bb3dd8373caf6de98b85dffdf8908fb533632d6f6c001e25a892c63d76393816

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
09/07/2024, 04:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bb3dd8373caf6de98b85dffdf8908fb533632d6f6c001e25a892c63d76393816.exe
Size 1.5MB
Sample240709-exa8bawblr
SHA256 bb3dd8373caf6de98b85dffdf8908fb533632d6f6c001e25a892c63d76393816
MD5 adc8b65bed6ed290ea4abeb13ffae0af
SHA1 1abc9804ab9f75a3fb379335a1f985a28e46c17b
SHA512 45218a514c046b502c9bbb6d843cff7d31acb0baf719ce9dc054bc41c490200ae3016dbfb599bd3bf25d822529edd6c6768eeb0283781362ae81a185e8a5a925
SSDEEP 24576:+z2DW48NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:VgDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
412	alg.exe
4468	DiagnosticsHub.StandardCollector.Service.exe
2396	fxssvc.exe
4892	elevation_service.exe
3780	elevation_service.exe
4988	maintenanceservice.exe
1616	msdtc.exe
4684	OSE.EXE
2848	PerceptionSimulationService.exe
3860	perfhost.exe
928	locator.exe
4388	SensorDataService.exe
2568	snmptrap.exe
1416	spectrum.exe
4512	ssh-agent.exe
1540	TieringEngineService.exe
3556	AgentService.exe
3024	vds.exe
1488	vssvc.exe
2980	wbengine.exe
2716	WmiApSrv.exe
2076	SearchIndexer.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in System32 directory 37 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\vds.exe	bb3dd8373caf6de98b85dffdf8908fb533632d6f6c001e25a892c63d76393816.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	bb3dd8373caf6de98b85dffdf8908fb533632d6f6c001e25a892c63d76393816.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	bb3dd8373caf6de98b85dffdf8908fb533632d6f6c001e25a892c63d76393816.exe
File opened for modification	C:\Windows\system32\wbengine.exe	bb3dd8373caf6de98b85dffdf8908fb533632d6f6c001e25a892c63d76393816.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	bb3dd8373caf6de98b85dffdf8908fb533632d6f6c001e25a892c63d76393816.exe
File opened for modification	C:\Windows\system32\vssvc.exe	bb3dd8373caf6de98b85dffdf8908fb533632d6f6c001e25a892c63d76393816.exe
File opened for modification	C:\Windows\system32\dllhost.exe	alg.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	bb3dd8373caf6de98b85dffdf8908fb533632d6f6c001e25a892c63d76393816.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	bb3dd8373caf6de98b85dffdf8908fb533632d6f6c001e25a892c63d76393816.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	bb3dd8373caf6de98b85dffdf8908fb533632d6f6c001e25a892c63d76393816.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	bb3dd8373caf6de98b85dffdf8908fb533632d6f6c001e25a892c63d76393816.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	bb3dd8373caf6de98b85dffdf8908fb533632d6f6c001e25a892c63d76393816.exe
File opened for modification	C:\Windows\system32\msiexec.exe	bb3dd8373caf6de98b85dffdf8908fb533632d6f6c001e25a892c63d76393816.exe
File opened for modification	C:\Windows\system32\locator.exe	bb3dd8373caf6de98b85dffdf8908fb533632d6f6c001e25a892c63d76393816.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	bb3dd8373caf6de98b85dffdf8908fb533632d6f6c001e25a892c63d76393816.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	bb3dd8373caf6de98b85dffdf8908fb533632d6f6c001e25a892c63d76393816.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\alg.exe	bb3dd8373caf6de98b85dffdf8908fb533632d6f6c001e25a892c63d76393816.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\ac8f2c0175cb61b0.bin	alg.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	bb3dd8373caf6de98b85dffdf8908fb533632d6f6c001e25a892c63d76393816.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	bb3dd8373caf6de98b85dffdf8908fb533632d6f6c001e25a892c63d76393816.exe
File opened for modification	C:\Windows\system32\AgentService.exe	bb3dd8373caf6de98b85dffdf8908fb533632d6f6c001e25a892c63d76393816.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	bb3dd8373caf6de98b85dffdf8908fb533632d6f6c001e25a892c63d76393816.exe
File opened for modification	C:\Windows\system32\dllhost.exe	bb3dd8373caf6de98b85dffdf8908fb533632d6f6c001e25a892c63d76393816.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	bb3dd8373caf6de98b85dffdf8908fb533632d6f6c001e25a892c63d76393816.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	alg.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	alg.exe
File opened for modification	C:\Windows\system32\AgentService.exe	alg.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	bb3dd8373caf6de98b85dffdf8908fb533632d6f6c001e25a892c63d76393816.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	bb3dd8373caf6de98b85dffdf8908fb533632d6f6c001e25a892c63d76393816.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdate.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	bb3dd8373caf6de98b85dffdf8908fb533632d6f6c001e25a892c63d76393816.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	bb3dd8373caf6de98b85dffdf8908fb533632d6f6c001e25a892c63d76393816.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	bb3dd8373caf6de98b85dffdf8908fb533632d6f6c001e25a892c63d76393816.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	bb3dd8373caf6de98b85dffdf8908fb533632d6f6c001e25a892c63d76393816.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	bb3dd8373caf6de98b85dffdf8908fb533632d6f6c001e25a892c63d76393816.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	bb3dd8373caf6de98b85dffdf8908fb533632d6f6c001e25a892c63d76393816.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	bb3dd8373caf6de98b85dffdf8908fb533632d6f6c001e25a892c63d76393816.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	bb3dd8373caf6de98b85dffdf8908fb533632d6f6c001e25a892c63d76393816.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	bb3dd8373caf6de98b85dffdf8908fb533632d6f6c001e25a892c63d76393816.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	bb3dd8373caf6de98b85dffdf8908fb533632d6f6c001e25a892c63d76393816.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	bb3dd8373caf6de98b85dffdf8908fb533632d6f6c001e25a892c63d76393816.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	bb3dd8373caf6de98b85dffdf8908fb533632d6f6c001e25a892c63d76393816.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	bb3dd8373caf6de98b85dffdf8908fb533632d6f6c001e25a892c63d76393816.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\110.0.5481.104\chrome_installer.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateSetup.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	bb3dd8373caf6de98b85dffdf8908fb533632d6f6c001e25a892c63d76393816.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	bb3dd8373caf6de98b85dffdf8908fb533632d6f6c001e25a892c63d76393816.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	bb3dd8373caf6de98b85dffdf8908fb533632d6f6c001e25a892c63d76393816.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	bb3dd8373caf6de98b85dffdf8908fb533632d6f6c001e25a892c63d76393816.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	bb3dd8373caf6de98b85dffdf8908fb533632d6f6c001e25a892c63d76393816.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_105781\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	bb3dd8373caf6de98b85dffdf8908fb533632d6f6c001e25a892c63d76393816.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	bb3dd8373caf6de98b85dffdf8908fb533632d6f6c001e25a892c63d76393816.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	bb3dd8373caf6de98b85dffdf8908fb533632d6f6c001e25a892c63d76393816.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	bb3dd8373caf6de98b85dffdf8908fb533632d6f6c001e25a892c63d76393816.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	bb3dd8373caf6de98b85dffdf8908fb533632d6f6c001e25a892c63d76393816.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	bb3dd8373caf6de98b85dffdf8908fb533632d6f6c001e25a892c63d76393816.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002aebc324b7d1da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000087361025b7d1da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000084334e25b7d1da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000aafed624b7d1da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9926 = "M3U file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e6e80125b7d1da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000090b1a924b7d1da01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000da13ac24b7d1da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000051326d25b7d1da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b423fd24b7d1da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
4468	DiagnosticsHub.StandardCollector.Service.exe
4468	DiagnosticsHub.StandardCollector.Service.exe
4468	DiagnosticsHub.StandardCollector.Service.exe
4468	DiagnosticsHub.StandardCollector.Service.exe
4468	DiagnosticsHub.StandardCollector.Service.exe
4468	DiagnosticsHub.StandardCollector.Service.exe
4468	DiagnosticsHub.StandardCollector.Service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
668	Process not Found
668	Process not Found

Suspicious use of AdjustPrivilegeToken 41 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3212	bb3dd8373caf6de98b85dffdf8908fb533632d6f6c001e25a892c63d76393816.exe
Token: SeAuditPrivilege	2396	fxssvc.exe
Token: SeRestorePrivilege	1540	TieringEngineService.exe
Token: SeManageVolumePrivilege	1540	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	3556	AgentService.exe
Token: SeBackupPrivilege	1488	vssvc.exe
Token: SeRestorePrivilege	1488	vssvc.exe
Token: SeAuditPrivilege	1488	vssvc.exe
Token: SeBackupPrivilege	2980	wbengine.exe
Token: SeRestorePrivilege	2980	wbengine.exe
Token: SeSecurityPrivilege	2980	wbengine.exe
Token: 33	2076	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2076	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2076	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2076	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2076	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2076	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2076	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2076	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2076	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2076	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2076	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2076	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2076	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2076	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2076	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2076	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2076	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2076	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2076	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2076	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2076	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2076	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2076	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2076	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2076	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2076	SearchIndexer.exe
Token: SeDebugPrivilege	412	alg.exe
Token: SeDebugPrivilege	412	alg.exe
Token: SeDebugPrivilege	412	alg.exe
Token: SeDebugPrivilege	4468	DiagnosticsHub.StandardCollector.Service.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2076 wrote to memory of 3464	2076	SearchIndexer.exe	111
PID 2076 wrote to memory of 3464	2076	SearchIndexer.exe	111
PID 2076 wrote to memory of 2620	2076	SearchIndexer.exe	112
PID 2076 wrote to memory of 2620	2076	SearchIndexer.exe	112

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\bb3dd8373caf6de98b85dffdf8908fb533632d6f6c001e25a892c63d76393816.exe
"C:\Users\Admin\AppData\Local\Temp\bb3dd8373caf6de98b85dffdf8908fb533632d6f6c001e25a892c63d76393816.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3212

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:412

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4468

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:4176

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2396

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4892

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3780

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4988

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:1616

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4684

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2848

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:3860

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:928

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4388

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:2568

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1416

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4512

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:4560

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1540

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3556

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:3024

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1488

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2980

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:2716

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2076
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3464
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
  2⤵
  - Modifies data under HKEY_USERS
  PID:2620

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
Size 2.1MB
SHA256 21e91474c509388f0380df54234625fc6827312ad66348382a65b60239473073
MD5 6b887453cab09a0cd1f76f8a3cc5df3d
SHA1 9f0aa68bd99fc81f945569d682c59daf6e539fe1
SHA512 1142f9ad7cbb1128d8c551f961552a5c71e8e45a70be688d92be8ff7e940d6180cb82098e74221c4596b586f049a3d411240a538f73bac01bd8386d9db0379c3
SSDEEP 49152:XuYk3H5koUXfTqkkYLO/W2buywzMbOX+T7z5tgDUYmvFur31yAipQCtXxc0H:XPfTqi90bAU7dG1yfpVBlH
MD5 SHA1 SHA512 SSDEEP

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 ae30fe4d720d9b4a0b8d98ca05e5f1e2c935671b24664f50acbf45ec9712a250
MD5 6c75b9317fb5323fd3812840f06f5ac6
SHA1 5265656b0b8cda0aa5198338f4b2c5be8f3e7b3e
SHA512 8dd9722054546ccce5f6154f5809e241f98fb3cc8ecfeb9df67487791fb2895abd56465f3af036eac40a0c344728f5af3fd1f20ecf880f8f589821e23411822c
SSDEEP 24576:viTnBsuE48NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:0SuzgDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 aa535be414d3c61c83c587005d8b2b5b4d7ccdb47ad8121b6bd2bee0ed42082b
MD5 38ab636c3579d0694cdbd8ffd8de2406
SHA1 96e8ef57afbfcf6d8ba4c2692e067505d0119679
SHA512 7a71d54a0260b0ca56331d4856b7e1bccda6d941450eddd7462f75893ab2c961a2a8303c07b67af309c8927f29babed65858b44cf3ec39241ddba0447a13679f
SSDEEP 24576:C+gkEHfh4CoM8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:HgkE/SqgDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 d02a9004368c8700e966f6f8040f65a26a96f3f81581ccb999e52fb402a50f04
MD5 a4b5c8aa2b2b3026e88de472e340bf3c
SHA1 0df2a2b7c98f35f1eef3aef64f83472af82d129f
SHA512 9c382d4dce0f8d3ba7c2787ac6995f8816d4e371f8039460a59307323f140efd810caa1f1f9c9266b54e48a67b6873cc7b2149d635945bf1320481bd6a72901b
SSDEEP 24576:UBpDRmi78gkPXlyo0GxjrB8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:wNRmi78gkPX4o0GxjNgDUYmvFur31yA6
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 c0f28d51204fb6cd0f3df07b1cc41a46ea89bb6c714a477807f76a9769021f32
MD5 05509284f85cd970b33cc5115d6978f8
SHA1 fd9d1d60d2d6057135586e007f1acf47bfa601ad
SHA512 7868fb27cd4c8aff70301e75cc9f46bc0debce12dd49d5ee4f7c0ad99366abcc2e69167e871b26c157aed7cb82fbb363e0a17d44197dc30e8dd7afe8851521c1
SSDEEP 24576:tLOS2oyPIXVM8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:H/ylgDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 132c3cad998b92efdf54dbd95b3eda8f572679db4f2a6de10710276668c49890
MD5 79ac560a40191f431675ebb3a0374f9b
SHA1 b58b1faeaa36b27936a574852e9420197aafbfb6
SHA512 6bddfa5a63ea87cd8ada8b774b6dea4ee9cbc6da9583a135d2afae549266ee144ec997edbe5285c5cc154d672f1f5f42a11e8f0178fd3b29a1cf9624fe1715e0
SSDEEP 24576:PtK8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:wgDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 c3c06d09565389d28fe9783ad0891ae7b8af9220fa7955ca92742cc93c5eccac
MD5 7316832d28746680cff495871013d3c9
SHA1 2477f9ca6503a00fdad06a6acb56258feb197b2b
SHA512 b63e43e9bfcd2465a8b4734492424835f1383c29c7bea84bf1f78991be8c37e7763ebf83a17087a6713ee71b8cec91cbb9a07073cdabfd05eac631f0aad87481
SSDEEP 24576:IJIUv8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:IJIUvgDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 3aa6939bc58e4fec222b9fff7010620276dcb3e2fa7e84372eb974cf2f4be6fa
MD5 f4cea0d2f8d25480794d4b308dbf3f02
SHA1 834a046a71049d48a07336efccf3bb23c1c76976
SHA512 ea0c3da5632b180f14659b333588d75c2a8fecf8409d65a23fcd396b65975a8c8b2f334a61c97c51478e85ce63a2c4d7d0bc3914be573a3e57bb2e0942186ce0
SSDEEP 98304:qQvGAdlCEL8c/yRNw5CJU7dG1yfpVBlH:LvyEYc/y3w8JUoiPBx
MD5 SHA1 SHA512 SSDEEP

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 13c25c64e29a9044d6f7b2aab055ee42c4250796ca6d57c4766bd14922e26cf6
MD5 4cbc8faab44fe0e49d9d941782bf05c9
SHA1 bb7630547ad9ac3e149a381cd36f59d8ba1d7059
SHA512 6302978ffa49998ec7a64b98a4f6d731a41f6594ecc74227e5d3a03e60cfe5e69cbca71c0761d950acbce9248741258f2910493bcd236f263b3ce2381d31e33b
SSDEEP 24576:U7ewsAjZ8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:mljZgDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 c1c0d81d8f17f19d1066e0282422fa7fc3853a5800ff1525927a7d3851bd8962
MD5 b6125afdf73efea63c135d78178d6623
SHA1 e14d9ab18babd4d13fb2c124ead5cc8ed565fa6e
SHA512 fffce0a5d15017bd10fe945eb4c0b54d37d400d164ab27b1210f3dec3e8b95224ae9b9d2273a45d23c8e0640030af1860679072e142e2437f55d6f22fddd9f2c
SSDEEP 196608:/UEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHYUoiPBx:/UEtQevvqc2W1cpV2EI32Y
MD5 SHA1 SHA512 SSDEEP

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 204cbf812cc4f1a61b5e08fb0dd83778f7e86d5c7ae6e8fa32559f118c4a62fc
MD5 00002a40c457b849e905cf69d3335079
SHA1 8feafec1b79fbea9cc291bd4911426fadcebd238
SHA512 cab89e54aecb78afeb527b62b8a280fd0af80fcad83e20679792d0ca872bf7916a0b6754bae41fe746432873dcd8571c7912fee82e8662d5dc028199ecf53ab1
SSDEEP 49152:rCbRquA/m2yL5zifFiV+XenmE3/z5gDUYmvFur31yAipQCtXxc0H:0oqHVjnm9U7dG1yfpVBlH
MD5 SHA1 SHA512 SSDEEP

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 551bb5d71509cff66eeff5a6cf04664f220cf1ad28f57be5b6b232b773cafe16
MD5 a23fea583894eb524df2c9c45f544d5e
SHA1 7a757d0913554371fc6b62aa9f5432f8c5c36246
SHA512 e566e9763abd0b6705371229b85992af1acdb25062b1a35e6473dd0bd8b632a9d0483546349418924f33dcd26e055d10132fcc4109e239551d6d50ded2c55f21
SSDEEP 24576:FAhGLJIFoiwtA5l7S53c8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:FAMyFoiq5sgDUYmvFur31yAipQCtXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 d7cff45d35815b0977aff4ea0a80370dbb575ce3df984c331f8069720a588b6c
MD5 18219d6107fc1feb70e4d2f7f9c2829d
SHA1 6a1d9fa9edb1e7f4b846b2cd105fd3d29fd72376
SHA512 7cf5df15f81dd737ff6bcb7bf6c4019e14acacddb7d72d96eb12e25c7c90151a301f07f7dbff02d09246d49e2c3a3567418a89dfa8f999845130d93e2722247e
SSDEEP 24576:GwuSOWl8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:Gw9OogDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 a00d9b987fb6d3ab0d9abee618dd1341c8091afaa5123c720e0c12fa40f65dfa
MD5 1dfda9b7fbdc4bd25a321782498df592
SHA1 2e7238ce0c67a82a8919fdd94c2bc5b04df0f198
SHA512 7b8cb611aea9a1054e837f51748bc8fd03308c47372953e2a890256c9e98095b7a3e33f2e5a60a95cbf7b4ba9f5966b816816c6be7967bc42ead71527e3d9146
SSDEEP 24576:QZu+8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:ggDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
Size 5.4MB
SHA256 c0c94c1520e35d2ef17a3f2633a1e817f03e5d7e4b04e4b89bb147dd390adab1
MD5 db710a903e42192a20b12e9cc840129c
SHA1 492e670d476a989759e1d24fa53e9502c417228a
SHA512 f528ae73726c1e7028cc3e68f3601a18a7d231bd5e809baa802163b1221bb0e833ed11939490849ec665490df905c26a9f1e3d9f800015c98e8f3c2e4c3e2613
SSDEEP 98304:YwfhY7g/rLd7yYA3awr341gFU7dG1yfpVBlH:078yhFUoiPBx
MD5 SHA1 SHA512 SSDEEP

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe
Size 5.4MB
SHA256 9f58ad18c706424c0fe297b55ec83daa1b2140546f4453167ad68c060516258c
MD5 883389fe39febd9a33825c47ed127ce9
SHA1 abb79df4d99e6e8473951cb8022b56718193b9b4
SHA512 fbc6ed7876738cc470ef30b103576421e69961678e54142107d376dea7fd4d0c33f1cac175ed8ef4c3a16b5f2c0d2795bafe41650f7316aa1d6259c0a1fe436e
SSDEEP 98304:RwfhY7g/rLd7yYA3awr341gFU7dG1yfpVBlH:z78yhFUoiPBx
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe
Size 2.0MB
SHA256 50075fd59e88207029b9e6bb61c1c843c0e530670dd62cd41a0cb831b8d2171e
MD5 a1a16cab92dff713d0e1ea0f69d2d27f
SHA1 b653ab094c43d5c56e7f0d2e66f70936ffbf96cf
SHA512 2327e13520dd50cda33530d1c4e767c9e18d6908ca5b7f60e9a0f1b10b1c5627a1c7566cafa5f5327f5b77c2e856878a8186c5a546e8a30b4586d9092b613d09
SSDEEP 49152:7uXv0Ftpn5606zOlgDUYmvFur31yAipQCtXxc0H:6c56FpU7dG1yfpVBlH
MD5 SHA1 SHA512 SSDEEP

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
Size 2.2MB
SHA256 ee99c5e47aef03a3377b728d9862c6ab5aeffec97808274445ac468c285dc900
MD5 f6a8dc346e4baa8cdbf192f99950a3cf
SHA1 acd361c9368238362b8715d7adbcc335c9e5858c
SHA512 b440e92dbda8d5661fa0d250d9aeec10f5f040654b03eeb1d7829873ce167483e43adf37b73abaa79779acd79c2ed6468fb3861f506769339e3f644d3e7593c7
SSDEEP 49152:zy7mTd0GxN8jyynxHjXKUyn4GVcbDSKrNTxZgDUYmvFur31yAipQCtXxc0H:OmYeyxHjWjMTAU7dG1yfpVBlH
MD5 SHA1 SHA512 SSDEEP

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe
Size 1.8MB
SHA256 5d25d1ce6f25e2d15b78e99ad9d4d98800a67b6d7a6eec478bf92129f4540bd2
MD5 f96ea22ab19406a5711a3140c442c209
SHA1 6a2dabd3342cc5db964807e11117a900f2c33b64
SHA512 3143fa2b32d51a5b6f81053db636522df60b77c293befb587ca9257e9cfdd3a79014c494f888573a8abaa5c627e4a207187bc1904d1893d80dba9d0524b137f4
SSDEEP 49152:uWnDci18yNNUgbYtgDUYmvFur31yAipQCtXxc0H:/IqNNocU7dG1yfpVBlH
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 1.7MB
SHA256 210c3f4299a4e06031d6c8412ae3d8fc9fb191528e5a27bdbc7f2c6231784f96
MD5 b72d2092e257a1fd9ac22c3898652e10
SHA1 67ac1119d59a491917464c963fc8cf5785f3195b
SHA512 7d034c9d041f0fe7b5cd7df5e40a8e84570ab911db76529e899270f356b5881881de01732393f7d97521c33a0adbcd39c2957e0ba6b6d7fb994923806e7b55e5
SSDEEP 49152:RizMZm0GhamSo+gDUYmvFur31yAipQCtXxc0H:Rm0UWorU7dG1yfpVBlH
MD5 SHA1 SHA512 SSDEEP

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 a5c6fe46e8839f424f38b39522585c514dd27d5f19e687e8e1452b053d6979a9
MD5 9057f726514e1186668b0d9d048ccae0
SHA1 fc3d7a829e4ca95b4a8adfc9b95e33ae8ad70b6c
SHA512 95faa1ca3f79785c3129397ddfcacf7bbac386befb0beab9bfe3fcae6b695cf2b06db035cdfaffca41c9159621940afaa2a082e1962dc9ea71bae84372792ed0
SSDEEP 24576:hy8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:YgDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 bbc3df08e2d03f30e277ac82296d91e9010a80487cdd5a1e50db00e6aa123110
MD5 1fbdc6b150ad83384d9edcbb18438d7d
SHA1 eac33e90b2542d3e91135bec8667d5a2ebbb5bfe
SHA512 04327c5f32e5af09177f321637d09b6ce3800102461f97f17645407b4a3dab5f9d0bafb2cb992dc894ee7deb1a0ff9210e896c4945ceca423bd6d99e5ca9139d
SSDEEP 24576:nd8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:dgDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 3205101fb4dfd2e4f52b974558f13805085d671ca3f6af84fa1290a53f62c0e1
MD5 e6027913b5b25859ef600e570505207e
SHA1 5de7387d21da781fafaf38e44bd0bf2036e71ac1
SHA512 3f3dcc9e835215e7c1306fb74480fb53c94168edefc026fe7a104599fa0635ab7c407d1728453a57a4371b61f6ac7620f2f332b4018a16cdbae45a48f945c578
SSDEEP 24576:OX8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:CgDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 dc7ef300a8d6b1961a7fed8b512c9415c22f46915f941c0c33765f0526cce7c2
MD5 77d82e25f23875f61c5fc7ae735f59ef
SHA1 07375e5ea2f7d0fbb55c49384190f3e93f58d8b0
SHA512 08690b53417ab9fb780b4459f295de59ca3f924507abb46bd1bfa280083ca81c47cd7224ce09a9d1f2d933e62e1cd2592cb43529bd87231bf83a638d8abc6ae1
SSDEEP 24576:S8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:SgDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 a1815b30ef1e262bb310c32d29a6f039b706e68c33e719a69be705fd25365f6f
MD5 adfb0535ae41f73d7b9f3cfa3bfe9d7c
SHA1 9fae92f2809f65864acc81274b2c4d0fb7a9841e
SHA512 fc9483169625fdb2221398cb3dbf833bf8debde137c7a6d42193712cf8fe87912d486dd6a78323bdd6529d6d2f561bb3286f01a9fb24077ffacf0808c14f7681
SSDEEP 24576:DU8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:ogDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 220c5c43a72be2b8f3a6c9f3063b1be8a61354dab175fb596a6fd62f26646678
MD5 d7c5324ff2edbe02564d9d777abfd235
SHA1 9fa8e92a5a2353a79f64b37b8031181039f8128a
SHA512 69038207a55732466b482f3d73514ef4824b3ee344276044fd989262790777b408dc9bb1ee4d9f0c1707ea3f49ab6a1efffd51f7b4a174a555c71fc9c75b55c3
SSDEEP 24576:lB8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:ngDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 6e7003c37fffe395f20127153a15cd830db5fccc2269a71c7441ffc9da77c732
MD5 d7dd3bbce57591882a66d9d4ce774f60
SHA1 b6bc8c7e987337cf4378893fd89d47921a3a5e1f
SHA512 862a48de066a37bdf6d5003ea3cb5d4be8caa0e855ff10dcdc8728fcffa822593cbcbd472f63619f622cfae4eb3a29984076c1e04b0e843ac37b64d97d579808
SSDEEP 24576:R18NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:TgDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 df3273f1b4e2abe1dfae3f458793df82c989603e7ec2439919526df943cc91f5
MD5 8570c16294d520f9e35dc145afd8c90f
SHA1 e6277c0d25ad6312e0da58ff50909ab67efad5ea
SHA512 3848762557491104eaa74c1078cda72a3851b31c8c6b0338cbb9f573ff24b1137ce165b2237327dbe623badddfbbd48eca0593e13fdb17af2c3d5c227cf309be
SSDEEP 24576:JZMEzFVSO98NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:JZMEzfxgDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 89f7cdcbb01ded8ef36849237648c8c3aec5aba8d1e10135350f9152139db1f3
MD5 982e2f0a77d352191cc425f6a9670bf3
SHA1 7aa3cbbe056da8ddbef5f6578ba4e01b20fc1394
SHA512 e399b2ab54c3b77a1c772b8241bf67e44dd0374f208ab47e8262fd64f5f2f479dcabade05be89730dac9dacd2088ac3d11f68460d49e5c92d46b4bfebe5659b2
SSDEEP 24576:Ou8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:5gDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 3ee619f722ca362e53542b94569afaea1b06285d2fb5d51ddba6ce62990c041e
MD5 1a3e7045aad8bd9616cd21a170507a00
SHA1 9122f7cd7a26ecd41ffda320efafde349c7543a8
SHA512 ab85c02b286b9d460d4fb9de677522f05df576a437c3a2b2cc47025cf092d14f9635d6c5931c00eb5c2f7a3b00ff129cf2f4c6af662c6a80266875e174f7bb76
SSDEEP 24576:I68NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:7gDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 3414c9e9d7bae57aba234783a9e309c85cd75cb7423de58d38543ff505165261
MD5 3bc51bfb252fbac22054979040ad9640
SHA1 b1339da434001fa1bd294f7168fbfef2ee777d9f
SHA512 5036b8adb0a1e1beee5cb28ec784e42095f27931d9232e8ea30a7d5b065609993b7c2e19f281d649df2a3f0741bdedafdd3b53ed10a534994305f730351f353f
SSDEEP 24576:kzyJ8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:kIgDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 f7df9e7f3ce1a1ace72b8e798cfe43244da8817af5ceb1c5e53c2caae2136e4b
MD5 9f0645fb81df098cc7728287de6bd340
SHA1 cd848450de30fbc0d566b60af87ba6cb6d104260
SHA512 2545b30412f718a9fdfcdee397ee26d8257b043633cf3925590aea26aada625d3a1f60f92020cb8b829bd554b7e9ab984557845b13b4dfc3949d9df0df04473f
SSDEEP 24576:Yu8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:LgDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 52157d0ceff3a2a2fcfcda1738a464e45e321acb88656efff76889aaee430570
MD5 4e1b259cab7357c8539d8efd7831ecdc
SHA1 76d6edc78e89499b196b472038e1218a573d4717
SHA512 86be03f2c7c030a9f172a2cd06e53da208805fbd2513540a52f7d629d5ddf4c7a6adda831317fae884782802dce3cc498d7b25c3e20f2a7a4c424c09fcb2e11b
SSDEEP 24576:Xu8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:+gDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 c95c3ce3152c9af1386f36b1f737538aa19ee75779bc469d1fec621982f01a2b
MD5 102f2f5030c4451d7c9a21936f7fa6b7
SHA1 876203cf36495d97e97adfd81d10905e70871a5f
SHA512 4dde64432230003e5cd2cd1d1c88f677d2762764d0d4c0e11cfec5e610e6b9e0e9fd223a9c4eb6b54d3958f11d944b9c3be3e0e0abf550230dbf5d48b60e3bb5
SSDEEP 24576:nzyJ8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:nIgDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.7MB
SHA256 052ab2355750e6bf63bac66405d1b5072c4ccbb5b253e10bdd7ec1b5b7dcf07c
MD5 2bc6e9ab3c3992c20af71dcf6d15846d
SHA1 26a42096727e159d67b7313f7f85eda2142f2583
SHA512 187f7d4f158224a404b2fe4851b39e3770d413058b894a7ecb3f384892c51a4ceadada3a67f74331e45c76bc8fdc21414de69b21977ba430e70c1a3ad4ec4b62
SSDEEP 24576:YTdaLl3z0zDn8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:YTwLljggDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.9MB
SHA256 89ac42d25feaa2c4806866877a5cd7d562a4be78668217e216b7c8957027c975
MD5 9960b118ee0e6d49b79759e75bc520a6
SHA1 9a5d5b7216719956d28c3bbf5a6dc72c8b14be9f
SHA512 48fa4f2253c01c85b3f1e9d92e1499d0ebdc04922fdae2b208c4673609897745a9556e7d00e470380988a842d27437c2e1db08c3d8bee77ce43ba98242f8af97
SSDEEP 49152:U5d9CHKyaxgDUYmvFur31yAipQCtXxc0H:MCq4U7dG1yfpVBlH
MD5 SHA1 SHA512 SSDEEP

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 b622f689ddb60964a9d0718ad6a77b341b190144b2788d0f6cd85219fce440c4
MD5 88f9262260110bf957161c8f21cbf6c1
SHA1 0c3a359910aeca4e1ff3067d91743d6eb32a9f6d
SHA512 b1cf05e069b4c7d9ef8a214d9b5175ce3e647813c75d2c0dbd7df4147937972c657eeccd18c8ae69c9b5b9dc9dd43b9ff8c06b894a9392e9054380690248de80
SSDEEP 24576:Q38NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:QgDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 df4061795bee9ac937b746116654bd4abfdd57163d5361f40115734b43f61a89
MD5 e501acebabc1dd805d8d50432bcaf9c9
SHA1 c2992af0e754b53cc622db63564ae7fc9f437aae
SHA512 9d4c0e06618fe2321e1eb48cd2add257661edeadb5bb57abd39d3ebb84fe93c86e1d673b1e86a4b5b4ed2995d565a81fe75a864f735d4ee8acd59493fa163749
SSDEEP 24576:3cP4mcvIjkGOxhKP2l71SNKbrh/8KBm8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:MP4m4IpOO67N8KQgDUYmvFur31yAipQi
MD5 SHA1 SHA512 SSDEEP

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 6a36615e8c695e6b651fe2faa5f96256f30c560df51ab1e0334885969db7bbf4
MD5 813d8616d248e40680025996bfe9a441
SHA1 99358012264e2fb028d67e3df133244c0f435d72
SHA512 83697f7648ff9cfa34548186887ffe188d7b089b8991a1ecd5a5e3171dd7a178bfeae3adc71d752e61cca9c541379f587207d25f4647de1d8c8a06fcac45bb43
SSDEEP 24576:S78NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:UgDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 0936f68c3de4a86dfc15a390382fbba1e6459727115e214d1c6badfcf59ee6e2
MD5 442e681c3f51e3336e4cf188bfa28f36
SHA1 af9731a6cce383dbb5f39254a4a72415e6f43688
SHA512 987ef827fe2d7795bac324452a1ca760693a7d1dd2f78587b93c8729e699fba572d036f0c70705c2c4ecd094efd0f8e83dd20e8f8012c47172d4c9de9b2cdb9a
SSDEEP 24576:me8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:megDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 9a901e531319d224e3e37f4a2afe37b669093a36cff677e0359ad44319d0b611
MD5 0f8693a854857154ceae1f513fa24867
SHA1 aa99989b98c55c78bf78ecae4980e4ea69473459
SHA512 bea9f34beebfd782ae0483a73bb2302a4dcbc1fdf08c7a8023c5e02a28a108d7af8952159886bf77f516c29f614ee0a857e633a76be93604263375a13a023f57
SSDEEP 49152:Ea0h2GEkuAe73q3pp46zwwQUgDUYmvFur31yAipQCtXxc0H:Ea0hNYG4JwYU7dG1yfpVBlH
MD5 SHA1 SHA512 SSDEEP

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.5MB
SHA256 069a966871e98cf1aaab8833bd104bbf0ebd87668d0ca9015344fa9db1aa9c9a
MD5 05c003455491ef3c09864f349170d80e
SHA1 5eaf65c8d3b07eb1c109232d99b185ccc088e5cd
SHA512 949045bb16175e7c086e50471a762c2cbdd51d0c15bf52bd0e48639bc75c9d9f5921c8754896e6840067a29a442b79939f579b12f47ace8726563f283a0faed0
SSDEEP 24576:fhbHjPt8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:fhbHj1gDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 78e9cda9895adf6083b1487afc4c5fe0c9f13b434a49c8ed371cdadf3b44875f
MD5 613234866548d269758bb2aeeca9ba63
SHA1 d26f2289843b94d2f4340e0f84c0d19e00693b2d
SHA512 8348401fb3a27118c6d3aae3ba1921b7617e573a92c3e44b1f2f8fe74330d817dd7e66f6ef82ee9e8ba89e26a27a81d5b530680254d83150214232475389d957
SSDEEP 24576:J3YgnJcRTk4yti+R5dpR/l8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:JIgnaTk46ppR/lgDUYmvFur31yAipQCx
MD5 SHA1 SHA512 SSDEEP

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.4MB
SHA256 e8fd88c139e71deff13f57653a7cf17b14bed583f8ed7d18c939b4f8d6aa3ee8
MD5 1bc50990680f4396692743d72da848c7
SHA1 d6e1726111140661ed348e5e684e504f8a2b02a6
SHA512 a2a362838011893e578a4be6c45d5119b2a0ea318cbe73c4aac9e0c7690ff797df15e95f0f567bbf29fa45d9eb923eb38440654f00ed1763abe83ade84e9f849
SSDEEP 24576:7q8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:7qgDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 248965efbad300aef87400ef3babac90390e780614aa5f8ce18c2fcb0fac0df1
MD5 a252648140487b14ccc13d85f84eb737
SHA1 a82e3b523c3a056620390bc977e274565d1f4dc3
SHA512 8b4ba8660b664bc600ce4c872a7ef529b9fb98206da9840ac3ff31b6f03d8f8e6ea75bb574cafb5a87b97fb9ea07cf07145f5c5d84ab66959f57044765581bff
SSDEEP 24576:efL3UTj8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:efL3UvgDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 ffd10ed0091b0c9583e9be19381c0c2ae7e77f01d2efea28e4d6e36a879b4535
MD5 3f4a04858ab6e0a25d3df4f1f38403fd
SHA1 b2e962a7eb3da4fbf32d470c5c1a0c9dca24df20
SHA512 91219a97b6ca2d602c9dfbc0df6aad783bc02b5e86503f54881dacb214c5caaddb269111c4fd59b41c37ceac8970d6f5998965dcc0b46213603bc13e03673b3c
SSDEEP 24576:/OP8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:/OPgDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 e1aa36ce3a7a1a169d5cbccd726e3aa20d8ee05f3b2f510cce807ea01bf15a85
MD5 9f3200d02e27d7b5a009dfb732661e4f
SHA1 92d7e7dddfbdf2d024e932cd346d69c112969155
SHA512 f04233dec2cf662c0368741d6d85dd2088d9cc757302c0d7eca1c4d61ab48de37ebd29e979aa1522f23363213c4203015dc68e0a037da34c68ba8214c98f97f6
SSDEEP 24576:Y7NM9YmZqmWMUkPjZM48Mv6bEhsu8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:Y7cBWMpPjN8DbEhNgDUYmvFur31yAipZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 c336bff7ac4c838fe132fd5c9f7e5c895e7fce0643cb98a62bd1942ec67bef33
MD5 732d93b15ae691a8c2044778b6006549
SHA1 c7b8df8974790891818db1e9074b6664e7b01f3b
SHA512 88882abb4dcdf495a92abb472aa01d9a36f2904f07a47d8954fb84c502d9e3ab47a2bcdf132b9ad37afab27a8ba541923b59911e54aef5460b09d79646d66e97
SSDEEP 49152:gF2YuHNETovcvNYf8kmOgDUYmvFur31yAipQCtXxc0H:16tCf8k6U7dG1yfpVBlH
MD5 SHA1 SHA512 SSDEEP

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 1bc213b305081a55d2c13103bd54e776d4afb19055b7d7aecd8bac1951e55c59
MD5 cdce0ac146bc20d502aec7abb344ae3c
SHA1 90baac302e2771bf31440bd98a47e4bd9fdbd12e
SHA512 1b8da6e8ea143fc528c943a46ef06640a35349859623612543dbd3051af4c4540257bd28775d1b33ff5c14fa0ae4cb17e5af09fa114477d810fbde55dfae501b
SSDEEP 24576:CAFs06+Omlf3NXEbTor8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:7Fs060lVXu0gDUYmvFur31yAipQCtXxx
MD5 SHA1 SHA512 SSDEEP

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.7MB
SHA256 303ca30cc2561a17b01629fe5b6b60d0b215cf158f13cea23141bcb6172bba98
MD5 cdf345cefe0d5fa977b7193162539e75
SHA1 d7d7b1a8f5d25fb02bcae83b318b07538bc2c6af
SHA512 37e8876f28f480863c4bec7485850be117408e7cd1676f718fd0b51dbb03439d23b9e6d1629d64ccceb3f304da0db6b2ba284e3bae25d7b861c0c7b16ac7fa57
SSDEEP 49152:yJnJ5DGL0gDUYmvFur31yAipQCtXxc0H:ZU7dG1yfpVBlH
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 33bec4e686526164a2e2ba9995ce66b01831cce6f022a1f19e0bf064e5df2084
MD5 e22b29ba95a164d0dab734b20a5e2362
SHA1 94354ec3b7d077f553556b177c853380e576e201
SHA512 6bbc7ec440b1ebc84a9edf70fb82256fa09cab30ab273648e5e026503cc94e4e9b166c61f91899176ca710c4b36056b7973a59ea0793f3a84126cb4e78d82d4c
SSDEEP 49152:eo06DIKdwc+eQnSt65aVygDUYmvFur31yAipQCtXxc0H:XRU7dG1yfpVBlH
MD5 SHA1 SHA512 SSDEEP

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.5MB
SHA256 2377f73da9e85a6bdfbf45ce3acd5972b8e51240dd6ad6aa87ebc75499404240
MD5 80a62617300fa260baac158ea22f8c6a
SHA1 5b37d9d8955192c675c31f09c3eba5321f627895
SHA512 40bdac1003913e53488a94280c62dd4c655f5036201dc06a4fe0dd7a5ff2b2c7a5df8b9ca117ce63f7fd41891753242a8279aa1f8f41f55465ea2f363beec669
SSDEEP 24576:xBA8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:xBAgDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.6MB
SHA256 d9435c84a59ee187d46382e89e7fcd375750a5023b2c2a7cdc5d8f797cb0c502
MD5 30415a9fbc97a2c5e7e61e58047f06ec
SHA1 85b8d790259b251f4d9d00b0c4d4eaa25d320015
SHA512 8985b2b1c8d243b1edf22252ce70d28e302a412dcfeb04bd4152a7004c6e559907ee354299a06cfd0b291ead7d49ec46252b34326ab6f5df9507687ffa440d29
SSDEEP 24576:vIyd8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:vIEgDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.4MB
SHA256 344510a55254780403b3917025b60f0ace7211bfa925cc0f63e81eefd58820df
MD5 8ffb108a9f0980e41dd12053a47b9c23
SHA1 2d742f66959bf7a47a4e2b223a6cef3e9dc87e1b
SHA512 c20c55bcee879efdf0d4e05425cb9edf10cbf2757063947f3ee8b2b601ca3f489a945401061e4cf5855924dccdec05dd4bef84d8db198d5045a898672a5a59df
SSDEEP 24576:A/8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:A/gDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 747049173de8a0411f65536af202e0e876476734a638bd273653917b627a4c93
MD5 c9750b1427db01cabfb695de7ee982bd
SHA1 81f3c87ae6c09ecc1977e799a4dd1214ed6a9ad1
SHA512 cbba2748c568e1d73eb2e6768f7a28374a3e31e10b5b229a3d2a0de772a792e4d549271535f44625a6def51a41e3952fbc89e87836584c0a6e70e2f7f727604c
SSDEEP 24576:7Q9MxZKdcz97w328NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:7VKX2gDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.6MB
SHA256 59d0d301f4323b3223b12cd69f39f94693a007d2b7e8dcf8626d25ecb57a0016
MD5 3bf95fb47abbc076ecb12baadddd93bf
SHA1 7e6da571db871139507eea9ff5f9b7d7a641d1f7
SHA512 e39fd3ece8ac37dfb2b9450e5670f13074c6ccd2fc73fd3a2fa43195e6de60954c320394004ee914f26d442710511c836ade1d776cdfffdf8aa532e8aea4b028
SSDEEP 24576:xyocbApZ8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:cocbApZgDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 747381fbd46e95761b095923704619bf15fc38678ce1e753601a3bf775c21364
MD5 58c13405cec086e589cd27e912700a30
SHA1 8e439b99fce40d47bb0497574bbb5039c9824fbe
SHA512 8242056e24e7ebd7f6c10ce213bdff7d864199a2e28ecb4093384376e83b1dfd0d27fca139813803468c13b7ce9c2321635b6a0100a78a7c97336c25a0f8c4dd
SSDEEP 49152:nWcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIKZgDUYmvFur31yAipQCtXxc0H:f0zuNIkU7dG1yfpVBlH
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 495efd788289c31dcf967baa8c177e8c5ec9d9023e5c51b6f9cce34c92a411f0
MD5 c216e1bf3617859ad0476717b11a3de1
SHA1 f2e200fd826ebc94e5827d8fdfcf5c1be1969010
SHA512 b7255215e8b82fc91aa26fb8ec7de9ac13d1d4f182368cbdd2e789b13071896720d7c2880a1851ef3d4cc44f65340237a4a969aa834c20a49155924f8480e562
SSDEEP 24576:j1QT7EcpfxR+N5AWAz3ooiYtjMqbA8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:+TDxR+N5YzTfjMvgDUYmvFur31yAipQi
MD5 SHA1 SHA512 SSDEEP

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.7MB
SHA256 35d81f839b825639973152b817170c696c3ea772183c8020d56a9be681831a59
MD5 60710f659f66b70b0aae64ddba8365ff
SHA1 3cb21789901d14a010f94dbe6f58f0f26266d5f6
SHA512 d3a498ca75191d970bdfec6937d60451d1cbd63be8e4b61710775efde375f9f1e07d5a0e2be3d02bc28e8286053b5b3aaa99df8c0a852f9917fd7683a8144224
SSDEEP 49152:90K+kmSL8gDUYmvFur31yAipQCtXxc0H:VNU7dG1yfpVBlH
MD5 SHA1 SHA512 SSDEEP

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.5MB
SHA256 9e931dae8c1a200b27eba65c9ab73ba4e00d48e970fb9caf253b009871d461fc
MD5 9f1ad15c13a4fa1b6d054773e4b9db94
SHA1 a3b58c19f68270198cfbb27fcd77ccb3aa98ca8e
SHA512 015fbd91f52c0faebc929f715a7b27bccfd2046198b5b126557042f4fa1a926fc4c30699ef18d0fc7a82169fbdeba9c4bd9e3c45d95cacfca56b2f7eaed8ee10
SSDEEP 24576:Nj8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:NjgDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/412-23-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/412-137-0x0000000140000000-0x000000014018A000-memory.dmp

Download

memory/412-13-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/412-22-0x0000000140000000-0x000000014018A000-memory.dmp

Download

memory/928-261-0x0000000140000000-0x0000000140175000-memory.dmp

Download

memory/928-149-0x0000000140000000-0x0000000140175000-memory.dmp

Download

memory/1416-183-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/1416-606-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/1488-611-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/1488-238-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/1540-607-0x0000000140000000-0x00000001401C2000-memory.dmp

Download

memory/1540-208-0x0000000140000000-0x00000001401C2000-memory.dmp

Download

memory/1616-92-0x0000000140000000-0x0000000140199000-memory.dmp

Download

memory/1616-93-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/1616-218-0x0000000140000000-0x0000000140199000-memory.dmp

Download

memory/2076-614-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/2076-283-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/2396-53-0x0000000000D90000-0x0000000000DF0000-memory.dmp

Download

memory/2396-52-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/2396-40-0x0000000000D90000-0x0000000000DF0000-memory.dmp

Download

memory/2396-39-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/2396-46-0x0000000000D90000-0x0000000000DF0000-memory.dmp

Download

memory/2568-172-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/2568-519-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/2716-613-0x0000000140000000-0x00000001401A6000-memory.dmp

Download

memory/2716-262-0x0000000140000000-0x00000001401A6000-memory.dmp

Download

memory/2848-237-0x0000000140000000-0x000000014018B000-memory.dmp

Download

memory/2848-118-0x0000000140000000-0x000000014018B000-memory.dmp

Download

memory/2980-258-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/2980-612-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/3024-608-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/3024-226-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/3212-9-0x0000000000AB0000-0x0000000000B10000-memory.dmp

Download

memory/3212-0-0x0000000000AB0000-0x0000000000B10000-memory.dmp

Download

memory/3212-441-0x0000000000AB0000-0x0000000000B10000-memory.dmp

Download

memory/3212-444-0x0000000010000000-0x0000000010187000-memory.dmp

Download

memory/3212-91-0x0000000010000000-0x0000000010187000-memory.dmp

Download

memory/3212-8-0x0000000010000000-0x0000000010187000-memory.dmp

Download

memory/3556-219-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/3556-223-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/3780-196-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/3780-71-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/3780-65-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/3780-73-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/3860-249-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/3860-138-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/4388-161-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4388-282-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4388-589-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4468-27-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/4468-35-0x0000000140000000-0x0000000140189000-memory.dmp

Download

memory/4468-36-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/4512-197-0x0000000140000000-0x00000001401E2000-memory.dmp

Download

memory/4684-225-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/4684-104-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/4892-62-0x0000000140000000-0x000000014024B000-memory.dmp

Download

memory/4892-182-0x0000000140000000-0x000000014024B000-memory.dmp

Download

memory/4892-60-0x0000000000440000-0x00000000004A0000-memory.dmp

Download

memory/4892-54-0x0000000000440000-0x00000000004A0000-memory.dmp

Download

memory/4988-89-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/4988-86-0x0000000002240000-0x00000000022A0000-memory.dmp

Download

memory/4988-77-0x0000000002240000-0x00000000022A0000-memory.dmp

Download

memory/4988-83-0x0000000002240000-0x00000000022A0000-memory.dmp

Download

memory/4988-76-0x0000000140000000-0x00000001401AF000-memory.dmp

Download