5ce9b55f25ee687b7d63452b0ac8d5765595b7151b66b0fb6d0c507cb427bd06

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
12/06/2024, 16:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-06-12_17cae72487cb4a7713a0a546e7955948_avoslocker.exe
Size 1.3MB
Sample240612-vbqnwasblf
SHA256 5ce9b55f25ee687b7d63452b0ac8d5765595b7151b66b0fb6d0c507cb427bd06
MD5 17cae72487cb4a7713a0a546e7955948
SHA1 c3d6e7467c82e64dae2cd80e47887e92d50f0af1
SHA512 73303f299f0c1db44b1fac75b91ce0de4cf2bee82e00299aad5e01ab3745695e88f4a8adcade6bc284ba8fc9289cce942b1a8731832d21000340198a12515220
SSDEEP 24576:g2zEYytjjqNSlhvpfQiIhKPtehfQ7r9qySkbgeddc+pFB5z+//ufNRoZW:gPtjtQiIhUyQd1SkFdK+pFzz+/2fNR
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
4852	alg.exe
2368	elevation_service.exe
1800	elevation_service.exe
976	maintenanceservice.exe
4848	OSE.EXE
552	DiagnosticsHub.StandardCollector.Service.exe
1092	fxssvc.exe
1416	msdtc.exe
2764	PerceptionSimulationService.exe
3228	perfhost.exe
4952	locator.exe
820	SensorDataService.exe
2480	snmptrap.exe
3840	spectrum.exe
2724	ssh-agent.exe
3036	TieringEngineService.exe
3632	AgentService.exe
4116	vds.exe
4392	vssvc.exe
4540	wbengine.exe
2720	WmiApSrv.exe
3044	SearchIndexer.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in System32 directory 26 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2024-06-12_17cae72487cb4a7713a0a546e7955948_avoslocker.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2024-06-12_17cae72487cb4a7713a0a546e7955948_avoslocker.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\74998eafc8648821.bin	alg.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	alg.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\110.0.5481.104\chrome_installer.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\110.0.5481.104\chrome_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Adobe PCD\pcd.db	2024-06-12_17cae72487cb4a7713a0a546e7955948_avoslocker.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	alg.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateSetup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_96109\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_96109\java.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe	alg.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e5e917a9e8bcda01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d5c5d2a8e8bcda01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000538715a9e8bcda01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008f7321a9e8bcda01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008ce2b2a9e8bcda01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001fe755a9e8bcda01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000f5e4ca9e8bcda01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000dc62d0a8e8bcda01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
2368	elevation_service.exe
2368	elevation_service.exe
2368	elevation_service.exe
2368	elevation_service.exe
2368	elevation_service.exe
2368	elevation_service.exe
2368	elevation_service.exe

Suspicious use of AdjustPrivilegeToken 42 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2932	2024-06-12_17cae72487cb4a7713a0a546e7955948_avoslocker.exe
Token: SeDebugPrivilege	4852	alg.exe
Token: SeDebugPrivilege	4852	alg.exe
Token: SeDebugPrivilege	4852	alg.exe
Token: SeTakeOwnershipPrivilege	2368	elevation_service.exe
Token: SeAuditPrivilege	1092	fxssvc.exe
Token: SeRestorePrivilege	3036	TieringEngineService.exe
Token: SeManageVolumePrivilege	3036	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	3632	AgentService.exe
Token: SeBackupPrivilege	4392	vssvc.exe
Token: SeRestorePrivilege	4392	vssvc.exe
Token: SeAuditPrivilege	4392	vssvc.exe
Token: SeBackupPrivilege	4540	wbengine.exe
Token: SeRestorePrivilege	4540	wbengine.exe
Token: SeSecurityPrivilege	4540	wbengine.exe
Token: 33	3044	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3044	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3044	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3044	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3044	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3044	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3044	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3044	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3044	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3044	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3044	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3044	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3044	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3044	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3044	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3044	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3044	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3044	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3044	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3044	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3044	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3044	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3044	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3044	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3044	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3044	SearchIndexer.exe
Token: SeDebugPrivilege	2368	elevation_service.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3044 wrote to memory of 4072	3044	SearchIndexer.exe	113
PID 3044 wrote to memory of 4072	3044	SearchIndexer.exe	113
PID 3044 wrote to memory of 928	3044	SearchIndexer.exe	114
PID 3044 wrote to memory of 928	3044	SearchIndexer.exe	114

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2024-06-12_17cae72487cb4a7713a0a546e7955948_avoslocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-12_17cae72487cb4a7713a0a546e7955948_avoslocker.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:2932

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:4852

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2368

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1800

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:976

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4848

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:552

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:1592

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1092

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:1416

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2764

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:3228

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4952

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:820

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:2480

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3840

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2724

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:2076

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3036

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3632

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:4116

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4392

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4540

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:2720

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3044
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4072
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
  2⤵
  - Modifies data under HKEY_USERS
  PID:928

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
Size 2.1MB
SHA256 4aa1f66106eb8ae96370012a6fd01aee864edfa3eec63c8b35057bd5467f81fe
MD5 f07ffdc94e40cae432860314983e0519
SHA1 251bee4e16657a8771c078aefb121c8060a0a9bc
SHA512 71468993299e3272ad0f0d88dd861b25b89b5a249ccf97ff840abbab8c8fbc09d39a622a7b0124dd204d1772d09fa55e0e4098b69ea5275727ce89d4a4639d87
SSDEEP 49152:cuYk3H5koUXfTqkkYLO/W2buywzMbOX+T7z5z+pFzz+/2fNR:cPfTqi90bn+pFtFR
MD5 SHA1 SHA512 SSDEEP

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 c1a68aba44a26be21105d18d156ac0c22f2dd1c0d0b1f62c3e352feb4cdb2f5b
MD5 e82f9c882b63ee57692c6e74582506d8
SHA1 f68a149baa8b88c279e850982dd3382343a59915
SHA512 c51211b81c35342abfa253bcc1b5ff6031866ef0ed7bc4e111d96a00905783570a90f8a461416d1de4c884cd47c8a65caf84e4ce93c27d599abed0a1602752f4
SSDEEP 12288:rcQiQmNJLBsunEMYlc+pFByStv9JRa//inz86NRo1qiRlUWC4kXzVC3:TidnBsuEdc+pFB5z+//ufNRoZW
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 a2612adf1e4eb23fab5eb694d643fa095a9895e453903c97a0beef9669cce80e
MD5 5a2fdaf6d6d7fe9d05ae07404d20a998
SHA1 e219f4e59f3ef0262fdcd6d42f9c00f2a786b2f8
SHA512 dce6a13c1b935234e61bb240678c061ec0df6b71777686a76fe4edaed78f0f82aeb412ca6272d0a1b39db13bc81c83d416d68478092fc96da17b29e564675106
SSDEEP 12288:E7a3iwbihym2g7XO3LWUHfh4CoQYlc+pFByStv9JRa//inz86NRo1qiRlUWC4kXa:J+gkEVfh4CoBc+pFB5z+//ufNRoZW
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 7a7eede9b1532c0dcbe7be7e9bc8dd4392106f57f9a6d703b72818382f183995
MD5 c3471b8059f51800b7083b85e3e41839
SHA1 706cfc016da15e58a84df9c25df5d55cb71cc296
SHA512 753a7b5206ff25f87c62d1322d66fb89ffdad1ebc44a828a013923d9bc66f113c42216916fbe3df4a34a1d5b140a8dcb393ffbea977179f68d470d9aab488da0
SSDEEP 24576:xBpDRmi78gkPXlyo0GxjrKc+pFB5z+//ufNRoZW:jNRmi78gkPX4o0GxjT+pFzz+/2fNR
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 ca3dc537f4eb0d165236bca7bb91cf2dfe607b11d4707406c55067ba9141da6e
MD5 edf59d52611dcfc464738db12fc21c2d
SHA1 88d9ab3297c6c775ff8d0e1ef08623c0ef3dff20
SHA512 4ee8287aace80f808ab04d318074bb626bc2f7c847d358afee2cfceaf1274aa20cf8e2861745a79d735786db233b74bda211af79222356f95afce0a7fa98fec2
SSDEEP 12288:VfC6Aj+TN5uixZN+8rKhUdTC/wE1MD0Ca5ZIXVQYlc+pFByStv9JRa//inz86NRa:tLOS2oyPIXVBc+pFB5z+//ufNRoZW
MD5 SHA1 SHA512 SSDEEP

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 7875f6b030dda88331388dbd3da01a652f40feb79c55d5fe2054b3a752ed0f28
MD5 28b139b9b71e6e3ba6d4b84a0fd161cd
SHA1 a09c4c023f1f2a6c4af1be9ef71be96f129f35ab
SHA512 d1d5c15221953cdcb26d5ab41a3205aa3d3e7582cf65891ea3e18dd4126425f39e0a7c44790c888f86370667f24a4fbb2807fd67d3eb5f03d5d24b0352db4732
SSDEEP 12288:tfyYlc+pFByStv9JRa//inz86NRo1qiRlUWC4kXzVC3:tffc+pFB5z+//ufNRoZW
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 a8a93766a6c097bd0547fa256daf4e5c9d69d8cbdf2264c4cd495e9cefe1e6f5
MD5 ff1c2c029d881895e8246da649d48438
SHA1 efa26a9d18759c400231488458c79de9da3a1801
SHA512 62a2f3b0ac8a5c87ab44e0882f8fece7124b4cc42648104e287b14e4ef5e82bd7974aafff32a96b7d9f0607bc3c92942e82d19e706273f4ee5501320a651ce78
SSDEEP 12288:oeBNUbTVO86UhYlc+pFByStv9JRa//inz86NRo1qiRlUWC4kXzVC3:oJIUQc+pFB5z+//ufNRoZW
MD5 SHA1 SHA512 SSDEEP

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 c88e5bc1e8605d5db3653d67f2ec587f575e2d68d355adaab36a234817bd9756
MD5 4a5dffb8c95157d2c502743f6b97744a
SHA1 6497c3b57af3298ef0fcf209d16025b4f2b97222
SHA512 9cda05e48b564332a0b817366162b4dea2682118650d4cc6179b9495c3bfab89fd310cb81e14681d7415e6de3dfe0c6041da16107c56b883520706b4428dd300
SSDEEP 49152:PQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THY:PQvGAdlCEL8c/yRNw5Ci+pFtFR
MD5 SHA1 SHA512 SSDEEP

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 917488a3513e94b2f88dcb81ac90c3d4454e167c9082c279cb7c820bc4d9d3a1
MD5 d5a5f3cf7d510f0013ca2ea87c0db03a
SHA1 4b1d32dac2c2a4c35bef1d94f0465a9150f85cc0
SHA512 c01a26398621eed87de7e49ddfb521bf99bf6865fc77cb5e47667e2540e3eaee0af5874c2cd2a58810611776816e20cd1a061f96f300a275c1090173488bfc91
SSDEEP 12288:FAwSfxL/2Dc34DLLmt0LDQewsAjHYlc+pFByStv9JRa//inz86NRo1qiRlUWC4kq:mdewsAjSc+pFB5z+//ufNRoZW
MD5 SHA1 SHA512 SSDEEP

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 0a1b6aa5a72fbc8fd82f39e9ae7e1c56d6463057b5241fffcc1106922c2f30b1
MD5 a027b7c73733e168e666eb590a407045
SHA1 bc6c2651faf522002386f07adc4f5363b7d9a67f
SHA512 1b8f47226dd318b749da474a7d834374e3cc785783160ddfdf52ea670046cbfc7f0cfa4cd9c5f236f9626428dd1e4823eca9a2ec5448b57280931d82176946e1
SSDEEP 196608:7UEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHY:7UEtQevvqc2W1cpV2EI32
MD5 SHA1 SHA512 SSDEEP

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 841be679ffcdbbdeb39ee290cc6d1614516f22fff70036b5456f03c052b4057a
MD5 fad50800cb761bb5abfd6b12cb39fd74
SHA1 f951a21a5ad99fd83111c1dbc0f5438f8b3eb80e
SHA512 41bf0f6aea31dd123b74a2f41d356c736048f671f9010ad8473bd9aaad4f852c5f8c6ded8bdce8f0079529a4cbcf03a787033b008a5cb4899ab13a70c0eb7738
SSDEEP 49152:ICbRquA/m2yL5zTfFiV+XenmE3/zH+pFzz+/2fNR:hoquVjnmm+pFtFR
MD5 SHA1 SHA512 SSDEEP

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 c0622b5e86d797c0a156c4eeda3ee28490bf56df88805eb02ce29517c8ef8507
MD5 4b3711644b1bb70bec84dc19a40a4734
SHA1 37881c5b6fc41554598014469f2bfc9ce5bf279d
SHA512 8ff71841230908d59f70bbc31e8dce0fa467e447c66b3a6515272d6713b76395441afa7216d6f9b95f98a5e78bdebb9288586ece7032c99fc9da7b7575c66937
SSDEEP 24576:JAhGLJIFoiwtA5l7S53Rc+pFB5z+//ufNRoZW:JAMyFoiq52+pFzz+/2fNR
MD5 SHA1 SHA512 SSDEEP

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 5edf70cc7fd2cafe2f7c48b6d8929dd4347a35472a0a3709903e198f7875e06b
MD5 de24e860eccc4c8a3e8f2b43495cd71b
SHA1 621ac6a4c0de49cb49fa9807ea0b76bb338d4a94
SHA512 617cc63f131e24a7c0a8bc55173ac224087086de7ad51390a910bd6fd6cf2ff2625bcc7f3ffbaee763761e3601fdb0d0393c6b288811cee40949d85a8c593833
SSDEEP 12288:Imw5HEjsChNVBFgl0WDm+CEYlc+pFByStv9JRa//inz86NRo1qiRlUWC4kXzVC3:lwuoOW+c+pFB5z+//ufNRoZW
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 12044fd136df37e1afe15038dafc4c6b46a49305db05edd3e0d9ae3fa418c31c
MD5 4272586c7dc70f156ab086ca515540d9
SHA1 8d70594fd6c03c6d23867158cf07e566ed911618
SHA512 279f80eecc23e4c063698d2a52af12682d2c5d8db620cd1eaf54184ede12412b828dde98da9786149a6b7f1d346eef614cba913ab112d47e6e7b9a87fa976d39
SSDEEP 12288:aBZ1IyXYlc+pFByStv9JRa//inz86NRo1qiRlUWC4kXzVC3:UZuDc+pFB5z+//ufNRoZW
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
Size 5.4MB
SHA256 3601d2382c1ede920a66aeee78e6c83fdd5bc3abc4ec17bca273e164cf70db08
MD5 58a90f32f98c53a47bd84cdc287cad2e
SHA1 6115528becfaeb15a72e63723fbb926b30065c0a
SHA512 82f5a0778ddb4566df562259afbd52506f2f35a67cf8a875a676809a429263faa2db11669c2f2ccd850772942d7415e38a5d374240420da0a07b3440418054dd
SSDEEP 49152:V0kwIi7c4xZlm5knEtw99Kn/2vim7vgv6m+yyJ/0gbvjR7yY7BHi3u7L/gBUUWLI:9wfhY7g/rLd7yYA3awr341gu+pFtFR
MD5 SHA1 SHA512 SSDEEP

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe
Size 5.4MB
SHA256 2e1415c11267d8516c384b0a8669209c03b1d4b2166124b089ba7e63da5c795b
MD5 08e6188d864dc7719910cf84a2e95a9e
SHA1 8df26fc50c41320bcbcce35d84866ec9879307c6
SHA512 3c7ca99c5eb61ec1b3b1dce592047c32e2cf5b3787ff4b0c461c1fae47a231e17b64eb027ebadaf5df156c2d98579c4b05f775d14c5de2f080e3055746bb8bd0
SSDEEP 49152:o0kwIi7c4xZlm5knEtw99Kn/2vim7vgv6m+yyJ/0gbvjR7yY7BHi3u7L/gBUUWLI:OwfhY7g/rLd7yYA3awr341gu+pFtFR
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe
Size 2.0MB
SHA256 317f656ea7c2d0b7b1b085e054a4dd8921189c9752e22de99c9785e036249736
MD5 0ddd8a6f082fa8032d6b3796745cdf65
SHA1 e52c666d58010b958caf7614ed9518f8f5d31a9d
SHA512 da55d5a0275062c0f70a9cce4091ab4ac16e64d894d801dc55084351159b53c039bc263220f5ca55daeec16bc0bee52ec9e9d4133b17e09ae5caca4fe1a96f9f
SSDEEP 24576:DcTyYv0FteQU+5I2kjgD6iQacA+c+pFB5z+//ufNRoZW:DuXv0Ftpn5606zOL+pFzz+/2fNR
MD5 SHA1 SHA512 SSDEEP

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
Size 2.2MB
SHA256 89eb288b53aeb4b00d8f8d9898f3c263f1572fa4cb44c241d9d1451decd1494c
MD5 9c198b9f796df3fd16ec3a9ba95ff14a
SHA1 ef98551435c498b50a472cec2f217e09db9e628f
SHA512 52b07959892f31ba9acdc67c2b98eb1b1034aef0a8e039e9a2acaf9df7d32efc6aab24456d2b59fd9f28020e7af2ffff018c5bd70a237e093334ee6253ef8b60
SSDEEP 49152:1y7mTd0GxN8jyynxHjXKUyn4GVcbDSKrNTxn+pFzz+/2fNR:QmYeyxHjWjMTn+pFtFR
MD5 SHA1 SHA512 SSDEEP

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe
Size 1.8MB
SHA256 fa73d599b7b86e7cc8d1c015f2818e912dc188c62e53451a963e8cc10a3c5653
MD5 6154d0ff975c439f0f57427a4b811b5c
SHA1 e8701a88b7b47c85b2f5cfd87566af632ea431a8
SHA512 7125a7028958ee5729570480a62af0ea218211f9cba5e4f362c67fc17c1d43c16d676b7e28c033c6413735d9d406c8d3c2baff537badf766aa1c33156fa1e4ed
SSDEEP 24576:06drZn1WEci182IEUeNbJeRgUebgW816rc+pFB5z+//ufNRoZW:0WnDci18yNNUgbYz+pFzz+/2fNR
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 1.7MB
SHA256 20f40f4dc67a4f7b206cb4fba36f02cebbfad9bf59b3e6a364762ac891643b36
MD5 ff3d76019c352832543455dcc0601600
SHA1 eac8bb12643997ee0da556d25f911c0036509be2
SHA512 00b98d015067a5cd156a309ee0ae98739e1b77ffb80159f4f38c7ca9649427b3d6ef619b1bde9dca3e2608ba09c0e3ed73d656a17ef82185095d0822ab85bf86
SSDEEP 24576:mk5lHW5EzMZupO80G2reD+melRgTTv/1nyEc+pFB5z+//ufNRoZW:gizMZm0GhamSoA+pFzz+/2fNR
MD5 SHA1 SHA512 SSDEEP

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 19827fb515b88d35cba11ef95c70eb310ea30c27e4ab1fd15b59c55be14534ea
MD5 df2f3f5189364d51f2d720d71b1ff766
SHA1 b09c2c7b8af0c8b1b8ab84098f319f7d58e33e66
SHA512 c5ea5b268b8f5cb061b3b4a8ffe9615ca5c74ba342f676d1da160c5e0e5e32b2f5486e82f2038f5293ed394257c6624987b16742fbcef9a24b821b3ab7b2647c
SSDEEP 12288:RKYlc+pFByStv9JRa//inz86NRo1qiRlUWC4kXzVC3:R3c+pFB5z+//ufNRoZW
MD5 SHA1 SHA512 SSDEEP

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 87c09b4c6ed5cbd18eccf8473bcf8d7241f536a6d5a88f65b6a4d4198bca9355
MD5 bd33f05b9c2c1b3841cf7670e6fa2c6b
SHA1 af866efdee1a50539f758b6f442f2cdb60e5d473
SHA512 829ba650c31851ccfc9877ed912df298a3edc20a3d9b0c42a320997fcffaeaf6ba8e79d9853bd99a436c5dd26d116b6c7467da57a73ce903df0cd543c2706c7e
SSDEEP 12288:X7Ylc+pFByStv9JRa//inz86NRo1qiRlUWC4kXzVC3:Xmc+pFB5z+//ufNRoZW
MD5 SHA1 SHA512 SSDEEP

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 45b51d2a183da682a454df49b4241c4a9cb748867859e4ad406597eec0a62c7c
MD5 d91bb28aa6a5b4dcdbbf9b807d56e658
SHA1 ea599efbce88ae51b4143929721d0f5a4d2dbb65
SHA512 4f06a9b2021e815601f4d6f8ea28fa5fe6f2d8ff1705ec45f98ccae858c8bb4d330e1018bef80e6fd4078016c1f92487600c213d22c820d2c850c4e1030a217d
SSDEEP 12288:hZYlc+pFByStv9JRa//inz86NRo1qiRlUWC4kXzVC3:hIc+pFB5z+//ufNRoZW
MD5 SHA1 SHA512 SSDEEP

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 4dbfcf1a00d34bca76e12b91770a77a208da3ddd67f6fcd323227e9cbf78816b
MD5 366f1bdbaca40369ad1ffa36033a2fb2
SHA1 8ce8d2f9e9b60041240976eff905784e78985165
SHA512 331704d2fa18e005ae453bf507bf71664b4b161128a031a0a38c7634aa1ad02dc1e61579d8f218c4bc6ced0da14216cb53845df36f05b9c592aa201366bb7b4e
SSDEEP 12288:/VgYlc+pFByStv9JRa//inz86NRo1qiRlUWC4kXzVC3:/c+pFB5z+//ufNRoZW
MD5 SHA1 SHA512 SSDEEP

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 82eb867e87ecc8ce5bb3412bed37caf664eac3e65b229656964bb1b23532c7e1
MD5 ba1b01cd5bdd95a0f2859240114dbc23
SHA1 f4573a7a7ad80436bd6645aceb57ac0e50ea9899
SHA512 92750a6c0bc86712c395712ea54ebac0b794df7c47fe1313df57dc5cc3f8547c5433aa7efe62376e5cd367f6774d6d724ddfe8d4284097ad951f56c5bebd7faa
SSDEEP 12288:eIYlc+pFByStv9JRa//inz86NRo1qiRlUWC4kXzVC3:e5c+pFB5z+//ufNRoZW
MD5 SHA1 SHA512 SSDEEP

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 f05fc5e039d86b91c562eb49eff8e00f1bd8eb75bb60d10ae1192dcaa365bd9f
MD5 c062c37ca2688326d1c215339e57d6e7
SHA1 2e746d3fbf31ffdc6e89d9193c2e5cd39cffa70a
SHA512 1bdc4390658a3dccf5d6dff394428dfc1c105cf95e750fb8d9a1e324a8ccae3f4bde6035b05789e5f103ea7352b796a14259c98c028a812957be3b7e85a9260e
SSDEEP 12288:o/Ylc+pFByStv9JRa//inz86NRo1qiRlUWC4kXzVC3:oKc+pFB5z+//ufNRoZW
MD5 SHA1 SHA512 SSDEEP

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 8a990b2b7ad5bbc60b5832729aba35b84536ebce73a1eab1316f9c6f9c3fc0e3
MD5 41b0422522cc89c0c0b0ce624ed2cf83
SHA1 51db6d2bc6466a79a325a437c2ed95ff1c3d58d4
SHA512 0912841b71355e62503f5436b39294326fb2221eff5d88159ba6b0680cf9534e1cffb296583a15506aa0aa6ad0aec59be9540bb05706bea712138f8a7d6be75b
SSDEEP 12288:pjYlc+pFByStv9JRa//inz86NRo1qiRlUWC4kXzVC3:pOc+pFB5z+//ufNRoZW
MD5 SHA1 SHA512 SSDEEP

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 daed28a6ab77508a2d11b518a06afc082d0f284e64b9bc28ca00d4393dff92eb
MD5 cd6b03f6b63b3e9f80d17a1ac7fcba66
SHA1 a246c45f4ce4b3476b7cacdc259d9912a4a9e9cb
SHA512 0ca5bae54f28c440cecaa33afd2668f75b9dfd0b2f31895787f06520abebdc6620423c4136f1bf0545ce44db013f51e88276facc9460ca94961e07a2df819d1f
SSDEEP 12288:qiZwb6zzFEoS2cPvybYlc+pFByStv9JRa//inz86NRo1qiRlUWC4kXzVC3:NZMSzFVSOGc+pFB5z+//ufNRoZW
MD5 SHA1 SHA512 SSDEEP

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 79224221d44a1d279a4cecd8b8c8d903b0487c76055de07422d2d8557b284cd9
MD5 10561fa7f3fcfa8bf1e7a40066fb1715
SHA1 f7cde6390a47832dcd87951ba163bf1dd411b347
SHA512 29851122c58f43dd7601d0fd75b3e4d9e2361cc6e7be7a7513e3e91904b51be373310b5e31128e4c3d4b7b9867464d939869b9429e0a5179678792ee38ad4f9b
SSDEEP 12288:hGYlc+pFByStv9JRa//inz86NRo1qiRlUWC4kXzVC3:hzc+pFB5z+//ufNRoZW
MD5 SHA1 SHA512 SSDEEP

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 82bb45ab5538edfa0c3cfcabe7c8ed8c36ae2e7f965889ffeda259040f54fe1a
MD5 706fff32b2e68e793711f18ebc0aa701
SHA1 74c220e177198138635a176814c1e1badf7360fb
SHA512 5f97b6b3b89a309904a49a16ad26d4cd2532d43a915d5ecd52c6e4f05b7cfe8d89d59873ba8fb44a177d88f52b07cface3ed15c5289041f7dc1c6f9b27fd7556
SSDEEP 12288:uCYlc+pFByStv9JRa//inz86NRo1qiRlUWC4kXzVC3:uPc+pFB5z+//ufNRoZW
MD5 SHA1 SHA512 SSDEEP

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 58cdc5e6cc5491f6f811eda42fb135d33a4de2bf8dccedc5bd354db9603a282b
MD5 cfc5e22c1aeade7bac17a790aea1b747
SHA1 53a82dfcbbb114d0544928854ea9b9c69d8011d5
SHA512 3f809c1232b727c912ca8c7c03bd5d9e4d3741707fbe15112e90dd9e8155081037b42d3c832befeee4f244cfdcc2bea04a8744a392e330d37fae12e2ecfdc11c
SSDEEP 12288:TyPz5L8XYlc+pFByStv9JRa//inz86NRo1qiRlUWC4kXzVC3:ezyCc+pFB5z+//ufNRoZW
MD5 SHA1 SHA512 SSDEEP

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 60b2664f92d07be771bb000d8da604d7f8a3c1b04df0b8cc51449c3f9be9477d
MD5 c3570bb3cb3d139afbb873a03cf8f698
SHA1 8f80c1f67ed66a696f8bdcd4dfb18433df11cebc
SHA512 82459bbb1bc4c27267593c4fec7799e4c76498ff60cb73574cab8262c6de42e8d1c442a9dc58eca81320e47dbadf126b8ac65d1db088dc8ab5ef28cb1d4eed63
SSDEEP 12288:eGYlc+pFByStv9JRa//inz86NRo1qiRlUWC4kXzVC3:ezc+pFB5z+//ufNRoZW
MD5 SHA1 SHA512 SSDEEP

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 29fd93c3ddcc1b3d089cd11dbda69357abb4e1b52381f3572444b22ebc5033f7
MD5 dcda99dcc80fc9ccc24294ffb8473950
SHA1 c43355fc9b8617c3e6d701d78af63f1700ceadf7
SHA512 7b9f9c7e9d61b5d49a80813a4993b10bf417bd892feb7881f8c3805b8812c921e3533803627db53cd2c62f90b9ab8d4e87eb1bcde1af070bf4014b3ad9edba0a
SSDEEP 12288:+GYlc+pFByStv9JRa//inz86NRo1qiRlUWC4kXzVC3:+zc+pFB5z+//ufNRoZW
MD5 SHA1 SHA512 SSDEEP

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 e46707004d6281e711e34621b11b63284ca7870837309840eed4c85a3e0668d0
MD5 002bd004519983d86860c62fd70c2844
SHA1 ada93b7903200da8fb7d5991d47bad288ae78202
SHA512 a1fe665594be7ebe55e07d07a2ad83724273116d03d89663b820a3e9669041cc84dda9dcd22e73a02cd08d3fffb9911cbe74c030f17eaa1c9b97ccb741befece
SSDEEP 12288:CyPz5L8XYlc+pFByStv9JRa//inz86NRo1qiRlUWC4kXzVC3:fzyCc+pFB5z+//ufNRoZW
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 9ecd82264eac825f92ea3ae174665418bb0afad58c940944030c65cd4b2cdfc6
MD5 e32c090e048e64d4f605a353c57c2e64
SHA1 7d23700edd567c6c5e458d62f14be9e2862e5a51
SHA512 0f0fd5db8084db8012a929180748bd94370fca0262a35f157088f0718e2fd2850f8344d43e3dd4fac2d9cf3d9e306ebe5ed12e733de24d10f7261e23cc6781cd
SSDEEP 12288:eCd9eWYoaLHF3z0z04PDvhJYlc+pFByStv9JRa//inz86NRo1qiRlUWC4kXzVC3:PTHaLl3z0zDYc+pFB5z+//ufNRoZW
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 6ebb03b5661acc4cb67094f6f1cc7ce6a92013d45fec00e2913f4587cb418268
MD5 fd55385e3650dfd366db88cdfd3f83b7
SHA1 a784d24872acc38baf211ad237ce11f9c45b59b1
SHA512 b98cb5681ec4bbdc2235540392450f781742cd8c1f87e298e32f130f7da21cef2bfd382b384a17d73c8a95c833eecdc1724f4f03737d3a4747be418c1885a70e
SSDEEP 12288:Ii4e7+RdTfgwCHKy7GLbbdIvMYlc+pFByStv9JRa//inz86NRo1qiRlUWC4kXzVI:I37d9CHKy7GZsc+pFB5z+//ufNRoZW
MD5 SHA1 SHA512 SSDEEP

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 3736daff53ace42e62a09b0e2933945e4966e65cf15b67d9c4aa4874280a28dd
MD5 c874d860b32c151020a2d5ef571002fc
SHA1 3db5927f1b23910b5152f694d0431b461a0505cb
SHA512 fc8d5b0447546d2ca1df4a3b7c544365a4ddf1ef43e9421e2c10909b1522154409a6e5b4e191563b99725e78e39e271c6aca492c09c46cce025345af05fbeb6b
SSDEEP 12288:y5Ylc+pFByStv9JRa//inz86NRo1qiRlUWC4kXzVC3:yoc+pFB5z+//ufNRoZW
MD5 SHA1 SHA512 SSDEEP

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 69fd82ded22c4a1e7ac5b0e710c477e7f7ba1b9a861b18e298c39defdc8eee07
MD5 f22d42e2ab17153cbb652878f2ee2fd9
SHA1 f81e898349689defe4b82aa4e72ebf0f6f69664f
SHA512 e57655321ea0b723e178b78d6149e76abe806fdbe38da9467731cec4bd81878d152f481fd903778f8510b7563dded2c16b4fb094ef4c801cae910e927a0ca5ba
SSDEEP 12288:f3Ylc+pFByStv9JRa//inz86NRo1qiRlUWC4kXzVC3:fic+pFB5z+//ufNRoZW
MD5 SHA1 SHA512 SSDEEP

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 fb28caa632af7ec6bb2524186626733347425e41d407bc7456d8f282a47c8f1e
MD5 6a6826282a60dce064da25dc1a5e410b
SHA1 9eff7f1b9277b186d7fef2b4166d08cbfe23aada
SHA512 f684d57ebc2c421bbce2d0340da5958f740edad5539bdf9fad29a7768c715a1eafe755f2500dc118c31c43871b6b3832d331a5fe8bd60eef3f474fb1915d7297
SSDEEP 12288:9MYlc+pFByStv9JRa//inz86NRo1qiRlUWC4kXzVC3:9dc+pFB5z+//ufNRoZW
MD5 SHA1 SHA512 SSDEEP

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 d9dd4890ed0b21652cd83c2a65eb0910514d1397cfba451746809b642b389cea
MD5 3311b4e8d3da456bd8c8976587052bfa
SHA1 3cf5a60417ae4c62cb9f9efc20859db2f8d47752
SHA512 c5ac72cc54e145f46bb98eebb749a1a820973b41b58ea415125c8d970889917a73a1538da0775e42e2493459a747c213cd0c8fd840403aef9a01af711ddc064e
SSDEEP 12288:ZGYlc+pFByStv9JRa//inz86NRo1qiRlUWC4kXzVC3:Zzc+pFB5z+//ufNRoZW
MD5 SHA1 SHA512 SSDEEP

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 591e12689b7d89c415b38599362289bc74c4d6b1dcab97f11eb99e06fa163690
MD5 c27afedb30405d5c48d6d68cd4c13059
SHA1 75b2ce185e578d08c790028dd4616b75230b1499
SHA512 e38e98913f67919b4013290de50d9db640daff9ec29ab9d69d8e7dd4377df882f1d6031476a8e152f89715a77a3098bde345c9ae6376ceef1bf0969e8fad6676
SSDEEP 12288:85Ylc+pFByStv9JRa//inz86NRo1qiRlUWC4kXzVC3:8oc+pFB5z+//ufNRoZW
MD5 SHA1 SHA512 SSDEEP

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 adf8bbcee01d26d68eea917e53cda8d41a6a5f5640ba84e2204404782864ed19
MD5 47ceaf769784ae1611cac57202789393
SHA1 738cc96b60b6530614c161754ad89b8bb7985e8f
SHA512 41fb87a6c7fb307b1ea83b4a5384e20084b6e7701f773798b870eab0b291f3b52906a40ad09451e6d34aca9177f58165aca5cad4cb8982a0f642d1ad4cb3825d
SSDEEP 12288:1uYlc+pFByStv9JRa//inz86NRo1qiRlUWC4kXzVC3:17c+pFB5z+//ufNRoZW
MD5 SHA1 SHA512 SSDEEP

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 9d78cf652376d3a519e857f7076ec2801070866ce0384e1baa50094d8c616d59
MD5 bee26b8f0072343c165e1a9a64e4ad84
SHA1 eafc9c141d2bc0ed5764d5d7a9bd653cdc70a08d
SHA512 87465bf089bc5a9ab70d1deb1dd0c0f74cc0e434eb95dbd04e179d56743f7c99e6238f75e6e3a6593c7409a11db7fc0e10fbf9e23cd5f2d94c52f90e85d3f5fd
SSDEEP 12288:JUFmDDLtYlc+pFByStv9JRa//inz86NRo1qiRlUWC4kXzVC3:98c+pFB5z+//ufNRoZW
MD5 SHA1 SHA512 SSDEEP

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 e7e565df7d231d193642ffcbd0de61c888ed726ff730f3902e64b347f9b22754
MD5 722bea5f64e97c134dc33327bbb491c1
SHA1 63175ddd49a80dba3c8ab36a1b96f45d9bf4c9e6
SHA512 ff831649878f4e30d3fe42f752c5d7e15d24094e0f51f08f5ef68d2354e82a195049979fbf829c3367c342df3f956deb42dd809763e1680d1dd0393d494eec34
SSDEEP 12288:f6Ylc+pFByStv9JRa//inz86NRo1qiRlUWC4kXzVC3:fHc+pFB5z+//ufNRoZW
MD5 SHA1 SHA512 SSDEEP

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 045d4e6c71d56a91b18773e206dffd343d9d49bc7c5abd632eac35404bf7d9dd
MD5 9520f2d8fdf3a814c8721306860199a7
SHA1 91b2739a5a7badda203fbeff71f35ce7dbe334c3
SHA512 2c4bfe5b6e221f09ffce39a863fad59579a31467ffd15b42d43816a9edb0eb7d08442dabc5833c2d0657e81eb459ed0ab872d11518e651d3667f11a09e008f6c
SSDEEP 49152:9a0h2GEkuAe73q3pp46zwwQO+pFzz+/2fNR:9a0hNYG4Jwj+pFtFR
MD5 SHA1 SHA512 SSDEEP

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 dff3858d6e5f22d4bcf78dede882a72f1617fed1ba15963110dd036ab69711fc
MD5 1505bd53ab5bc05b13a7dc566b986d4c
SHA1 09c58131e2f16da4979b2ed793ad5263b3cfae47
SHA512 abca2fcf69ec1d94f681bb0f1e3bcf6ed50d99c2f96ef1e726311ddd9a23517f7909e758a376e311e9468a655cae1ac850c8010d9e3753a7bec48a00da4e1a43
SSDEEP 12288:MhbHjfXHYlc+pFByStv9JRa//inz86NRo1qiRlUWC4kXzVC3:MhbHjPSc+pFB5z+//ufNRoZW
MD5 SHA1 SHA512 SSDEEP

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 6b3a5f502d5355773ad12a001ed4af41ece5ed450d40ba555371b23ac003db77
MD5 ff6f810d0f4c84871388bcdaffe3b79b
SHA1 19c2212e13cca272f2d84ec08a388873313c2ecd
SHA512 4cc58c1cf8eddfafe74a52b58015bf6835f68a8e6ff043f86606d58c29829248c75d5e8827dadc00a847f8e7fe0d5562fdad21fe10e17d631dd9a541531e7e0a
SSDEEP 24576:n3YgnJcRTk4yti+R5dpR/6c+pFB5z+//ufNRoZW:nIgnaTk46ppR//+pFzz+/2fNR
MD5 SHA1 SHA512 SSDEEP

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 2c00a9ff154c221a2b9a41a3387893ce4f478e1f2e4adb31a1f6a735001a8e29
MD5 b97afc89dcff98ba9b4c0256635e075b
SHA1 9a1bde0f5d80f3b5474f275285338336a7813a92
SHA512 5bf4ccd876af4149d4265f4f01926d3bae2c51df9ce4b90943de4a4d66c4ae2a63ffd90e6d089e5eb37e7e75dfc2b1faf4d7cbd9947c40ed3f3042a625fb3f24
SSDEEP 12288:mmYlc+pFByStv9JRa//inz86NRo1qiRlUWC4kXzVC3:mTc+pFB5z+//ufNRoZW
MD5 SHA1 SHA512 SSDEEP

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.5MB
SHA256 e0b1525df5c5559bb1f81d0979ea3b57c5e267369c736a6bbe4ea2a61aa1127c
MD5 54c8b7979cff130ffd412dbaa780cb4e
SHA1 588862b5fa7ed3a93a80fb514dd20f71bd257b76
SHA512 fe35cff305dd6f6d69515d5cfa02b694b1689102376dfd2aa635809685b64c5eb0de7c7d13882a6ae48f7163acfb00cb886d4675310ff7820a8858bea0a0cf2c
SSDEEP 12288:UOb9A4LWOsvAYFTNYlc+pFByStv9JRa//inz86NRo1qiRlUWC4kXzVC3:5pL3UTcc+pFB5z+//ufNRoZW
MD5 SHA1 SHA512 SSDEEP

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 29b4372f49cace45cef81adc55bd826d4165b6b3e6f36f1aedb15034e4debdbe
MD5 be227128cfc278443fd661b60637effc
SHA1 21d62827826aeacbee7f70a13066a80ab81de675
SHA512 3271a96ecb0ac4592c90a2dbf1c8da2da9dd4125528a4920defa497ad4d0e7b3fd89b5593dac787c9f2ccc7f848a906677cd99f90d7a715d766f972d7bb35752
SSDEEP 12288:opFtpOZYlc+pFByStv9JRa//inz86NRo1qiRlUWC4kXzVC3:6OIc+pFB5z+//ufNRoZW
MD5 SHA1 SHA512 SSDEEP

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 f892dbba88c8193a4db5c33ab8ae7248b74f32f18dd7cdfce041aef9495ff2e6
MD5 d81d6de5bab7dffc3175dbf16979b70b
SHA1 1a0f6669637498cad15be30c2fa37696d4d7b1c0
SHA512 135900763b0355878115315cf8ab1537bc8b39bb3c7a56a13f2b59b103439f3801439904da3da86d42d63550fb1c06da311284ebb39ef3e3624a7c105d24d30c
SSDEEP 24576:z7NM9YmZqmWMUkPjZM48Mv6bEhsXc+pFB5z+//ufNRoZW:z7cBWMpPjN8DbEhH+pFzz+/2fNR
MD5 SHA1 SHA512 SSDEEP

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 aeb039215c02eb78daffbffa133a42a6c6910304c444c4045e16812344331dee
MD5 dc5fdbedf4760aab6d750783a9f2c9b2
SHA1 3982b1644d2588dc993397a67a28f63b57fcef2a
SHA512 0857ae3eef40293304870cb1fabdfff0a97e7edc0903efcafa753e227d56be19ff1fa8dc00d95a0e9c2950084d0d80648c0a56d3ef8473d002ec6642d8370073
SSDEEP 24576:SW6BApg2YuyuNDYTabvcRvNYf8km1tc+pFB5z+//ufNRoZW:SF2YuHNETovcvNYf8kmM+pFzz+/2fNR
MD5 SHA1 SHA512 SSDEEP

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 424f581982197fa765fdd7881cb0fdb8346e86421f6aefc28ed9392a1656fbb4
MD5 9451827ef48976db037cdcbd1eeebcaa
SHA1 6c9036b0f97f659900a1133a5d462dc390fe18f6
SHA512 a577b3cfb915ccfc128461ddeb91de5300647266a1006f5622f6f1b68cbe525623ebc41230591df967cc2641dfa8a0f075bd29897ec334ebaff99e8fc10ae082
SSDEEP 24576:VAFs06+Omlf3NXEbToUc+pFB5z+//ufNRoZW:aFs060lVXuu+pFzz+/2fNR
MD5 SHA1 SHA512 SSDEEP

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 9b72142338af50191fab4b362a127c865b7e1c1dcf5c378d2348065c06b54263
MD5 cc574e8043538ab980561fb7e7dee7bc
SHA1 fede32f115ba3d554a5200ef06692116a4eff3f7
SHA512 ce169bb2e89389be363930de101a8380cef6eac1c56d31919f8bd9150509121a1bd8ed09ef4aa9fcf504640ea398a2f0aebb7b71af9fd8ad1233283cc6093380
SSDEEP 12288:8CJnJ5D3VkrlzxKYlc+pFByStv9JRa//inz86NRo1qiRlUWC4kXzVC3:BJnJ5D3Wtpc+pFB5z+//ufNRoZW
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 66f895c28fb3fefea0ec5590ddd6cb76aaf1e7b7e7d98b2792fab9ca78bfd5d3
MD5 b98d2245ea1104a006689b2b58d81792
SHA1 13d5e5c7070b0c0a5d987bc2c7afabc88719663f
SHA512 3e4767583f6c1ba526ac049d5347757b00445974429321ae8da48dc118a0e044e7b56763416354acc6aa84da8e23c3c0f12060d8b8bd4ee966783e84bc681249
SSDEEP 49152:Ko06DIKdwc+eQnSt65aV4+pFzz+/2fNR:ra+pFtFR
MD5 SHA1 SHA512 SSDEEP

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 e439954847caf58fae7adf80f3be20c65b25bea2cc68c5dd9d0606876bd9a210
MD5 12f2cf7e9f7eab843e00f0e6aad2f57a
SHA1 e9da4f11bc8ba6febe7b027b57c620eab8252f87
SHA512 e6a4bbc89f4a8fe7a302b3be3d80b0611309c6cd381cf71fef7b0e96e28087a7b84331a04821edd03b79987d90cf10da81094c68ed2afb91b94795b6fd51f8f8
SSDEEP 12288:bEP3Rr+Ylc+pFByStv9JRa//inz86NRo1qiRlUWC4kXzVC3:grrc+pFB5z+//ufNRoZW
MD5 SHA1 SHA512 SSDEEP

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.3MB
SHA256 7abe71431ff8edf33a918e77a11273dc687556d0f86e4a5c5a0a13b98b7aa127
MD5 a84c21eb72c8ce9b8b7c201c1f84b210
SHA1 c23874385409cd78e71cfc1f074ee7cc947f6234
SHA512 3687b342ad05927f28b2c9eb145f2a2ae0087980d744c0328d2e1941f9b7649f4b349b745d2f592feadb61c87fa894e07edde86983c00276cca17746f5393538
SSDEEP 12288:QjkyXYlc+pFByStv9JRa//inz86NRo1qiRlUWC4kXzVC3:QIyCc+pFB5z+//ufNRoZW
MD5 SHA1 SHA512 SSDEEP

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 45b1e8c7224b3bbd1b61922a320b517fa1468cd4d16146c82bc2e5e1572d1bbc
MD5 c864e30aefdda5d7adbcf9824bc224fb
SHA1 3f16d0ddd3e56f34f944ff22141a24db06ed12c7
SHA512 f29381fd02f20e99333b1ad1330730f93b6efb7aeb19f64ecf0204c833bbd5024733ba7accb9b28a026eff97a0502233cba984fae5162f4b47c30cfbb0cd81b5
SSDEEP 12288:yFpYlc+pFByStv9JRa//inz86NRo1qiRlUWC4kXzVC3:g4c+pFB5z+//ufNRoZW
MD5 SHA1 SHA512 SSDEEP

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 c56e9cd45efd0e70f4168657ca6c7daa8e481fe91d497483b8dcece8024f6dc2
MD5 4c121e35bd82693b71a8dac7872f01a1
SHA1 092438dbc112cf66da4667aa2e46e76864554796
SHA512 6a452a07460fdbc3f1872b72a16f165ff2a699505d50d575d5528ee82b5be490326899e4b6950eda1d846d9ea85160cf0377964ff384669d3f56cb29ede33a82
SSDEEP 24576:WQ9MxZKdcz97w3vc+pFB5z+//ufNRoZW:WVKXU+pFzz+/2fNR
MD5 SHA1 SHA512 SSDEEP

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 773041cf27292e69e56533da52cae81348f34034be32b5c4f3b357f532450d48
MD5 53168b14075a5c3f146235cde5b22be0
SHA1 ac93fbac2873a13664b52b61eec97b44d720a9e1
SHA512 0013a28403b72f0f7ba78cbcdc0355cbd5f744f4224fab5ce708e280fa4056219561d620d919229edde5b26f53fbf6b0cdd2cd081ffc945534188560b5fbc19a
SSDEEP 12288:XyoKo2HRple9pzYlc+pFByStv9JRa//inz86NRo1qiRlUWC4kXzVC3:XyocxAp+c+pFB5z+//ufNRoZW
MD5 SHA1 SHA512 SSDEEP

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 eaad1357ad0811e454cf5a280ccdd94e1fe3010842224c8a6b86099fd8bd62d8
MD5 57d28ffde655f288760d826b68f3b2cd
SHA1 271a9a2455371c7f6b30e58cbec387e78713df2c
SHA512 ae2aff3ef87bddfe366777604ceb218fffb1d3a7dd0f68a53b5b82b3907d2d0b18943c54e86755c6e63ca3838789572f32e2300d14ef965b91e37555d5487096
SSDEEP 49152:7WcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIKL+pFzz+/2fNR:r0zuNIP+pFtFR
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 9449463652a889def6f31a55b0dc358f0f2926e6cf6f93c8f33e462326608128
MD5 623deb1517e5da9e9d01a3b7eac76dc8
SHA1 e02a6219b03154418ec724df6ab79ebba2ec0da2
SHA512 01ce49e70f29cf4491e9a194ec10a1d75e4f18405725a2e3647937587be279578f4b48bdedce47f6b7c7e55d18cc89f74863969effa90b32a2058a53b9694083
SSDEEP 24576:51QT7EcpfxR+N5AWAz3ooiYtjMqbrc+pFB5z+//ufNRoZW:sTDxR+N5YzTfjM7+pFzz+/2fNR
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/552-254-0x0000000140000000-0x00000001401E8000-memory.dmp

Download

memory/552-246-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/552-252-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/552-363-0x0000000140000000-0x00000001401E8000-memory.dmp

Download

memory/820-441-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/820-639-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/820-312-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/976-65-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/976-55-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/976-68-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/976-56-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/976-62-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/1092-257-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/1092-271-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/1092-258-0x0000000000E90000-0x0000000000EF0000-memory.dmp

Download

memory/1416-272-0x0000000140000000-0x00000001401F8000-memory.dmp

Download

memory/1416-384-0x0000000140000000-0x00000001401F8000-memory.dmp

Download

memory/1800-43-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/1800-53-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/1800-51-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/1800-239-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/2368-40-0x0000000000440000-0x00000000004A0000-memory.dmp

Download

memory/2368-238-0x0000000140000000-0x000000014024B000-memory.dmp

Download

memory/2368-30-0x0000000000440000-0x00000000004A0000-memory.dmp

Download

memory/2368-39-0x0000000140000000-0x000000014024B000-memory.dmp

Download

memory/2480-332-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/2480-635-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/2720-429-0x0000000140000000-0x0000000140205000-memory.dmp

Download

memory/2720-647-0x0000000140000000-0x0000000140205000-memory.dmp

Download

memory/2724-640-0x0000000140000000-0x0000000140241000-memory.dmp

Download

memory/2724-347-0x0000000140000000-0x0000000140241000-memory.dmp

Download

memory/2764-295-0x0000000140000000-0x00000001401EA000-memory.dmp

Download

memory/2764-396-0x0000000140000000-0x00000001401EA000-memory.dmp

Download

memory/2932-38-0x0000000000400000-0x0000000000554000-memory.dmp

Download

memory/2932-0-0x0000000000400000-0x0000000000554000-memory.dmp

Download

memory/2932-1-0x00000000022B0000-0x0000000002317000-memory.dmp

Download

memory/2932-6-0x00000000022B0000-0x0000000002317000-memory.dmp

Download

memory/3036-367-0x0000000140000000-0x0000000140221000-memory.dmp

Download

memory/3036-641-0x0000000140000000-0x0000000140221000-memory.dmp

Download

memory/3044-649-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/3044-442-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/3228-298-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/3228-408-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/3632-382-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/3632-370-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/3840-636-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/3840-335-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4116-644-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4116-385-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4392-397-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/4392-645-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/4540-409-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4540-646-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4848-78-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/4848-70-0x00000000004F0000-0x0000000000550000-memory.dmp

Download

memory/4848-242-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/4848-76-0x00000000004F0000-0x0000000000550000-memory.dmp

Download

memory/4852-11-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/4852-237-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/4852-18-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/4852-12-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/4952-428-0x0000000140000000-0x00000001401D4000-memory.dmp

Download

memory/4952-302-0x0000000140000000-0x00000001401D4000-memory.dmp

Download