c2d62fd3baae1c1416fcb98104fb9c08fe4cbb29ba5c63fa8bedd4a96e49ddd6

Analysis

max time kernel
147s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
14/06/2024, 03:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c2d62fd3baae1c1416fcb98104fb9c08fe4cbb29ba5c63fa8bedd4a96e49ddd6.exe
Size 1.3MB
Sample240614-d9mw7stfqa
SHA256 c2d62fd3baae1c1416fcb98104fb9c08fe4cbb29ba5c63fa8bedd4a96e49ddd6
MD5 c398c6d22ac3c67ea8ed63060d3d48ac
SHA1 145fbb2e8b64c680803b12176ffa1c554cf10d62
SHA512 ee31277b6f26e32cd6e3ce743b88524030ed211ca7db64fcbac18e84135d524b08d26fe931811d0367adfa5bbb600ef97e1d490db2b2c578fb235cf4955a9f50
SSDEEP 12288:Yqz2DWUJYlc+pFByStv9JRa//inz86NRo1qiRlUWC4kXzVC3:5z2DWVc+pFB5z+//ufNRoZW
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
3224	alg.exe
1236	DiagnosticsHub.StandardCollector.Service.exe
1124	fxssvc.exe
1396	elevation_service.exe
2456	elevation_service.exe
1604	maintenanceservice.exe
4924	msdtc.exe
1812	OSE.EXE
544	PerceptionSimulationService.exe
3664	perfhost.exe
4872	locator.exe
1924	SensorDataService.exe
1340	snmptrap.exe
4696	spectrum.exe
3556	ssh-agent.exe
2372	TieringEngineService.exe
2500	AgentService.exe
4308	vds.exe
232	vssvc.exe
2120	wbengine.exe
1612	WmiApSrv.exe
3372	SearchIndexer.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in System32 directory 37 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	alg.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	c2d62fd3baae1c1416fcb98104fb9c08fe4cbb29ba5c63fa8bedd4a96e49ddd6.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	c2d62fd3baae1c1416fcb98104fb9c08fe4cbb29ba5c63fa8bedd4a96e49ddd6.exe
File opened for modification	C:\Windows\system32\spectrum.exe	c2d62fd3baae1c1416fcb98104fb9c08fe4cbb29ba5c63fa8bedd4a96e49ddd6.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	c2d62fd3baae1c1416fcb98104fb9c08fe4cbb29ba5c63fa8bedd4a96e49ddd6.exe
File opened for modification	C:\Windows\system32\AgentService.exe	c2d62fd3baae1c1416fcb98104fb9c08fe4cbb29ba5c63fa8bedd4a96e49ddd6.exe
File opened for modification	C:\Windows\system32\wbengine.exe	c2d62fd3baae1c1416fcb98104fb9c08fe4cbb29ba5c63fa8bedd4a96e49ddd6.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\e2691d3c293b476c.bin	alg.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	c2d62fd3baae1c1416fcb98104fb9c08fe4cbb29ba5c63fa8bedd4a96e49ddd6.exe
File opened for modification	C:\Windows\system32\locator.exe	c2d62fd3baae1c1416fcb98104fb9c08fe4cbb29ba5c63fa8bedd4a96e49ddd6.exe
File opened for modification	C:\Windows\system32\vssvc.exe	c2d62fd3baae1c1416fcb98104fb9c08fe4cbb29ba5c63fa8bedd4a96e49ddd6.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	c2d62fd3baae1c1416fcb98104fb9c08fe4cbb29ba5c63fa8bedd4a96e49ddd6.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	c2d62fd3baae1c1416fcb98104fb9c08fe4cbb29ba5c63fa8bedd4a96e49ddd6.exe
File opened for modification	C:\Windows\system32\AgentService.exe	alg.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	c2d62fd3baae1c1416fcb98104fb9c08fe4cbb29ba5c63fa8bedd4a96e49ddd6.exe
File opened for modification	C:\Windows\system32\msiexec.exe	c2d62fd3baae1c1416fcb98104fb9c08fe4cbb29ba5c63fa8bedd4a96e49ddd6.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	c2d62fd3baae1c1416fcb98104fb9c08fe4cbb29ba5c63fa8bedd4a96e49ddd6.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	c2d62fd3baae1c1416fcb98104fb9c08fe4cbb29ba5c63fa8bedd4a96e49ddd6.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	c2d62fd3baae1c1416fcb98104fb9c08fe4cbb29ba5c63fa8bedd4a96e49ddd6.exe
File opened for modification	C:\Windows\System32\msdtc.exe	c2d62fd3baae1c1416fcb98104fb9c08fe4cbb29ba5c63fa8bedd4a96e49ddd6.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	c2d62fd3baae1c1416fcb98104fb9c08fe4cbb29ba5c63fa8bedd4a96e49ddd6.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\vds.exe	c2d62fd3baae1c1416fcb98104fb9c08fe4cbb29ba5c63fa8bedd4a96e49ddd6.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	alg.exe
File opened for modification	C:\Windows\System32\alg.exe	c2d62fd3baae1c1416fcb98104fb9c08fe4cbb29ba5c63fa8bedd4a96e49ddd6.exe
File opened for modification	C:\Windows\system32\dllhost.exe	c2d62fd3baae1c1416fcb98104fb9c08fe4cbb29ba5c63fa8bedd4a96e49ddd6.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	c2d62fd3baae1c1416fcb98104fb9c08fe4cbb29ba5c63fa8bedd4a96e49ddd6.exe
File opened for modification	C:\Windows\system32\dllhost.exe	alg.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	c2d62fd3baae1c1416fcb98104fb9c08fe4cbb29ba5c63fa8bedd4a96e49ddd6.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	c2d62fd3baae1c1416fcb98104fb9c08fe4cbb29ba5c63fa8bedd4a96e49ddd6.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	c2d62fd3baae1c1416fcb98104fb9c08fe4cbb29ba5c63fa8bedd4a96e49ddd6.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	c2d62fd3baae1c1416fcb98104fb9c08fe4cbb29ba5c63fa8bedd4a96e49ddd6.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	c2d62fd3baae1c1416fcb98104fb9c08fe4cbb29ba5c63fa8bedd4a96e49ddd6.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe	c2d62fd3baae1c1416fcb98104fb9c08fe4cbb29ba5c63fa8bedd4a96e49ddd6.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\110.0.5481.104\chrome_installer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	c2d62fd3baae1c1416fcb98104fb9c08fe4cbb29ba5c63fa8bedd4a96e49ddd6.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\OpenExport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	c2d62fd3baae1c1416fcb98104fb9c08fe4cbb29ba5c63fa8bedd4a96e49ddd6.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	c2d62fd3baae1c1416fcb98104fb9c08fe4cbb29ba5c63fa8bedd4a96e49ddd6.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	c2d62fd3baae1c1416fcb98104fb9c08fe4cbb29ba5c63fa8bedd4a96e49ddd6.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	c2d62fd3baae1c1416fcb98104fb9c08fe4cbb29ba5c63fa8bedd4a96e49ddd6.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	c2d62fd3baae1c1416fcb98104fb9c08fe4cbb29ba5c63fa8bedd4a96e49ddd6.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	c2d62fd3baae1c1416fcb98104fb9c08fe4cbb29ba5c63fa8bedd4a96e49ddd6.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	c2d62fd3baae1c1416fcb98104fb9c08fe4cbb29ba5c63fa8bedd4a96e49ddd6.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	c2d62fd3baae1c1416fcb98104fb9c08fe4cbb29ba5c63fa8bedd4a96e49ddd6.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	c2d62fd3baae1c1416fcb98104fb9c08fe4cbb29ba5c63fa8bedd4a96e49ddd6.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b78aefeb0cbeda01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007b5d83ec0cbeda01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000306207ec0cbeda01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000082f71eb0cbeda01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ade76dec0cbeda01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008928edeb0cbeda01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000013e324eb0cbeda01	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
1236	DiagnosticsHub.StandardCollector.Service.exe
1236	DiagnosticsHub.StandardCollector.Service.exe
1236	DiagnosticsHub.StandardCollector.Service.exe
1236	DiagnosticsHub.StandardCollector.Service.exe
1236	DiagnosticsHub.StandardCollector.Service.exe
1236	DiagnosticsHub.StandardCollector.Service.exe
1236	DiagnosticsHub.StandardCollector.Service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
664	Process not Found
664	Process not Found

Suspicious use of AdjustPrivilegeToken 41 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1136	c2d62fd3baae1c1416fcb98104fb9c08fe4cbb29ba5c63fa8bedd4a96e49ddd6.exe
Token: SeAuditPrivilege	1124	fxssvc.exe
Token: SeRestorePrivilege	2372	TieringEngineService.exe
Token: SeManageVolumePrivilege	2372	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	2500	AgentService.exe
Token: SeBackupPrivilege	232	vssvc.exe
Token: SeRestorePrivilege	232	vssvc.exe
Token: SeAuditPrivilege	232	vssvc.exe
Token: SeBackupPrivilege	2120	wbengine.exe
Token: SeRestorePrivilege	2120	wbengine.exe
Token: SeSecurityPrivilege	2120	wbengine.exe
Token: 33	3372	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3372	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3372	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3372	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3372	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3372	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3372	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3372	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3372	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3372	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3372	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3372	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3372	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3372	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3372	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3372	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3372	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3372	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3372	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3372	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3372	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3372	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3372	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3372	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3372	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3372	SearchIndexer.exe
Token: SeDebugPrivilege	3224	alg.exe
Token: SeDebugPrivilege	3224	alg.exe
Token: SeDebugPrivilege	3224	alg.exe
Token: SeDebugPrivilege	1236	DiagnosticsHub.StandardCollector.Service.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3372 wrote to memory of 4960	3372	SearchIndexer.exe	111
PID 3372 wrote to memory of 4960	3372	SearchIndexer.exe	111
PID 3372 wrote to memory of 3400	3372	SearchIndexer.exe	112
PID 3372 wrote to memory of 3400	3372	SearchIndexer.exe	112

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\c2d62fd3baae1c1416fcb98104fb9c08fe4cbb29ba5c63fa8bedd4a96e49ddd6.exe
"C:\Users\Admin\AppData\Local\Temp\c2d62fd3baae1c1416fcb98104fb9c08fe4cbb29ba5c63fa8bedd4a96e49ddd6.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1136

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3224

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1236

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:1148

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1124

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1396

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2456

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1604

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4924

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1812

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:544

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:3664

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4872

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1924

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:1340

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4696

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3556

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:5108

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2372

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2500

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:4308

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:232

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2120

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:1612

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3372
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4960
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
  2⤵
  - Modifies data under HKEY_USERS
  PID:3400

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
Size 2.1MB
SHA256 bd4baeaf1b086fe3867c18a1436b31ecfb72a664cf495eb4804266f218f04ad1
MD5 5ac8f88c1a29027fa8627bc62f8da0a9
SHA1 66172bcc5d94de9493ae4f36f93f84f34770ae36
SHA512 5c1fa4155d987e8bc649b6b3dc95bee9b77bc1c3802101ac022c2e8d5a29ad6213ad3b2c9bf846346f3b0df8c42aca692df11bf16e5a9fc56aedb94aa2634fb3
SSDEEP 49152:fuYk3H5koUXfTqkkYLO/W2buywzMbOX+T7z5I+pFzz+/2fNR:fPfTqi90bU+pFtFR
MD5 SHA1 SHA512 SSDEEP

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 235a462745755cc772464155ff61fe536bcf409f730da692627c7d6b3b4b18c5
MD5 4fe14e52664005aea3854e4beaa298df
SHA1 ab6da055a04ad7fc036ce1d9fca1e1aaa51c810d
SHA512 0f957d24f62b0277c8f0a0efdca6b6d5cc4dfe9a92b40e78902c72c8797bdf05389d38c9f64584b38829eb502ceeb6246380f953fe67a9fbc3d0acb1144c4c6e
SSDEEP 12288:scQiQmNJLBsunEVYlc+pFByStv9JRa//inz86NRo1qiRlUWC4kXzVC3:eidnBsuEkc+pFB5z+//ufNRoZW
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 fcb4ef457a6e88e36f22d40e3a46f18a4b00afb831dd4a0adc32364b23ad49ac
MD5 9ae39909594e178dcc3e767fedfb9a29
SHA1 ea397c47865cc6e03d20042ef1f012389198c7bc
SHA512 f2d9f20af3bd84412ccdf761aaf5d19696097708942813a7d8c0186137cf85fb5de6e7121a11580c98cb590ef03524e09bb120ed1385b36b8554e034cef53b48
SSDEEP 12288:B7a3iwbihym2g7XO3LWUHfh4CoBYlc+pFByStv9JRa//inz86NRo1qiRlUWC4kXa:E+gkEVfh4Cowc+pFB5z+//ufNRoZW
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 9dc0a4303e7856a0acdda26cb240827dc662cfb6b549ab4cd1ac1dc35621ceac
MD5 8ec99984c82fa3a22a86b256032f54ed
SHA1 94c8b10adf225c9ec8c6881076ed67e73d4eacce
SHA512 96653191e16f53e003dd7d15a470036f6e6305e03e6fb6c58e3fe96a16461b9c4d8f3411781ef6c8981ae5c49245e86f596ad09713a24ae623d617c90c7ae379
SSDEEP 24576:WBpDRmi78gkPXlyo0GxjrHc+pFB5z+//ufNRoZW:SNRmi78gkPX4o0Gxjo+pFzz+/2fNR
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 a438fcac0f8662f19326b70a923e3b11ba867eabc0638927e6c4e7a8ede45605
MD5 f17062cacea5c0647c320e4191cae6de
SHA1 80a9930c65d785cbe2a6372f0e4cdfc0b640ec88
SHA512 5d4227fd9d1cca767ae9b10e01ae3634a6d37921d583615e2884eb53735e97ec6f20685a0e9c7721bbb00f9bb54c1f574e8a6fb4c127f2c220b46d04d7e85d3e
SSDEEP 12288:xfC6Aj+TN5uixZN+8rKhUdTC/wE1MD0Ca5ZIXVBYlc+pFByStv9JRa//inz86NRa:xLOS2oyPIXVwc+pFB5z+//ufNRoZW
MD5 SHA1 SHA512 SSDEEP

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 32d72df3523175f8022e0230b02591fd5e24f85cc89f08d6721b1d77c7c9af6b
MD5 d05d99d3a9c2f98b4aa247366c77975a
SHA1 98f328a12b5690f681e1b57f6ffeac37029d65e1
SHA512 7d3ae40f582595f9a4968aea3f8d9851a5c1a99dabdd5f7552c8bcf5f6411efa0e206cf3163c1c79f37ec25bd47a8b66fc9c3cec3b525ef229e31fee2de34f9d
SSDEEP 12288:efvYlc+pFByStv9JRa//inz86NRo1qiRlUWC4kXzVC3:efac+pFB5z+//ufNRoZW
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 9c8df253d607bfc2385e1afe51a5698f72479bc8d1a486b0c0a7d20f89e07357
MD5 062a0cabc93cc4d8ac8a842b2b05a289
SHA1 6490f3b431b4de3c62d8eb2bc5210fdde26fbdb5
SHA512 67c41ea4f1964049164ad0fcd31f0eaec72a5e74370a0ff28547f2a106dba32a21154eae6d1b7186749134b1aa84411c9249374a9009d7cb2e5d795eb9b512a9
SSDEEP 12288:reBNUbTVO86UQYlc+pFByStv9JRa//inz86NRo1qiRlUWC4kXzVC3:rJIUBc+pFB5z+//ufNRoZW
MD5 SHA1 SHA512 SSDEEP

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 5a20c81b5d3a41821b10c786a0bf9b0e43e11deba90688ca53ab73b536fc2d08
MD5 d7274da8febf2ce19c7569c3d4144b98
SHA1 44f3d337ed7254c6b85246bd9f1f12eb17834914
SHA512 b75a263c336101faf9915a3f855facb1546186ff8f797de9ce6bf0f53ca17c35e1d3dc406b5c8cd15f7ea0d5ee520c6da037ba614fa5379505e8e6223af9ea13
SSDEEP 49152:nQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THh:nQvGAdlCEL8c/yRNw5CZ+pFtFR
MD5 SHA1 SHA512 SSDEEP

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 bbac6b6bf629b41367f02569b3a0328991820302567f82975259dbde57007796
MD5 c4caf278ae4b04cfe65a94129a2b32b2
SHA1 f1d38a3bf25e6450f644af54e04c3d82433d0268
SHA512 6450a119a384c4f228723d8520b81a0e342034ec3219db67dbf4d83148d95f9aad4d423daeed258554f3a16adb9045a6d73f1e74105d6fd657e59ce5aaa83939
SSDEEP 12288:MAwSfxL/2Dc34DLLmt0LDQewsAjiYlc+pFByStv9JRa//inz86NRo1qiRlUWC4kq:xdewsAjvc+pFB5z+//ufNRoZW
MD5 SHA1 SHA512 SSDEEP

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 6c5bf5a1f8a7f295512612c1eaf4c3c70a3327d9b52177e3c8308bcd4b7f9f03
MD5 a1fc9844e9b24673670c6a190db0f84f
SHA1 a4ca14a2380ff5534dc2e60f7abf7d30a378d4d8
SHA512 24c9543e0855dd4ef6c4efe169ef083fbed2827715ce0631abbc9ab11f786ff5da88357cb956d2b865326473595c0829f2ad6019bc2cb35a21aa1db3540c6542
SSDEEP 196608:uUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHZ:uUEtQevvqc2W1cpV2EI32
MD5 SHA1 SHA512 SSDEEP

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 1d9c48766a9acd328fc127c33af0fac5238baf3a7be6fc2a7f8a0a819b5a5de4
MD5 d79e6245d285cc79861c54eee01bdd31
SHA1 656adca0ac2794bc656be9a0f3df790034bf2e91
SHA512 e49eef2c424f362a6ca381a19e6139b6b64fd16d497e5f3b34bbe2f29ec74b0c1b6750a991eb5c6d114b77bf3ace5835a8f7f1198aa948a11e5b337d29cc2320
SSDEEP 49152:CCbRquA/m2yL5zTfFiV+XenmE3/z0+pFzz+/2fNR:HoquVjnmV+pFtFR
MD5 SHA1 SHA512 SSDEEP

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 7aeed82cc352ea2982c53f873c57ef1943bcd85c749af16ca27dd70d7e3eeee2
MD5 1a3141718c10944b9437a0de6a03ff14
SHA1 60bbb0c271d8c4c754fd88284759480bb05ff98a
SHA512 e77be9a1e9e8254626a68e41912352fff77b89afc925956e914f257043ed6576f6f7bb0d1e49d66df9e156950fd7f7b82d055e099cbc16ec0a1d615aced9752c
SSDEEP 24576:JAhGLJIFoiwtA5l7S53gc+pFB5z+//ufNRoZW:JAMyFoiq5F+pFzz+/2fNR
MD5 SHA1 SHA512 SSDEEP

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 2691ba5f9c2db0d7d8b5c4cdcde7f748c374fc334179d007f6b0aa8b9a8691bf
MD5 72dd73857b79830e5b505ffc7dcb101f
SHA1 01afb2d9fe6f8805203c3e168d659be3c37b1bd6
SHA512 32136acf084f2a47e3eb2be7ddf8f26d8a0151322e84ab1f2f85dabb05001b2dfe8ad804d8c1f2f7eee3ad13d28728cde52374180333145be191bc034cd9db69
SSDEEP 12288:Nmw5HEjsChNVBFgl0WDm+CtYlc+pFByStv9JRa//inz86NRo1qiRlUWC4kXzVC3:owuoOWjc+pFB5z+//ufNRoZW
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 700523b5bdd64265e141c372de31c6f7e44739f3f8c5a141c7133099d95742ff
MD5 32ef633322c1d4418cf2b5b011949520
SHA1 5477a4d14e0a6b1db685815ecbdd7fbe39bb3df1
SHA512 7a068acf0033ba7cf08229f7fe518f603f6a26ef2e59afb77a4f2c183ce6a8990fe3914130b47dc6df2452ce05d72e20b76c262976879976ba355fc1e77ca63d
SSDEEP 12288:5BZ1IySYlc+pFByStv9JRa//inz86NRo1qiRlUWC4kXzVC3:XZu2c+pFB5z+//ufNRoZW
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
Size 5.4MB
SHA256 f3d71cf2fb49b3f50f628c3846daf0d5ca3b85ae446bd80827e6d278a6d2dc51
MD5 ab598f771ea856c986380ad3fe698abf
SHA1 7c5a2d077f8ba37910b9a40276fc068140758847
SHA512 6a6e7155aeed844ceffb2baf39d4a8638f98ceae5b4b899c868d0be51cb2b69f3303914d09aeaf5de229f734a3702838760e18637879326314804eb71f75e690
SSDEEP 49152:R0kwIi7c4xZlm5knEtw99Kn/2vim7vgv6m+yyJ/0gbvjR7yY7BHi3u7L/gBUUWLx:hwfhY7g/rLd7yYA3awr341gd+pFtFR
MD5 SHA1 SHA512 SSDEEP

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe
Size 5.4MB
SHA256 4a462a65e1d4c53423e80e69929616a5303a2822e3b2da7c257276c47fb653d4
MD5 24342611864a4cc040a27de9dfc1a3d5
SHA1 6bebd04da9c36ce4dc8dbfb987677d3fda5dfb3c
SHA512 ec88bed3d95663f10b505fa31c3ed6de5cd860a136731cf96038c0071be2c53743491702f6c6c5e1856f48eed68e6690abda8d2231d0cf2843fab8717d7ac8b3
SSDEEP 49152:h0kwIi7c4xZlm5knEtw99Kn/2vim7vgv6m+yyJ/0gbvjR7yY7BHi3u7L/gBUUWLx:RwfhY7g/rLd7yYA3awr341gd+pFtFR
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe
Size 2.0MB
SHA256 9446b2ea54e0e8a1cabdfbe4141dabae909821a7ef05b80a379c29d80d7a34da
MD5 a9ecbcac06ee8d7d3b3075bae5328623
SHA1 3fd799730944f80c2ed159ee21f9fef731a2540b
SHA512 f30ca97025fe3fdd8641476538235e26107a175ffc999d0b95aa3963f13a3a0ef2daf0da5baeec2442f67b86c82d220a287286e88c5ca0614d3f975753b964f2
SSDEEP 24576:scTyYv0FteQU+5I2kjgD6iQacAjc+pFB5z+//ufNRoZW:suXv0Ftpn5606zOg+pFzz+/2fNR
MD5 SHA1 SHA512 SSDEEP

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
Size 2.2MB
SHA256 2bc67c7b5d6948b30fd4299fb9acbd791e4d0a65b3513c55f994065d397a2f12
MD5 0d963eba7b0b9cc424cc9f4b2882326f
SHA1 fd0fe66ec158d35f65a67884f4d9d892332a34c2
SHA512 933b274930c6f144dfbaa92c8fa32055896b49a80c7aa5d414358041e32799346974ffd6e0c5260e88d3e655170fef65d2869939bdcdcdcf1a302c00a6e5f9d7
SSDEEP 49152:Ny7mTd0GxN8jyynxHjXKUyn4GVcbDSKrNTxU+pFzz+/2fNR:4mYeyxHjWjMTU+pFtFR
MD5 SHA1 SHA512 SSDEEP

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe
Size 1.8MB
SHA256 3fd2b292d8d37055b8cc07d9fe63fa6821b349279849b021014fcf97efa69e12
MD5 0f00260862d3d4fbbf28db41451472e4
SHA1 d1cc48e59d534eb5d8cdd9e412761b472bcb2e58
SHA512 0adf8f58a856c3e598d161292e261d873a1f80264d11f62b12697d3209d210882ac23f79db07778ec7303a6f2c85fb315603bf36804647e1f8d5df775f67affc
SSDEEP 24576:/6drZn1WEci182IEUeNbJeRgUebgW816+c+pFB5z+//ufNRoZW:/WnDci18yNNUgbYI+pFzz+/2fNR
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 1.7MB
SHA256 c7b9f688ad93a6c7a83539f17c0d3033b93ea176363140bed48539d819d79201
MD5 b76058ed8bbc3c8c542c508cdb397ec6
SHA1 6c6c4a3a287762d60f779c77cd09840c86f1bac4
SHA512 d72eeae7bb42990956275c663269c14909499d9a468c271afa22a58c5933d0f3856da1ce3ab68cf1b63130006455b7d5db4d4db36511e9941c984006a7e3c2cf
SSDEEP 24576:kk5lHW5EzMZupO80G2reD+melRgTTv/1nyNc+pFB5z+//ufNRoZW:6izMZm0GhamSoz+pFzz+/2fNR
MD5 SHA1 SHA512 SSDEEP

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 f192d25fefe2c80e707852f4c83828fe3fc238c680dcbef1944228bf74fa6cc3
MD5 616c59f33abf2d38d4e753bf1f254676
SHA1 26a785131fa7ed4b39e464a1e48cf68430a3b7bd
SHA512 708b499ae0ddde98270659312ec2e61ace20ad5f8d46cab543876259af618c56ac7f1765d366f0d43df338e91642b0e8aef5e8faf705ddd5746d75e2ff12d108
SSDEEP 12288:ZHYlc+pFByStv9JRa//inz86NRo1qiRlUWC4kXzVC3:ZSc+pFB5z+//ufNRoZW
MD5 SHA1 SHA512 SSDEEP

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 40441e014ad3eb9a4eee04924392c2fcd01fb5935617d6a985290aa807615dbe
MD5 8857ebad66ee8a8c63fc66f16565da63
SHA1 eb76a87a416e8564eb6863ad45b90b07429f78d1
SHA512 9ac6da75cf1a576c6ed2e74d44b6397fea28d3cd3ecaf40ef09986e31638ed86dd1df7b0084e097c026668ffd119be3ae60dcb841569e6287df261e7e9699c84
SSDEEP 12288:PeYlc+pFByStv9JRa//inz86NRo1qiRlUWC4kXzVC3:PLc+pFB5z+//ufNRoZW
MD5 SHA1 SHA512 SSDEEP

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 cd890977aaa05f5efad0e78f962492ba37f111e24f3c2198655025586f39aefa
MD5 4af7122f8596e81dc396298b3731ec9a
SHA1 1bfcae26b0f3eaca6e121c92211169b97a640df1
SHA512 b27d76f980a2af8c23c01f4c2cf007f6359014315b95ab98951957665eb1efe7cd3d765369a7c2c8fb72261f1765942e90e1bfdcbf5cd0070c49163053614d9c
SSDEEP 12288:fIYlc+pFByStv9JRa//inz86NRo1qiRlUWC4kXzVC3:f5c+pFB5z+//ufNRoZW
MD5 SHA1 SHA512 SSDEEP

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 8d2632ced03d5648c4dfa10408b9a53c66931514e33c881843cb662d2412a0be
MD5 a9edf505c5a5a77eeefb80b991d987b2
SHA1 5a17d36c4aff8cff25e23deec617e790ef6b8e9a
SHA512 fbd400da9db470622ee4350b69311ba8a3ba374fbe3758fc89c3181a3dcb65d763f14f3b5d057c112177a8e5b90dc3a95b1656d4d956cf41a7dd2b736a55d651
SSDEEP 12288:OVxYlc+pFByStv9JRa//inz86NRo1qiRlUWC4kXzVC3:Pc+pFB5z+//ufNRoZW
MD5 SHA1 SHA512 SSDEEP

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 5cc974e6fda20c9480056712d9758460f3815a77e0d5eb8f3ae5bc4ad941f762
MD5 0ec68f69158f6b746354eb5d17e9359a
SHA1 b1f744cf142bf32fd0ff60d99ddd8d2c21a1a879
SHA512 8475b9f3285c5de96c1bb6c34ce5016854c58bbb34bcfb3854ced4a2e01632d26b70dc9df6d73c2827b538ed67030a2883546fadf5e9ee055f6204aecbacc3a6
SSDEEP 12288:fZYlc+pFByStv9JRa//inz86NRo1qiRlUWC4kXzVC3:fIc+pFB5z+//ufNRoZW
MD5 SHA1 SHA512 SSDEEP

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 dd3e2cac27f782dcc0799a02d0990d8ac9832f2e5a15b881ab07752071c2df61
MD5 8e8dcc260cd33bf355c5952d2e4cf0fa
SHA1 cb8f030a47f357ee49a319c668aeaefa203d490f
SHA512 0c8941fb7387515d0c1976cefe8b83db2d80e34887ff8bcb9b925dd4d18c85c61f8aabd428c317bf8909fc1338ce946c3a43c28fb31586441884d4901862bb12
SSDEEP 12288:R6Ylc+pFByStv9JRa//inz86NRo1qiRlUWC4kXzVC3:RHc+pFB5z+//ufNRoZW
MD5 SHA1 SHA512 SSDEEP

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 08279ac1715ae7e7a1b179ad6fbb614ef1d09100d5c102a4b8f7c4a702d3a406
MD5 ced16a5fb61cedfd830b79175b7596e7
SHA1 04280b43918f11e8935ab52e607700ae23ca77b6
SHA512 03e5270abb5df50db3335e85e0b1f9cbaaecbf5efb1c441f727b74d53fb64e6fd48ff94d43a0ef07fe2cc04474ca19d7928851bd9ab67aac65882721d5bff684
SSDEEP 12288:WmYlc+pFByStv9JRa//inz86NRo1qiRlUWC4kXzVC3:WTc+pFB5z+//ufNRoZW
MD5 SHA1 SHA512 SSDEEP

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 d0f822715cec9226dae8db0e3a27b8d1ae56f0ce43c8d592c679f08b262160df
MD5 1c1b087bb4975b375bb7424887e3fdda
SHA1 940947338a56e049d9a98576d73807524b870bfa
SHA512 de3cebc8690e349287df96b6b0656838d88a62307d378c9e59819cbfa315f1024bde2faf95bfbe416c1b5344c90f179d971150c741155506641816bc46529c06
SSDEEP 12288:viZwb6zzFEoS2cPvy+Ylc+pFByStv9JRa//inz86NRo1qiRlUWC4kXzVC3:KZMSzFVSOrc+pFB5z+//ufNRoZW
MD5 SHA1 SHA512 SSDEEP

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 18ebfd737cfcd5fa8f8b433383c06b8d570dd41a1606142f2a27faa63ff5c7d0
MD5 1f71d06681de6f12ca55766dd7efaf6b
SHA1 45ef9bbc409941b80280b8a6ff147512aa15e1aa
SHA512 f6f9ae1dd2b3cd4e0012c7328e33676c896a9629028ef0c8daa6a59e9cc311353cd8260132c6dcc190a4069438526fa961f298d9e5d6857f6761c0eda9407124
SSDEEP 12288:1bYlc+pFByStv9JRa//inz86NRo1qiRlUWC4kXzVC3:1Gc+pFB5z+//ufNRoZW
MD5 SHA1 SHA512 SSDEEP

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 9a5a43bbfbdd37615a1a175ba50e8d0a85de4e8e264ef3f1f92ac6814329e14b
MD5 8b68dc5958f6765f9835b8e3ce68b7b4
SHA1 5087366d4e5f721afdfdcabafae6946e21d84949
SHA512 0af844de34775e1bc70ba881ada37d56af62c3b48b2abd044838cad2757b2e8eb3182ae6b909b9d019fe5fdc226cc5df45c9aa75423dee3f11381f1e67ac610b
SSDEEP 12288:cfYlc+pFByStv9JRa//inz86NRo1qiRlUWC4kXzVC3:cqc+pFB5z+//ufNRoZW
MD5 SHA1 SHA512 SSDEEP

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 ffccbf73c76ce46a856173f14df330cb0abd71f93cb9d9be1c566bfdb85f0d31
MD5 533355f43c0a83b31426097e09195d92
SHA1 0a9d1736a1663a332ed69c38974e450c0c5abe3c
SHA512 ef1586ed43b29e250d7d85fb0b6edd4ea71ffe67e266e54de5376715642161b3da2561cb8e8078e4098ac7e7316537278f7d566e235c43dfd9e909635712e4b0
SSDEEP 12288:MyPz5L8SYlc+pFByStv9JRa//inz86NRo1qiRlUWC4kXzVC3:Vzy/c+pFB5z+//ufNRoZW
MD5 SHA1 SHA512 SSDEEP

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 32b291349c569221786f0b27adc05ef7fd6b0cd17730e8187e925cd90141377a
MD5 a73b31efeaa819fbeb2afbc89e2ebf43
SHA1 a4f6a22126e9bee4098413976d953243df56b629
SHA512 9c3ea5764c03455ca8dffc07adb3c541b2611da5bd515e32332c7f2fc0793da864f9073609e30db77396785a6c55f98949e1e2afcc2b8c5afa667cf181902b9b
SSDEEP 12288:mbYlc+pFByStv9JRa//inz86NRo1qiRlUWC4kXzVC3:mGc+pFB5z+//ufNRoZW
MD5 SHA1 SHA512 SSDEEP

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 209342a1de99c312ec03602e2db3bfe3a9ae4d5a0f651e0fce081108c4caaa4a
MD5 8e9c9482be54adb6a5de71ad0da343d7
SHA1 e1caa5c0403feaeb37d5784d89d0f23ea211c8c4
SHA512 a8904fa3c98288a7fdebff0105d549a758f636a569ae61ff1edd3603405f6b7dd82217524e5f2e89cdc832aad9d8a3b65565a91557f95b2bb12167371391dead
SSDEEP 12288:ubYlc+pFByStv9JRa//inz86NRo1qiRlUWC4kXzVC3:uGc+pFB5z+//ufNRoZW
MD5 SHA1 SHA512 SSDEEP

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 8a1bddfe8475297a22000bef9ea05c37f681dfc1617b595a20c8902d7f19abb0
MD5 172e5d19bfc0d7c76546878f37687c5c
SHA1 034ee3dfab6434fd9eb1df63289e72f602ff50de
SHA512 19902be4687d791370c36911308fe508d76381f91cd5df81662dc8ea937dfa8bbe7a003bd8c3cc76401d3e266a7f4cad64a92e1c7bbbc5fc3aa38dd015d74d4e
SSDEEP 12288:yyPz5L8SYlc+pFByStv9JRa//inz86NRo1qiRlUWC4kXzVC3:vzy/c+pFB5z+//ufNRoZW
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 fb5de4da932dac9c9fbd514eea5f5c6f9bb482b366b20eb5d0c3a4bb34abd158
MD5 501487a31c3c65e380f8c44943f75b50
SHA1 1d7258fc6b6f6b62144f184a7c9480ec1a1518d6
SHA512 7499ac17ac317c17d54fe073590e6dd645939ed0f15478392e370ff1efa1d2d05468572eaca13ed2e7701733107d9e7b33e5ec9798f714cb5ce084c10677c639
SSDEEP 12288:VCd9eWYoaLHF3z0z04PDvhYYlc+pFByStv9JRa//inz86NRo1qiRlUWC4kXzVC3:wTHaLl3z0zDpc+pFB5z+//ufNRoZW
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 0c626f2cf50474faed49b4dce6026ee17427c45f4bc7fdfaffe610b27248374c
MD5 5121d497b9dbcf1467f3a3ace41d68b5
SHA1 715ad641b46a9cc4801537b160ee8f701c5e1538
SHA512 322627b3c1ef76bfc84277797950e4b08c008913a3cbf4dcf89c47807b0cd48342fe169f384870f97a60734b622da3f2c067f8014535e1411bf51eb9d296b2fb
SSDEEP 12288:Ni4e7+RdTfgwCHKy7GLbbdIvVYlc+pFByStv9JRa//inz86NRo1qiRlUWC4kXzVI:N37d9CHKy7GZ1c+pFB5z+//ufNRoZW
MD5 SHA1 SHA512 SSDEEP

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 4b8b6aa8da130de4df342b86274e493518fb99107710db43ccb6e571970c2989
MD5 40566768b0b4ca22ee33947ade9f73a2
SHA1 5cd7d28b2bfaab9a09059afe0c70e6f2ce3c8195
SHA512 f185adf6b10a6a7546c16d9f9a3604173c82c0a541704ec8c5c7d2c154f319e374fcb4788f48d75c2d48fb284d20ae5abc35f45ad5d31509abc61cbf846dcc97
SSDEEP 12288:NoYlc+pFByStv9JRa//inz86NRo1qiRlUWC4kXzVC3:NZc+pFB5z+//ufNRoZW
MD5 SHA1 SHA512 SSDEEP

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 bcba6972a9802a24c4f84a2f647a1f2f89724fe29520fe56ecaf41d627e30ef3
MD5 b5bcb1e7ee941ccf6f9fff6cc911272c
SHA1 edcc6b0f417f53e48a037dccd861d55a74bf00ed
SHA512 cc175a2dec854e4a44c3090543b84901d266f93ffd4851bc2100c8361139748244d965de9079b836f48d0d6818c4d2ea8664fc5f898ea65373ed77f44f79f99d
SSDEEP 24576:gcP4mcvIjkGOxhKP2l71SNKbrh/8KBuc+pFB5z+//ufNRoZW:rP4m4IpOO67N8KZ+pFzz+/2fNR
MD5 SHA1 SHA512 SSDEEP

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 ebeed3a4b20bda78e9d76916e7f3951e51fe948a3698ed4fdb0d144291640f15
MD5 032f13f4dc4552f0eb9f09092bf973fb
SHA1 f832d086050077f39dc4029dac7f82ec9106e51c
SHA512 9019b396cf265232af42eaa82b398955e02ab512eb35c93c81b598a01028232ea70470df31abc8a760bf939dce0a77663d4f3c557c3ae10752c7f733a92fbec5
SSDEEP 12288:7UFmDDLUYlc+pFByStv9JRa//inz86NRo1qiRlUWC4kXzVC3:Tlc+pFB5z+//ufNRoZW
MD5 SHA1 SHA512 SSDEEP

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 58bab5eb3208b408a74b8fe74e49e557bf2b3919b92e52b00e4af3193aa87a8b
MD5 a06ad85a34b6e068fb2fd46939018b8e
SHA1 8fa32255f3d890dc48efe175be8604089d82e3a9
SHA512 c592b62958423f32f66907f263e26dd02bceffac067149cd368e31f5e6401bc6aae1dd6dc34ac2b2302b13889ae23d0c56681490c76369e93fb929601d4d2cab
SSDEEP 12288:eLYlc+pFByStv9JRa//inz86NRo1qiRlUWC4kXzVC3:eWc+pFB5z+//ufNRoZW
MD5 SHA1 SHA512 SSDEEP

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 c2497877f4bbd5b32c852f2187896f7f3f330cdbd6a40efae3150390ec80fb62
MD5 2515fcdccbfa149ef95bf9622fe53d75
SHA1 306c6444c871c66d9b21abbed67e2595c785cf8b
SHA512 67d2b801d6707cd76731075b1cb2afea9fffbaa269a71761670363724f7069581e5c0d1f53716a7baceecb3c5e177a25dbbc5e2cdb19fec192a5126c69fd4118
SSDEEP 49152:Xa0h2GEkuAe73q3pp46zwwQt+pFzz+/2fNR:Xa0hNYG4JwM+pFtFR
MD5 SHA1 SHA512 SSDEEP

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 d5feee3ddd99a9979a96e28a787dede2c9ba826178588ea112bd3c68901641e2
MD5 9641cb23890e6467597be09ee88b923f
SHA1 b2eceefae7b5bbc3f9c0b915d5fc2c613813274d
SHA512 34bd8fb284d6652db871eab22c2f7650ad6ab96474da472860f969f768a4093c9da53949fa95767119ccb8169488ca4f7c6213f8358918a06445a535b9c98506
SSDEEP 12288:ZhbHjfXuYlc+pFByStv9JRa//inz86NRo1qiRlUWC4kXzVC3:ZhbHjP7c+pFB5z+//ufNRoZW
MD5 SHA1 SHA512 SSDEEP

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 d7134f40fe9fca77463417f6a1cac857cdb9f892657250dffd858cb7e3ebbecb
MD5 2538fb942c075ab7c1ef9f36ee521bae
SHA1 8e794ecd994e74806746a2e8b0da0e92f6c2186f
SHA512 e6b4d936a80e4efd7913f77cec782bb6e3625bf66eb9fa9e84bd34843a2cc3c6e3e69cf6a2aaa34afbb9b73b274770bd269bd851b6c3e16c5d5385b60c1bd84a
SSDEEP 24576:z3YgnJcRTk4yti+R5dpR/jc+pFB5z+//ufNRoZW:zIgnaTk46ppR/g+pFzz+/2fNR
MD5 SHA1 SHA512 SSDEEP

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 ef355a7a227d9b0445b660c9b212fd79b64861bc6ca72fc9b3ff88a933c06010
MD5 be3ab8267086771af80067f08c2947ff
SHA1 43b3a2fddf0877fe0a22558c18d5740ad3b1489c
SHA512 b137d5913ac637afaa0fffa2c5a75561135b6036605bb72074dac714b604e9c519257d09db274f2110d26ecb6c85dfcefa993e5758aac95a8ff0e41ac9cd04cc
SSDEEP 12288:SPYlc+pFByStv9JRa//inz86NRo1qiRlUWC4kXzVC3:S6c+pFB5z+//ufNRoZW
MD5 SHA1 SHA512 SSDEEP

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.5MB
SHA256 436fbf3071b9e7b0a112cc10dc1de362caad9240ad2ad0cf38789e9892fcc809
MD5 6e0e5ee5cb4dcd5c48f9e42f71332035
SHA1 1a316e1bc9db54562f289fdd8fcb6d075ed6e8be
SHA512 84c4d9d47e518426b63c80a3787cb59a13a64b669b1c96b77f5317475fb80a0412facc7d28e71ecf03d9410ea6e9ee2ca15aac605cccab6bcb26333a913baffe
SSDEEP 12288:BOb9A4LWOsvAYFTMYlc+pFByStv9JRa//inz86NRo1qiRlUWC4kXzVC3:2pL3UTdc+pFB5z+//ufNRoZW
MD5 SHA1 SHA512 SSDEEP

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 f9487c84792c9bc881f792242bfbc30e23008b4a7e8bc67a0860f57621b2a565
MD5 ac7ed9069ba7842b72d046e4c1c159f3
SHA1 2f851155eb5961ee3fb250010ec042cf3e33a1ed
SHA512 f3c9ac13d7dda4575386019b937dbc37feb45746020e48bec5b9ea922fa5f77b514731c02fb6049700bbe49c3e88aee12577f44e195e565ec679817e14af6253
SSDEEP 12288:bpFtpOwYlc+pFByStv9JRa//inz86NRo1qiRlUWC4kXzVC3:nOhc+pFB5z+//ufNRoZW
MD5 SHA1 SHA512 SSDEEP

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 18a18e5dba9da385a2c489256825d47e5e6b1358727114e3d4a51c60e0246962
MD5 5e1c00a953d545a429e78fb2ed3aecee
SHA1 fdeb05d130beb4629ef4fdf6460d82441b14b901
SHA512 3c25d11417ec945a9cfe56b2cb489cba8d59dacca0ffc66e11610b0ca7c30d314c85490db912e38010a5e47d3ab4539fce4cbd97104088e9c05e7a515e488bad
SSDEEP 24576:77NM9YmZqmWMUkPjZM48Mv6bEhsGc+pFB5z+//ufNRoZW:77cBWMpPjN8DbEho+pFzz+/2fNR
MD5 SHA1 SHA512 SSDEEP

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 b5b869408370491df59ba575bbb0bd66f110addcc182f1fcbfd5dd89e69e7994
MD5 5b8866658416a35ab92774d11ef53a98
SHA1 bca0ac99f6d08182f206c8a1b0a9709bab7e61a2
SHA512 ef0ba1f211c9e88a393641af827e55508791f412e9e5e8ce33159e4007155a8f7d191e5dbfb65d4d82a726729ed0ef849fc17f4e01a578bf2b4e1f69e6a370b8
SSDEEP 24576:7W6BApg2YuyuNDYTabvcRvNYf8km1Ec+pFB5z+//ufNRoZW:7F2YuHNETovcvNYf8kmD+pFzz+/2fNR
MD5 SHA1 SHA512 SSDEEP

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 a262c124d20b0be92f81a6de5880bbb3a52c51ff72d85f516e42060409077ebc
MD5 25e84dc694a41cbdedc021c6aff6aa19
SHA1 d9f798e4de43b17493d56b60298db0a098be38bf
SHA512 2570c86bc2d22d432b7e6465069eecd4b9c7efcb222620cd59aa17bcf16953bdb4e3cbd5e9d9cef2085ec5648b9bda32e96c7b4c7b78222554895047b9f29f7e
SSDEEP 24576:fAFs06+Omlf3NXEbTo1c+pFB5z+//ufNRoZW:oFs060lVXuN+pFzz+/2fNR
MD5 SHA1 SHA512 SSDEEP

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 4ebb9940fb327735dacfba164c3dea82459019df4285d78cbc5412696176f2f8
MD5 001c4fec5dcd713fb9c5fc17af60c0b0
SHA1 fe31e3e4a85aa8101eb00d5250b3ae355224ba76
SHA512 64c5af5cd50909d7aa24209527e157c1d775f60f710286c928ebf875ae2cbb2efee05a55d23a350d70849b8262c2fb3689bee252b5041f654d50539a91e98e68
SSDEEP 12288:6CJnJ5D3Vkrlzx7Ylc+pFByStv9JRa//inz86NRo1qiRlUWC4kXzVC3:7JnJ5D3Wtoc+pFB5z+//ufNRoZW
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 89cd4a71015cb211aaccfc397ef696bf060cb2e3c06b46f621400b1c9c6f2a56
MD5 2cef88fd50000a2d1abbc9a226f236a5
SHA1 63d1ed8f4fc5d22e2a332b1f0aa551a3ef4d942b
SHA512 33343101c756ca45df73a3368191744e1b0f1f80dc682037d9ff347bd4c09ada009b4389f7c585281150b3a8a13dcfd0e56ccc74d1482bab8fc883959a1c9023
SSDEEP 49152:wo06DIKdwc+eQnSt65aVn+pFzz+/2fNR:dB+pFtFR
MD5 SHA1 SHA512 SSDEEP

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 0d21a6a6e95dd8f9be4453e8df0e12cad6869581f2a39d085c130404f9cb682c
MD5 dd98f673ad30686523121bbcb44aa752
SHA1 c18eda9c4e9c15361821d0fa00bb1df692c870f4
SHA512 592ef82791a118139e8cba593a46b56fea3dc3cd52c982252c81521ee08d927893dfbbc1dac87b7a66c039dc8f1ba61beb575e2bbbf89af1b0daee0479ce4495
SSDEEP 12288:CEP3RrtYlc+pFByStv9JRa//inz86NRo1qiRlUWC4kXzVC3:Br8c+pFB5z+//ufNRoZW
MD5 SHA1 SHA512 SSDEEP

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.3MB
SHA256 2968db3fad78f2537334e89f40b8c055c745b5b90b1237a50190567301629304
MD5 ba487029b835502421d6b26f3f0ce0f1
SHA1 b9be8e51d04c0985fc0aa5a7b0fdf4ec34a53383
SHA512 2df26335b0c8586cf9bd4fcaa1645cd5a4999c6f539a850d3ab30fbdf18e1744559da990fa13add45202f61071131967ab5e033ba0e600b2b3aa5857febee258
SSDEEP 12288:PjkyeYlc+pFByStv9JRa//inz86NRo1qiRlUWC4kXzVC3:PIyLc+pFB5z+//ufNRoZW
MD5 SHA1 SHA512 SSDEEP

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 a5304c245831a2bd92eba514fd71f9eb8210b842ac872cc1a1dd9179f19c908c
MD5 fdf6fc7524c6c45e0bd96375c63b0065
SHA1 c81351ebf11f0129a189ec94a7a5a76a299f88f4
SHA512 768d8df4f818a5004684c458649ab5435b23fcddf4451434ea585a848a2d2ba45d340187ad689b415831afb2295e4ae6e60cc2c74242578ec0c5278729cda401
SSDEEP 12288:tFgYlc+pFByStv9JRa//inz86NRo1qiRlUWC4kXzVC3:Txc+pFB5z+//ufNRoZW
MD5 SHA1 SHA512 SSDEEP

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 50726dba227a81a556381932cf0e5775b4aa5f4136dfecb2080fa039e4c3b819
MD5 81e586d2608a6ceabe47c8518e7d1b5a
SHA1 b556b5073fb624c3d29ab0330626ce34130a2a22
SHA512 e16da839b060ddd8a1f0cbfed95b9ab196bad581207babe8b3dcb16377d72cd5962047ae69e7691771508d0a193a5da3ffd0ff9b31cb7214c676a8ddb46a752d
SSDEEP 24576:1Q9MxZKdcz97w3ec+pFB5z+//ufNRoZW:1VKXr+pFzz+/2fNR
MD5 SHA1 SHA512 SSDEEP

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 a40c0b92f52ab3c7c7418cbc31b582f63fd5c4c9d8f841a6fb15e5b46b504e5b
MD5 e3680b6e1afce4092b810c2a81a671c7
SHA1 8ae907be0929b8f2447c3a7e88c9c4fbd197c0f5
SHA512 17a702c38c6d40c7b9f7d23ccfbf8e66854e87d1cc8f97b32129208ea94f004bcd4e50568219e9ad41dd8b0e4164f4b69925f90782d618e6eba03b0388cf0240
SSDEEP 12288:/yoKo2HRple9piYlc+pFByStv9JRa//inz86NRo1qiRlUWC4kXzVC3:/yocxApvc+pFB5z+//ufNRoZW
MD5 SHA1 SHA512 SSDEEP

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 f7709822aa709493fa0d6940dffeb32f7e91e290a3362e1c2908abe8879cac26
MD5 208c0abee28598a30421f41e5de0395b
SHA1 3373d51db98b3254e47497c864a163986f35e202
SHA512 86bad148db10f688253b8278d4011d2ebb4e8775790e39fddf3f2d6d3e426ab2b26ca40b33664c684140c50fb864889b7a125f798ca2389c75ad3cbaa2bd780d
SSDEEP 49152:TWcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIKU+pFzz+/2fNR:T0zuNIQ+pFtFR
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 d5a0876f8a7e4d51e38d24e455b699b0baa63425d7aa9962c95971a18046f130
MD5 9569df1be79dd64c9886fc125059bafa
SHA1 1e83cc98ebd99776667ceaa596fb3c1f42c43723
SHA512 f063d56a444804a512d79cab195b0ffcc027f5b368067edebcbddde77bebf230878290193a65590e73fc5c8b7d7bcff674d71c649f2ac4710e448475c5ebc44b
SSDEEP 24576:41QT7EcpfxR+N5AWAz3ooiYtjMqb8c+pFB5z+//ufNRoZW:FTDxR+N5YzTfjMW+pFzz+/2fNR
MD5 SHA1 SHA512 SSDEEP

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.5MB
SHA256 e896beca67b37c4776e8a7275b5ab9a6cf57f74b2d1516aa2ed3efd8199c5863
MD5 f47028a748e40ba5a1c702a17b85c5e8
SHA1 dee0dd83a8b560da453df74d12233f05ca1c28b1
SHA512 2320cfb9b9c3dd6e1575ea2f0878505cecbf4e7cb9258b0eec7b1d0dce6f565e8aa0a5c097c76acdd23908369d578bc259d0bbee80909ac8bbbbe6432fecc6c7
SSDEEP 24576:aTMdOz0FFS+imSLAc+pFB5z+//ufNRoZW:20K+imSLV+pFzz+/2fNR
MD5 SHA1 SHA512 SSDEEP

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.2MB
SHA256 438006e0bc6b5cb11c7fade81919fa67093feeac0807bd6d044cc58ed0d957ba
MD5 73a06caea8b235fe38d2f52c51e108fa
SHA1 b031bb6ee857339d95acfaac53e6c91ce211193b
SHA512 bb6035799d2ce8f5c2f66271ec43586e7b26553b97319d0b2b159525d5be7751bccc909774ac0c1aac62161e561f16f7f711dadeed107364b4d96e7851c25d57
SSDEEP 12288:C47MYlc+pFByStv9JRa//inz86NRo1qiRlUWC4kXzVC3:hdc+pFB5z+//ufNRoZW
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/232-560-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/232-267-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/544-258-0x0000000140000000-0x00000001401EA000-memory.dmp

Download

memory/1124-51-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/1124-48-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/1124-39-0x0000000000A10000-0x0000000000A70000-memory.dmp

Download

memory/1124-52-0x0000000000A10000-0x0000000000A70000-memory.dmp

Download

memory/1124-45-0x0000000000A10000-0x0000000000A70000-memory.dmp

Download

memory/1136-480-0x0000000010000000-0x00000000101E6000-memory.dmp

Download

memory/1136-478-0x00000000009E0000-0x0000000000A40000-memory.dmp

Download

memory/1136-8-0x0000000010000000-0x00000000101E6000-memory.dmp

Download

memory/1136-0-0x00000000009E0000-0x0000000000A40000-memory.dmp

Download

memory/1136-9-0x00000000009E0000-0x0000000000A40000-memory.dmp

Download

memory/1236-37-0x0000000000580000-0x00000000005E0000-memory.dmp

Download

memory/1236-36-0x0000000140000000-0x00000001401E8000-memory.dmp

Download

memory/1236-27-0x0000000000580000-0x00000000005E0000-memory.dmp

Download

memory/1340-262-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/1396-558-0x0000000140000000-0x000000014024B000-memory.dmp

Download

memory/1396-54-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/1396-60-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/1396-62-0x0000000140000000-0x000000014024B000-memory.dmp

Download

memory/1604-85-0x0000000001A80000-0x0000000001AE0000-memory.dmp

Download

memory/1604-81-0x0000000001A80000-0x0000000001AE0000-memory.dmp

Download

memory/1604-87-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/1604-75-0x0000000001A80000-0x0000000001AE0000-memory.dmp

Download

memory/1612-269-0x0000000140000000-0x0000000140205000-memory.dmp

Download

memory/1612-561-0x0000000140000000-0x0000000140205000-memory.dmp

Download

memory/1812-256-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/1924-552-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/1924-261-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2120-268-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/2372-265-0x0000000140000000-0x0000000140221000-memory.dmp

Download

memory/2456-71-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/2456-65-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/2456-559-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/2456-254-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/2500-198-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/3224-555-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/3224-21-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/3224-22-0x0000000000700000-0x0000000000760000-memory.dmp

Download

memory/3224-13-0x0000000000700000-0x0000000000760000-memory.dmp

Download

memory/3372-562-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/3372-270-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/3556-264-0x0000000140000000-0x0000000140241000-memory.dmp

Download

memory/3664-259-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/4308-266-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4696-263-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4872-260-0x0000000140000000-0x00000001401D4000-memory.dmp

Download

memory/4924-255-0x0000000140000000-0x00000001401F8000-memory.dmp

Download

memory/4924-89-0x0000000000710000-0x0000000000770000-memory.dmp

Download