ebe23106c548cbbc7bc8e12a687ccaf6adabd6642887721a2d389862babef0cf

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
09/06/2024, 20:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-06-09_2d58c7f04381d6b60da5142902867646_avoslocker.exe
Size 1.3MB
Sample240609-y3ebpsfb94
SHA256 ebe23106c548cbbc7bc8e12a687ccaf6adabd6642887721a2d389862babef0cf
MD5 2d58c7f04381d6b60da5142902867646
SHA1 3302e6afa59bfce7b6eaf2dfee8436ba5a09e3d3
SHA512 bd3b1fcf5d31e9f6a451b372d2d927513d9562643a4361f7dbc7b6b406682805158f989d495fab9513d7977504d0ff6b62a21c2f7777c79f8e6d718d0d8a7aba
SSDEEP 24576:Q2zEYytjjqNSlhvpfQiIhKPtehfQ7r9qySkbgedD6J17W8CX32+KJNA80T:QPtjtQiIhUyQd1SkFd2cW+S8
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
1088	alg.exe
880	elevation_service.exe
4688	elevation_service.exe
620	maintenanceservice.exe
860	OSE.EXE
1108	DiagnosticsHub.StandardCollector.Service.exe
1740	fxssvc.exe
1008	msdtc.exe
448	PerceptionSimulationService.exe
1020	perfhost.exe
4348	locator.exe
2240	SensorDataService.exe
1300	snmptrap.exe
220	spectrum.exe
3512	ssh-agent.exe
460	TieringEngineService.exe
4332	AgentService.exe
3220	vds.exe
4836	vssvc.exe
1884	wbengine.exe
3168	WmiApSrv.exe
620	SearchIndexer.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in System32 directory 24 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2024-06-09_2d58c7f04381d6b60da5142902867646_avoslocker.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\24ede915d590e271.bin	alg.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_95296\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\110.0.5481.104\chrome_installer.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\minidump-analyzer.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe	alg.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\caps\hdpim.db-journal	2024-06-09_2d58c7f04381d6b60da5142902867646_avoslocker.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe	alg.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000542979bcaabada01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000410091bcaabada01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000005ee7dbcaabada01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000da9cadbcaabada01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000015ed9cbcaabada01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c2f4e2bbaabada01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003cfcedbcaabada01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
880	elevation_service.exe
880	elevation_service.exe
880	elevation_service.exe
880	elevation_service.exe
880	elevation_service.exe
880	elevation_service.exe
880	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
656	Process not Found
656	Process not Found

Suspicious use of AdjustPrivilegeToken 42 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2028	2024-06-09_2d58c7f04381d6b60da5142902867646_avoslocker.exe
Token: SeDebugPrivilege	1088	alg.exe
Token: SeDebugPrivilege	1088	alg.exe
Token: SeDebugPrivilege	1088	alg.exe
Token: SeTakeOwnershipPrivilege	880	elevation_service.exe
Token: SeAuditPrivilege	1740	fxssvc.exe
Token: SeRestorePrivilege	460	TieringEngineService.exe
Token: SeManageVolumePrivilege	460	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	4332	AgentService.exe
Token: SeBackupPrivilege	4836	vssvc.exe
Token: SeRestorePrivilege	4836	vssvc.exe
Token: SeAuditPrivilege	4836	vssvc.exe
Token: SeBackupPrivilege	1884	wbengine.exe
Token: SeRestorePrivilege	1884	wbengine.exe
Token: SeSecurityPrivilege	1884	wbengine.exe
Token: 33	620	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	620	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	620	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	620	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	620	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	620	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	620	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	620	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	620	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	620	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	620	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	620	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	620	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	620	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	620	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	620	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	620	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	620	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	620	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	620	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	620	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	620	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	620	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	620	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	620	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	620	SearchIndexer.exe
Token: SeDebugPrivilege	880	elevation_service.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 620 wrote to memory of 728	620	SearchIndexer.exe	115
PID 620 wrote to memory of 728	620	SearchIndexer.exe	115
PID 620 wrote to memory of 3880	620	SearchIndexer.exe	116
PID 620 wrote to memory of 3880	620	SearchIndexer.exe	116

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2024-06-09_2d58c7f04381d6b60da5142902867646_avoslocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-09_2d58c7f04381d6b60da5142902867646_avoslocker.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:2028

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:1088

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:880

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4688

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:620

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:860

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:1108

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:2304

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1740

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:1008

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:448

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:1020

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4348

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2240

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:1300

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:220

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3512

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:544

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:460

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4332

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:3220

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4836

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1884

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:3168

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:620
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:728
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
  2⤵
  - Modifies data under HKEY_USERS
  PID:3880

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
Size 2.1MB
SHA256 fe1e889270388e58302e4071192558ca27e4e8bb47e64579831e0f80158f00f4
MD5 45b51a7128c371727faac6052ebb686a
SHA1 802f191cef6ec51115499493a9185f08d4a8059f
SHA512 8ba6b6555e3b152689d69f01f7c69e1e90cee3c30df6e26b3a03b32ff446d07c3c39d6c73467e32613a7f1a2a9800a01ab3b0db17529fb6ac8ec267a10bf8656
SSDEEP 49152:VuYk3H5koUXfTqkkYLO/W2buywzMbOX+T7z57cW+S8:VPfTqi90bz8
MD5 SHA1 SHA512 SSDEEP

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 9a8ef8a11907b10394b764e3b7621069cd7e96fd8df8b304be984b579aa2b9ac
MD5 cf8c1e047eb46df3312157e251587705
SHA1 bdd487d24ee86240f131b041453ae2932f66954d
SHA512 4d0214c4aa0dfc48e29e62bfb1e247c592608c83029980f96c07f50e0ed23a80fbfbc10179d666becba58477508fdc26373e76f6d99c9245e67ce4446f822e99
SSDEEP 12288:KcQiBmNJLBsunEP6JvY67VMBNO/aXpXI22+VufvdIOKek1h4TA8bXQJYe:UignBsuEP6J17W8CX32+KJNA80T
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 d5640af53342e6191411a2df71db27289d83324cba7d20e799536f77c33bf432
MD5 8f484a3dbcd98774a02f4a04ddf36314
SHA1 a6ae51138d43f85ec07a557e72caad6a8e725a90
SHA512 41680dc2ccb10b43ddb8cf1eff879811d7881aaf79ea6c0d1c08f06738a9413f9ac71e9c8f1f4368e16ab04f0cecd79c7c767ea23cd5871d23a9b1d3bf4a6044
SSDEEP 12288:F7a3iwbihym2g7XO3LWUXfh4CoT6JvY67VMBNO/aXpXI22+VufvdIOKek1h4TA8s:Q+gkEFfh4CoT6J17W8CX32+KJNA80T
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 258542eed0eaddc6c44fb9317f9e3b95ad7627e13cc39e6b671486154433bfcb
MD5 3002b4f063a1036654135855dbf15a24
SHA1 3252778ea4b683e5b71641cf7d8d928e492a6c3c
SHA512 815bbe41253a96cafb77619927d46cf8e1fe21f21ce8a074daada9dd1b806a2d4867ef901030ebdcfc198c1feec14beafe7636352a9fb03d11af1998b4f504c6
SSDEEP 24576:1BpDRmi78gkPXlyo0GxjrG6J17W8CX32+KJNA80T:/NRmi78gkPX4o0GxjbcW+S8
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 342bd04209754d462a5293e75e55c1c612919555083219279d292496aa3a136c
MD5 f93b2f97b33e92901f1584a7798b3592
SHA1 4a825b9fed041535fde3749ad649a8b1cb635da8
SHA512 cffdeaf5fe8dbdf611803fdea3c8dfaa2c219486d60590856a5d62ed929a0d4eddfb99fc8fece2d87bd306f1dd1815f66ad4cd113d35d68964360c4d1a38dade
SSDEEP 12288:4fC6Aj+TN5uixZN+8rKhUdTC/wE1MD0Ca5ZIXVT6JvY67VMBNO/aXpXI22+Vufvq:kLOS2oyPIXVT6J17W8CX32+KJNA80T
MD5 SHA1 SHA512 SSDEEP

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.5MB
SHA256 e841abb4f7849463e9d3d1ec0c94f252240a240b21eead952c32e501b9462816
MD5 29739a399bbcbad4265cf7baf1715aba
SHA1 a73efeda89a381694b27a3f72290607bc5d5b911
SHA512 b09b583ba56044e76b0ec2c36549f33c27fbff534b21c2f8c8df661b289a512195bdcbb8466cf38635742cb745953849c58149f22bca1fb5668a99ce69a2c830
SSDEEP 12288:piB6JvY67VMBNO/aXpXI22+VufvdIOKek1h4TA8bXQJYe:piB6J17W8CX32+KJNA80T
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.8MB
SHA256 4f27fc3c07c0260c5a32f6bf5982dbba735b77f93d99c5ab6d0320a46dcdd4ed
MD5 010153db88ed97cdb98a3b58ae6ead88
SHA1 47f1e0ff9c3981f8d2a73e69e079e6cfd37bedd0
SHA512 69ef6aa8342f5dd38e8661f07603bf8ade59de347cc227239ed3dd074c2cdc8d07bc91e973835565dfc0655225fef1d661574d87ce3f301ab4ae893bd1cda6b0
SSDEEP 12288:XeBNUbTVO86U06JvY67VMBNO/aXpXI22+VufvdIOKek1h4TA8bXQJYe:XJIU06J17W8CX32+KJNA80T
MD5 SHA1 SHA512 SSDEEP

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 734ad8ce3177843ee567a094817ce788ce49aa54f8e52a066ff4aad06aec24dd
MD5 07e0ac4c15ea429926af899bac52d688
SHA1 c58226052d9e4d3b3fbe7ed584fcb074b0f5beb4
SHA512 957ecb9c2d38a48c535910388d7ad622f80bd18f148646159d5199a3fc51ee3fbc0a1c67fd04fad270dbac3239feb159732a73fd66bf6ba8e092efaa26d56fb8
SSDEEP 49152:FQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THG:FQvGAdlCEL8c/yRNw5CQ8
MD5 SHA1 SHA512 SSDEEP

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.9MB
SHA256 f76595ad248edcf4f7378e04b3d217371b57ffd1bae73ba081a518e77335d60b
MD5 ffdef9a5eb4417dd68e7835cc5048c1e
SHA1 1a7fa5e3f1a0b14a56ebd4dbf1ab1867f634bc6c
SHA512 2598c470f90474f4f4e7deb398d86e4b19076204f918a3508f1beb4185a057ed85c2a40231673c787eda516f65925757ab7c0428164810798a2a559d0771434e
SSDEEP 12288:xAwSfxL/2Dc3oDLLmt0LDQewsAj+6JvY67VMBNO/aXpXI22+VufvdIOKek1h4TAn:StewsAj+6J17W8CX32+KJNA80T
MD5 SHA1 SHA512 SSDEEP

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 1b4fc6cff5d212d68e79e4c14639412cd82fa8cfc21d3bb42b44545a10a6f904
MD5 7dc27edda3935bc60685ca5e9995293b
SHA1 872766528fb8e5a2ec445e42dc23b2f27890874f
SHA512 efd0f139cc9bf6ff8474a34bfd6a872b45e31774aade75d3f4ea645f1b1e088fc577a5942d0f133622b7845b4cb320f50f084f641eab6a4e52f8254627d5bdc0
SSDEEP 196608:MUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHL8:MUEtQevvqc2W1cpV2EI32
MD5 SHA1 SHA512 SSDEEP

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 5d91bc443beed4ab28e45feeb943ac089de2da17b2910b0d861dda842e8c7ec1
MD5 c1b06837dbaafc978b91d5e4c1f5ea92
SHA1 de779a0d62f05c033bab7dd26ab0286f87b8e91a
SHA512 289ba836945ba400b1f5d5c380df26408298273dd6508d272bd0a2e4a7713b5912fb0bb2f01ab83c3ba4b24a658b8a6da84ac6410e8c630534a678698b079ef6
SSDEEP 49152:nCbRquA/m2yL5zifFiV+XenmE3/z3cW+S8:woqHVjnm08
MD5 SHA1 SHA512 SSDEEP

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 9f180cc3c25855103d579fe3869cc81b26b74a21485770e9a386747a3cc2743a
MD5 65b901d096f36343007f9ed41ff7beaa
SHA1 5771a5bcc0cc666b089891485224e0c791e953e1
SHA512 04a43d178905066e28df28b6ea34d089848a3b324a887044f9534cf51e58accc0a2abbede8e5bce53b2937de7a1630e895e7aea562f265d5a0114581dccb48c6
SSDEEP 24576:2AhGLJIFoiwtA5l7S53D6J17W8CX32+KJNA80T:2AMyFoiq5GcW+S8
MD5 SHA1 SHA512 SSDEEP

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 b7c9ec421d6a29f34fdcc980dd719f924344d017b57ef93ea951f4429ba3818a
MD5 1ddfd3b891e2f70f61fd227a9c09f09f
SHA1 8ba6a205ba8da791c5ae6b8f4ba6f0b97c9458e2
SHA512 cb4ebd833a2c19b667d98b7d69f2ec59dd3d84d9b771f77a388486f351c46b43120c25c45a960d9b1ddaf4255c67be8d5a87a4402286a391c1cadd2393b3d92c
SSDEEP 12288:4mw5HEjsChNCBFgl0WDm+C36JvY67VMBNO/aXpXI22+VufvdIOKek1h4TA8bXQJF:1wubOWa6J17W8CX32+KJNA80T
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.6MB
SHA256 c2bd0e0b9105d50686471cbd110ba073249594abc01da044596ad34f06c0d725
MD5 9b68c52aa2ee391438f20d12b5757049
SHA1 80ef4a796b773be287ed063a4ba94dbe4b4c5ce4
SHA512 9bdb164eebbea4a3183f111be20be9443e8f9a02d13050e92d248183b11d3f46f6e9b00b85f1214b2af39ba088b5526db32e40ce26f2460ccbd5642c79f22fbf
SSDEEP 12288:bCZ1IyO6JvY67VMBNO/aXpXI22+VufvdIOKek1h4TA8bXQJYe:WZuF6J17W8CX32+KJNA80T
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
Size 5.4MB
SHA256 afb304f39b12bb06e72efceba29b2b6d26af5b2102c3b6c39c98d97a9fe18b06
MD5 07eeb6ca6f42d0f32b17f1e30de427d9
SHA1 d67fa9600caf3dc883e8f216584c966710302e88
SHA512 980c98f7d65059b39540ec4b49bcffa397b6aa46a81c6e859f2b34171d87405b6d46220aa64ee751961fe97ae8321e1b4fa4eeb3e189ee028a72cffba2b04897
SSDEEP 49152:n0kwIi7c4xZlm5knEtw99Kn/2vim7vgv6m+yyJ/0gbvjR7yY7BHi3u7L/gBUUWL2:LwfhY7g/rLd7yYA3awr341gc8
MD5 SHA1 SHA512 SSDEEP

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe
Size 5.4MB
SHA256 5cc635ef354ff97316c1aa309efe1b7f99a94a62c887f0180d8a6030f543d963
MD5 ed3f06541734a4c6ed204f64efdb47c1
SHA1 daacbe481d90f31b57d710247ef865caf19e4f16
SHA512 923ca2c61d87809cfb16f12da65e2c1ac0bd62d0876cdede979a7a65913db3ef2c2a19c5e15e3bf1339476d45766cb459dad33d69438d661ed532b5d2eb1ef06
SSDEEP 49152:V0kwIi7c4xZlm5knEtw99Kn/2vim7vgv6m+yyJ/0gbvjR7yY7BHi3u7L/gBUUWL2:9wfhY7g/rLd7yYA3awr341gc8
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe
Size 2.0MB
SHA256 d1f1581ae3ba20a9bad260348f173c9557d18c16e44b466e7e2e834146067d56
MD5 c0293acc06c06bba893e83c78bf48ff6
SHA1 fd64f02fff7bd922cbd1fbd5673df4d1f1c1517f
SHA512 f0fa676f71dc6e265c91fcd393529a755820d897ffdb3c3dc9c062924f4cc41b69cfff95232fc5a116c86d19ec3719ee95f655c5ef72329c93f419cabf8ebd8b
SSDEEP 24576:ocTyYv0FteQU+5I2kjgD6iQacAa6J17W8CX32+KJNA80T:ouXv0Ftpn5606zOTcW+S8
MD5 SHA1 SHA512 SSDEEP

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
Size 2.2MB
SHA256 1c3057f922df87bd9337fabda819c9f8e65d73b8f363f308df00dd86c970a847
MD5 f11d827b70836fb5334872b92473bc50
SHA1 7d8c7e9824dbd6315be0b8ddf9bad12f1533af89
SHA512 31ceeb3178b675bb997ec54e7265bd26747def80ef556b4470dc34afcad4dd35354bbf119763bb00740b33fa5f1f7fe1cb15a6fd6f4d0cccb51d35eb6f570456
SSDEEP 49152:Py7mTd0GxN8jyynxHjXKUyn4GVcbDSKrNTxXcW+S8:6mYeyxHjWjMTz8
MD5 SHA1 SHA512 SSDEEP

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe
Size 1.8MB
SHA256 dabc6ee84a7efbbdb652f4d0afaebc2a5fabceb00a1fc0ca426db687dda53726
MD5 78e2068cc7e778b7f93255fb166224d8
SHA1 f2c9a78fa5dc2f4da0594da63fef40889688cfea
SHA512 0a293b855d839465fc8ecea266242b9a0cdd91ed059ee32f723240d97374034be9702db5b839f4cb0877a5aa848e1fb6bd3869f1aaa3e138b1c869ed24d60262
SSDEEP 24576:66drZn1WEci182IEUeNbJeRgUebgW81696J17W8CX32+KJNA80T:6WnDci18yNNUgbY7cW+S8
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 1.7MB
SHA256 d853ee2e33e808326072ed8c31ec22812aadbea19dc993920a84af922e0f3265
MD5 74c58ae6f4e6bd4eceb3be74ce18424d
SHA1 501a358cacdd5bf81a95dd910f6b600f5f9e9d9c
SHA512 f79b615909af92807a43ceb6c183d24052f68d900ba90a85da044dfe271111fee8c28229a32850091a64b35db131826b3b82c857841da064eca3def7d21b2cd2
SSDEEP 24576:Wk5lHW5EzMZupO80G2reD+melRgTTv/1nyY6J17W8CX32+KJNA80T:wizMZm0GhamSoYcW+S8
MD5 SHA1 SHA512 SSDEEP

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.5MB
SHA256 546e232a3d2454b7116946f70bc186b3692a92a6c4a045346334c5750206bcb1
MD5 9f29ae34b409663e3d2a23cb3d3ef34d
SHA1 a05bbc61ea216754963fb067e09e4d9bd890bf13
SHA512 15da8d911bef3585e8fa5e094d9e774912e3fe7ab2b74ca11e33f86a7f388186ee67d3a859a2292f2c90a692a1b54fbb4379fa6ad110766bd31942a83cfd269c
SSDEEP 12288:9J6JvY67VMBNO/aXpXI22+VufvdIOKek1h4TA8bXQJYe:9J6J17W8CX32+KJNA80T
MD5 SHA1 SHA512 SSDEEP

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.5MB
SHA256 7282eeaf1fe61bef597679339940781417b3d6629ad39de009c0d2a5af54f12e
MD5 4cc2c0948c626cc7b9a0e50f929331d1
SHA1 8f15c058b4b605d09ec9c636e10279b5a912d5f1
SHA512 543daea2f0e3bfc0baa7e030e463d0e2f7da46776d0eb5f95d9cf3ca2ca252e4913bc321b856c153e0b72a7db54af1d4102dd06962d7404953e4e88d8b2cb7ce
SSDEEP 12288:xS6JvY67VMBNO/aXpXI22+VufvdIOKek1h4TA8bXQJYe:xS6J17W8CX32+KJNA80T
MD5 SHA1 SHA512 SSDEEP

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.5MB
SHA256 864b9abf9ab67e9d21f5db0b8af2d48b91b2aef37f3702083c3177ba95b725ce
MD5 a7dfedd8d1fe5bd636fe7f02db1bc48e
SHA1 768ebbdf8bbe70f5d3c0351325f2e5c776a053af
SHA512 f845829bb4402325899fba064dd6397c8f691e271e9566b84fa1d1cc38ad416b4986c305f2997f64bc44a90d8043d8ac752f04ef589f15ff245f6120f7045243
SSDEEP 12288:V86JvY67VMBNO/aXpXI22+VufvdIOKek1h4TA8bXQJYe:V86J17W8CX32+KJNA80T
MD5 SHA1 SHA512 SSDEEP

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 bc23d7036dce183c20a735c8cc5632ddb74fe1b8414b102d9e30be33e986210d
MD5 a98c50cc555f630cd7c5c182651b3d43
SHA1 629d7bbb856ef60d275b2b719766e75bf8225262
SHA512 4d95dee051affafcd2ef309a0d701edcf209bd3c939274e61aa5dc618d64b95a529451a35a74da4386f5ceaaa87d9affd2b34ea6d46a2f6daeb7dc7dada4b5c7
SSDEEP 12288:7Vj6JvY67VMBNO/aXpXI22+VufvdIOKek1h4TA8bXQJYe:l6J17W8CX32+KJNA80T
MD5 SHA1 SHA512 SSDEEP

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.5MB
SHA256 ddb1e16b805e22a30d370e2c3acf1b8489de05267a8fd48d4bcc594593000a0c
MD5 0df5dae5aa6b120c15c30feae4c49df2
SHA1 45121dfced4f546b1f6197326d9ca1e884e5f639
SHA512 08a60d216a73d68b05c1e6fb38bb5771f1d23a1654b376822351ebb7b080c9dc7963544f9e3bffc0c6380d6a5393e1d3649c20e5a46c2fcc786730137b2c3a55
SSDEEP 12288:ib6JvY67VMBNO/aXpXI22+VufvdIOKek1h4TA8bXQJYe:ib6J17W8CX32+KJNA80T
MD5 SHA1 SHA512 SSDEEP

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.5MB
SHA256 35a27972c5a6ad88fd2f0df8dcfbfbbe48d6232e1e4f4bb15446277b1bc1cbf9
MD5 02c40f144fb2c1526b3e567a3940eb12
SHA1 bedd1d30c171994bdc1e8772210725479a91830c
SHA512 ea5e7ba9a139438a511a8561982d94a703302a032e56e6fc03b7251ecd4ce56ba615c6fdd314056bc253932fa806e5c2f4f5dbb722fac2b96599e6af95b60fd0
SSDEEP 12288:XG6JvY67VMBNO/aXpXI22+VufvdIOKek1h4TA8bXQJYe:XG6J17W8CX32+KJNA80T
MD5 SHA1 SHA512 SSDEEP

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.5MB
SHA256 2b17e35e5ca30b1aa9e053f117df37de6d90eae327aec295b04c24edf7e90470
MD5 329056f5b4338618d866c57252223c5c
SHA1 b28f7cb3a9b95585034c8bf98642b33fe069748a
SHA512 3ba221043c4355b7f021421368ce8e06601b8469aa45f0a39d919cc7b8222421b873c4bab7ff3184eec41c2d21d9320cd06a6d400a7fe2ecf2e3f2ae7b1f8310
SSDEEP 12288:+K6JvY67VMBNO/aXpXI22+VufvdIOKek1h4TA8bXQJYe:+K6J17W8CX32+KJNA80T
MD5 SHA1 SHA512 SSDEEP

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.8MB
SHA256 1196b1d2b1e110ca313f22bc6f2c4d569b69dc0f4971e835b5d3e48f2a4eaf21
MD5 4bd511a005c797971ab4d7a856d7a6d7
SHA1 6c3edb40533fe3252376a1eee8ec70aa76eb58ba
SHA512 ce217750206fbee45aecea2f2de107c71400d97531b70ce83f2d155121e4ef7902ce37996d4f3cd610d45da61906f800a8fe2fe330e9d95941212ba5b7b53fa1
SSDEEP 12288:piZwbKzzFEoS2cPvyy6JvY67VMBNO/aXpXI22+VufvdIOKek1h4TA8bXQJYe:sZMizFVSOy6J17W8CX32+KJNA80T
MD5 SHA1 SHA512 SSDEEP

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.5MB
SHA256 4917860f7777e0bc72eadd76bb607fa812434991adbd621d2b7a3705ba1728f2
MD5 27e5859517e8c166b139ea0ac85f484d
SHA1 5ff74280ea02cb1717b0955950bd44a439718193
SHA512 13cd582752bf71418b23ea41a3e4f4b56cceda741a823e43b72a1eed70155f221c3ee2ead178e38ac439fc9e3bca33c2e9c44a367a8faa03da9bb4147ff56b50
SSDEEP 12288:tV6JvY67VMBNO/aXpXI22+VufvdIOKek1h4TA8bXQJYe:tV6J17W8CX32+KJNA80T
MD5 SHA1 SHA512 SSDEEP

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.5MB
SHA256 051c7a5cca2c4341f2501787ab2df81c4eef0c14b769396d6cf2c0e63caf67c4
MD5 9e0f1d759d87abd2cc56124850d402ec
SHA1 f74442cc08c790b07c9701e5c3602f8e5bf5ebac
SHA512 2dd92cb7ba49e7c1df2fbd816130a91ad60df4b83d9477765c2d6b9e533475c4824dc144ea43f2db5066fdceb48cb6d9934d99e8043fe614f7223f5e75217641
SSDEEP 12288:0R6JvY67VMBNO/aXpXI22+VufvdIOKek1h4TA8bXQJYe:0R6J17W8CX32+KJNA80T
MD5 SHA1 SHA512 SSDEEP

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.7MB
SHA256 d81c75e3db2f2687663339d2910d7578a6b9e135541c43e3a3577ca28b588808
MD5 9767f52accc652736b309f3661644ff5
SHA1 b9638fa1494101fd43483407e2c6db498689b193
SHA512 4db1b7e3ad57c30bc13ac971b68378f522d7f0db07d9ecbf41af807c7ae05fbd50afac2b4949a1147e6ffff6004a4042eca583508192d31769e9e423dcde05b6
SSDEEP 12288:tyPz5L8O6JvY67VMBNO/aXpXI22+VufvdIOKek1h4TA8bXQJYe:EzyO6J17W8CX32+KJNA80T
MD5 SHA1 SHA512 SSDEEP

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.5MB
SHA256 6c3044f705c8e6e84d02c5456f3867ad6c467f1f5f5bd71352d58257ca820ea3
MD5 a62230228feca4633885d1d21cb1fcc6
SHA1 37e1656b715d8835e3bc76f6ed0e80c9acb45061
SHA512 6f1a0cb792d4361f0a78601df4b64aaed2a8474a545c68c01a609cbd647eb323ef5b3474ef380f987b866d944b0b72c0691bf02fd1d4846cf266ea700d30f377
SSDEEP 12288:SV6JvY67VMBNO/aXpXI22+VufvdIOKek1h4TA8bXQJYe:SV6J17W8CX32+KJNA80T
MD5 SHA1 SHA512 SSDEEP

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.5MB
SHA256 9124ac58a416366654fb9662b12327b7327d27f973303dcee9f75faf1ae00712
MD5 9b60a25aba9405bc83cebffe829fbeb7
SHA1 c0757e22026c8d2bc3fd2bb34fa9d1d35c9e6e01
SHA512 96049a6e1e5fc79b6c7eb6343001522b8dedbb4dac6c3f4d7446feeafcd4f3e5af803e2f152dd491221a2c72c9dedae740802155021677f45a91b693f4c32a62
SSDEEP 12288:bV6JvY67VMBNO/aXpXI22+VufvdIOKek1h4TA8bXQJYe:bV6J17W8CX32+KJNA80T
MD5 SHA1 SHA512 SSDEEP

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.7MB
SHA256 c25561617fd44070cf878dfb79a4bfb606c901436dd55e9e7415d3ba42bbe42a
MD5 e98f4efcd62f5043df2cac7579f036e6
SHA1 6781d363bfa795a4f6ddad8d5960ac2eb73c8ca4
SHA512 69f7acf5dbc0b7c45d7f293b730dddf091a02ef32bb977de0a2695516ee62b3d512f271893d5010d31917145d97d2d7239a5bc5119d868c544ab0ad9d8df86d8
SSDEEP 12288:QyPz5L8O6JvY67VMBNO/aXpXI22+VufvdIOKek1h4TA8bXQJYe:hzyO6J17W8CX32+KJNA80T
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.8MB
SHA256 6dd267b0287452b75e88bde5a279b0227eadcdf5744dcad177adfe0214259bc0
MD5 c38b0ada990423747db5b0e857109d28
SHA1 df75a3a5a1cb63a4661a64bb0de3ae1cc70df6ac
SHA512 9c5fe222c5ea08b0e8fe5f669e6c1c17880a5135dce814645d50a9a4e753747fdfc754288602bc86ed45c8c47040287766d42ffbad0322d5d9a1e1707d9f4fb6
SSDEEP 12288:PCd9uWYoaLHF3z0z04PDvhs6JvY67VMBNO/aXpXI22+VufvdIOKek1h4TA8bXQJF:aTXaLl3z0zDs6J17W8CX32+KJNA80T
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 2.0MB
SHA256 56619e028d84b6f0364680b1b09f07680d9c7ff62b6eee97dc07a62ca4f90031
MD5 c81cb0a678114f11c776c5ca8b39da48
SHA1 ac504ba7488c8efbed8bafbbcd0f1dbb92649893
SHA512 ec6ce05b2cca7da14bb12c17be1c563ca632c3ed2cb36b728ab4e9244106e1c68d76b230ae8660dc1750ce67ea84d84d87a38ab51199bb9ee9bf00af4e88e040
SSDEEP 24576:t3epd9CHKy7GZQ6J17W8CX32+KJNA80T:Nepd9CHKyavcW+S8
MD5 SHA1 SHA512 SSDEEP

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.5MB
SHA256 e349af3b84a5d8a6d77bc1be760354f2d3fa816fc70b63b113f7c14d6dafa1ac
MD5 24ef67b87debadccdcc31913cd042f48
SHA1 796ec5427c5f628f5e9df813a27d34d1256d557c
SHA512 e51a287d7b7646b0dfa720f73ccb55bfc7e111218b79de83d93e58a1543eb056f19ad4bdcabf7be7fe974d3820cdd7dec9c5a5bf40c2d609220fd6c6c01b43ff
SSDEEP 12288:Qc6JvY67VMBNO/aXpXI22+VufvdIOKek1h4TA8bXQJYe:Qc6J17W8CX32+KJNA80T
MD5 SHA1 SHA512 SSDEEP

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.5MB
SHA256 29ecf2ddcf832dfababfe6e718a4e8769e3fb85327de6d64ad03dd742deac2e4
MD5 80a5f6e788b4ba4a6e94e6aa3d79c501
SHA1 8b00fd25674ea3b15b7a973a0bbcf830fc6779b0
SHA512 953c652e880abbf475d32f38074d49a0973c39712dc488d8b96b938810fa55ce6a73e7a303bc7f1b7ff97d964225b2d066462d9ae60bf144e6c762baa86b89c9
SSDEEP 12288:fu6JvY67VMBNO/aXpXI22+VufvdIOKek1h4TA8bXQJYe:fu6J17W8CX32+KJNA80T
MD5 SHA1 SHA512 SSDEEP

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.5MB
SHA256 b91a6a73c6d9fcaaf44b1c686c3c23ef54d1c478474fb4b7bd76f389541663e7
MD5 018c7ff23b04646e9da3f327df79da57
SHA1 53932330f3903386417511046e965a3fe2b224dc
SHA512 8481fa65deb38815a07963807a576e275bf421ba0e9cdf9e27a65990ac03c943485e0a8df99605222374e3cbecf7146729a5d70f020aee5a468ea7b8201b9a36
SSDEEP 12288:HP6JvY67VMBNO/aXpXI22+VufvdIOKek1h4TA8bXQJYe:HP6J17W8CX32+KJNA80T
MD5 SHA1 SHA512 SSDEEP

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.5MB
SHA256 988f9cb4d3f2f7c7fb381886f6f2fb6cf8518067809348066404e5833cc28402
MD5 d79e0a1bca3e7a08d03065f9befbd0d4
SHA1 f882d5e8ad38b32a3fd91643bda7241ef89437b0
SHA512 0041180e55b15e5214d781bf31ff016d6d08c7b3e8b312e821afa0fec21dcaaf78811b629a4c458bb70546103d0565a96ae58cac5c3a30849d2107d379c4a174
SSDEEP 12288:PV6JvY67VMBNO/aXpXI22+VufvdIOKek1h4TA8bXQJYe:PV6J17W8CX32+KJNA80T
MD5 SHA1 SHA512 SSDEEP

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.5MB
SHA256 c6e8cf770d9278a231f638b47eff6297ae21dabdc4a6b8cda353ee515adda196
MD5 4413bcd5b2e62cd6ee8174ef5ab30ad9
SHA1 424663ac5b0323f3ae42aa16e4fb1a8d8f76c237
SHA512 68528a7b9b31302b00e71cfcfd559120afa0a21a2d6fe670e44d423fed74d59f1c66f05a440b82b0b0bf8465bdc063f79aba25bde429a7c0132e09330f9b618d
SSDEEP 12288:6c6JvY67VMBNO/aXpXI22+VufvdIOKek1h4TA8bXQJYe:6c6J17W8CX32+KJNA80T
MD5 SHA1 SHA512 SSDEEP

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.5MB
SHA256 0f0c1adcdc4878edaa19d73be72b3b2e1adeffeac695f02af8bd3e2fa899b4c3
MD5 61a26f011f0d61ca24e4649f00f662a3
SHA1 704c4a90b07a75d4ceb6378a74a4168ffb942c68
SHA512 9994257ab102836064c0005bd484c53af14a9915916d7a50a13a6f468b796bd6349d914ab1be83ada2eb2eef6ff8abedcf481f4673fabfb16c3c672a126e27d7
SSDEEP 12288:zt6JvY67VMBNO/aXpXI22+VufvdIOKek1h4TA8bXQJYe:zt6J17W8CX32+KJNA80T
MD5 SHA1 SHA512 SSDEEP

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.5MB
SHA256 b2357ed65bc3d74de420c53464065eba83e4499d54d30aeb1f9978905571a3d7
MD5 a38831a2d1cd6962341c675d42d3bdd7
SHA1 25eec3218f7609665bdc82be73b3c219d7fc35ee
SHA512 3b4bd60d84693b2a5107ae29921bc7d31cd80740e9058c30b66fe17a8239a37a9ca6e889a6f4bb4c0905f5342b489aba992dbe26732baa4df41d1939a4a693e3
SSDEEP 12288:Bb6JvY67VMBNO/aXpXI22+VufvdIOKek1h4TA8bXQJYe:Bb6J17W8CX32+KJNA80T
MD5 SHA1 SHA512 SSDEEP

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 79463e61db2a9c876aef97f8557423bdba00781d028b757602f68d78e28663f8
MD5 4865f128dea296bd8f45625b4681d42f
SHA1 2d890194f73ac90d140c3d013c8ae95044696936
SHA512 ef8073c645ac9962f70f1beb9df3b3c4ba71602f229ba29596069b47a54a7482391c74f53f30e306c8ce715b2e07019a2918e7c7ec9f3c2c84405991ad44e4d2
SSDEEP 12288:7UFmDDLA6JvY67VMBNO/aXpXI22+VufvdIOKek1h4TA8bXQJYe:TA6J17W8CX32+KJNA80T
MD5 SHA1 SHA512 SSDEEP

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.5MB
SHA256 cbaafe78a8300ffd5eb08131ddd891af6516879ba5b728ba167942d811589880
MD5 f0a1b91dabab4bc529e2be278a4198bd
SHA1 e66736b0960c2972eaca514d5673c0ad901392d8
SHA512 716952665ac308ba9e9d9a1f224fbd46ea161f1b5bb2b40e37325cbea663f407f366b1fb5ae90abd5fb2720c7348ecf96f0431eff5aac5a4759ef18af8cfdd82
SSDEEP 12288:cZ6JvY67VMBNO/aXpXI22+VufvdIOKek1h4TA8bXQJYe:cZ6J17W8CX32+KJNA80T
MD5 SHA1 SHA512 SSDEEP

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 f59ce2be08159f0717b4ec77d23ebe7252bfb277272fd00dbe68bdab8b89b205
MD5 80d93e1ed19167ddf2b1116f7e1266cd
SHA1 879ae0cc4c9bcd457b193b0541705c43141abddf
SHA512 c44d41acbe6af8f21942d44f2ee15766d0c0386f95edbf58436fe99bbaa05245761269f89945de3f50fe0b9f29c5c934bb1403857e1aae5e497cbf6e926ffab1
SSDEEP 24576:foiQ0h2Hm7EkuAK3xV3tk3tLjN2VMbxR86mHx/YY/izSI2sBq9EzwwXg/bb6J17g:fa0h2GEkuAe73q3pp46zwwQycW+S8
MD5 SHA1 SHA512 SSDEEP

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.6MB
SHA256 8ab59285521ad69943c64be415b4c06e03514329905910444913aa511cd78758
MD5 0f52fe075495687bff5e2b000b6e13a0
SHA1 c104fe53d2ec7db06ad5855f2fa7cf3ceaadb810
SHA512 49c25f6804830301c80a5de8065b06d1b64f24fe2118b3ed579b0816a99f5d9d6b84938cc1731f10c4bcf5ade22a1e98f815730751905f25d7d91804ed79c666
SSDEEP 12288:LhbHjfXS6JvY67VMBNO/aXpXI22+VufvdIOKek1h4TA8bXQJYe:LhbHjPS6J17W8CX32+KJNA80T
MD5 SHA1 SHA512 SSDEEP

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 c54365a6161a893e2fffc723151407dd788cfbae1570ed82253855d736b01661
MD5 235775870538124cde53609a8a2d637f
SHA1 6caefba85d837c83238ed206e4c29a59a29eb303
SHA512 e5f621193577c85596f55c602c5b1546914afcb740f1de3acd44f4514b2018d03570444090fa5017689a1f589cbfff7873539e784242e5df84527063886af828
SSDEEP 24576:F3YgnJcRTk4yti+R5dpR/66J17W8CX32+KJNA80T:FIgnaTk46ppR/zcW+S8
MD5 SHA1 SHA512 SSDEEP

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.5MB
SHA256 14104defd6bd29c3defd0f122f2fea5cdb3ab4c221d3ec491009d2178ab0181b
MD5 e11759cb16fdb2b7520d6ed7e7c3a52b
SHA1 b9e0847ae7c5583a75a6df0d34f177b72be862bc
SHA512 579ee5b72c27f65b94fcd8dbed3f4e3a02f41bd9c3c613b5c6554df27a337ec0d8c2ec08f9a2527930ec8f2e11adf66c83d30bb402410347d8f8c2a1430b84d2
SSDEEP 12288:qV6JvY67VMBNO/aXpXI22+VufvdIOKek1h4TA8bXQJYe:qV6J17W8CX32+KJNA80T
MD5 SHA1 SHA512 SSDEEP

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.9MB
SHA256 c5d2770b1c6872f0d861eba098a6848cd859dafae1eb400a2c626b402360714d
MD5 494f553d1fd5d76c1ace1cb6d8ba35bf
SHA1 f42cc23f4935431c17f549c4d14f650341d58262
SHA512 a7f771478ca51152ca9deac1810e4466e887ab97c0bee58e3293c6472bc9a271b61bbf2bcad2bff526e9b38bb5658ec0f088a4946cb9e4619ee44e1c11e7c6f2
SSDEEP 12288:aObsA4LWOsvAYFTI6JvY67VMBNO/aXpXI22+VufvdIOKek1h4TA8bXQJYe:LsL3UTI6J17W8CX32+KJNA80T
MD5 SHA1 SHA512 SSDEEP

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.6MB
SHA256 a185138898a80a8c3c68cf3ed834417bf0ba87eeb703a044c888d4fa90575eb4
MD5 b2f9acc1c3c1c02eceaaee63cc70c1e9
SHA1 70bce9f28835910e0dc39cdd76fbd4fca5c29801
SHA512 ab5af7079c5f1822eb7e739926a57600fc1812033821ebe53fad1035a09320a0b692d7062be823c343cdec85f56607b4eb7213034131b7a11250ac4b58c1ef1a
SSDEEP 12288:GpFtuO06JvY67VMBNO/aXpXI22+VufvdIOKek1h4TA8bXQJYe:3O06J17W8CX32+KJNA80T
MD5 SHA1 SHA512 SSDEEP

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 c91ece636827301565db77b32c711bb96b45189d030749ccd87f8e49955359de
MD5 2f2a481611ad59736198ea5b0aaf408c
SHA1 b308d12577fc62e6b71261d754c6fe024f8f5ee2
SHA512 595ad3205229b6ea715db358349f17d5bb85da819e4a7aeb91610f0a3f4bc3918b7a738392ed4119633decf5d173f460fe4920168429ce4a1ad74d4fcc684284
SSDEEP 24576:E7NM9YmZqmWMUkPjZM48Mv6bEhsp6J17W8CX32+KJNA80T:E7cBWMpPjN8DbEhLcW+S8
MD5 SHA1 SHA512 SSDEEP

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 cb992ef3aba289b09b5ef795bf5c98b34e31ad7202d13e4d2d8d2dec7ecbd0d4
MD5 f97c5432bd0b9db6ee86f38305b0ad52
SHA1 66c58321293f4415df2ee2778634e4d7afc3e70a
SHA512 3653147b16af68a73a18bde81fc7fc848ab7f7b41f585ce2dd9e5ae69e668af975ab1de48b0d94624665cd9cddf2718bb93674ab7c6632e0fce35559fa9be0cb
SSDEEP 24576:+W6BApg2YuyuNDYTabvcRvNYf8km1D6J17W8CX32+KJNA80T:+F2YuHNETovcvNYf8kmscW+S8
MD5 SHA1 SHA512 SSDEEP

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 1553f1b5ac8d144f612db0c48398ac580ff2f5774b53c724009eb8dc01cce198
MD5 68df9d411ae37e6baf249ba230991c0b
SHA1 d07040b6934486d866c699c1502662ccbe2b41a1
SHA512 1edbef40d17249d5420fe9d99eb02ce902a121b3e2af02c79c5ba28b66bf36ab6dda9e6d6da371455dfcef1f8dfe4f3e81af833e964321804b5da6f567f87479
SSDEEP 24576:uAFs06+Omlf3NXEbTog6J17W8CX32+KJNA80T:nFs060lVXuScW+S8
MD5 SHA1 SHA512 SSDEEP

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.8MB
SHA256 4ca1b25f8392ab0ca736ddc466624d054b8ddc55732b9e42214906806bb490cc
MD5 51872bbe4d5f5762063ae00058703510
SHA1 3fe9827a840360365b467c4a9e54e95b8ae48539
SHA512 b573351a64e23a4c9d81ce03aaf9e9953cc1619a16d7d029f189ceff648888aef0324ee1c6f5ce3afdb67000ec9b2863ccf5afbc384966c696b3282b856d61b0
SSDEEP 12288:/CJnJ5D3VkrVzxJ6JvY67VMBNO/aXpXI22+VufvdIOKek1h4TA8bXQJYe:6JnJ5D3Wdf6J17W8CX32+KJNA80T
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 90b0e6cc218dfe25d1f30e48350e5a0f4141ed6b110d5ff5d608acd887bc3435
MD5 917065f1de0039e6e712ed6efdcd49fa
SHA1 85559f95c2d7b1a7acfb380d8054ee0abb7f6b55
SHA512 e8c6e15f113d7a96480efc36f22fe61cb69801760f311cac9d13b7f36452fba38267d19a7d902a0e242059860790051be02ab146df80270919805a583d8d8fca
SSDEEP 24576:REPohm6/7IIXdwcXrif7qQncjlP65i3Vu66J17W8CX32+KJNA80T:Wo06DIKdwc+eQnSt65aVAcW+S8
MD5 SHA1 SHA512 SSDEEP

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.6MB
SHA256 a55b1bbef9e3bf9a12012dc7a1b41fea150b8fb01880d67cdee777004f6fefc1
MD5 58702b3307285427e2548eb751a9bc83
SHA1 4a30ea0a0fe010e880b68c7a67a4727c4a6a466f
SHA512 67092bfdea3a5dadd8e5befa1fc362525d06c79a21d06e6ef5746837a953ee4224c3ad1fb11e3c9dbc4ae62f6472f6b7ca87a11e517a58617e519408efa9a539
SSDEEP 12288:FEP3R7c6JvY67VMBNO/aXpXI22+VufvdIOKek1h4TA8bXQJYe:G7c6J17W8CX32+KJNA80T
MD5 SHA1 SHA512 SSDEEP

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.7MB
SHA256 65fc86e2a19eb374af165a6f6cd159325a8bdda7f42986b7cd795c48a7e1c345
MD5 cf2da1a32b181c22f90768640dc1cb80
SHA1 974572556b17247f089035b206ade3be5d1df5f0
SHA512 d7a73d8e7cd032bafe1947ea34f25fc183969a5dda5af3ef2410ff077de36e19ece60c2d1d6d57fbe55511616ee52c6dc477430032b3cd3529f4f2523dacd33d
SSDEEP 12288:8jkyC6JvY67VMBNO/aXpXI22+VufvdIOKek1h4TA8bXQJYe:8IyC6J17W8CX32+KJNA80T
MD5 SHA1 SHA512 SSDEEP

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.5MB
SHA256 cd2aeae5f2e822c702be5b8fc321ba3b43634fa83b40fefd0a00b5e406bd6957
MD5 6d1a2c0ef3694ba721ea81b86ef531fd
SHA1 89467b83e281248b0a3475a66e4e87202fb7da5a
SHA512 89868511ee60a3f46bd9644a04b1c0f5a94d3aa3c1106874eda7211a7f3d851b57f42c002fe6500e0990d935168b5ba13db3d317a478bb1b2ab8d25e5a6ed70b
SSDEEP 12288:cgk6JvY67VMBNO/aXpXI22+VufvdIOKek1h4TA8bXQJYe:Hk6J17W8CX32+KJNA80T
MD5 SHA1 SHA512 SSDEEP

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 928f015bbf3a84c8b4d01e5c5469517a715f51e800c5e0590bbeb0532effd0da
MD5 2b9c78cf199d16123defe16e0ecb5a6d
SHA1 f585982c941376988b023cfad1f6950c0a2a5be7
SHA512 8949d0c744584ce8bbb81be93df6689459ca01894c8d1d626275e9dd363f22635f29b355800c6060d4e2464a57e31c7d8737a7794e05a5ba8943794dd6a83a64
SSDEEP 24576:3Q9MxZKdcz97w3B6J17W8CX32+KJNA80T:3VKXEcW+S8
MD5 SHA1 SHA512 SSDEEP

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.7MB
SHA256 31c35ad65540839a54ec5c9cf7e6465d6313b71cff5b4cdb3a902d818f66d048
MD5 95d653eb992e1138e408ee815056cf43
SHA1 b80ff89328bf49c08243640e6dbecb76c7dbe3ca
SHA512 0ff2ced2aa857dcc64bda2bb370a0ed3c873fce4812280105e237ffa713f93f13ded6762817af31453089c6787c602910fe2703844b503b9e06bf6aa36ec7ea0
SSDEEP 12288:YyoKo2wRple9pO6JvY67VMBNO/aXpXI22+VufvdIOKek1h4TA8bXQJYe:YyocWApO6J17W8CX32+KJNA80T
MD5 SHA1 SHA512 SSDEEP

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 186017ef0313ad1ca7017ca9cb152626d02403f043eb570d78280a842886b5b9
MD5 8e802a51c9b5793b4b0a58bd5ba57338
SHA1 a15a174bb1aaa64cc2bb94523690fecd5a0d5733
SHA512 c92ec547348221d04939af61c5b29fa32c35a73db64f4bc8adbd1038a1f3ebdca8d4fc79eb2b66261407ffd6750f72f9e9336cce6d99583ae1752668e16d59e6
SSDEEP 49152:VWcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIKHcW+S8:F0zuNIn8
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/220-644-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/220-342-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/448-293-0x0000000140000000-0x00000001401A1000-memory.dmp

Download

memory/448-403-0x0000000140000000-0x00000001401A1000-memory.dmp

Download

memory/460-648-0x0000000140000000-0x00000001401D8000-memory.dmp

Download

memory/460-374-0x0000000140000000-0x00000001401D8000-memory.dmp

Download

memory/620-55-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/620-54-0x0000000140000000-0x00000001401C5000-memory.dmp

Download

memory/620-455-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/620-651-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/620-61-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/620-64-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/620-66-0x0000000140000000-0x00000001401C5000-memory.dmp

Download

memory/860-69-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/860-75-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/860-77-0x0000000140000000-0x00000001401C5000-memory.dmp

Download

memory/860-241-0x0000000140000000-0x00000001401C5000-memory.dmp

Download

memory/880-237-0x0000000140000000-0x000000014024B000-memory.dmp

Download

memory/880-39-0x00000000008E0000-0x0000000000940000-memory.dmp

Download

memory/880-38-0x0000000140000000-0x000000014024B000-memory.dmp

Download

memory/880-30-0x00000000008E0000-0x0000000000940000-memory.dmp

Download

memory/1008-400-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/1008-272-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/1020-302-0x0000000000400000-0x000000000058D000-memory.dmp

Download

memory/1020-415-0x0000000000400000-0x000000000058D000-memory.dmp

Download

memory/1088-19-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/1088-18-0x0000000140000000-0x00000001401A0000-memory.dmp

Download

memory/1088-25-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/1088-236-0x0000000140000000-0x00000001401A0000-memory.dmp

Download

memory/1108-373-0x0000000140000000-0x000000014019F000-memory.dmp

Download

memory/1108-252-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/1108-246-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/1108-254-0x0000000140000000-0x000000014019F000-memory.dmp

Download

memory/1300-331-0x0000000140000000-0x000000014018C000-memory.dmp

Download

memory/1300-640-0x0000000140000000-0x000000014018C000-memory.dmp

Download

memory/1740-259-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/1740-257-0x0000000000EE0000-0x0000000000F40000-memory.dmp

Download

memory/1740-270-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/1884-454-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/1884-650-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/2028-16-0x0000000000400000-0x0000000000554000-memory.dmp

Download

memory/2028-6-0x0000000000A30000-0x0000000000A97000-memory.dmp

Download

memory/2028-2-0x0000000000A30000-0x0000000000A97000-memory.dmp

Download

memory/2028-0-0x0000000000400000-0x0000000000554000-memory.dmp

Download

memory/2240-643-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2240-325-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2240-639-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3168-653-0x0000000140000000-0x00000001401BC000-memory.dmp

Download

memory/3168-488-0x0000000140000000-0x00000001401BC000-memory.dmp

Download

memory/3220-401-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/3512-645-0x0000000140000000-0x00000001401F8000-memory.dmp

Download

memory/3512-354-0x0000000140000000-0x00000001401F8000-memory.dmp

Download

memory/4332-389-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4332-377-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4348-479-0x0000000140000000-0x000000014018B000-memory.dmp

Download

memory/4348-314-0x0000000140000000-0x000000014018B000-memory.dmp

Download

memory/4688-238-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/4688-51-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/4688-50-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/4688-42-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/4836-404-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/4836-649-0x0000000140000000-0x00000001401FC000-memory.dmp

Download