871a66b0a692e
SHA512 7cc38a7b15e9fe750c643a46faf9c7e2a4c5525c87c3546c0bfb27f3753981e6adf6a566a81f10f186db3cd647bff172ec5dd7c9e1b7f9b50f7e38b490643192
SSDEEP 12288:2bDFaBfvfoPDct6SlxlwkJJrqQoUhTFfPLgpRtHmr/UNvp8hMoZUDNO:2layDcMkqQpRQmr/UN4MbN
MD5 SHA1 SHA512 SSDEEP

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 ea354c6cf45bc1c01efc782b1a2c08719579fcf2c09854e93d957726a191c637
MD5 c8468f69451cf35c1ad41d5eafd0f086
SHA1 e3fb2e6545091f0a8cf0b57489356853fb60ea21
SHA512 2b126d0de384e4cc82dd8811a2ed954756f2f0094576bbf4373f295ab382a9906bb303903d8c6439d46edaf1aa70d778fa5c5d9149166292c9ce7dc4c409c0d7
SSDEEP 12288:m3DFaBfvfoPDct6SlxlwkJJrqQoUhTFfPLgpRtHmr/UNvp8hMoZUDNm:mhayDcMkqQpRQmr/UN4MbN
MD5 SHA1 SHA512 SSDEEP

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 7703e061f7626979d8344e0d927eb485154642b83c2abcedcc3d9ffeea7fb65d
MD5 64ff14b714b8fae11113b22cada51b72
SHA1 eb1be2be67c7677c392abc39b48975139ad5357c
SHA512 73d79d5d47b5383c44e05b2c1387f376f1edefd114ff0e042920c3e017133d6ef5831951b303dee78eae7226aeb65539da5196384d1361d18c3fae767289910e
SSDEEP 12288:DiZwb6zzFEoS2cPvy/DFaBfvfoPDct6SlxlwkJJrqQoUhTFfPLgpRtHmr/UNvp8H:uZMSzFVSOJayDcMkqQpRQmr/UN4MbN
MD5 SHA1 SHA512 SSDEEP

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 9cf6abdeb0621086551686641d550d91894f48270e498cc9c0e99fcbb41f5524
MD5 d71848f60b608a5f9eb1e02b635959f5
SHA1 999d5dcf1eb96dab0f9607a82a18cdee7486498f
SHA512 0a8ad409306db5c92735f30ce0d289375b331a822a6345e1ae3ea550b0be15440280419e5de6c970cd7e8c611c28b6ecc0faa19fb71b61f1b8e22785209980a5
SSDEEP 12288:+eDFaBfvfoPDct6SlxlwkJJrqQoUhTFfPLgpRtHmr/UNvp8hMoZUDN6:+6ayDcMkqQpRQmr/UN4MbN
MD5 SHA1 SHA512 SSDEEP

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 2586acb94430091420734f4e087382efd46266ee50ebe1c1c53447b714296830
MD5 dbc72c6c78366370981f7794adb0ac42
SHA1 b4cc682181e1cff5710c635b9e000cc876e1ec7f
SHA512 fb44d1a8b4fa5616165df6cd49c39e4920b9c270f71986b1b22490aa2716a653d62bac5474c1b3b7207b912479a6c413363c537494ecf40bcf7f241ff356eb0e
SSDEEP 12288:MyDFaBfvfoPDct6SlxlwkJJrqQoUhTFfPLgpRtHmr/UNvp8hMoZUDN6:MOayDcMkqQpRQmr/UN4MbN
MD5 SHA1 SHA512 SSDEEP

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 4b46661e0ea9b50ae389d884a682d1b473ff82eac3240be1e0dd29b334cc0e85
MD5 bb0a8ea45bd516d5e5ffc96273111141
SHA1 b21a10a4e35523d328f15a3a5f6f027d6e212d04
SHA512 4a173fe934649e7b45480277cfd0e508de2e39ca316e21879734638b394f8388836e9f88e104c24d6e342a7ffe0b3e8233dda782e08cb8cd505d90a50321a863
SSDEEP 12288:DeDFaBfvfoPDct6SlxlwkJJrqQoUhTFfPLgpRtHmr/UNvp8hMoZUDNm:D6ayDcMkqQpRQmr/UN4MbN
MD5 SHA1 SHA512 SSDEEP

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 f58fa216fd886a9dc5625713972fa6c2663fd427fd657c5856c363d17b9e9a08
MD5 6804044f6cb985b27f47d7acb901c8c9
SHA1 892f42064b1734f3914e4c535f0c3669f01a5891
SHA512 9c7702ded5cb341b98398f59d6c0167b1a8b2d289d93de14bf41f81ff19efbd08cba4ae51d3bdfe30b236c181b5afb05a45138ff1d4280f58297c77f2681672b
SSDEEP 12288:0eDFaBfvfoPDct6SlxlwkJJrqQoUhTFfPLgpRtHmr/UNvp8hMoZUDNm:06ayDcMkqQpRQmr/UN4MbN
MD5 SHA1 SHA512 SSDEEP

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 bd17ecb7f6e397ac4568f92d36fc3b9c9f28c77014968919a9cfe7515db21f47
MD5 d57c4eadace420368ba37b6085a7f4dc
SHA1 9b40e19b295e3ff251adb84aea536d88602ea876
SHA512 d5160d4fb8876226ae023e5029488a1d81cfe9bdea317cfd359bf02461cbcf5bc65dce60b4d828cbd38251397926415ae4454507088e1c250bf85f6980136a81
SSDEEP 12288:WyPz5L8DDFaBfvfoPDct6SlxlwkJJrqQoUhTFfPLgpRtHmr/UNvp8hMoZUDN8:rzytayDcMkqQpRQmr/UN4MbN
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 04e49a3fc975088639004dad278517dc8aaad2cdd30acf60b17468c8adbb1ddd
MD5 4459c75a938819a47f3c676e80b1000c
SHA1 4b46124105e8a7270fb4be4c4f1a259dbdcaf261
SHA512 ae6099f15e93a79137792d559413da2b7c620304237955aea95acb8895bf12b2b668dd731df16682521dd20aba68f7203411d3bcbe437454785411eb72895d01
SSDEEP 24576:WTHaLl3z0zDbayDcMkqQpRQmr/UN4MbN:WT6Lljc7DcMlQpRQQMKMZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 ebb661deca2606c82e172c10bee0b39ac6c919397b5ea4c7fceff9d2ec458c91
MD5 af86b8f5c1edd1630aef951799bb1c5c
SHA1 1d6da4c50f216f270c9e53c3542d9c71fcd4bbdd
SHA512 7cb5ec86acb03ddfda106f1262a7f87619fe3a3b1f87d2683d476745dbec7ee58419bc41459d37dbeb68a7487c2c768aba4660a7991ce2f973cbad51c3f40f96
SSDEEP 24576:637d9CHKy7GZnayDcMkqQpRQmr/UN4MbN:c7d9CHKyaV7DcMlQpRQQMKMZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 d3422ffce8f0f0c13e4b6e3717b1485a71443ca8174224893d780037f3358f92
MD5 06ed0c7abbef24bb4ddaf996ab7ed6e6
SHA1 0dee2e57dc5d488a98481204f4b3f6aeba372339
SHA512 ed33e3d0e5805eca9e5b94cf60d48426f4e81170c79e73122cd5793979e0947793696dc48e870e03670490ba2382ed0d19912da86036efcecb5b73e89106b581
SSDEEP 12288:e5DFaBfvfoPDct6SlxlwkJJrqQoUhTFfPLgpRtHmr/UNvp8hMoZUDNm:erayDcMkqQpRQmr/UN4MbN
MD5 SHA1 SHA512 SSDEEP

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 caf7b6bb39789f102b03ae9c9888f81bb503efc84bff4e5605f23c9a4c8a1db8
MD5 70d185c530dcd10e9be3fee0d353bc4e
SHA1 d821bc0a8a4bfd1c6dc7955da4cd416d1aea472d
SHA512 9e809291ab16fd363e2249b45f277e100aa1588ffd11999f77919eb91b540db93a3d775a7805be1d9ef8b5d305e5d6eaff08d7dcbfa0112f4156231dcbfa1729
SSDEEP 12288:KjDFaBfvfoPDct6SlxlwkJJrqQoUhTFfPLgpRtHmr/UNvp8hMoZUDNe:KNayDcMkqQpRQmr/UN4MbN
MD5 SHA1 SHA512 SSDEEP

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 4686261591dd41a74dab15589223deb6ff79f5c279ff5ffe9ac8eaec3597a4c0
MD5 cb2a4c0b0f58a1121973eca987671ecf
SHA1 d2d48d99730198e2d19ddbcc89b8d55f3fdec02c
SHA512 30abf175154f80312fbc8ac140cd28e8478077b7456626fb8620cec820a0d58b698b1367cde72fcef1209e9b64ec3c2c89f5b9fe12f7976cc81f0fe25e3341f0
SSDEEP 12288:PQDFaBfvfoPDct6SlxlwkJJrqQoUhTFfPLgpRtHmr/UNvp8hMoZUDN6:P0ayDcMkqQpRQmr/UN4MbN
MD5 SHA1 SHA512 SSDEEP

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 808a9246e1e2ec6a9f1e77035eaf32fdbd9c0c7c2abf5a3ad33b777ffc1ec1f1
MD5 26ef2c3ef06a018b7e5f535a934b4871
SHA1 4eca0d298981f9c84bb44800b46b3778ede0ed96
SHA512 a1cacfd7bcc529a772f8a9a05f3c9b80794e5ea2f195a9bdd58d365b1cbca5109667117d5026c027c85161ce6c65b8fae6f257d49d7d8be9b622591c600aeea5
SSDEEP 12288:TeDFaBfvfoPDct6SlxlwkJJrqQoUhTFfPLgpRtHmr/UNvp8hMoZUDN6:T6ayDcMkqQpRQmr/UN4MbN
MD5 SHA1 SHA512 SSDEEP

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 e8ffd6c2ccf821444fdfec8a30f9f50b6bcb2fcedbcb304e47e99d5b5c1a75f5
MD5 d2a8235c61a639ed2f3b6f354c70bd9d
SHA1 4e2190a39cfb20150b39e72d702abf0f6f52ef13
SHA512 b273797233dcae1ea7a23738714fd1413be44e0d43f46be487db4a2d28e3ffb15e445d6236039fa76f88c96f697fdb7f13abb7b6a2dbeb4850f760d5b5f91bbd
SSDEEP 12288:45DFaBfvfoPDct6SlxlwkJJrqQoUhTFfPLgpRtHmr/UNvp8hMoZUDN4:4rayDcMkqQpRQmr/UN4MbN
MD5 SHA1 SHA512 SSDEEP

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 701KB
SHA256 4babfb47219419f1ed4c5690ea068b5960fd41a5deea9c90f1ca25a799d1f45f
MD5 bbe6f0b3475005388d775d6fb3f86708
SHA1 6e0427e29c95cfad66bc52995bb9846784f4c048
SHA512 b9780d13d820d7780d02162ba6a62d5d911d33b1dbaab08e59a46fe0fe9534835e03042dbc923046c44ac8da6da96d94021c3720901e0e44bd4e5ee311c88911
SSDEEP 12288:gUFmDDL1DFaBfvfoPDct6SlxlwkJJrqQoUhTFfPLgpRtHmr/UNvp8hMoZUDNi:a3ayDcMkqQpRQmr/UN4MbN
MD5 SHA1 SHA512 SSDEEP

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 699454444e7479dbd1e40dffe7d2b416c54d39e930768891c8e31c373f1c7c9f
MD5 775a2cd85e872871ae0d5b07227548d7
SHA1 84e5c0e90a01b733b7477e4c8d683887a3c10fbb
SHA512 60069027bfca4b1124bb237151cedcfa95908797ef14f59b38a39bb022d002b26e1d5fd844a9682ef78c46f6a76548c0ed54a3fd82749f9d38d1bb11dd7e7b6e
SSDEEP 12288:1xDFaBfvfoPDct6SlxlwkJJrqQoUhTFfPLgpRtHmr/UNvp8hMoZUDNY:1jayDcMkqQpRQmr/UN4MbN
MD5 SHA1 SHA512 SSDEEP

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 d980048bf87cb945c7d085e55b334bf86cda84d26e769969ffa07eea57d13b64
MD5 727d3737e2c5cdd32d48740fd78e4b7c
SHA1 987527032c33f2c5753aa770b300da3ea6e0442f
SHA512 c0e5aa8654b7e9b31f278c5c70318e9cad69af92155d4d5cc1c2cca788511a9151be459d85da1bcaba0fbfd41ce267504c7f2abe4cb19974aa52e5bd7a5e832a
SSDEEP 49152:la0h2GEkuAe73q3pp46zwwQp7DcMlQpRQQMKMZ:la0hNYG4Jww3zlQpRQQY
MD5 SHA1 SHA512 SSDEEP

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 659KB
SHA256 ccddeac24bec3f67d68fcc1bd972405cfec4a6ba88f70b7a9f5caf54ef74e682
MD5 06f9dc8c273901ee9683c537c3e422ca
SHA1 660e51a8cac2676e0eefa9eb57fbb2d6b375c5aa
SHA512 73753bba5cc33a12dda2bf3d47d692244de594d1b7c6ed33392e8587fe772ad7bb61d21d7e553ddbdd0e6ea52bed6e1fa7bc9c24b51d9c619d2f34b499a570ca
SSDEEP 12288:QhbHjfX3DFaBfvfoPDct6SlxlwkJJrqQoUhTFfPLgpRtHmr/UNvp8hMoZUDNS:QhbHjPhayDcMkqQpRQmr/UN4MbN
MD5 SHA1 SHA512 SSDEEP

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 2cd7d76e33a0d17d05ddd2593f6ebca36c60bcc7547ae5d0fa4ea9e0f637dccd
MD5 c9643261217649e04f7793931c426ed5
SHA1 0f1c7b00ef1f42822dc631ad7fd91073c297dd54
SHA512 80e1a78cb3e0979b6be24bc46603780777389df1e9eaa72b3a8d9e8cd125b30ff2367730c3d9e9a7a9269607478e6f465c41b90bf09c9ce3bf98daa3b5824d2b
SSDEEP 24576:C3YgnJcRTk4yti+R5dBR/EayDcMkqQpRQmr/UN4MbN:CIgnaTk46pBR/E7DcMlQpRQQMKMZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 578KB
SHA256 c99c9fd75e3cfd6fc406ec3ea34f75f10efcb87406bad7b7023dcbb319803cff
MD5 ae14e27b6a070f19723e396a7f8bb8c6
SHA1 d95144443e89d69d695dfc6d84d8aa9e4da5798b
SHA512 40aa7668bd35d62e1f4eb4abd69109bb6025f8e34f3ea6bff5cb13adb231029505e50325784de80afe229586b72385cabd73336f77472f8614b12020dca78914
SSDEEP 12288:sNDFaBfvfoPDct6SlxlwkJJrqQoUhTFfPLgpRtHmr/UNvp8hMoZUDNd:svayDcMkqQpRQmr/UN4MbN
MD5 SHA1 SHA512 SSDEEP

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 940KB
SHA256 1922651ba6663f7825f7cc17098d74494c26cd729cff06a92541ec03d4f6199e
MD5 d5db6834c89bd92ab082e33b99c65003
SHA1 5654e05b8085a7852aa714b1354ae3c5c76a0d19
SHA512 2686a2d89f1feda8056295b22c6bc249c195a559a1e32ee41ce89ee13f843c891755dd5e5705a5ed50e42c7a8583a74f00bce8eb3b75821e2e9a76d55ca14bb7
SSDEEP 12288:yOb9A4LWOsvAYFT2DFaBfvfoPDct6SlxlwkJJrqQoUhTFfPLgpRtHmr/UNvp8hMQ:jpL3UTSayDcMkqQpRQmr/UN4MbN
MD5 SHA1 SHA512 SSDEEP

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 671KB
SHA256 aa1a635646857f05799b2af8057eefce1e79d415b1bf8075d3c5269144ef9c5e
MD5 b00e4877b79f4a62a24533a38e52be93
SHA1 8eeee36f9f3f7f9d92dba6db4dcb815896abf7f2
SHA512 8d65535fb8a8f4c3ae1bf53401b66d2f202611dc307f8384e6f2de6433cc22d8c01238214b732a1b21f8712c4f224573e9d22f8a3a37296ef3c2a3c83c50d37a
SSDEEP 12288:6pFtpOCDFaBfvfoPDct6SlxlwkJJrqQoUhTFfPLgpRtHmr/UNvp8hMoZUDNT:4O+ayDcMkqQpRQmr/UN4MbN
MD5 SHA1 SHA512 SSDEEP

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 7738f1ce71dd49b0c2328da1a4644356bcd76807e647fde011eb9c3ec86c27da
MD5 0745772c73672e54ef08d266a5a81342
SHA1 ae50cc827b18c839ef24cadaf9a409cfe848550a
SHA512 28a229ae25c5d093641f85c167cbe0a559ae9f618e427ab21e5a483d8492b8c723ff79d87567e8daa33db815476d8cb8cf67ca1095472dc739b82bc637209b0d
SSDEEP 24576:z7NM9YqZqmWMUkPjZM48Mv6bEhsTayDcMkqQpRQmr/UN4MbN:z7cBWMpPjN8DbEhc7DcMlQpRQQMKMZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 e17fc45faea656e96eb95f176cf2ccc9e43172fd2d710dbd526d922afa13ff26
MD5 29ade48bc19e430279df57534759ad49
SHA1 2eef8849500680c23533b5f7b28a4e49260c8a7e
SHA512 17a5e1ec80762eafd2c59b22373483b4f5ac22ab409e126170ba90120bb44d3e371e8c89ecd0e2f149acb3dc640e5ef63a7d8331c1c901ead4f6fe29f740e8f4
SSDEEP 49152:NF2YuHNETovAvNYf8kmz7DcMlQpRQQMKMZ:Y6BCf8k+3zlQpRQQY
MD5 SHA1 SHA512 SSDEEP

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 462b14cdc2ac873768bac8e3322c6976170a57265bc9ac451e26c7d37e8deb21
MD5 2fae4fc2960c8541af62a98c29631bba
SHA1 e73e8a52ffd0b9055b38d2c2093f4e2b137f8e97
SHA512 35edc309e716da375a9d2c0c4421240501d4efe7c99466d64e6b2d55ad26fc35cf9b51ee131936fa3b016fb34c8abbd555901c846996207ec32ffe7e1228ddbb
SSDEEP 24576:oAFs06+Omlf3NXEbToqayDcMkqQpRQmr/UN4MbN:tFs060lVXuJ7DcMlQpRQQMKMZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 885KB
SHA256 cb4a990c7193a696deccb42a8ebb54cae84bdd5ac1bee0ff5ef9b65f1437e117
MD5 9c9ab54306cca812048a085094f4c070
SHA1 c3066c31c1566589fe4730b67c12d8bddffdf466
SHA512 11c55deed4edafa7b9f7188bfb136b4d0c1f4bc29a04a03ec3fad38966d3137326d300397660cd76e216d8957c29a0b17a80b3ab1ab94111e7644b608f89d4af
SSDEEP 12288:bCJnJ5D3VkrDzxhDFaBfvfoPDct6SlxlwkJJrqQoUhTFfPLgpRtHmr/UNvp8hMoK:WJnJ5D3WXJayDcMkqQpRQmr/UN4MbN
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 29c93f2659a7f3225fc791d75c6b73033748a56e912944b31737f4a84f76b6e5
MD5 729676f68e9701964b472364d6e50912
SHA1 61576ab915dee47c4096c9722bc8ee97eb21fc74
SHA512 eff3fd26b03509a1e135ff2bc10a9d93792f97e7e5149041e27ffedf2d58133cef81b869f64a668aac758e35e9daceb2253d1776846c3c84dbb6d5215fcf4b44
SSDEEP 49152:Tg06DIKdwc+eQnSt65aVn7DcMlQpRQQMKMZ:sd3zlQpRQQY
MD5 SHA1 SHA512 SSDEEP

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 661KB
SHA256 90a64019e4770170374f20d1c02d6d2f3c22d4ce8f52c14ae37c0740fe6bd450
MD5 6936876604abc5550117703f52ccd472
SHA1 13ee9dccdc2f6c11dde226378103a1ef95409ea1
SHA512 2a1dee61512fd6e3dda62f1d5b2e82f077624a0c41b9ba42ed2b4ecc85f004a33fc02f6e5e24dd96e16fa144bbecaf3e289ab2668d7e261e4fb16ef18147f2c7
SSDEEP 12288:aEP3RnEDFaBfvfoPDct6SlxlwkJJrqQoUhTFfPLgpRtHmr/UNvp8hMoZUDN/:5nIayDcMkqQpRQmr/UN4MbN
MD5 SHA1 SHA512 SSDEEP

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 712KB
SHA256 c9c3dcb3315e2eb9e81d2d4b48dfbd275cdf32492a37fad62b4e8ea532f1a7ff
MD5 2ab251e5975c434ab79cf8a17e6e77be
SHA1 88fba1ed1c3454ee03bd4a7aae2a8fbc879d1166
SHA512 f7ff59cdccbc948d1d17e77f6d71eb1362daaafc388f3d05abcbc8d729ee84fd17284d6e2800a171cd06a41fc7d0f346f51a1e0e1f4441019a5b165070b074f1
SSDEEP 12288:RjkyIDFaBfvfoPDct6SlxlwkJJrqQoUhTFfPLgpRtHmr/UNvp8hMoZUDNp:RIyMayDcMkqQpRQmr/UN4MbN
MD5 SHA1 SHA512 SSDEEP

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 584KB
SHA256 0be17eb6535bed660889b3ecb1094840da93d03ec9164e645d7ab30145902871
MD5 573eda5002654857b5dbabe290066155
SHA1 f86c3160e78decb2282433aadcaa28b2653db95e
SHA512 9f29b0f438b2241d3a6afafffd61fa2f3115e59317bd1af7e995449f0af4019a2d1dd06441752968713aeeb67d5576e3872cdf3ecc73ab4c489d2ee6a95b6033
SSDEEP 12288:VyyDFaBfvfoPDct6SlxlwkJJrqQoUhTFfPLgpRtHmr/UNvp8hMoZUDNX:0OayDcMkqQpRQmr/UN4MbN
MD5 SHA1 SHA512 SSDEEP

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 8c8ceebb085e2e044338e50a7b9ddcb05eed0f61434890a7a9850ed155019806
MD5 e782a5ee06cd0f3d061d7bf89e68ebcf
SHA1 8983e714cc6ce380cc316afb551f3d6a3aff50f9
SHA512 3c0123a88bf1849ef8d6e4769996e38d456c033cff6e0e143daaed0a10b9cb865cee0ad4b7860939671067c237fe95dc0ab7c151cfc582a47860bcaee4f494ba
SSDEEP 24576:0Q9MxZKdcz9dw3rayDcMkqQpRQmr/UN4MbN:0VKZr7DcMlQpRQQMKMZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 772KB
SHA256 0cf612f36ab4b32fb435490686b0bcf08146040cac3f66750ffef7c977bd9394
MD5 f5eeece6af044a2af489959c7927f6c3
SHA1 404fa30ddde74d865d0ecec86eb58c3b950f55b0
SHA512 b889e3988d12e1b2dfc38586388b376bf62c8b27bd55ec0112ded89cdba4bfe8a9cb0c49eeae21f994b32e4c69ebdc138ecded6a962abec6e514cbf8b02ed07d
SSDEEP 12288:qyoKo2JRple9pkDFaBfvfoPDct6SlxlwkJJrqQoUhTFfPLgpRtHmr/UNvp8hMoZ6:qyocDApoayDcMkqQpRQmr/UN4MbN
MD5 SHA1 SHA512 SSDEEP

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 2b97e3b8a276faadc0afac840126b72e4d0c35d0039de805a9dd68de59460bec
MD5 eff6fa89cfc01b016dc3f0445dbcaad5
SHA1 9d08446b1080dfb8b223bdb78ad968da7dc56561
SHA512 197f3bc53b455af0e6f5752836c1078487d61ab8bf42a0447191a370760c2247cbfca7f3455bc66808eff42d1762d80281ac76d66674bf7b1e20b57a9b2696df
SSDEEP 49152:yWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKo7DcMlQpRQQMKMZ:k0zuNIS3zlQpRQQY
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 e68246682f12a926f2b2ceefdfb0557aa9c8a3fb2d8ce26f45525c5cb46e18b0
MD5 213fbf5ce94e7c7df689fe5bf5544db5
SHA1 916f2dedf2231a8b823f55f2b8f66f689a2a96e4
SHA512 e664f5af0b37a80712778d3e2bec5ab479e7ac43450d3f3cec039568961441cdd424730367ded5d23d5c7aa90c2c004c14fea501824b3718a845b6d8da30bc3a
SSDEEP 24576:H1QT7EcpfxR+N5AWAz3ooiYtjMqbIayDcMkqQpRQmr/UN4MbN:6TDxR+N5YzTfjM/7DcMlQpRQQMKMZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/948-291-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/948-564-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/1424-326-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/1424-571-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/1496-288-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/1496-467-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/1816-284-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/1816-565-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/1816-338-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/1904-281-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/1904-333-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/2120-243-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/2120-67-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/2120-78-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/2120-75-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/2604-567-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/2604-314-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/2768-329-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/2768-271-0x0000000000750000-0x00000000007B7000-memory.dmp

Download

memory/2768-278-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/2984-32-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/2984-40-0x0000000140000000-0x000000014024B000-memory.dmp

Download

memory/2984-38-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/2984-239-0x0000000140000000-0x000000014024B000-memory.dmp

Download

memory/3048-339-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/3048-575-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/3148-566-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/3148-303-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/3540-43-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/3540-53-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/3540-52-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/3540-240-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/3596-238-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/3596-27-0x0000000000680000-0x00000000006E0000-memory.dmp

Download

memory/3596-24-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/3596-18-0x0000000000680000-0x00000000006E0000-memory.dmp

Download

memory/3828-77-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/3828-61-0x0000000002270000-0x00000000022D0000-memory.dmp

Download

memory/3828-63-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/3828-55-0x0000000002270000-0x00000000022D0000-memory.dmp

Download

memory/3828-73-0x0000000002270000-0x00000000022D0000-memory.dmp

Download

memory/4080-267-0x0000000000580000-0x00000000005E0000-memory.dmp

Download

memory/4080-257-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/4080-325-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/4080-261-0x0000000000580000-0x00000000005E0000-memory.dmp

Download

memory/4164-573-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/4164-334-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/4308-572-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4308-330-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4356-570-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4356-322-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4480-0-0x0000000000400000-0x00000000004C5000-memory.dmp

Download

memory/4480-6-0x0000000002350000-0x00000000023B7000-memory.dmp

Download

memory/4480-17-0x0000000000400000-0x00000000004C5000-memory.dmp

Download

memory/4480-1-0x0000000002350000-0x00000000023B7000-memory.dmp

Download

memory/4504-12-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/4504-237-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/4848-321-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/4848-252-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/4852-318-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4852-317-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4956-248-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4956-253-0x0000000140000000-0x0000000140135000-memory.dmp

Download