820fdaededd6a9a09e1a87f94237a15c124ff69bba01ab86326dfd2b35a20f3e

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
14/06/2024, 00:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
820fdaededd6a9a09e1a87f94237a15c124ff69bba01ab86326dfd2b35a20f3e.exe
Size 625KB
Sample240614-a48pyayapd
SHA256 820fdaededd6a9a09e1a87f94237a15c124ff69bba01ab86326dfd2b35a20f3e
MD5 cce3fb3a257fc7ccbc7f26de5ed4ee2e
SHA1 ea8ebcc6dff6febca51aa2b4bbc1181bbf29f2dc
SHA512 4b0bb0efaf4ed3a5cd27229f7937662566e059191f8c667abab2e5ff1f5e3e72f93ee292ccc40d11a2ce30dd2d9377546ecf492d1cf885d872e9bc97256464cb
SSDEEP 12288:o2vDFaBfvfoPDct6SlxlwkJJrqQoUhTFfPLgpRtHmr/UNvp8hMoZUDNx:VZayDcMkqQpRQmr/UN4MbN
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
2664	alg.exe
1020	DiagnosticsHub.StandardCollector.Service.exe
4856	fxssvc.exe
1368	elevation_service.exe
3292	elevation_service.exe
5272	maintenanceservice.exe
5332	msdtc.exe
5140	OSE.EXE
2408	PerceptionSimulationService.exe
3996	perfhost.exe
3596	locator.exe
5912	SensorDataService.exe
5388	snmptrap.exe
1804	spectrum.exe
5872	ssh-agent.exe
1912	TieringEngineService.exe
3492	AgentService.exe
2208	vds.exe
1852	vssvc.exe
608	wbengine.exe
4048	WmiApSrv.exe
5796	SearchIndexer.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in System32 directory 37 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\fxssvc.exe	820fdaededd6a9a09e1a87f94237a15c124ff69bba01ab86326dfd2b35a20f3e.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	820fdaededd6a9a09e1a87f94237a15c124ff69bba01ab86326dfd2b35a20f3e.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	820fdaededd6a9a09e1a87f94237a15c124ff69bba01ab86326dfd2b35a20f3e.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	820fdaededd6a9a09e1a87f94237a15c124ff69bba01ab86326dfd2b35a20f3e.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	820fdaededd6a9a09e1a87f94237a15c124ff69bba01ab86326dfd2b35a20f3e.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\418bd357b3b9834c.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\locator.exe	820fdaededd6a9a09e1a87f94237a15c124ff69bba01ab86326dfd2b35a20f3e.exe
File opened for modification	C:\Windows\system32\AgentService.exe	820fdaededd6a9a09e1a87f94237a15c124ff69bba01ab86326dfd2b35a20f3e.exe
File opened for modification	C:\Windows\system32\vssvc.exe	820fdaededd6a9a09e1a87f94237a15c124ff69bba01ab86326dfd2b35a20f3e.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	820fdaededd6a9a09e1a87f94237a15c124ff69bba01ab86326dfd2b35a20f3e.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	820fdaededd6a9a09e1a87f94237a15c124ff69bba01ab86326dfd2b35a20f3e.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	820fdaededd6a9a09e1a87f94237a15c124ff69bba01ab86326dfd2b35a20f3e.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	820fdaededd6a9a09e1a87f94237a15c124ff69bba01ab86326dfd2b35a20f3e.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	820fdaededd6a9a09e1a87f94237a15c124ff69bba01ab86326dfd2b35a20f3e.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	820fdaededd6a9a09e1a87f94237a15c124ff69bba01ab86326dfd2b35a20f3e.exe
File opened for modification	C:\Windows\system32\spectrum.exe	820fdaededd6a9a09e1a87f94237a15c124ff69bba01ab86326dfd2b35a20f3e.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	820fdaededd6a9a09e1a87f94237a15c124ff69bba01ab86326dfd2b35a20f3e.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	820fdaededd6a9a09e1a87f94237a15c124ff69bba01ab86326dfd2b35a20f3e.exe
File opened for modification	C:\Windows\system32\dllhost.exe	820fdaededd6a9a09e1a87f94237a15c124ff69bba01ab86326dfd2b35a20f3e.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	820fdaededd6a9a09e1a87f94237a15c124ff69bba01ab86326dfd2b35a20f3e.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	820fdaededd6a9a09e1a87f94237a15c124ff69bba01ab86326dfd2b35a20f3e.exe
File opened for modification	C:\Windows\system32\wbengine.exe	820fdaededd6a9a09e1a87f94237a15c124ff69bba01ab86326dfd2b35a20f3e.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	820fdaededd6a9a09e1a87f94237a15c124ff69bba01ab86326dfd2b35a20f3e.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	820fdaededd6a9a09e1a87f94237a15c124ff69bba01ab86326dfd2b35a20f3e.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	820fdaededd6a9a09e1a87f94237a15c124ff69bba01ab86326dfd2b35a20f3e.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	820fdaededd6a9a09e1a87f94237a15c124ff69bba01ab86326dfd2b35a20f3e.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	820fdaededd6a9a09e1a87f94237a15c124ff69bba01ab86326dfd2b35a20f3e.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	820fdaededd6a9a09e1a87f94237a15c124ff69bba01ab86326dfd2b35a20f3e.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	820fdaededd6a9a09e1a87f94237a15c124ff69bba01ab86326dfd2b35a20f3e.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	820fdaededd6a9a09e1a87f94237a15c124ff69bba01ab86326dfd2b35a20f3e.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	820fdaededd6a9a09e1a87f94237a15c124ff69bba01ab86326dfd2b35a20f3e.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	820fdaededd6a9a09e1a87f94237a15c124ff69bba01ab86326dfd2b35a20f3e.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	820fdaededd6a9a09e1a87f94237a15c124ff69bba01ab86326dfd2b35a20f3e.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	820fdaededd6a9a09e1a87f94237a15c124ff69bba01ab86326dfd2b35a20f3e.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_93546\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe	820fdaededd6a9a09e1a87f94237a15c124ff69bba01ab86326dfd2b35a20f3e.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	820fdaededd6a9a09e1a87f94237a15c124ff69bba01ab86326dfd2b35a20f3e.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	820fdaededd6a9a09e1a87f94237a15c124ff69bba01ab86326dfd2b35a20f3e.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	820fdaededd6a9a09e1a87f94237a15c124ff69bba01ab86326dfd2b35a20f3e.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	820fdaededd6a9a09e1a87f94237a15c124ff69bba01ab86326dfd2b35a20f3e.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	820fdaededd6a9a09e1a87f94237a15c124ff69bba01ab86326dfd2b35a20f3e.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	820fdaededd6a9a09e1a87f94237a15c124ff69bba01ab86326dfd2b35a20f3e.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	820fdaededd6a9a09e1a87f94237a15c124ff69bba01ab86326dfd2b35a20f3e.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	820fdaededd6a9a09e1a87f94237a15c124ff69bba01ab86326dfd2b35a20f3e.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	820fdaededd6a9a09e1a87f94237a15c124ff69bba01ab86326dfd2b35a20f3e.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	820fdaededd6a9a09e1a87f94237a15c124ff69bba01ab86326dfd2b35a20f3e.exe
File opened for modification	C:\Program Files\Mozilla Firefox\minidump-analyzer.exe	820fdaededd6a9a09e1a87f94237a15c124ff69bba01ab86326dfd2b35a20f3e.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	820fdaededd6a9a09e1a87f94237a15c124ff69bba01ab86326dfd2b35a20f3e.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	820fdaededd6a9a09e1a87f94237a15c124ff69bba01ab86326dfd2b35a20f3e.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000be99ee68f4bdda01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001aed9f68f4bdda01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9923 = "Windows Media playlist"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004434d06af4bdda01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ba629668f4bdda01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9933 = "MPEG-4 Audio"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ad5b3169f4bdda01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007a83846cf4bdda01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009aab3f69f4bdda01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000002a0be6bf4bdda01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9926 = "M3U file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009ede7b6bf4bdda01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003d12c668f4bdda01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
1020	DiagnosticsHub.StandardCollector.Service.exe
1020	DiagnosticsHub.StandardCollector.Service.exe
1020	DiagnosticsHub.StandardCollector.Service.exe
1020	DiagnosticsHub.StandardCollector.Service.exe
1020	DiagnosticsHub.StandardCollector.Service.exe
1020	DiagnosticsHub.StandardCollector.Service.exe
1020	DiagnosticsHub.StandardCollector.Service.exe
1368	elevation_service.exe
1368	elevation_service.exe
1368	elevation_service.exe
1368	elevation_service.exe
1368	elevation_service.exe
1368	elevation_service.exe
1368	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
660	Process not Found
660	Process not Found

Suspicious use of AdjustPrivilegeToken 39 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1372	820fdaededd6a9a09e1a87f94237a15c124ff69bba01ab86326dfd2b35a20f3e.exe
Token: SeAuditPrivilege	4856	fxssvc.exe
Token: SeRestorePrivilege	1912	TieringEngineService.exe
Token: SeManageVolumePrivilege	1912	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	3492	AgentService.exe
Token: SeBackupPrivilege	1852	vssvc.exe
Token: SeRestorePrivilege	1852	vssvc.exe
Token: SeAuditPrivilege	1852	vssvc.exe
Token: SeBackupPrivilege	608	wbengine.exe
Token: SeRestorePrivilege	608	wbengine.exe
Token: SeSecurityPrivilege	608	wbengine.exe
Token: 33	5796	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5796	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5796	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5796	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5796	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5796	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5796	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5796	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5796	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5796	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5796	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5796	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5796	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5796	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5796	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5796	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5796	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5796	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5796	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5796	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5796	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5796	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5796	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5796	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5796	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5796	SearchIndexer.exe
Token: SeDebugPrivilege	1020	DiagnosticsHub.StandardCollector.Service.exe
Token: SeDebugPrivilege	1368	elevation_service.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 5796 wrote to memory of 4484	5796	SearchIndexer.exe	109
PID 5796 wrote to memory of 4484	5796	SearchIndexer.exe	109
PID 5796 wrote to memory of 5544	5796	SearchIndexer.exe	110
PID 5796 wrote to memory of 5544	5796	SearchIndexer.exe	110

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\820fdaededd6a9a09e1a87f94237a15c124ff69bba01ab86326dfd2b35a20f3e.exe
"C:\Users\Admin\AppData\Local\Temp\820fdaededd6a9a09e1a87f94237a15c124ff69bba01ab86326dfd2b35a20f3e.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1372

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:2664

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1020

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:336

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4856

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1368

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3292

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5272

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:5332

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5140

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2408

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:3996

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:3596

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:5912

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:5388

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1804

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5872

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1912

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:3528

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3492

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:2208

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1852

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:608

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:4048

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5796
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4484
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:5544

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
Size 2.1MB
SHA256 a7959e6d3faf6b1b0204589da6babf4da9e8bd107e19dfd24f2ada132c2353bf
MD5 abfa22cd250e5c6306ccc5aada68401e
SHA1 6f74a10621de001fc1ae293715451e1d07d7951d
SHA512 5bf1b653489f0ab8966b66d804b6703e7a46fe7e5f8a0c1fad88482a2ff1cdb026e5b966154ae4442bb9b7b425ffaa525ec2df62f55e0774df09b25be95b24b6
SSDEEP 49152:+uYk3H5koUXfTqkkYLO/W2buywzMbOX+T7z5O7DcMlQpRQQMKMZ:+PfTqi90bC3zlQpRQQY
MD5 SHA1 SHA512 SSDEEP

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 797KB
SHA256 82628e7a18afa46850b9e771a391346461f81ce2cd2335e06b6e60737c2d839b
MD5 9199111383dcd314c161eb64e85b52bc
SHA1 e833cca14ce3eb3ab48e41ecffbace7d1cbff5e3
SHA512 c73063e1c71ad30e09634db718869633189ef6a5f4f94c8ba4b60da2136d774ee1a5b4f652e4852e39d81401ebdcb3eb29f7bab28b96019a623016d14d4d595c
SSDEEP 12288:TcQiQmNJLBsunElDFaBfvfoPDct6SlxlwkJJrqQoUhTFfPLgpRtHmr/UNvp8hMoV:bidnBsuEHayDcMkqQpRQmr/UN4MbN
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 95b30e315045f2b14524dfda39cbb38593a4b796b61df88115f473bdd6c83ad2
MD5 747e81c2b43e418654b58597f4ee2306
SHA1 118757ce43504d533e05d0e975a5e8621d6a293e
SHA512 b2cc30fef1058bd2f4b22165a98dfadc8933eb4592c037779216a545d95698d255a93e340bd573785cd186f05df17b4ab61b310547d8f91ad50a54113cb2c207
SSDEEP 24576:B+gkEVfh4CozayDcMkqQpRQmr/UN4MbN:IgkExSF7DcMlQpRQQMKMZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 3cc040cb3afbc5f525bebf7df036c7da395d15a4ac17dbd9c950cc993f4612dc
MD5 ba479f8854e7844406b9b426c6b28324
SHA1 a204cc2809adb7435db378052d17fe46cab5c84d
SHA512 0c2dc6549f454d04f7f90672bde492e3bd81ae93ec9f9056391df7303def86fd4d7fe782c34abc280156e8dca85445303aacf4fbbfae5e42a33057603526451b
SSDEEP 24576:qBpDRmi78gkPXlyo0GxjraayDcMkqQpRQmr/UN4MbN:uNRmi78gkPX4o0Gxju7DcMlQpRQQMKMZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 7e780e3df40e269b1b4933479925e787e8cc662071ccb83ef4bb79973f7998cf
MD5 643a88c5cafcdcc370e617666b515a99
SHA1 80a197de28b4aa97d113e1a76b1e953335722cfd
SHA512 684fdaf1bce775dda61fa74bc6c0d2d1ac790fbc53a25f2897666cb989a197e0aac192643c59cc705cccb20a49e053bafa156c8c41643310da3f265327ba4456
SSDEEP 24576:vLOS2oyPIXVzayDcMkqQpRQmr/UN4MbN:J/y27DcMlQpRQQMKMZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 a3c44c9809c9795caf2a2f91db27c509e892d753972bfc9372d3e1849989e350
MD5 43d3e171d67970a276968246fc58b110
SHA1 83c7709b3f51885aa2dbe828f9edd2f2282a559d
SHA512 0ae9e4128d946a80577151e4dd847bf83e36ce9434b0cb568964b5500b3b5fffc0a644878c4d40865ce0693f0c4102fc6b0c90e7c114d1caeadfaea399b1a438
SSDEEP 12288:VfbDFaBfvfoPDct6SlxlwkJJrqQoUhTFfPLgpRtHmr/UNvp8hMoZUDNL:VflayDcMkqQpRQmr/UN4MbN
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 7cb5992cba92155ec74a537172018614b3631df407750d9ef94d63722c18feed
MD5 2f1daab1ccd03ef66793f4e23e632e44
SHA1 41dce96c870a9346fcaf387813e2699286e66610
SHA512 b963c50d26a68421434a13457cc45b4debfb515ec32ae1f9ee966f4f6578b43698e285dab692b3a9bac8887b68ac3eb568e81778b300945dcab510a00be5bef4
SSDEEP 12288:EeBNUbTVO86UQDFaBfvfoPDct6SlxlwkJJrqQoUhTFfPLgpRtHmr/UNvp8hMoZU:EJIU0ayDcMkqQpRQmr/UN4MbN
MD5 SHA1 SHA512 SSDEEP

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 cf5f7b5382eca9d745c41a018fa54da60bb8c43fb97e421c4abf55e740f20041
MD5 83effe7b3eb590f89d397bd50460987c
SHA1 87388876c232457ad1d03b22ffe11a903f16b949
SHA512 5fdd74db8f91b289bdc94ca4cdf2d2f05806346e494c6689075b27594e3278f822c347d8ff30fc0d6bbc136f43298736847a14e2f186246ce8f4464c625c3240
SSDEEP 49152:LQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THi:LQvGAdlCEL8c/yRNw5CP3zlQpRQQY
MD5 SHA1 SHA512 SSDEEP

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 65badbce078fab4e608ca4ab5179f713895831a2df93a6c786871931c3bd075b
MD5 c134d183d51fb8700c2d5302d52f5f71
SHA1 9e18c5b7733ea5fc59bc008e1ead746f9094f955
SHA512 53483590542125f2f5892b2682e5ebc699ed71ca7c6f30cb84bf74f5aa22fc6ab01ae1c0e6c3b3017ff57f9c2bb63a4b2859e4321446f83ed8da888ade7de491
SSDEEP 12288:9AwSfxL/2Dc34DLLmt0LDQewsAjGDFaBfvfoPDct6SlxlwkJJrqQoUhTFfPLgpR7:udewsAjCayDcMkqQpRQmr/UN4MbN
MD5 SHA1 SHA512 SSDEEP

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 a090c367a5c6c7b58c235ffe36d8a4e1aee101eeea35b0cddcaabc0bb5c747e7
MD5 c4eebb0fa12eadc6923ba0a51cb980c0
SHA1 400e3f12097ddd513986d3dda6955e3c65143abb
SHA512 142495036643eb909308b00dec4536416d5648653401c64b8d05f56d6fa1541a99887a0755b8599da7f9abd431293905ceb85bdff454f8c08bef88463b45ee3f
SSDEEP 196608:XUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHq3uQQ:XUEtQevvqc2W1cpV2EI32q3
MD5 SHA1 SHA512 SSDEEP

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 a9bd77210ec50d6bec474f546be90f1d9d4bb2bc1ffef72221c753446848fdb7
MD5 6a4e0fbdcedc687c528c6bca30336483
SHA1 db7079fc41af62d1609e2f3a13fa548a094a72b9
SHA512 1baf742d6945c366d175a5d65d7885c025ca6abf48b5ff998340d2e1ed88484789cd831061f20a4c175b7f0cea930ce9acf954a850e53024af1270a80a4ad290
SSDEEP 49152:4CbRquA/m2yL5zLfFiV+XenmE3/zi7DcMlQpRQQMKMZ:xoq2Vjnmj3zlQpRQQY
MD5 SHA1 SHA512 SSDEEP

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 1f2b4f9f794c1ed5e34be2e0b50bbfbf54535146ab98498a3e18034ef8a3a67b
MD5 f6d5ca332fd9ac7f967825922d2540a3
SHA1 82ad4dcb712e86ebd902899f4322471f5aab4dce
SHA512 dadc378bc3f42d85943f13dfbad5d9441d88a17f0966a658ea0aa3e6b1448822fa21c83e635dbe456672cd13dfcb8c0d970993684c2901472069aeb85c81793d
SSDEEP 24576:dAhGLJIFoiwtA5l7S53DayDcMkqQpRQmr/UN4MbN:dAMyFoiq5T7DcMlQpRQQMKMZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 93a701b6365d15802b4182d4b0872764b2f6aff6974fcc31727acfb7fba1eb2c
MD5 228acdf73e5aea81c568ab897d12e962
SHA1 58708c74c7fd1156433dfc41a41baaa97d9a0d51
SHA512 26ea8f6491fa6d7b0fba97fa153bad63fee24ba51c3cb48a7ee917c3c0b020f00bb2a3f136ca6f8775414dbef1fcff3fcf1e41f3cbac301e5e992011af0dc5ea
SSDEEP 12288:Fmw5HEjsChNVBFgl0WDm+C9DFaBfvfoPDct6SlxlwkJJrqQoUhTFfPLgpRtHmr/F:gwuoOW2ayDcMkqQpRQmr/UN4MbN
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 ae18790f7206d95afb91f13eb6c07b80e77bfff91ca8cd0a02407c6c2c6f080f
MD5 a72e9e48cb36351a10b03b12abdda982
SHA1 483138d35d272dd883d09cda470edfbcd4b3be7f
SHA512 829935997b3ed0a35a66c697935bd65cd025fb7f33f9d3bac3f14940c3ac2acdb542233c15fd733714b8151b046540ec65dc67941655a1ca7fd6edb361a89ad8
SSDEEP 12288:ABZ1IyWDFaBfvfoPDct6SlxlwkJJrqQoUhTFfPLgpRtHmr/UNvp8hMoZUDNQ:+ZuBayDcMkqQpRQmr/UN4MbN
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
Size 5.4MB
SHA256 44f34d3d111b01504b67bf8134d415b554445d0cb838d983a1e9c1f2eff30d53
MD5 806e5524ea7fa3292afd72034569de99
SHA1 e4855f1b9483836615cd3e7572ec7e363ddc58da
SHA512 4764e74e7cdb711482ceb546dbae000c05b196bd61ef3dfdd0dc22b81938aa9b1c1a871c033450ddcf0142364da06a7132466fffed9aa6e059e9b00c126a143f
SSDEEP 98304:FwfhY7g/rLd7yYA3awr341g73zlQpRQQY:n78yh73uQQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe
Size 5.4MB
SHA256 997e1023ff83087a213fa6c6fc3afc276bc7ac94308dd4743ccb64f1a0605cad
MD5 5628122e372f1889357035c11d31c86a
SHA1 79eb740f747c62115bc28b29a3a5a81679d9eb69
SHA512 0ffbfe5ab4ddfb19dd10bd0439997a6aea3218b24a1a59dab4f71027d45e0b27d9bcaeaf384bc29d0a92591e05cb8d82fe8b47327e47bbc194ffa4b16a20e7c8
SSDEEP 98304:lwfhY7g/rLd7yYA3awr341g73zlQpRQQY:H78yh73uQQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe
Size 2.0MB
SHA256 688b124bc02465e0869631df9c373c9cb7adae26bc7c25f6d102882c580b3ab6
MD5 b1964dafcb573297d43788de15ea1b24
SHA1 e05f6493781e7838772045c79e33d833ef967ebd
SHA512 e1ad0ec2a5221f7abeb26bd15c4a048c9ca9d1821baa68c871e0e13673a26a23d72d2aee786daebbddb0563535767b9a270d937a5fdc83b9c2661abc5646a6f1
SSDEEP 24576:+cTyYv0FteQU+5I2kjgD6iQacA2ayDcMkqQpRQmr/UN4MbN:+uXv0Ftpn5606zO27DcMlQpRQQMKMZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
Size 2.2MB
SHA256 a007e8a1b60793a23cd03a881020c653b94d36edb84a137cbb31fb34ce750a47
MD5 745e14e95909b73b2fa47ed10b95ed29
SHA1 7a9bc1e00988be4fc38c8fe598b08593a53b5417
SHA512 024adbc1b345c9b2ea61fa98994d990cadd83bddb5361c90b830eab1e3fa9da6ee1576bf17f46c434777dc381445f5ae34d6164182bf7b23e36b2b9fe8cf8078
SSDEEP 49152:cy7mTd0GxN8jyynxHjXKUyn4GVcbDSKrNTxC7DcMlQpRQQMKMZ:7mYeyxHjWjMTC3zlQpRQQY
MD5 SHA1 SHA512 SSDEEP

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe
Size 1.8MB
SHA256 f5ee9a8586a8ce4d240329e98eb5372984ca9a7bcffa999fc650a7e6bb3dacd3
MD5 93722e353e2efbf5821a0a0e63cd2f58
SHA1 148bb1c26b3cf8b0072dbec1e5d7d590fda30a9a
SHA512 8c3480384cccb1e44d8402e86034a221c288023d632fd4f0dbe6ddb98a748543469cb33174980a25abf7ced35f210c14fa64c4fa97222f7b5ba2b60312c292bd
SSDEEP 24576:86drZn1WEci182IEUeNbJeRgUebgW816JayDcMkqQpRQmr/UN4MbN:8WnDci18yNNUgbYO7DcMlQpRQQMKMZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 1.7MB
SHA256 8d78df439a73c569c7b80c5caaf96ae769ac61b7ffb641a61719fa3f006871c5
MD5 379ed4efded1fda868a2c34526209973
SHA1 c6e26d99bee68b2d871aa0edc3f80b5fec667cee
SHA512 d81ae7d2d9a008c96dc8029ec0797bef4e010d772f449d94fcd136af2074339bcf77b79ad8e12da99593e211fba648bc5fb6bce95a623d487a7115359c4e1040
SSDEEP 24576:pk5lHW5EzMZupO80G2reD+melRgTTv/1nygayDcMkqQpRQmr/UN4MbN:lizMZm0GhamSoB7DcMlQpRQQMKMZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 1e7d1234a9efa16605e29041123338c7f70be79001c0584264f074bb099a1d47
MD5 8b17d8f4cf7cca0a72b02633d4363ace
SHA1 e310d5487681bcaf3c1b20f4c3a1016b3a865855
SHA512 ab861aff9ecfb3eaaf8ca01094573f11d2250d1499a750326cc2300ebac2b6f0461f01cb70786ac74a8d07e50ca3aad8003d389b7e98d335b5de7266b81f9ec5
SSDEEP 12288:izDFaBfvfoPDct6SlxlwkJJrqQoUhTFfPLgpRtHmr/UNvp8hMoZUDNx:i9ayDcMkqQpRQmr/UN4MbN
MD5 SHA1 SHA512 SSDEEP

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 51acbd779cd6c15cbcc82d97eee66795b398404ffcc0a6450dc188bf10fff17f
MD5 ca0458700970dde789717ca161c9e23a
SHA1 17cdd839b5a5a0e84d883f3891054fb160e37f3c
SHA512 44d5b34a96b2a25bae41b2d0ea490436b2013b0d46b540c9ddb9c97607bc0036e4473e533fae80a9b0925a4ffcc5fca2c2d3c813b0daf0d2157b5d796b1c4dd1
SSDEEP 12288:rCDFaBfvfoPDct6SlxlwkJJrqQoUhTFfPLgpRtHmr/UNvp8hMoZUDNx:r+ayDcMkqQpRQmr/UN4MbN
MD5 SHA1 SHA512 SSDEEP

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 03e5520b613dd8b971aef0662044d2e5bde955bc3de114d563292601eb0f7e39
MD5 c98ecdcc641b8842aeba0d78ad5a494a
SHA1 5b8f4397df4534ecabc19c30147a9e36c08060df
SHA512 c98fcd531fc42e012da09fe2e4b03812803e7612333d510f21a661dd03d6954123ed5d0cae708ba7d33b8cdd73c744969b1f3050abcbfc62f8d2e7331be42843
SSDEEP 12288:KoDFaBfvfoPDct6SlxlwkJJrqQoUhTFfPLgpRtHmr/UNvp8hMoZUDNx:KsayDcMkqQpRQmr/UN4MbN
MD5 SHA1 SHA512 SSDEEP

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 ec68121f5117513010b6228425c29f13e224c2e35b2be8edadc3d7a64d76ecef
MD5 0658b2dcd0a3b02a2d97dae999e3447d
SHA1 bac921f2801f5df627c8f589af289e4b01220f0f
SHA512 7498109a4f030d6ce54fe294adbf936c62e943a21780a284b653ee6f606cd8a630a5f429a4b152f69e32c1845d81f15438283f07eebcd8692a490a270d57f854
SSDEEP 12288:9VxDFaBfvfoPDct6SlxlwkJJrqQoUhTFfPLgpRtHmr/UNvp8hMoZUDNk:bayDcMkqQpRQmr/UN4MbN
MD5 SHA1 SHA512 SSDEEP

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 2a981f1a0d968c8b2716cc3917deb87801317afb98107bd7d8894288cf505996
MD5 f198bd32b711397031bcf371f6b7c02b
SHA1 5d44bd476eb428e9b394d047053d8f52ee73d95f
SHA512 c3a2ca3741e53e9495a658d2a1642eed36ee31bbfb72fff242563ff190423457332cf787d7522287243aab2a6fbcc849f952ab3e48417fdb1e9a57899fd76070
SSDEEP 12288:/ZDFaBfvfoPDct6SlxlwkJJrqQoUhTFfPLgpRtHmr/UNvp8hMoZUDNX:/LayDcMkqQpRQmr/UN4MbN
MD5 SHA1 SHA512 SSDEEP

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 b806393d51a360f411191eff501b9129fc00b6f761ea48264e86776744e67935
MD5 361b1398753b2a46704fa17b4869c1a7
SHA1 0fde6e10005f2bf9c64abcbe7ffd954609537bbe
SHA512 c4558d2de7ddf27414f57ca199f5cf3e1cfec987ffb988cbbe479a8484ed2e00d8c5237d00201d0e613acfe0d10973919c10fe98d5f7911d6113c3bd380b9088
SSDEEP 12288:0+DFaBfvfoPDct6SlxlwkJJrqQoUhTFfPLgpRtHmr/UNvp8hMoZUDN8:0aayDcMkqQpRQmr/UN4MbN
MD5 SHA1 SHA512 SSDEEP

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 34f1df462a26a395df1ca231967f28b9e3ba40e379e46d412898a1edaf92227a
MD5 c2c38d8b4eddee006ba7f1f5eed6dfcf
SHA1 5b1ce957764cbe857c4a1b38a8fe95379d8376bd
SHA512 aaeef702c899ddf7336c35eab8ba9e080718d3a276486fd286cc3c5209f0acd9cb41a3e9e0ccf2307f1c38126e7de8dbcb077e84a5be665c45cfb6e71c7dfc73
SSDEEP 12288:4qDFaBfvfoPDct6SlxlwkJJrqQoUhTFfPLgpRtHmr/UNvp8hMoZUDNE:4GayDcMkqQpRQmr/UN4MbN
MD5 SHA1 SHA512 SSDEEP

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 36b1662b0e68210aaba0059041f5bc2feb52191ed1f51b191b870fb1e1e4945d
MD5 bf9aa0c5da54450b138637f9ef510d56
SHA1 92e76e477b2553095dd8ba268abdb6f8ffadfe03
SHA512 4f0e575e160c6057dc603789b1721b59fc0ca757ebf8ed0f66ed387bd3e1a93aa4f268f7b2d8f55d54a6ca1577405a04a5e1492b40d72c7b8d2a82868a906d9d
SSDEEP 12288:KiZwb6zzFEoS2cPvyiDFaBfvfoPDct6SlxlwkJJrqQoUhTFfPLgpRtHmr/UNvp8v:tZMSzFVSOeayDcMkqQpRQmr/UN4MbN
MD5 SHA1 SHA512 SSDEEP

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 40adec90e03e6242d141694ab0bf0ebdb4f552009f5fc1bfe8c28385349c126a
MD5 c7d11b93f58a595efc4fe1f801d56532
SHA1 5f935b00eb191526cd9dd1f306642f9f76b052d2
SHA512 52b51b2b941155d71eb1bbe3bdcc51b82781e55f3d17e9cdcfffd0da49b548c0115fa8103cca268b5e77598c83ea2ee24a7f547bc0631c59ea6777e74b6518ca
SSDEEP 12288:UnDFaBfvfoPDct6SlxlwkJJrqQoUhTFfPLgpRtHmr/UNvp8hMoZUDNR:UxayDcMkqQpRQmr/UN4MbN
MD5 SHA1 SHA512 SSDEEP

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 1ce196716c4c039c06761d1588256a4e29023e740e2a2158adc16a47839f9415
MD5 0ab901ab4389b1d6d24b39c565a1776c
SHA1 72ae546de14c4b013afe014c282718094b59bf71
SHA512 da8fe457cfad92c5d51e4299929969aa278a58f0337fcb5a7cd7803030d56c7966c3f407bb0bd6ade49e8a4b4ebbc2b207a89347c082203692adfdbde6d6e32b
SSDEEP 12288:xrDFaBfvfoPDct6SlxlwkJJrqQoUhTFfPLgpRtHmr/UNvp8hMoZUDNR:xVayDcMkqQpRQmr/UN4MbN
MD5 SHA1 SHA512 SSDEEP

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 67f0ec82b21c420c712e33c8a76622315ee2a8fbab8f63b2c0f9c6e15b506ff7
MD5 b362079a1447ea886cd998ac39a2d8f1
SHA1 bdb849bddd90fe74311ca0a5bf57a48cb0ec3538
SHA512 aacbf7a5c5a7cc8ca003f15b0ea27732092c60791382aa8b9feb3693992e09067ff80da60b76fab42eb8a997435fb1ffdf0d576ae8fed95cd4d826eda0885c62
SSDEEP 12288:iyPz5L8WDFaBfvfoPDct6SlxlwkJJrqQoUhTFfPLgpRtHmr/UNvp8hMoZUDNJ:/zyyayDcMkqQpRQmr/UN4MbN
MD5 SHA1 SHA512 SSDEEP

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 86da3b8bd72ec8f8fc8b4b9f22e6cf95c302319ab52c77618c028d32e82d4186
MD5 11a72e68a499ee5c3fd0914c9a894557
SHA1 11ae1a0f83001ca43299d22632eed3879239775f
SHA512 28dd6224715a760ee4d5cd6f6c2a3fd0c7df32b2edb143e9ade02d319ed4bd5e9064202688f3b2843651d24c2dd15068c788a440749c1ca1b889222c6884c930
SSDEEP 12288:TnDFaBfvfoPDct6SlxlwkJJrqQoUhTFfPLgpRtHmr/UNvp8hMoZUDNI:TxayDcMkqQpRQmr/UN4MbN
MD5 SHA1 SHA512 SSDEEP

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 2639b90a5cd4b9b9ab0abafee62de293ed8e86ea8ae087dcc58ca2270e55c7f0
MD5 0d10fe409858be42e6e2af4950592fe8
SHA1 68523cec3180e2257e9ea83bf304cb96ef3a2ec5
SHA512 1327fa8658f08f20389f33281a051d301cccb2d16acd8c9f977a29342f16cc127540981d0f30e7d67210c54c40d9fbf66cfc9886b933425403ba26568e26a715
SSDEEP 12288:inDFaBfvfoPDct6SlxlwkJJrqQoUhTFfPLgpRtHmr/UNvp8hMoZUDN9:ixayDcMkqQpRQmr/UN4MbN
MD5 SHA1 SHA512 SSDEEP

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 a0aec10b81e0fd3ba3801946e6cb91a1f93f70be6eae01e041b51699cd434fde
MD5 5ef2520dfa5633cd85e282ab0db363b1
SHA1 2f2270ded47386b245921cdc1682082fc78ce8ab
SHA512 e0dd3b57c90653039e3e177d8814a12fbc7b298418a92df1ee981e5e5662de1272957c8c2e20683a908e6d1744b0a983ad25e1633598a7a16110479ce21d4e1b
SSDEEP 12288:fyPz5L8WDFaBfvfoPDct6SlxlwkJJrqQoUhTFfPLgpRtHmr/UNvp8hMoZUDNr:SzyyayDcMkqQpRQmr/UN4MbN
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 7350bdc3b2592ee8e66dae232f2f39dd974ce2c227fead59555c2bb9b510d590
MD5 69546b5a318255fe17625dd9d7ab2c0f
SHA1 3529bdf74be00a8d5f13bf4f876ad3b5ecd8ea62
SHA512 f893574ae8a55f636affca22a86d70851ced3b414e03974e41685c7e1eae482748ab1bd0edaffa899190441d376570bfa572de45be2ca67fff82c6f6b9f911e9
SSDEEP 24576:aTHaLl3z0zD8ayDcMkqQpRQmr/UN4MbN:aT6Lljf7DcMlQpRQQMKMZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 7d6488bb43a23a41895a45838660ace7a9cbcd263044233d878602aaf39634f9
MD5 7a5d247ddbb94de82b99ff00f01f160a
SHA1 2d13866e1d84897611b85ace7bc1365a4d9853e9
SHA512 adca5d71d094a45b7850a04f76906c3bbc8e2d83ef22d15fd7f4a2c1b247d8aed9950f71cc04353a4cbbca8deb6f916186646b42cde3c94843478e4ee9485b22
SSDEEP 24576:537d9CHKy7GZoayDcMkqQpRQmr/UN4MbN:J7d9CHKyaK7DcMlQpRQQMKMZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 f69f795db76140b47952906f4b4be99b60364391fc71e234e6d7569ddc908c2c
MD5 edd122c7c294e8bd99fb9215496bda77
SHA1 eea3343723e4b8f9b8e65759d7dd5c3a05b7adad
SHA512 ffad56149d6a3f702583d2f48e0ebd711e0255d9b0d1ff85a3c570bab3657beafab32bb5733cbf0ed769147edb1733fa6ba21474b3f8863d95221c5fd0d3fdae
SSDEEP 12288:hIDFaBfvfoPDct6SlxlwkJJrqQoUhTFfPLgpRtHmr/UNvp8hMoZUDN7:hMayDcMkqQpRQmr/UN4MbN
MD5 SHA1 SHA512 SSDEEP

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 1f01c73d815a6bb4aa8d2f9cfd8b0038c0934bbe806db838f442db3cfe3b32c0
MD5 70e0575ca9f4c4eb22170c7ebcff67a3
SHA1 676d4ef6a15eb83d40e3302798b10240e00fdf81
SHA512 44c5d7972f32010290a63a0ed9c7891528d38f4dea2bd883bcdb474d7b700f7e8bb9e96da4f42456d590f1d6bdfff5c456c0fc1aec33b4faf469a0ec10e12fb9
SSDEEP 24576:acP4mcvIjkGOxhKP2l71nNKbrh/8KBZayDcMkqQpRQmr/UN4MbN:FP4m4IpOO67W8KP7DcMlQpRQQMKMZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 701KB
SHA256 21bf3af66fa8dce5b4787d80e5885f9c39c78271b21e00ac540df54919091194
MD5 cc075df655ff36f26d034e1b18eaa45f
SHA1 5ce3ac0d00f37e69556b8e43d4a1dcb12bc25343
SHA512 e78e60d755b0d1056042285b7f2f727d9146370dd10ae7b9fc35d0c224393bfee4cc74eae5ee6f572dda65d73befeeb9a6907c5f82455004768fe1a6c4db7ea2
SSDEEP 12288:ZUFmDDLUDFaBfvfoPDct6SlxlwkJJrqQoUhTFfPLgpRtHmr/UNvp8hMoZUDNw:t4ayDcMkqQpRQmr/UN4MbN
MD5 SHA1 SHA512 SSDEEP

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 a347f17a2b33954226373e3d01beb8485bfaeb842e0f3f1e580d073674075079
MD5 1928ee97360bbe29f9ab567041186c44
SHA1 4f194ba84c416e79d719aaa77df914197d575a28
SHA512 56f3df10a3d28844846e1e340a7578db8c235ec671f0e9c818fc3b39ce65231f757e032689cc006fe56605b5d619eb420c1efeb9119ef079d068f02c16e80dbc
SSDEEP 12288:03DFaBfvfoPDct6SlxlwkJJrqQoUhTFfPLgpRtHmr/UNvp8hMoZUDNt:0hayDcMkqQpRQmr/UN4MbN
MD5 SHA1 SHA512 SSDEEP

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 6e39ff4276f3490bff7ccb55668130069d0ab5ed8160bca3c34c4383324ea956
MD5 1368d94c8f51730de96c235dcc636465
SHA1 bf27b4978c4f7209263f9360668002ebcd474346
SHA512 2d255293299467a344b33a27c94ba5cb38053b1502ee7fb0e4b8db86eec5227015bc8281ee0e38e8b40405f38f9c377d9a8b4501f9222bfadca8c9a7f26cdde8
SSDEEP 49152:Ea0h2GEkuAe73q3pp46zwwQL7DcMlQpRQQMKMZ:Ea0hNYG4Jwq3zlQpRQQY
MD5 SHA1 SHA512 SSDEEP

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 659KB
SHA256 8cdb3116442715b1509a06827edb29c9f0e5cb265de0eeb487d0f2464e00a8a9
MD5 f2875ad0f4a8c8b37730b8efce3fdd33
SHA1 38d7b883f67252d77c49a9d0c23661c7389b66c2
SHA512 93f893d844e8bd0c83c765d19b81418284cdbc122763a4c0ce31c904101b0852079b838b723559f3c9411ad7cd7bac6099e1c6eaec37c8093ebca9ad9466690a
SSDEEP 12288:/hbHjfXyDFaBfvfoPDct6SlxlwkJJrqQoUhTFfPLgpRtHmr/UNvp8hMoZUDNR:/hbHjPOayDcMkqQpRQmr/UN4MbN
MD5 SHA1 SHA512 SSDEEP

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 21e198c69aab493ee9c3f392bf3124f5679de197d6a6a54ec0f6c3b2924550fc
MD5 d0ed459ca24f2dfb52d230f4b8437e3b
SHA1 df0da2a5a2b176457fa59a6cf0176ad3eab39f2f
SHA512 962251bda9aa6e1bf84f38d7d2a7bb5e36ec25d05ea62011da429148dc4990095f85da1953ad379953d162524fa82a5567cfda2a24d788963827ed8e54399edd
SSDEEP 24576:l3YgnJcRTk4yti+R5dBR/2ayDcMkqQpRQmr/UN4MbN:lIgnaTk46pBR/27DcMlQpRQQMKMZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 578KB
SHA256 52e715e06e08aa6c1595006890b4e59902b9f5bfc881e5caa45e08027543df92
MD5 d411fd93265b8b20ac6b061419b718d5
SHA1 07339e5034ff2d2783f8a61028e891ec3df35bd0
SHA512 6068a07159754616350d1572f7bd904384278e05c976dcdc333fa6a0e7109335d1ebceb5e1cfca2327ba9fbae9dab7189faa21da0944f9854d480b3576307274
SSDEEP 12288:t7DFaBfvfoPDct6SlxlwkJJrqQoUhTFfPLgpRtHmr/UNvp8hMoZUDNU:tFayDcMkqQpRQmr/UN4MbN
MD5 SHA1 SHA512 SSDEEP

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 940KB
SHA256 2d5890351a90f851459be55194809e01be828b25e1f2393ee0cfc3e84a7612e4
MD5 43de70448a0465cce74cf7c1e953cdff
SHA1 05c51f849d210d0ad3bdcbe4b32c70449364daca
SHA512 ac5db5d9ef165722ed54ad2a22436eba302684cfe7c50462009e8ca44ee50136c69a153de6aa7d08d38fdeedefd23f89a4165afbf2e9a5304bd53354d2b3ab02
SSDEEP 12288:AOb9A4LWOsvAYFTsDFaBfvfoPDct6SlxlwkJJrqQoUhTFfPLgpRtHmr/UNvp8hM/:9pL3UTQayDcMkqQpRQmr/UN4MbN
MD5 SHA1 SHA512 SSDEEP

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 671KB
SHA256 66a576e0de602eef332e1d219ca756668c2e303a2b31bd58cd9ee9d5bc7d15ea
MD5 3db9b11c443263fb3340c677a4f91dc4
SHA1 176feafb5ea7eafc839f4acd5f617af552bb3101
SHA512 8252552114e60b5525a44da5be64a786f2d20a96c725e60b9b3b56249528ac7df5622704c09d552fa8a43e4a467ff0b1fa36dce5e74ec12dc64e7d4744e308ae
SSDEEP 12288:EpFtpOwDFaBfvfoPDct6SlxlwkJJrqQoUhTFfPLgpRtHmr/UNvp8hMoZUDNu:uOUayDcMkqQpRQmr/UN4MbN
MD5 SHA1 SHA512 SSDEEP

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 8c2599d958f00075846bdee374c22d7628b0ae17977624072502d664378a1268
MD5 1431619d2e5197f4e781daffbc05c9ae
SHA1 717e3f1b19f32587212a2969237960ea630cf93f
SHA512 8b3480847f1793803c3272b46508fc9893aada3b4e51e4041a07486552a4969cf9ffb99c2fe18029448002ce04829c426e8dc39a505122f30defd8c028bbcbf8
SSDEEP 24576:p7NM9YqZqmWMUkPjZM48Mv6bEhsxayDcMkqQpRQmr/UN4MbN:p7cBWMpPjN8DbEhu7DcMlQpRQQMKMZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 0549e03c572b3ca09816331655a3314028420168281e90144d87b96a9fd74222
MD5 a0d829e75842bcdca483acb9145578e8
SHA1 715b67e81c6b7b47496e7a3d89c1e13c9f70f2a0
SHA512 e512242c70b7cfb054bc1079c05940ce73889954bc8edb78aa5b684f41f657c19ff1674a4d9cbe52a7cfca7569672a1d7e802dca30e2763a96c597865fed94a1
SSDEEP 49152:4F2YuHNETovAvNYf8kmR7DcMlQpRQQMKMZ:96BCf8kU3zlQpRQQY
MD5 SHA1 SHA512 SSDEEP

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 1332b8ce66aac07fa00192f51115e111bcc825377769bc188738d0535f33035f
MD5 fbe16ea4f2c436077558ad0d4d786b47
SHA1 17579de4d58f4b6fc57dc91687f7585efad17344
SHA512 e22353c6e256a3788506aab2b8e0c8797ea82f7c208e8964c9ee51dfb8e5633f8102f4ae48ed0b0ab0cd90b3f1a2e274522694dbab5fa942c342d142df598dcc
SSDEEP 24576:AAFs06+Omlf3NXEbTooayDcMkqQpRQmr/UN4MbN:VFs060lVXur7DcMlQpRQQMKMZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 885KB
SHA256 53f178b8bdcad332a31feaafbe7c58d763cd523a36e6fdfda0f7f101acb44efc
MD5 88de51439374a6ffa16b91e69b9dda46
SHA1 9f6b79835daf83ff53d1421d4d2ce265fa18a168
SHA512 8b6cf2abd833269e363c911abaaf8875950ab6397188133bc9685cc037be7dd42f8c44360d3117ee1aa0c7432791f13d697103a291f19645006c1bdf5e523526
SSDEEP 12288:sCJnJ5D3VkrDzxHDFaBfvfoPDct6SlxlwkJJrqQoUhTFfPLgpRtHmr/UNvp8hMo9:xJnJ5D3WXrayDcMkqQpRQmr/UN4MbN
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 8159da375c82acec71942f8e5535213b9936e448ca58234808cdf69727e29588
MD5 0187afb1e9716fe637511a54b4b4e065
SHA1 c1d21fd61d207cd879fbe4ce5355167878ebb807
SHA512 3cf9f1f46fda19f74a0d3599234633587174afaf9e1761b9655bf773784a879494a24811118881a3bb1413d3d933755afe30be7c8a9685b5576655b75cca42cb
SSDEEP 49152:fg06DIKdwc+eQnSt65aV97DcMlQpRQQMKMZ:YH3zlQpRQQY
MD5 SHA1 SHA512 SSDEEP

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 661KB
SHA256 49398cc2bf6bbab84d6f779cbae43c51db023d1ba36257fef7495c545c72eba7
MD5 27acc9b16925190256d67c0382a5f216
SHA1 e94fd8f620d7e27ec62f93df20c81fbf28f4f49c
SHA512 7d9e995803da286271629a39acd9b140332326edce847f113a82846c12a1c893be4eb9a564a1539fb4c7af8f7c81411919706ec288eaa530243cf8c6fc857146
SSDEEP 12288:9EP3Rn9DFaBfvfoPDct6SlxlwkJJrqQoUhTFfPLgpRtHmr/UNvp8hMoZUDN9:en/ayDcMkqQpRQmr/UN4MbN
MD5 SHA1 SHA512 SSDEEP

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 712KB
SHA256 7438e7bd8ca5a032c0fe75f09f038a730d93cc65c80a8738a05af3b3213ef939
MD5 57584a2700d10112b22aedd81ad6f4b8
SHA1 9119fd00f5e203661fb73f80db5236e1cc1b8ca4
SHA512 f0ded5430597b06e978baba8629bede6bac5620bd092bcaee1819746fcd7847dfefb6206330f4b765ea5cc6621ed8d7947528d46a73fdd55cdfb2d5005145aea
SSDEEP 12288:XjkyCDFaBfvfoPDct6SlxlwkJJrqQoUhTFfPLgpRtHmr/UNvp8hMoZUDNj:XIy+ayDcMkqQpRQmr/UN4MbN
MD5 SHA1 SHA512 SSDEEP

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 584KB
SHA256 c8bf760a70175069d29b2e2eaeea12b9ba14fa7f509d16afeeefab82f0556563
MD5 0d959698781c3f2ef555ddd4b95eb72d
SHA1 23dda737a7fbab3a6ecccc6293090b7b721ffae8
SHA512 8b1f9ccea7a85410b54641db855b60219b68620072d2e472ec401ac48f8472fc3da075174fd5624b3aadfeed082e5905e134578298c470d4096d2ecd59812ce3
SSDEEP 12288:9yADFaBfvfoPDct6SlxlwkJJrqQoUhTFfPLgpRtHmr/UNvp8hMoZUDNL:cEayDcMkqQpRQmr/UN4MbN
MD5 SHA1 SHA512 SSDEEP

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 ce0e8f63294bbdf19c5437395362ee4da472160dc554f11e74dc552edc4ed7e0
MD5 f84f02afa7181c32586ff4f341fa996b
SHA1 c414208165a8271c6a821239fde3dfc8962b98dc
SHA512 bdf156d537a96cfe2de63b9495b05fd2c6ff078c14a807704373b9b4fcb5307e47a6f983773f8b312b192bef8531ed08027fbb921e8cc3dd2bf58a35bef27925
SSDEEP 24576:4Q9MxZKdcz9dw3payDcMkqQpRQmr/UN4MbN:4VKZp7DcMlQpRQQMKMZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 772KB
SHA256 16343e7c3fed633769ca9e71f9622720f94e5d4b93d159225d0892b8d078290a
MD5 dd31e911c83174e5db914eb9bd460ebc
SHA1 e340039c951be279deb1a90510114f525857983b
SHA512 6ffd4a6a4fc22b67b06f16c9072144f621b6719b530b2efd4ee186f7ba0857554c17dd265a0f7a715c3e7798d9261a4e0aabac0e7e7fcb02eb5081e34bd26eac
SSDEEP 12288:/yoKo2JRple9pGDFaBfvfoPDct6SlxlwkJJrqQoUhTFfPLgpRtHmr/UNvp8hMoZs:/yocDApCayDcMkqQpRQmr/UN4MbN
MD5 SHA1 SHA512 SSDEEP

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 9ac07273acaf4b5de589709fbfae1e68bd486f23d30cc8c5fb683d52b572a7af
MD5 7dc06f675a78201bbf3324e1d136f6c4
SHA1 79305b81c2de4828ad87a39ec987c91ffdc3a990
SHA512 8ac3c2a84d91d9b7be55fc72a7fe4c53bb07f6489a4671804ee0ceab5cb39cbead31891d230801add37292a39d78807a644253202dbde26ddeeb03ed3221f6a6
SSDEEP 49152:9WcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKC7DcMlQpRQQMKMZ:d0zuNIQ3zlQpRQQY
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 48c3077dcdb20d5984e6f34cc90281010300de9c048168ce1dca71b9cdb17371
MD5 ec7b5b9cf93f7c704846ec81e6a3ed53
SHA1 75fb7911634e05a27b031478f4fc470a0a66e089
SHA512 66ef3ba4ad4b4370dd6c9163847b5bfc7713808685abe3d538af3dd7463a5e5d5b81d067070d961d96d431b1ea60a8b0866ce2d8a0564091efa8c1106d60f727
SSDEEP 24576:K1QT7EcpfxR+N5AWAz3ooiYtjMqb/ayDcMkqQpRQmr/UN4MbN:3TDxR+N5YzTfjM07DcMlQpRQQMKMZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 877KB
SHA256 145f2174ad1767e5b9f6ac173f278a69a49263a47f2e3dc2ac1da00ba95d09f7
MD5 1679437cea09ad32e762834a58333a50
SHA1 fd9929171bc43f7c73496ad24fd73c9dc6719c4e
SHA512 a313e045b37e4b7de29faa2626ed0d770969032e714743c51c89972d47a0a38a96a9219aae1d0e7175267ca791bdb7690d1c798463efb02fa58b9c42835ba1ac
SSDEEP 24576:uTMdOz0FFS+imSLjayDcMkqQpRQmr/UN4MbN:a0K+imSLj7DcMlQpRQQMKMZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 635KB
SHA256 e2547bed400f34f414cd64b3d0c18d914a099b7703ce166b0707f5442e41c983
MD5 a6c0e97cdc6f411dfae769ea45bdc81b
SHA1 e6ec777e447c4f5aaabd2221fb6978f8f1182b01
SHA512 d2a0c98afb13e01950d72ff2f967ec3a4280e2b7e83f3150ff90678b153faaf4754344beec6760d0ae05c5800ebf1813196a79dd5e8f1f84e5180325c1414594
SSDEEP 12288:V4KsDFaBfvfoPDct6SlxlwkJJrqQoUhTFfPLgpRtHmr/UNvp8hMoZUDNK:xQayDcMkqQpRQmr/UN4MbN
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/608-526-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/608-158-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/1020-146-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/1020-24-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/1020-23-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/1020-15-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/1368-40-0x0000000140000000-0x000000014024B000-memory.dmp

Download

memory/1368-160-0x0000000140000000-0x000000014024B000-memory.dmp

Download

memory/1368-37-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/1368-31-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/1372-1-0x00000000009C0000-0x0000000000A27000-memory.dmp

Download

memory/1372-6-0x00000000009C0000-0x0000000000A27000-memory.dmp

Download

memory/1372-344-0x0000000010000000-0x000000001009F000-memory.dmp

Download

memory/1372-139-0x0000000010000000-0x000000001009F000-memory.dmp

Download

memory/1372-0-0x0000000010000000-0x000000001009F000-memory.dmp

Download

memory/1804-465-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/1804-137-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/1852-155-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/1852-523-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/1912-521-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/1912-143-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/2208-522-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/2208-151-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/2408-89-0x0000000000B70000-0x0000000000BD0000-memory.dmp

Download

memory/2408-83-0x0000000000B70000-0x0000000000BD0000-memory.dmp

Download

memory/2408-140-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/2664-13-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/2664-145-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/3292-43-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/3292-165-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/3292-51-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/3292-49-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/3492-149-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/3492-147-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/3596-134-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/3996-98-0x0000000000520000-0x0000000000587000-memory.dmp

Download

memory/3996-133-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/3996-93-0x0000000000520000-0x0000000000587000-memory.dmp

Download

memory/4048-161-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/4048-527-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/4856-42-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4856-28-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/5140-78-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/5140-72-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/5140-132-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/5272-55-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/5272-61-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/5272-54-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/5272-65-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/5272-67-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/5332-81-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/5388-136-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/5796-166-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/5796-528-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/5872-138-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/5872-466-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/5912-467-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/5912-135-0x0000000140000000-0x00000001401D7000-memory.dmp

Download