20a06d9b6f722e4cb20404a2fba4b672f63553008d3ac0faaf2ecf8a01f90eb5

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
25/08/2024, 07:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
20a06d9b6f722e4cb20404a2fba4b672f63553008d3ac0faaf2ecf8a01f90eb5.exe
Size 1.4MB
Sample240825-hvpjpsshkp
SHA256 20a06d9b6f722e4cb20404a2fba4b672f63553008d3ac0faaf2ecf8a01f90eb5
MD5 04cf752bf50fb7d68435caa823fa82e7
SHA1 69d3d1327726735ae5121373ef5d8dd8cf765e41
SHA512 bee450025581fff1051afaaa10ae7e49b2c2399542ecf216eb0aa98617e79c020578995a24a36bd1f58d376db71c0183424a1159078af05c1ad4cd09edff375e
SSDEEP 24576:cK5tmSH1BN4j7UP3QFnn6/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:cOmSZKUM6LNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
1672	alg.exe
2156	DiagnosticsHub.StandardCollector.Service.exe
1520	fxssvc.exe
3468	elevation_service.exe
4868	elevation_service.exe
1688	maintenanceservice.exe
692	msdtc.exe
964	OSE.EXE
888	PerceptionSimulationService.exe
4504	perfhost.exe
64	locator.exe
3820	SensorDataService.exe
2128	snmptrap.exe
4512	spectrum.exe
1828	ssh-agent.exe
4200	TieringEngineService.exe
4428	AgentService.exe
716	vds.exe
2120	vssvc.exe
1108	wbengine.exe
4596	WmiApSrv.exe
2468	SearchIndexer.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in System32 directory 37 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	20a06d9b6f722e4cb20404a2fba4b672f63553008d3ac0faaf2ecf8a01f90eb5.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	20a06d9b6f722e4cb20404a2fba4b672f63553008d3ac0faaf2ecf8a01f90eb5.exe
File opened for modification	C:\Windows\system32\wbengine.exe	20a06d9b6f722e4cb20404a2fba4b672f63553008d3ac0faaf2ecf8a01f90eb5.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	20a06d9b6f722e4cb20404a2fba4b672f63553008d3ac0faaf2ecf8a01f90eb5.exe
File opened for modification	C:\Windows\system32\spectrum.exe	20a06d9b6f722e4cb20404a2fba4b672f63553008d3ac0faaf2ecf8a01f90eb5.exe
File opened for modification	C:\Windows\system32\AgentService.exe	20a06d9b6f722e4cb20404a2fba4b672f63553008d3ac0faaf2ecf8a01f90eb5.exe
File opened for modification	C:\Windows\System32\vds.exe	20a06d9b6f722e4cb20404a2fba4b672f63553008d3ac0faaf2ecf8a01f90eb5.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	20a06d9b6f722e4cb20404a2fba4b672f63553008d3ac0faaf2ecf8a01f90eb5.exe
File opened for modification	C:\Windows\System32\msdtc.exe	20a06d9b6f722e4cb20404a2fba4b672f63553008d3ac0faaf2ecf8a01f90eb5.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	20a06d9b6f722e4cb20404a2fba4b672f63553008d3ac0faaf2ecf8a01f90eb5.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	20a06d9b6f722e4cb20404a2fba4b672f63553008d3ac0faaf2ecf8a01f90eb5.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	20a06d9b6f722e4cb20404a2fba4b672f63553008d3ac0faaf2ecf8a01f90eb5.exe
File opened for modification	C:\Windows\System32\alg.exe	20a06d9b6f722e4cb20404a2fba4b672f63553008d3ac0faaf2ecf8a01f90eb5.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	20a06d9b6f722e4cb20404a2fba4b672f63553008d3ac0faaf2ecf8a01f90eb5.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	20a06d9b6f722e4cb20404a2fba4b672f63553008d3ac0faaf2ecf8a01f90eb5.exe
File opened for modification	C:\Windows\system32\msiexec.exe	20a06d9b6f722e4cb20404a2fba4b672f63553008d3ac0faaf2ecf8a01f90eb5.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	20a06d9b6f722e4cb20404a2fba4b672f63553008d3ac0faaf2ecf8a01f90eb5.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	20a06d9b6f722e4cb20404a2fba4b672f63553008d3ac0faaf2ecf8a01f90eb5.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	20a06d9b6f722e4cb20404a2fba4b672f63553008d3ac0faaf2ecf8a01f90eb5.exe
File opened for modification	C:\Windows\system32\vssvc.exe	20a06d9b6f722e4cb20404a2fba4b672f63553008d3ac0faaf2ecf8a01f90eb5.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	20a06d9b6f722e4cb20404a2fba4b672f63553008d3ac0faaf2ecf8a01f90eb5.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\5562c0ed2dbdc151.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	20a06d9b6f722e4cb20404a2fba4b672f63553008d3ac0faaf2ecf8a01f90eb5.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\123.0.6312.123\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	20a06d9b6f722e4cb20404a2fba4b672f63553008d3ac0faaf2ecf8a01f90eb5.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	20a06d9b6f722e4cb20404a2fba4b672f63553008d3ac0faaf2ecf8a01f90eb5.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\minidump-analyzer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	20a06d9b6f722e4cb20404a2fba4b672f63553008d3ac0faaf2ecf8a01f90eb5.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	20a06d9b6f722e4cb20404a2fba4b672f63553008d3ac0faaf2ecf8a01f90eb5.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	20a06d9b6f722e4cb20404a2fba4b672f63553008d3ac0faaf2ecf8a01f90eb5.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\minidump-analyzer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	20a06d9b6f722e4cb20404a2fba4b672f63553008d3ac0faaf2ecf8a01f90eb5.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	20a06d9b6f722e4cb20404a2fba4b672f63553008d3ac0faaf2ecf8a01f90eb5.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	20a06d9b6f722e4cb20404a2fba4b672f63553008d3ac0faaf2ecf8a01f90eb5.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	20a06d9b6f722e4cb20404a2fba4b672f63553008d3ac0faaf2ecf8a01f90eb5.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	20a06d9b6f722e4cb20404a2fba4b672f63553008d3ac0faaf2ecf8a01f90eb5.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	20a06d9b6f722e4cb20404a2fba4b672f63553008d3ac0faaf2ecf8a01f90eb5.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	20a06d9b6f722e4cb20404a2fba4b672f63553008d3ac0faaf2ecf8a01f90eb5.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ad2dd6f1bcf6da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000053e4b6f4bcf6da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004456bef1bcf6da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000099a5adf1bcf6da01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003045d8f4bcf6da01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004391b9f1bcf6da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d4a9bbf4bcf6da01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b2063af5bcf6da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9908 = "Wave Sound"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000399889f4bcf6da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e132c5f4bcf6da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
2156	DiagnosticsHub.StandardCollector.Service.exe
2156	DiagnosticsHub.StandardCollector.Service.exe
2156	DiagnosticsHub.StandardCollector.Service.exe
2156	DiagnosticsHub.StandardCollector.Service.exe
2156	DiagnosticsHub.StandardCollector.Service.exe
2156	DiagnosticsHub.StandardCollector.Service.exe
2156	DiagnosticsHub.StandardCollector.Service.exe
3468	elevation_service.exe
3468	elevation_service.exe
3468	elevation_service.exe
3468	elevation_service.exe
3468	elevation_service.exe
3468	elevation_service.exe
3468	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
652	Process not Found
652	Process not Found

Suspicious use of AdjustPrivilegeToken 39 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3308	20a06d9b6f722e4cb20404a2fba4b672f63553008d3ac0faaf2ecf8a01f90eb5.exe
Token: SeAuditPrivilege	1520	fxssvc.exe
Token: SeRestorePrivilege	4200	TieringEngineService.exe
Token: SeManageVolumePrivilege	4200	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	4428	AgentService.exe
Token: SeBackupPrivilege	2120	vssvc.exe
Token: SeRestorePrivilege	2120	vssvc.exe
Token: SeAuditPrivilege	2120	vssvc.exe
Token: SeBackupPrivilege	1108	wbengine.exe
Token: SeRestorePrivilege	1108	wbengine.exe
Token: SeSecurityPrivilege	1108	wbengine.exe
Token: 33	2468	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2468	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2468	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2468	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2468	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2468	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2468	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2468	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2468	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2468	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2468	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2468	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2468	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2468	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2468	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2468	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2468	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2468	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2468	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2468	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2468	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2468	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2468	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2468	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2468	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2468	SearchIndexer.exe
Token: SeDebugPrivilege	2156	DiagnosticsHub.StandardCollector.Service.exe
Token: SeDebugPrivilege	3468	elevation_service.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3308	20a06d9b6f722e4cb20404a2fba4b672f63553008d3ac0faaf2ecf8a01f90eb5.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2468 wrote to memory of 3660	2468	SearchIndexer.exe	113
PID 2468 wrote to memory of 3660	2468	SearchIndexer.exe	113
PID 2468 wrote to memory of 1844	2468	SearchIndexer.exe	114
PID 2468 wrote to memory of 1844	2468	SearchIndexer.exe	114

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\20a06d9b6f722e4cb20404a2fba4b672f63553008d3ac0faaf2ecf8a01f90eb5.exe
"C:\Users\Admin\AppData\Local\Temp\20a06d9b6f722e4cb20404a2fba4b672f63553008d3ac0faaf2ecf8a01f90eb5.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3308

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:1672

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2156

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:4808

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1520

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3468

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4868

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1688

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:692

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:964

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:888

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4504

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:64

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3820

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:2128

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4512

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1828

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:1872

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4200

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4428

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:716

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2120

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1108

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:4596

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2468
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3660
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:1844

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
Size 2.1MB
SHA256 eb6f6f984bedee73fd741f840d71274e1dbc4762800ecc4fc9b171bc300f3be5
MD5 c1f98081781ec9085ec19a3fb32c9de2
SHA1 7388cbf56816732ba03733b77b97426bb262d1a3
SHA512 c43200e101a8d66ffea883b2e81da667e71cacae08f2d1a7e9d109b1551cfa51281563707078e7d0d9a2d1f24549782fadc4e515b965beaa82f0ae3ecfc1b944
SSDEEP 49152:KuYk3H5koUUfTqkkYLO/W2buywzMbOX+T7z5ELNiXicJFFRGNzj3:K8fTqi90bY7wRGpj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 b8856370cb79041f74ad138a47905222ff3dc2b90e7525f0bc4a72380ab98f1c
MD5 16a4719315e6ef11c1b70251a684ea69
SHA1 eb5e34b45b171a780bc169106f66e064beea1ef1
SHA512 025ce9027231a7cdff9bea6b30e1db46e0a34f654536f27378bb5bf92030af5e2fa8f91b36e793cb87a6bf47877ed10701869dd594d048c27fecd57a94f53611
SSDEEP 24576:GZFwVuDw/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:2FwVu8LNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 98f1e6733c64a474ec22e86d204ee1cd681ff3a4da84f6c1083180dcb8a4a7ef
MD5 f7ed39ec3b8cb0e844b65ff8b1fb0f49
SHA1 c53a0157853846e43590e3f92a2ae3278e81fb6e
SHA512 315a092af15a60f929874610b4778b20ffd510d93e334efb361ce2a22c5c0d3854bb715283a1e64cfcf6dd38d0f596460a5838f06796f746a03b32050d119c78
SSDEEP 24576:5+gkEdfh4CoX/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ggkE5SVLNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 bb4cee5ee64034eb5c8bb3a56a885ea918dd2650c5dc6ca00eff6e79c1aceea6
MD5 2a58cdd2892b6b864a590cf19c6bd2a5
SHA1 af238175a692a2300458fb0797b9cbf5fb99aab4
SHA512 d8e70a621405a405c69b52709e4c1520bf29108afd7f26b9462b40021daa3a603bd603f81290f4bbeb04c3be2f437b37d376196b3a0bf0bd2270a17fe2c37f28
SSDEEP 24576:aBpDRmi78gkPXlyo0GhjrQ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:+NRmi78gkPX4o0GhjkLNiXicJFFRGNzb
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 ba4195994f14bc3df0a8fa5e839f971a6101897638fc01d5864f6b850f383511
MD5 19fc31198e8fe078ec242a392cbf0106
SHA1 124f28ae3cf982eca3d22656127e5f01970945b8
SHA512 40944a0775c0af1815b6bc6659e10fec83a1eb0151c621953d2d3b2d8e4fadfe8d708315eb8e26c7293d393fe024a046d9345daeda3283b185bd847cb5783a61
SSDEEP 24576:RLOS2oPPIXVX/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:r/PsLNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 4486ed9dcef5a23d0704a9382dfe37fc133d99c59aad7d3c38bd6c35da6ac928
MD5 33f32d3dd8a898dd0980e71d0111b2c7
SHA1 3d7c7deb444e7fd8cc2256c08a2f26a956bc47fd
SHA512 7456827f43a6ac9259aa1f087750a086a84057e589679e7e74de7eabb0a1c90f75a955daccc8102d8592f7ca3431f1ab1a874400695a1df19bbce7d787d2f8f1
SSDEEP 24576:DY1/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:2LNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 7c31f67796f78622c01073287f0cd34bd4610892a7a5f53845b7977ba39a77b7
MD5 698efd27175d152f75aa34bdcd0140d7
SHA1 b2160c15422ae1b95795fa887e3e55870b425d30
SHA512 2f1a62f86fa71e69f70a2b9581dcc5dcda9d5912d87a75fc12602eaee4f2efdbab2705b0351ce1c253f9db8248230479e793526d8f4576096fc0d33b1454aefa
SSDEEP 24576:/JIU+/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:/JIU+LNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 ae64d2f73c467dde4a4f770e6a82e9b9e4d9818a65acae321e32457625d2ce1a
MD5 182aef76cf7d2c83c38b0604201829ac
SHA1 ee32ddba27902d49c1791b6925222129aed7abfa
SHA512 7cc1e9ef4aeaf547417f7391d44ff9bceedc6ad23276640e00b2c01564ab44605571bc35146cb5f81fb239128bb5070397b309ffcf163d905cd71ee642ce1c4b
SSDEEP 49152:YQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THQ:YQvGAdlCEL8c/WRNw5Cj7wRGpj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 a76732a2c0cd967170b1838a84649cd47b1c20c67da37ed549d91ed72f06e328
MD5 69963833cb88f820c302545af98a62b0
SHA1 48e74719b0292ca963ac9f4d5f43bf598b82d2b2
SHA512 17265216dc5501a3b39df1f5d960d1ebf0ed1626f0828553bc73450d846af355915388834a0b7057dacd20ad5b4ef1fa02e1e641ae96cecd59da4baccde1d8d4
SSDEEP 24576:ufewsAjY/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:MljYLNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 9b23d0340ac49ea30be66ade8cebeccd9dc8317fd05475f9f9b060ae6344440a
MD5 99517d8e6e079790f33b3b7e1b6fdcb8
SHA1 c8f2063ac796ac2fe77007bdfe36528a77c2ae64
SHA512 d5ec288368bac801297fda6a66440fc891647bc9a7b9e65947d79b8a983b892d6f1151d2562db221ba9706861a0b188f73b7531c57ce1a73b4ffa186bde6c435
SSDEEP 196608:OUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJH8F9:OUEtQevvqc2W1cpV20I32A9
MD5 SHA1 SHA512 SSDEEP

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 449b074f55c3fc6cd131a3df7e9c53bb7be89939b03c5948e1b0b540b166957b
MD5 25abe987f41aeff4eddd07724fccc6b7
SHA1 7f057e324d3247d9c8b8676eaa6add1ee5449972
SHA512 b79b3ae622770fb6105b428fdc0a6d63d94dfb7eef98fb61f99a35d231b15a7d8a2fed0889bceffdb44e203f0fe73d5f4d31864ad24bd842143719c8ea2032f6
SSDEEP 49152:nCbRquA/m2yL5zLfFiV+XenmE3/z4LNiXicJFFRGNzj3:woq2VjnmH7wRGpj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 8776ba53e2a8d994f0756cce8d3a8741c7c77f3632545bc91ccdd69c1bc217bf
MD5 11c75b9fb800376b82addbc824bdec8e
SHA1 29d4f7eee416b70e1d0a6f6f74c69345f2c4e6ec
SHA512 54849b3fd16b67ee196e8810949063901774fcfba86e00f8e863b673e5644bd51d3f381bff6fde094b283b3c6bca20c79cb1da436211eedf5522a429d2d2e13b
SSDEEP 24576:HAhGL6IFoiwtA5l7S53n/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:HAM5Foiq53LNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 fa343d682eecb2a812baf4e78efeba79dd59c54d25b681dfffac0f08f44558b8
MD5 5918ee06764871dd00af526ddd305aae
SHA1 6785e39e1e6fe40b05882fc2584f8a0eeb71ba52
SHA512 d883802ebdabb40334679dba8c56d547cbddb23194d51eece515712fb48c892acc0e37de3d7648187472dfda8505a5832827c05c42744ba55b3f6b5ba03e5aa6
SSDEEP 24576:HwuROWs/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:HwSOLLNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 2e81b95ae290c0a8796cb0f87e1e8382423a94bf3a9dabfe73d0a0b8f3e9a708
MD5 5180c1667f1e0f41f58e5c1b57343878
SHA1 30939fba5eaa2bb43be71e9ede81e4839855bfe7
SHA512 a0f2ec821a882b98a9c3f7b3358f664fc4e6d0a5b0cdf81b2835690f3b95408e5d675f8b15a7066fd14e74f26aadb1e8141e52519e70745f4286c6b2e052a514
SSDEEP 24576:WZuh/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:lLNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrmstp.exe
Size 4.6MB
SHA256 ade6c613e031c33cfbcdf5ad3f7ce3c73e790941981ba359c4867108daf0ad71
MD5 79e176a18c3882952fa07456cb1e0015
SHA1 033782dbdd083790d0f360ad7c57850afc88164a
SHA512 dca4348f6e6549e8c357915836ba0541a7c6a350085606ced4267aa1ae3f62b17945b46e7bd6fa8847e24229bb5fd349166825c912bba4f83ada9e2039425c4e
SSDEEP 49152:CyEKQ5E3ieGR0PEtBFUow1b89eX61S+2xmepn/TRijbqYW3qkCbDypSfe6qwiXEc:cq9ceqs+2xl/SSayj7wRGpj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe
Size 4.6MB
SHA256 0282357d0508e3893534e2501e8a86be3c0279ddcf25b8dd2dd5c73d9d638539
MD5 534c1d272bb225f3c2b8ef0aeeba11d4
SHA1 98fffac80d2bbedc4c588913fdb99d8af82636e6
SHA512 929089d38dc14eb349bb2bb7780086c45c8a2c1f3ef74c7d85ddb9383013f17a3fc05ceb514192d0c73dbc1e9511af695b96c641501603dc074565373ef0869c
SSDEEP 49152:/yEKQ5E3ieGR0PEtBFUow1b89eX61S+2xmepn/TRijbqYW3qkCbDypSfe6qwiXEc:7q9ceqs+2xl/SSayj7wRGpj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\123.0.6312.123\chrome_pwa_launcher.exe
Size 1.9MB
SHA256 7c3af1b7b0b0e81c795758711c685ccc83c5fa3edc2c9c23eb2f80631e7bfb80
MD5 f11ed7042ac88ff946f33b90963bd3d1
SHA1 287a68ba5922cb3048f656c0c86d7ddd3b659f9b
SHA512 ad0a75de68ff6983e6085f6f557061e7c04911ca69b415b3080b75e8e17b60a2c4450e4a0548dd02b2f79649b69cec187dc6188c90571a7053d5b818b9750a67
SSDEEP 24576:JVN8FYh+U0m/YOn/xvNSH/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:JVOyh+U0zyx4LNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
Size 2.1MB
SHA256 c777a42162dcebf719d4560c9e1a6c445252a57b312b5311c43c4f4914b03111
MD5 67b7a5168e1eec771b2ccf53cc105f7a
SHA1 d9810f9456452bdb82de211a461629bc447f7f21
SHA512 8f1faed8ef4cedd5c062b81dc67386420d1d11594b8911e749de45200c2daa5c8fae8bd6364aaff07762d992747eea5d246b5d24f3dfd856b73c65598314108f
SSDEEP 49152:u59PYHvI7wi/rIKuLFrFXlMWGxbgCLNiXicJFFRGNzj3:uGgrIKgMp7wRGpj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\123.0.6312.123\notification_helper.exe
Size 1.8MB
SHA256 a4449cdb0a4505afcb8f5a15d5f7f6f8d14590f8529f3960d83eb5cd1d70dc06
MD5 af71bcf14fca615e26b80e00c817519d
SHA1 4b330e50b8e6ccb839e3c1d412363d518996cd73
SHA512 c5bea5db3d80326dbcd861f3d05bb9c54b1a214b74739755632b8dc54fb1ce43bf5e8c23eb0947decf63cb6b005ead5fbaa526aa62aaab12c3ec7cfcb55d3055
SSDEEP 49152:8brUzFjGMVYDy9INqZALNiXicJFFRGNzj3:TL2Dyu7wRGpj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 1.6MB
SHA256 f4a87320ab1c501d8e99b962a8b6530c2960e50bdbd8ff17f98aa547de6d659c
MD5 b0c3a54366647f9b57b69a823d3ad81d
SHA1 e1ee8e4401a5c2470ac68b64904397d84dcb82fc
SHA512 68f43fbcee68c36c97327d3b870c54eab797dd0337d3379af492b1708988936c7afddf8c903dda207b096280666dd997fb599aadce8e02b4cb2f0676416362b6
SSDEEP 24576:P436epN7w2PROWFW9sQ0MtJM/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:P4qiw2PASW9mMtGLNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 0c0be2cdae7180734a00816c3f297a30d8ef61be4c8e42d7b1cb1a16ba76d9ec
MD5 cd27eb5671c14c3f7df21972ef5bcfa6
SHA1 7e30a564d7124e7d0193b8e2796752fb41c7f3a5
SHA512 15dd683ddaabfd389c50718d3b0979e05beea8953cfff7a05deee76fbb0f4f3c73398243ee25c879ef08d4a20a8f3b4f324f29858d6e572c46d57f99e707f2f9
SSDEEP 12288:ZBiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Zt/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5 SHA1 SHA512 SSDEEP

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 55685cb26a7b6a217eb77db3aa1ace20e530f2ae7b03159523e287f922d70de9
MD5 921924c1b0531fb31df49e464e0c83d4
SHA1 923b7a7e8a427c4cea8c4519788dc41539a16f54
SHA512 70d94aee2a4cafb27da8d34d75dc84d91889823cb4e396ab371223a30653423ce49c46bb317882a797e84f3f400289ff7296de4ff9abb49b96141e91d779ea10
SSDEEP 12288:eSiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:e0/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5 SHA1 SHA512 SSDEEP

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 c416710164978f06169ec2acf067ffa96c178a1ad131eae244454a8fd40d328f
MD5 a09fa0aef96a11c6dec71fe8a127a104
SHA1 5f9ffdbea46a403ccdca0155dc9625c39752695f
SHA512 44ff203b6e3dd65b17bbe5961c351f22fdc11bf2b96f0dccce02a29ad63400f1327da4bb6fa427d2b1cf51cf71a35213b3ea92f7c5ab8e9d3faee3e8b8e2a88b
SSDEEP 12288:vsiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:vW/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5 SHA1 SHA512 SSDEEP

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 37a0b908a8880b288ddbc3ffc16e546f5387ca56cad7113604c951b691e40586
MD5 335e370d2fd8bfbbca5aba35bcca2810
SHA1 c1e174e434d1b068c77311f4f6bc682fac422b97
SHA512 71f32329bfcc08a07ffaebd0b1eb73951e45b3cb3358b219faba810a211288a8a5938a84b8703ae446bc70f897386e510473fb140fd489f1fa4638076b3849f5
SSDEEP 12288:0VziJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:i/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5 SHA1 SHA512 SSDEEP

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 04182b16cf2f1cef77e870515040c2ffdc89b25c2db7d9a763e9f1b5b1581571
MD5 f317942340aa62d4bb3020e59aea7cf3
SHA1 6106697ff84aac4d076ea8d9e8e9a0afd765cf27
SHA512 7238ef7a9cb376705ea8a377f2b449dceeb245de99b7cbc0c57063cfed27da1b86df49dc8597cc80d9e019b604f35fdc382a4d786c693d760be923b9907edde2
SSDEEP 12288:SbiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:SP/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5 SHA1 SHA512 SSDEEP

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 572c0769ddd392902d1aaddd1e85c4ac7b7b07889e7e0be11d584c5f1693ed13
MD5 b723b80a7a88b5c25c0803c40a2ece91
SHA1 ac9d99ed40fca96cfeab5f70b48f9c3c5f82600c
SHA512 e7b3b002ee624da5a89fb6ad6f46f1881576d0cb0bbe4c58580858a9651885c5aa27f94f35e4b38c50ae1e8f82055a4d9c8d216d643cd598c961a81533d8364a
SSDEEP 12288:qmiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:qQ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5 SHA1 SHA512 SSDEEP

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 766ac2f0522accb9dfb3466bb92a4b3d3f3407bcfbe5f2a706f36f9f86c5b025
MD5 cd10c70fe794c8dc88d374bf30e3eda8
SHA1 1d0d4de03ec77b5e772e46995739865443dc96aa
SHA512 31671a5ef9c023cd65c1abff23e75d2a2e79a79155cf5074fe1a34366c45651fc9b6d02185117367d1d494bdd3860c3600a69b2a027face7d1711ac6bc1470c4
SSDEEP 12288:MaiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:M8/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5 SHA1 SHA512 SSDEEP

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 4962969edca4a1a0edcea16ec176c5d9db139afa651e303338fb591f6250fdda
MD5 20ca7593d5e5ea57b1cbfc6dcc5d9df4
SHA1 ac09a2414a8d46f28dbb62f87b0952f61d39285c
SHA512 fb3c9f1400c4d25df91cf2b7287c199bfd6233bb2a5a6a5238b34aa7c141861198cbf58890e12e57aecfc17a81917e3918d6299ce54a6de62a32c585b63f946e
SSDEEP 24576:GZM3zFVSOU/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:GZM3zfALNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 df3475f783ca3b9c521481b9fcf770d2e463e1fa0f110d18a19ad388776aa916
MD5 75fb20b81f903f0e01b57967d6f40862
SHA1 e466c6f72072730e98ff0ea0d88f411667e79ce7
SHA512 83a43f90407c00e1773fad31e0d2a16542a6127c4e408a5b8c08c852d614f90e113e6558a8aa0d44a27cf46c9819d05694383ff7f50a04391f7a9ba0547277ba
SSDEEP 12288:PNiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:PR/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5 SHA1 SHA512 SSDEEP

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 1fb62149293d343d0378f024ec121d58cf2ded6b37724f8fd80d8459c4e88b0e
MD5 f0417429b37ab418dba574f4151461bf
SHA1 881979b36791548a25cb611c23587eee674ff385
SHA512 065d8f0fb2d1370ed16b90e91c3b648de889f4d9d1229174b0255b0e61b807ca350cba1303155508fe46f71fdc9325719058a06f3d5b80623bf26d3a7de29a19
SSDEEP 12288:j5iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:jl/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5 SHA1 SHA512 SSDEEP

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 6e7420492e4b8a30c6a575e00213497cb058e6acef0e73a8aaa231c2e3bb79a4
MD5 d585d9d79e8b11ec519b3fc3ba205ef6
SHA1 832fc86ec8a50a26c28cf5c7e747e45d6290ac04
SHA512 84f4726528ecd86f7e010f3f616b65663db9fa657b864931334b4dd57b811607accaca9300455d992f7844c17d1de4c268bd6122a65f754d7c98f6338c80990c
SSDEEP 24576:wzyI/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:wrLNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 ef5646e17a71ef7e93a7d4bcdb0f7c2d65484d4a537039bf2cb1a83cf0f85d4b
MD5 e75f2ad0557aefbe23a75ca0080d54ac
SHA1 c18172d0667092d9f91f8770e292987f50971124
SHA512 52a1efb3d96eaf3543c90e8539a6724da930404692e5c684dae5f52f780e35159f67d6499fecb32c19603429114ec6a774a747381490f918b85eb740e2a9188d
SSDEEP 12288:yNiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:yR/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5 SHA1 SHA512 SSDEEP

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 9f3819278622a67c6379dd7547a389c4e564a37b1de74a22836703cba42622e0
MD5 7e183915fbda11625c87c03270dda3b7
SHA1 de78efe3ac1d906be034a0dd97acb8d124b9b275
SHA512 fe8b8e29fe946eb68d2d33c1d9d7e1af5fed990de0d78f580259ee65395a638a78547e681b5a894e9a9e321b23abeb2a3a816fbc4866aacbaca9a156bbbc0944
SSDEEP 12288:sNiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:sR/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5 SHA1 SHA512 SSDEEP

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 e24294f24c874a4a309391182b98297e007923d09ca64ed44e0ade6c5069941b
MD5 f68f721d2b838b13f94d8c33fe21c349
SHA1 d965dc15559557e3d38d6d7e199009e781a36ee4
SHA512 ac6e126337384839bd75e1485f56a607dbcf07c1d5a2c777e1ca7f8383133d80850f87b593984378d0d693de80f534fd5965e94a6151d4864fc1d6a455107af0
SSDEEP 24576:1zyI/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:1rLNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 6effe40311c908931ca12954f759b96605d1b6a7004ae3220ec8e96255d3f206
MD5 6eff3db2c07765fc8838429d73d83f33
SHA1 4a4a7ee1666577ff19d38b24abce36b2f011ca14
SHA512 6a9821dd02fd03fbb58e1f9643c41bcb4991d73277bad3a0da69bf7cc050f4dcdc14891bb9ec9c4411ef0adfadf59556ed59090ea18254138fa3efc89b7159d5
SSDEEP 24576:fT8aLl3z0zDm/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:fT7LljzLNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 692ed3c348530c99c87e962dd39d524b84c87bb7162ac3986ef4e48b9a94e598
MD5 15490d8b52e6d648f66c46d6be6edf2c
SHA1 bf50bbcd2ea2be787492f91c697cd00e2991de8b
SHA512 30101fbb743d4085dce7f092d549f66dad331860dda50966333725ad422172418a1af03533aa3940673a1590c26421d06004c8a06faecbdf9a81a892a76f8be5
SSDEEP 24576:63rd9CHKy7GZC/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:crd9CHKyaALNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 05d2a9c64a6c8fd7451e76e637642d1afc1e2589a2cf6f23f2009db64b86c9a7
MD5 3db3a48cd16e4397f4d11900beac733e
SHA1 d7f494a78b1608399273ae3362c107a8ebcea855
SHA512 eb92361fe92188376ee8cb91894db02e4b503382aaeade254a2f3ee6a56b9259a5422083d724133c617b7d0e2b2b2cbdd82300eff7915c69ac541245d18f357c
SSDEEP 12288:pMiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:p2/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5 SHA1 SHA512 SSDEEP

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 e09efeb84745cfba7bce80393e870c96d40a44f25bf3f0539913560ed03c614e
MD5 dc6d13c5bfe72472abe1ec8a112f9c0c
SHA1 524262ed3a5db5fbd0c8293e749400ebb093f177
SHA512 f24de37d5e73f572dd8c634762ee7975e5586c6a4855d8093e0c39724422e8c10030922df83dd04a138543fdc20c9a742383d9b1d87b222281103e5650e490f4
SSDEEP 24576:scP4mcvIjkGOxhKP2l71nNKbrh/8KBZ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:HP4m4IpOO67W8KjLNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 cbf92afdd640747ba049c3c27d4bb17bb8333c49057de78b35e7f11fb45acbd0
MD5 a894d1c96da0c770e3a454b4e60a5e08
SHA1 3c0db73839a6efde87da53f8baedadf7d6af12ab
SHA512 e526294883e6fe6b95c2efeb3417874a2209f6399ef520156027b4c79a03dea60016103ed9b68d7ab7507f293ebc85044ef0cf315a4416317390cf893d9e6a0a
SSDEEP 12288:KUFmDDLAiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:oS/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5 SHA1 SHA512 SSDEEP

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 bafc7f43f6afe14c03fe52899933206d6e9e0c2ac9fbf6e658ed4781c9fd476e
MD5 02e5d9f2289193e918dcf2e137d3c6f9
SHA1 892f6133a9f9b7c47504f82b3859c53e9f1e9dc1
SHA512 addcd6339975e27550050e509e6f76a41769127124f40ad5480f0f9d70d8af2acc001982c2c9eb7023160c79833d3baff35d482e60aecbede7019af753ee6b3d
SSDEEP 12288:XdiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:XB/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5 SHA1 SHA512 SSDEEP

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 a556fa282dc48a8e6faffac872d6d3e332d6c2c120641780e54e7a6a7df3e5e5
MD5 7aa9409b17b2921dc03c92181d7254cc
SHA1 b69ab6658e77158539837ef7b1a4ff097057528e
SHA512 13ee0bc695588e481a34b1855aec1e6ab2dfd74c17c913d5e3cb3353bde8fd5ed7f937cb043a9b3acb98ee6362ea09ce302a9b8feb7ccb3333d4a483ce11cbd0
SSDEEP 49152:na0h2GEkuAe73q3pp46zwwQPLNiXicJFFRGNzj3:na0hNYG4Jwg7wRGpj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 2f26565bc4447fa1b1f092ca3b91da1b00fad7df5f1ed5e2e8ad88adc70411a7
MD5 7c3a7d1bcc2746140e13ded8eff16f31
SHA1 0f90cff0b58a81ddd80f93ba4fe6262f57374dd5
SHA512 67b73b9a4ae0aeb71ac4007bea545c04979a5f68ebc8a6714024cfe26646e9f3c4403a9128694239cb6664a07b7cba79e311a053cf7c849108671b499cdf4aac
SSDEEP 24576:zhbHjPE/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:zhbHj8LNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 41ad97f982791fe2d31590b7a42e895a2af75cde3710b67f86862386f8b971f1
MD5 b20c160d168db63189b0e5844b535795
SHA1 b5158e8950fbdae3d0e5f380090fb910e77fd59e
SHA512 8ef7b62b105e767e9f346afebd22d25da9f69b6604faee67bc9d631a76801b4e10e49cd442b8d11a4f2309081a8a2409f1b93bf0a7e785d615fb58b7ca56a0af
SSDEEP 24576:+3YgnJcRTk4yti+R5dBR/s/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:+IgnaTk46pBR/sLNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 c7b5c6d47167738338847960e7f8d4c425084b5f66a18760d70d4753e7b5767c
MD5 30907a72456974cc453afa443b54e1f4
SHA1 338847f0183270a79f41d2dc39174ca8bb450944
SHA512 25b5835008d4c5171825dc37ab755b97fddb4729c43871468300814965c997ddaf6795bdd709f9e62522c672e8e6b731ea2d4d351168ad5f426f04fc544eb0b7
SSDEEP 12288:eJiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:eV/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5 SHA1 SHA512 SSDEEP

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.6MB
SHA256 0c0c4c0aece41dcb4fcef8d6957eb0b28e59223d20f293a6fde44193bf06c004
MD5 8550bc7dfc39de9b92c425dc77689ea8
SHA1 a4bb03a8f70ed5c6e70699559b037b901e458191
SHA512 69de76e337b0f6b65ef240443adb4b9d335600d46be9ebf4d73ded43dce67dea61c472fa8b796abf55810386d70c72ac67767e7da5e16fb1a224dc9b08e15089
SSDEEP 24576:UAL3UTK/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:UAL3U+LNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 25d6fbd1c903608d4f279ed3d2fd09af7c2856b275c9356671e18c1f2d1d8faa
MD5 043d22da3223542a37a3d44f3e27afca
SHA1 079a635226210c3e7fcb594e850a1fcccdd9b35e
SHA512 a21d121f8e688dc2754bfbf10e811d4e8dac1d90ee8bf7ce3ff4b2f4a116179ba626b7758aad49bb8cf3515d9b9bf1370c155fc529c00018907efe297389f407
SSDEEP 24576:VOe/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:VOeLNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 8be0d845825f8a55eef35a4bef6914236cd7e8f8a9ba7b12086f3b0fe3af9efc
MD5 f0484c9ab115acdb51351fed9c7f94e5
SHA1 122410a50379a05c099e248d5b90c88442d7d36b
SHA512 297827ccef9f49d995d2674a84db31206832f79352f63f43a41df7aab89c8df05bfea54371e6dd621c1215f5e7a32c8c54557428aa91156661ec29f9371f28f0
SSDEEP 24576:v7NM9YqZqmWMUkPjZM48Mv6bEhsR/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:v7cBWMpPjN8DbEhkLNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 1638e706356bb57944d2a813054dfea84ac09012a801be512798140c62dbeb29
MD5 ab9a405665c58123df23ae30c9964679
SHA1 64cf85cb34ced7fa3c623f33772739301bc6619c
SHA512 9382c6d4d1083a5d4ffc7cabdc67135cafc8964f11930f39a8257dba426dc80536e4718ad3a8c7fd6a94b352260445f278b040789319acf84d616b7b5432a89e
SSDEEP 49152:jF2YuHNETovAvNYf8kmxLNiXicJFFRGNzj3:S6BCf8ke7wRGpj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 b22010d3c68223dbffff38cd380e2518e3bd4eb148900480bfa4012e6d446975
MD5 709273fb4707127e1000fef5d17a52e4
SHA1 69c420c5c1d7065c567d8ec4f24be5a0a6458b12
SHA512 eae40ba20c734c6fc64815c271e895f255804413758593403ccaa740d0eb675ed86f45a65a65de702a50ba426308062e5e557edf7449712395bb9fc927964ac6
SSDEEP 24576:1AFs06+Omlf8NXEbToC/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:6Fs060loXuvLNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 dba5a3e3ea89b43771f658875dd780cba448bd9a8e4f811163c4a69ac9d4599c
MD5 774466f689539da7513c6c79c2aaec9e
SHA1 c71f50e99892cfa1cd1df41c1d677b339c598ccd
SHA512 305aef53d1762dd41d45c35d5f969c8b83e62686a37f0ebd32053c7e91ba6bdbc616b28703a2847efff2c860c6f733178b314280056915ccc3887f158923afd5
SSDEEP 24576:CJnJ5D3WXv/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:CJnJ5DGXvLNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 90d9a02cd85de0896ae37c765b5a17f2b63ba300435f059fd4571eb5f466a506
MD5 9c75993fc09000e4d6bd44a087dc800b
SHA1 0b2a8fa89490da9772dcdbe7a7f0d72d2a05a5c9
SHA512 bf4f8fb208bb90486b2eda8ad77fe086e10c5b019ae96eb80ebc5d381c434469ed276483caea923fff95f4d7a8251699b4620c25646c37e43061360416bb12e3
SSDEEP 49152:jg06DIKdwc+eQnSt65aVtLNiXicJFFRGNzj3:8b7wRGpj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 b99a85a6b7f19fd554ddca2b59d6169eed07a40f4017b9b2c1b94d034ba93ba5
MD5 bf17cd5ccaa487439f1425b6240f3d05
SHA1 6907fe2af5cd4f66f604be66c594db26aa5ef99a
SHA512 09587db0c5cfb3f622efb602f7fa2cfb8ead6f81ed9b69a4012f778ea33b6b6142aef2cb30ffd356aa9e0466ece051348485f3c9266525e6d33eb68a824fe4cd
SSDEEP 24576:xnT/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:xnTLNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.4MB
SHA256 8666a24dea419520f7600f6cc7629078ec82fb608539c5516bbbb1b7f880e944
MD5 a60a459b311d59f0af880f1fb0de3a49
SHA1 f6a7df89f8271f5af2783b3afd5d56e37b930456
SHA512 e7360185b4f7c6663d04f7017ca6004e4208c328f6c75abcd89669dd010b52055e753adf5de51165c24f810ea4b23d0ddcc41551b1ae8afbe3f77e3925454e21
SSDEEP 24576:FIy0/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:FI/LNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 c2fd7673c944e350e2e65fd3ec4f0d85c76410e9b2130f8c9952b5d0b1bd1553
MD5 da08238c66129fd9ff961de7dc20d517
SHA1 3916d8dfa794cb310d9b7555c5aa5170bf5b447c
SHA512 5708f5dda5ee4482b155cdfdb8d3b65452969fc4a8b832f7b11a27d7eb34307a70e546857a05496df964fdd1fb25483a178471bd5f92e5d132867d2c4126abb9
SSDEEP 12288:/yEiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:KO/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5 SHA1 SHA512 SSDEEP

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 7c603e43efeb31dadad50ca6e053e52530f2a3ef30d0e0c16c8165f255856173
MD5 261dae04534858c002512d11fb8a4ae4
SHA1 1ddec6648910b09354d4f2fce443779efa5f782d
SHA512 16e78ba9a07ad285845348f72d92e2cff4c729952e5bcbde3bbe4007894cdfb900c8335414bfd01a576d872523c4ff09640a57b1d7e443674ef59a911d7ba3fb
SSDEEP 24576:KQ9MxZKdcz9dw3p/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:KVKZpLNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 e24f7665ebd0f77a5b0368db9f32e13d1acbe0eaac5cd93d6349e3589a027117
MD5 7f2e0023ff9d5af25bb8bc31bba47a50
SHA1 db70cdcdf82eacc45c3749d04404ccc64b2f30a5
SHA512 ad5292899a172c53fd2949dd1cba08174203d573bc4c08a8dbaa3e29eb83019ecc02570d9c128aa62a89f9c5343b608e997d7b14f83e3192853900f1c3a4f4fc
SSDEEP 24576:LyocDApY/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:+ocDApYLNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 03fea50c6f9062c081e1a1bfd716dcad846c756f7487230eb5e618de3f45336b
MD5 df53d49cc95ac0b263dc5e09298443ac
SHA1 c1be03cf819c263240020e6fb4b8b3af198e19d8
SHA512 4dae07a0715e62ca01b82e80054684656ee4fcf2e09874a0b7f8aca561a8b3ccfc8413bdcb81d1583c6ff3a95038f5c0354a6c942e61edd69384f8fff19b1299
SSDEEP 49152:3WcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKYLNiXicJFFRGNzj3:v0zuNIK7wRGpj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 c2ed070ae0f0661ef08302e80997e19b65cf21aa20aafc248b57936dd37c532d
MD5 3ecaa59ec6abf5cd2176fcf7b2c0e7dd
SHA1 b98a925cf1007276723b7d6b30d19a71d4885db9
SHA512 94c8e1b080083c85132e149b8c1dc247752738d4675b2ff23518bfac781de364f1c82ab0a2a68aac069143325b10b81244062d1a795866fbcfca5698679ecff9
SSDEEP 24576:V1QT7EcpfxR+N5AWAz3ooiYzjMqbT/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:QTDxR+N5YzTBjM+LNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.5MB
SHA256 35fea340ab3dcae26763ff2570f4916bb82372d48d77c0b8a270c8b83bf78ef3
MD5 b61765f92ddd50601a1b6f0bc53ed408
SHA1 ded20b0d962f1cef0c25956e6d05c0a2d0d5096c
SHA512 e1368cfbbc40213d7835955f140d0c75fb75ec29a0d240727aa5b30e17dcac0834b62cb0cb4ffedecd8e7b9a2bc9807611b7df74caaca485eb36a2f528dfafe5
SSDEEP 24576:LTMdOz0FFS+UmSLH/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:Z0K+UmSLHLNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.3MB
SHA256 00a987130aaf7f0d5cfcf874437293471653a61ba5612be2aeade532ee86d3be
MD5 544b779f90fc069f453791c6221fc234
SHA1 9bfbc01f826e7b0713c93a5917d64f7ed939bf91
SHA512 a5fb5f53e0cd12b1fc3e46bd7cab89ab88d09e3da57fd4c8ada5f5677e3dba11fca46c59d86015d036d0e9bc04aa6fdfde91b58313ae5a224868d167dc99977e
SSDEEP 12288:74K4iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:nK/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/64-114-0x0000000140000000-0x00000001401EC000-memory.dmp

Download

memory/64-168-0x0000000140000000-0x00000001401EC000-memory.dmp

Download

memory/692-72-0x0000000140000000-0x0000000140210000-memory.dmp

Download

memory/692-152-0x0000000140000000-0x0000000140210000-memory.dmp

Download

memory/716-428-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/716-156-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/888-96-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/888-160-0x0000000140000000-0x0000000140202000-memory.dmp

Download

memory/888-90-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/888-98-0x0000000140000000-0x0000000140202000-memory.dmp

Download

memory/964-80-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/964-76-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/964-86-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/964-155-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/1108-165-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/1108-531-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/1520-30-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/1520-43-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/1672-101-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/1672-15-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/1688-56-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/1688-70-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/1688-57-0x0000000002240000-0x00000000022A0000-memory.dmp

Download

memory/1688-67-0x0000000002240000-0x00000000022A0000-memory.dmp

Download

memory/1688-63-0x0000000002240000-0x00000000022A0000-memory.dmp

Download

memory/1828-389-0x0000000140000000-0x0000000140259000-memory.dmp

Download

memory/1828-137-0x0000000140000000-0x0000000140259000-memory.dmp

Download

memory/2120-161-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/2120-496-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/2128-286-0x0000000140000000-0x00000001401ED000-memory.dmp

Download

memory/2128-120-0x0000000140000000-0x00000001401ED000-memory.dmp

Download

memory/2156-26-0x0000000140000000-0x0000000140200000-memory.dmp

Download

memory/2156-17-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2156-102-0x0000000140000000-0x0000000140200000-memory.dmp

Download

memory/2156-27-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2468-174-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/2468-534-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/3308-8-0x0000000140000000-0x000000014016C000-memory.dmp

Download

memory/3308-1-0x0000000000540000-0x00000000005A0000-memory.dmp

Download

memory/3308-9-0x0000000000540000-0x00000000005A0000-memory.dmp

Download

memory/3308-353-0x0000000000540000-0x00000000005A0000-memory.dmp

Download

memory/3308-354-0x0000000140000000-0x000000014016C000-memory.dmp

Download

memory/3308-71-0x0000000140000000-0x000000014016C000-memory.dmp

Download

memory/3468-40-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/3468-123-0x0000000140000000-0x0000000140234000-memory.dmp

Download

memory/3468-33-0x0000000140000000-0x0000000140234000-memory.dmp

Download

memory/3468-34-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/3820-173-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3820-431-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3820-118-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4200-408-0x0000000140000000-0x0000000140239000-memory.dmp

Download

memory/4200-148-0x0000000140000000-0x0000000140239000-memory.dmp

Download

memory/4428-153-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4428-158-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4504-104-0x0000000000920000-0x0000000000986000-memory.dmp

Download

memory/4504-164-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/4504-109-0x0000000000920000-0x0000000000986000-memory.dmp

Download

memory/4504-103-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/4512-132-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4512-335-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4596-169-0x0000000140000000-0x000000014021D000-memory.dmp

Download

memory/4596-532-0x0000000140000000-0x000000014021D000-memory.dmp

Download

memory/4868-136-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/4868-45-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/4868-52-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/4868-46-0x00000000001A0000-0x0000000000200000-memory.dmp

Download