66b31963441dfc8fbd770c1cfaa2e328c176db05d9bd2f3013dee3a0d272b09a

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
21/10/2024, 16:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
66b31963441dfc8fbd770c1cfaa2e328c176db05d9bd2f3013dee3a0d272b09a.exe
Size 2.0MB
Sample241021-tphprayekb
SHA256 66b31963441dfc8fbd770c1cfaa2e328c176db05d9bd2f3013dee3a0d272b09a
MD5 b0740b9e07131f253a14350e896c9946
SHA1 d25b4a0c1eee9bf4811a8540df2312378d808326
SHA512 066ba41fb572e2b1eb173130908b1ac8f0d68efaa6ee21ad40731592c287e23a856ff426b81fc2c5008e56fd4e12ef5d6d230bd863dc6b46d7b0137238cf0dc8
SSDEEP 49152:wgi7tbYOMjUfkptVxhxlMPdlR8v4UC0Eg6ET7M/I:wd7tMjUu5zl2/V0cETQ/I
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
2040	alg.exe
5052	elevation_service.exe
4108	elevation_service.exe
3744	maintenanceservice.exe
4464	OSE.EXE
4344	DiagnosticsHub.StandardCollector.Service.exe
1156	fxssvc.exe
4432	msdtc.exe
408	PerceptionSimulationService.exe
2608	perfhost.exe
4076	locator.exe
2812	SensorDataService.exe
1408	snmptrap.exe
844	spectrum.exe
1452	ssh-agent.exe
4952	TieringEngineService.exe
4252	AgentService.exe
1424	vds.exe
4480	vssvc.exe
2772	wbengine.exe
2824	WmiApSrv.exe
2472	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 24 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	66b31963441dfc8fbd770c1cfaa2e328c176db05d9bd2f3013dee3a0d272b09a.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\1cda65847cad7dd2.bin	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleCrashHandler.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdateCore.exe	alg.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdateComRegisterShell64.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdateComRegisterShell64.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleCrashHandler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	alg.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007dc6f86ed423db01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000031ddcd6ed423db01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009667d76ed423db01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000efcc2270d423db01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bb43736ed423db01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000002e9e6ed423db01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b8441970d423db01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006b08786ed423db01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009e8ede6ed423db01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9908 = "Wave Sound"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003d78096fd423db01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
5052	elevation_service.exe
5052	elevation_service.exe
5052	elevation_service.exe
5052	elevation_service.exe
5052	elevation_service.exe
5052	elevation_service.exe
5052	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
660	Process not Found
660	Process not Found

Suspicious use of AdjustPrivilegeToken 42 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3612	66b31963441dfc8fbd770c1cfaa2e328c176db05d9bd2f3013dee3a0d272b09a.exe
Token: SeDebugPrivilege	2040	alg.exe
Token: SeDebugPrivilege	2040	alg.exe
Token: SeDebugPrivilege	2040	alg.exe
Token: SeTakeOwnershipPrivilege	5052	elevation_service.exe
Token: SeAuditPrivilege	1156	fxssvc.exe
Token: SeRestorePrivilege	4952	TieringEngineService.exe
Token: SeManageVolumePrivilege	4952	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	4252	AgentService.exe
Token: SeBackupPrivilege	4480	vssvc.exe
Token: SeRestorePrivilege	4480	vssvc.exe
Token: SeAuditPrivilege	4480	vssvc.exe
Token: SeBackupPrivilege	2772	wbengine.exe
Token: SeRestorePrivilege	2772	wbengine.exe
Token: SeSecurityPrivilege	2772	wbengine.exe
Token: 33	2472	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2472	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2472	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2472	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2472	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2472	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2472	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2472	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2472	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2472	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2472	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2472	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2472	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2472	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2472	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2472	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2472	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2472	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2472	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2472	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2472	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2472	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2472	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2472	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2472	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2472	SearchIndexer.exe
Token: SeDebugPrivilege	5052	elevation_service.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2472 wrote to memory of 4008	2472	SearchIndexer.exe	142
PID 2472 wrote to memory of 4008	2472	SearchIndexer.exe	142
PID 2472 wrote to memory of 3312	2472	SearchIndexer.exe	143
PID 2472 wrote to memory of 3312	2472	SearchIndexer.exe	143

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\66b31963441dfc8fbd770c1cfaa2e328c176db05d9bd2f3013dee3a0d272b09a.exe
"C:\Users\Admin\AppData\Local\Temp\66b31963441dfc8fbd770c1cfaa2e328c176db05d9bd2f3013dee3a0d272b09a.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:3612

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:2040

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5052

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4108

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3744

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4464

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:4344

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:3328

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1156

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4432

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:408

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:2608

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4076

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2812

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:1408

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:844

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1452

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:372

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4952

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4252

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:1424

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4480

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2772

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:2824

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2472
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4008
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
  2⤵
  - Modifies data under HKEY_USERS
  PID:3312

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
Size 2.1MB
SHA256 d10d6edbf5746e7f179d5d23dbbb4d8df504b96b1ee6e207274e08abaea84199
MD5 c25b91cabea098f92370823113422990
SHA1 122a8851b6f2858ae9376fd4b46e1a78c32eb323
SHA512 14addb55e714a5f0ce40152fcac2b9b8aa198a3185bec487dde26d1f445ef0ac47348d5abeb04f3e368795e41fa546f7d41dfeea78ff3c524ccdd18c5aceefee
SSDEEP 49152:FuYk3H5koUzfTqkkYLO/W2buywzMbOX+T7z55xlMPdlR8v4UC0Eg6ET7M/I:F7fTqi90b3l2/V0cETQ/I
MD5 SHA1 SHA512 SSDEEP

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 fb564343067abb16313efdb00fa87dd22cb1a6c63e530f4778e4c1941f8911fd
MD5 c7f47666f0e104213daf103be754ebb3
SHA1 e9e22df2542adf2def668ebc0bf4bc92627d3bb7
SHA512 2321ceed29c44ffa8a433645e321578709f216007593d7bb08df25252c159ad582fecd7a9eae8a47071ce293fc6b57820deeab2d3be698ea3a52df19731aebe1
SSDEEP 24576:dZFwVuD8WHRlMugdD+JsRgZRJ4fM430Eg6nET7M/IiN:zFwVuBxlMPdlR8v4UC0Eg6ET7M/I
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 fec04158ec69fe40a983176ce01679283c249fee229d263384665dc4d588b6d8
MD5 ae9c81d6c6bf42d6b6734b4fd113b3c5
SHA1 85e0d70723064c651c02793a863f2e565c813495
SHA512 e1d8b0e8cbbe52945e90ef3ac54270c6f7d6f671da50ddea070bd98cad99757b505c7af6e611e1549abd5905bc03a41b8a6cb721791e1869c434b0d9d4a78b5a
SSDEEP 24576:7+gkEjfh4CofWHRlMugdD+JsRgZRJ4fM430Eg6nET7M/IiN:SgkEzScxlMPdlR8v4UC0Eg6ET7M/I
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 79fc115a6082623bf466a02ac43a4d7b07c7fa4e9fe6ac0c9be3acee30248d12
MD5 dc979e4c98a0e82f9e0de475baf33e2d
SHA1 2163cc2d6401fccecbb8bba3794afc346922ac41
SHA512 e56ae941be8dc3ba872a41ee2679df17a2883e0d7153221ebf471704b2f0fdcebd60bbec793e2fe21e09bad7d0cdab056f0428000cc961e408964f194482516d
SSDEEP 24576:ABpDRmi78gkPXlyo0GtjrcWHRlMugdD+JsRgZRJ4fM430Eg6nET7M/IiN:ENRmi78gkPX4o0GtjZxlMPdlR8v4UC0d
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 18f991c6d789a0af5fafdb4d6fd163a29cd131c905c559cfc72c3708dbc855dc
MD5 dc1c2475ac22895c12bfc9b1d75b3f53
SHA1 d8b2d8280147a5277031079d4831ef0fca1fb6d4
SHA512 f49225b5342dc5ada329711f59dbd443810cad52d7ea86fc0fc04269382503cbeadda1e9411a1464d519f2b87e0045aac52a06a7507ea76e1cc66f5166240d42
SSDEEP 24576:GLOS2oTPIXVfWHRlMugdD+JsRgZRJ4fM430Eg6nET7M/IiN:2/TxxlMPdlR8v4UC0Eg6ET7M/I
MD5 SHA1 SHA512 SSDEEP

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.3MB
SHA256 0be94e1fc70374ea14b56afc2489e648bceeb07d06c4582107279b071bd7d2b7
MD5 d21e9f52a83643cb04e41e5a10b25d18
SHA1 83721bd6f45b5d85d00cc3b5f2857ee3c02d390c
SHA512 d45de4fb28fb4cae76cb447d437bb75fbd09c0e172b3da7b821b6fb0e02bd7e342a22816d958627aceedb74835706b457b29bfe6b4e0557365bad0b0839c71f0
SSDEEP 24576:qpJWHRlMugdD+JsRgZRJ4fM430Eg6nET7M/IiN:hxlMPdlR8v4UC0Eg6ET7M/I
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.6MB
SHA256 867a895153d5458da928b456f0a4c367b7cfb4e630c80c0b51ac75bbbb580d2d
MD5 f689860d6a3b96c1bd670edc350e1408
SHA1 a7967545b06b1a7b58ebfe7ce012c1147246f861
SHA512 f557ad0484de9aa8f46fd733ca2be68f565e30fbf989da2e91db6d85148652d1ca85339ebb69d3ea8cf323d6198b01b703d85fafd3b18d27a8e4ca6f66aaf04e
SSDEEP 24576:bJIU+WHRlMugdD+JsRgZRJ4fM430Eg6nET7M/IiN:bJIUrxlMPdlR8v4UC0Eg6ET7M/I
MD5 SHA1 SHA512 SSDEEP

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 7043a55af9be2257724a4f3dce9e51ac74b7b9e04b08301807afbc0c8c0e97a1
MD5 22b7f86eb8fa76c55499f927f96298d2
SHA1 0f29fc5c002dcb72d772888524dc412aafa5176c
SHA512 bdce1338543da29b74baa31750e8d3fe6d5bd2da828e97c1c9e76d79479ceb43e8235afa2fdfcea0749ca8fe67114f61e0aae27e0383112b30079b64af228460
SSDEEP 49152:RQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3TH5:RQvGAdlCEL8c/DRNw5C+l2/V0cETQ/I
MD5 SHA1 SHA512 SSDEEP

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 ebcc26cc5f6f983aa67d1f71f256f703b8f82640646b2ba640007197e25e4971
MD5 9bd8cf54f39995e5001d3d9e1aa7fe93
SHA1 7a32d292a7022616a46ca74b80c946ea3f154c5d
SHA512 1beaebb932e87313225f07f5c00aee3fce9c1928e3d9787cf3b9b586b45dce498603d6e62b372f50900b52b9f02c7e8f7b18ef915024b6dbada86590e20b7b8f
SSDEEP 24576:lAewsAj0WHRlMugdD+JsRgZRJ4fM430Eg6nET7M/IiN:qljtxlMPdlR8v4UC0Eg6ET7M/I
MD5 SHA1 SHA512 SSDEEP

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 a226cf42f3de45f367f68b62e7dcdc0418e355b42880ff2d0561f6707c66c26f
MD5 96cb79dd7851778d7be5dbd411ae1c00
SHA1 0d953fed2b5c581cdd76a8a99d3816c4071d7b8a
SHA512 d635962198b342f8c2604336dd7c07e183fec3a65532e1e59673bc42251301d3ad7e4beaa2562de6ef5da58379113f74601f8b471ea954a9605b38df2244983c
SSDEEP 196608:jUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHf+Z:jUEtQevvqc2W1cpV2tI32f+Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 f287eb8d6f0108b5a1176d810ad6632ff61787fe52e39e1ca4ce3b96524ebe97
MD5 cd377266e1a7b24b31ef34ee6d6b285c
SHA1 18cc9ea87bbef3126cba28d604818d7298d4639d
SHA512 eb0bd70b8947912e33fa0a7a67e89d317604dc2b2edf34e281c4ff62a53b52ac2a8ca2e79f3852f36eb1d597f9eab00742f8b7a6116e78ab6c1edd33c1d47c18
SSDEEP 49152:9CbRquA/m2yL5zTfFiV+XenmE3/zNxlMPdlR8v4UC0Eg6ET7M/I:6oquVjnm6l2/V0cETQ/I
MD5 SHA1 SHA512 SSDEEP

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 ae05c9767a0de4ff33fc8e27b038435dc77e709a39b6e4e5959f712d59715452
MD5 ff27b071f139e00ae3e430d4ecd67114
SHA1 c5338535f2418bc7b074000f05993919ce01e7da
SHA512 9ab659183fea2093d1df78961b791398d34218e4521addaa922927795d6ce8cabcea3d2992a753fc559f41afd0bcdc394c87c712edde344bed13e4289e3d1e75
SSDEEP 24576:VAhGL3IFoiwtA5l7S53PWHRlMugdD+JsRgZRJ4fM430Eg6nET7M/IiN:VAMUFoiq5uxlMPdlR8v4UC0Eg6ET7M/I
MD5 SHA1 SHA512 SSDEEP

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 3872bc5fa1d62b7aea223b3a912efcb407a551bd1ab662185ad91bf64f19e165
MD5 9cb69502847b7d69b2ba18f1ce18dfad
SHA1 c9130b65fa7f16655fc9e88f33165ca7339a0fe6
SHA512 a8d3187db2f479029a359819d8052d4de7a3916c46efdc59a8921da3494b5f438bbb2ecd4aedec8b8ad2b2244950742548de7e737f028b15da862ff9db28f043
SSDEEP 24576:ywucOWIWHRlMugdD+JsRgZRJ4fM430Eg6nET7M/IiN:ywDOCxlMPdlR8v4UC0Eg6ET7M/I
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.4MB
SHA256 53d13348cf490f819b52b169084a65c2451d304649cc277f615c98db29c6c231
MD5 fd993ac88fc0b167b459f151a8e07bd2
SHA1 5dde75eda493de58644a052375de7180b3b03e1d
SHA512 fbccac871bcb92b6e5dd032a0e84e60613f16939a720defedae57f4d2dbd97c99b88bd8d2f0052fa42e21ffa842d4813f967cf6a90e73ab62163e9063b1f95dd
SSDEEP 24576:IZuVWHRlMugdD+JsRgZRJ4fM430Eg6nET7M/IiN:ixlMPdlR8v4UC0Eg6ET7M/I
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrmstp.exe
Size 4.6MB
SHA256 c4ffbe379bc4773cf1bb4e4ee958f6738b0f4671779cc428e083ba56beb080a7
MD5 21fc33701b28312fd0b637e21fc9b501
SHA1 76a6c341e715cd3e7d932df808a82660fbe2195b
SHA512 2b442ad54502bfab24225051cbcdc1249bb5dc30674274203d2566d48a4c562bbe9f4b2d3a5a549f79989457be11b9fc46b5b76b54a1a42fa4cdacc1460ff399
SSDEEP 49152:2yEKQ5E3ieGR0PEtBFUow1b89eX611+2xmepn/TRijbqYW3qkCbDypSfe6qwiXEF:oq9ceqz+2xl/SSay+l2/V0cETQ/I
MD5 SHA1 SHA512 SSDEEP

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe
Size 4.6MB
SHA256 2b6892fa11df63e6b4a0106be9130ee586c4f49ec5c19cbef5292cd13b6c6d48
MD5 9c3488b9322d99c157dd0444de328557
SHA1 4f2507aedd67ea7c3fcfc8814c1ed3547d46c043
SHA512 3bf0584369938b914e9d62784ddc7b76ad668f57c0ff48531d43cc880b8d18258ba87b2726735df46588ee514753871d9cf993843885b7836cf03d5bd72d1ebb
SSDEEP 49152:uyEKQ5E3ieGR0PEtBFUow1b89eX611+2xmepn/TRijbqYW3qkCbDypSfe6qwiXEF:Aq9ceqz+2xl/SSay+l2/V0cETQ/I
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\123.0.6312.123\chrome_pwa_launcher.exe
Size 1.9MB
SHA256 4e156ff9116a04f00c9ed7b7aea2cfba2a48f86b5d2d2242b282ba4031ce2bbc
MD5 a44664aad016beb361ea194255e3d4f7
SHA1 e565077acc72205236281993a810601a2473ddc9
SHA512 fa5f2b3c18331ae8ee5b735629fc1cef0d74fce895e021b8dde62ea819d41bf9c0bc0025a55ee22cba4ed5d22d583aaed984b65dfe56265320d5bcbd4c9f53ec
SSDEEP 49152:ZVOyh+50zyxNxlMPdlR8v4UC0Eg6ET7M/I:zhE0zGl2/V0cETQ/I
MD5 SHA1 SHA512 SSDEEP

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
Size 2.1MB
SHA256 f025c983c21388ce631555709117bc4ba193be1a9d6e1afb57b20a9f36e3666c
MD5 2d84b3d0ff865c40342ffbfde06974a3
SHA1 d7026019f8336f58e675ab5b0838496da39e539c
SHA512 eae86eb920c4b0424671fb3fcd7b034300bf54e951001a0dc9ba2e7db514b0326ae2465b685a8d9da75da47644ebbd853a31297989acf561910d84245f9ee7b3
SSDEEP 49152:+59PYHvI7wi/2IKuLFrFXlMWGxbg/xlMPdlR8v4UC0Eg6ET7M/I:+Gg2IKgMEl2/V0cETQ/I
MD5 SHA1 SHA512 SSDEEP

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\123.0.6312.123\notification_helper.exe
Size 1.8MB
SHA256 c6f312c02cabde6cf7c0ee13218843083977fc66cc512a90254ce103f6b0abda
MD5 abd0872777a78b1fc7df3ed28cb40820
SHA1 a68f87245467708884bbaf7912b32c2a7b8290f4
SHA512 ffc7128cac75545ac99d0fa2bd74082b971ce3ddbfdf98907d05635be84b4a77ad44115ab6c5e20f163a97bc7da6d269615e186986a8221a5e162a3b768ffce0
SSDEEP 49152:mbrUzFjGMV8Dy9INqZFxlMPdlR8v4UC0Eg6ET7M/I:FL+Dytl2/V0cETQ/I
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 1.6MB
SHA256 83632e5dd210f79f078466eef87a9130b4c8ee1c56065c4ec9eaf0d6607a9720
MD5 bea5ec19ba736e318d162ab6e5c08c6e
SHA1 29cbf970112b4b235cbd00235a40ffa11c7f6b43
SHA512 8c89adf8fe99a4653e9285abb3c263f3a1ac2617770257b4d4cb0e8bfd1687dc614e6aeabb7251bd6e6e83dfd30556d4cb055e34271122102ac04ae84e688f08
SSDEEP 49152:z4qiwzPASW9mMtjxlMPdlR8v4UC0Eg6ET7M/I:2UPALll2/V0cETQ/I
MD5 SHA1 SHA512 SSDEEP

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.3MB
SHA256 cc772eb2492cfc1076c54239043002206c491d92b3f864f3fdc2408a7ac9cc60
MD5 c310147d56ca5f3ece740ba57e32cdce
SHA1 5a351f5e4db6608332d182f77f22d922e6776691
SHA512 7930a6f0711747486f32e032ba04a0cce4b697a7f345c94bcd18200b9429a04347e78913587979ab0dd56307ff074f67fa142d8fbf8f0d99cdd54354007f4401
SSDEEP 24576:IRWHRlMugdD+JsRgZRJ4fM430Eg6nET7M/IiN:txlMPdlR8v4UC0Eg6ET7M/I
MD5 SHA1 SHA512 SSDEEP

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.3MB
SHA256 3d78e487b32c58273aa8cf0396c57683de29fcf487fcb275520bc23d497363f0
MD5 46d00dcdad4262083ff9f55271ff4911
SHA1 89a8cd834d40e0230d6afae348c1cdffcec6ca3e
SHA512 aa8c38be2cb434c6780620b932ad87c138a5c14f87e9a784aa1aaec8a1d874ec52467b7e42fda9b702134ce051ce59e399eb3388efac1fe1bdf20c044c628de6
SSDEEP 24576:UAWHRlMugdD+JsRgZRJ4fM430Eg6nET7M/IiN:8xlMPdlR8v4UC0Eg6ET7M/I
MD5 SHA1 SHA512 SSDEEP

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.3MB
SHA256 b7c799df575bc8d885b1de20adb3ad495d9dfa80701632ac6eec41cc67990ed4
MD5 ba0515e9db1a6c83c9257720b1354116
SHA1 f86eef76c363541fd13685a6269fe653e96de9a5
SHA512 fc893bf4c29ec4b368a80dc79fb99b2f3b71d59ea566205c53195cf2ea69058766bc1496a54b9ba576cc40449ac3fe435c3819ca6df7b84304f53f8cf6ecc47f
SSDEEP 24576:JmWHRlMugdD+JsRgZRJ4fM430Eg6nET7M/IiN:5xlMPdlR8v4UC0Eg6ET7M/I
MD5 SHA1 SHA512 SSDEEP

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 5916bab80dd28d6d62482e730f764549a9c3b1ce7fcc4117d8fdc84d55142606
MD5 6298b7d950a967c1c163b62060505a1b
SHA1 17b2bb489df5199e9687c45086f3d45ab4eb582a
SHA512 39d851b5097c2e576a7ab36aae2648c5cb2c8c0d3348e4d54b730abd27c01a371dc9cd8b4c471046c2952d72bd9eba1bfb92a25a4ef1f5ffc78ecebe03bd7344
SSDEEP 24576:AWHRlMugdD+JsRgZRJ4fM430Eg6nET7M/IiN:pxlMPdlR8v4UC0Eg6ET7M/I
MD5 SHA1 SHA512 SSDEEP

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.3MB
SHA256 51e0fa463784191aa7ced6347d306e7be72030f809ce086639177b1676d013e9
MD5 06e57a91223f8fe667dc8b6924716782
SHA1 538ddbcd46015d033060cc37538ff37c7307013b
SHA512 68a0124ed66fc5c423e288b82af6885e5faefbb79b7b98d885e56d2886cccab4b6e07e0a5b2f8842bbeb4473645447dcffb994117bcd52204f6e6f5dc95263cf
SSDEEP 24576:xnWHRlMugdD+JsRgZRJ4fM430Eg6nET7M/IiN:oxlMPdlR8v4UC0Eg6ET7M/I
MD5 SHA1 SHA512 SSDEEP

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.3MB
SHA256 acc6e7e77b294e66f9e9f7faca391d049b24b72f95087443be78287bac8eff94
MD5 1270a6fc990f5be0db08c3e7f63caadc
SHA1 4df547af2b7ee6a2b0b01ac480b157a01200ca05
SHA512 f15ee1c9a70999ee7ef3a2c4f36dfd2572ad7285c33b3656b3c645d23d32836af4a58806f06d3e08c31745acb53b736eb7a345e410d09391d725c6d1a9881e74
SSDEEP 24576:bcWHRlMugdD+JsRgZRJ4fM430Eg6nET7M/IiN:BxlMPdlR8v4UC0Eg6ET7M/I
MD5 SHA1 SHA512 SSDEEP

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.3MB
SHA256 70241d7bbabdc432bdea734a2972a43213688186007678895ec27dfd8ddbf226
MD5 4cbe0dc043ae78edec17d4d21f018fcc
SHA1 ba0e25671a81b64c6e52f37df9d840529fbffd69
SHA512 e8c80df7f0a5d9a48c96e92f8ead9bfcbe4847d07b53718e8a8876615fb3dafb38d4ee563229fa2a0206ea2d38b29782c5e219dbd61e4f13aea771144cbf028b
SSDEEP 24576:M4WHRlMugdD+JsRgZRJ4fM430Eg6nET7M/IiN:8xlMPdlR8v4UC0Eg6ET7M/I
MD5 SHA1 SHA512 SSDEEP

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.6MB
SHA256 b9c5ce786db8fc9e14d8ab2949c3060ab922265299fae51a6d02fb43623820cf
MD5 762aa3ebefd722db0c6f8fc9fba4154e
SHA1 66d2e2a2bda3e729a21856136fabe208a87edad1
SHA512 fd975e950e539b5a7a5dff770b976d81494310ad2562cb760a9905bf1fd736967fcd1c4ecdd10e87a936e60f59f4f2c073b6cbef0c4892af4aaeac738c8d179b
SSDEEP 24576:PZMNzFVSOgWHRlMugdD+JsRgZRJ4fM430Eg6nET7M/IiN:PZMNzfFxlMPdlR8v4UC0Eg6ET7M/I
MD5 SHA1 SHA512 SSDEEP

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.3MB
SHA256 d854983b69d0df1dccfcaeb67ba87bc123dc826e15e13a68d1da92ec30ec057e
MD5 eb0d838e77b631c427011b252786ce6b
SHA1 70153b53429200d51efdda46e181655774232d0d
SHA512 8850bf8b9fd17fd12f68bbb741775453e7a83d754cc3000d13eb30054575f8092479ea03a70852455ba09e32cf3d6df747c7f396f038881f1a576c9a3172def9
SSDEEP 24576:blWHRlMugdD+JsRgZRJ4fM430Eg6nET7M/IiN:MxlMPdlR8v4UC0Eg6ET7M/I
MD5 SHA1 SHA512 SSDEEP

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.3MB
SHA256 b8fa58a785de6a2842f91804cb740a8a9753f3152dd74295f6b8e777aabf14b5
MD5 fc96239054ec0ec42e1954167aab23b8
SHA1 ce26df584c81362920c027a70833a34f7a644324
SHA512 15b558c4839c4bcf6b9f3b079370294ab03ac73427615cbd02aecfbcc8221cefeb3debffb494f321fb286f71258a29d80edfa6d673385772a8a4c8fa918dc907
SSDEEP 24576:VZWHRlMugdD+JsRgZRJ4fM430Eg6nET7M/IiN:ixlMPdlR8v4UC0Eg6ET7M/I
MD5 SHA1 SHA512 SSDEEP

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.5MB
SHA256 38e59a54a16afc24ab4f51b985edf9b21011cbc338b268d7c1acccbb9f08f987
MD5 5a831b3b37fd98c97eaaab373b1ea616
SHA1 96ee66bead94800e733747b9e2cdd45993edd45d
SHA512 96608ffb78a39f67812205886138397ce4481c317904d7b5f61f1a9128300fe64375cdec3a53d96728410093a1523213a2dd6bd5636307a50179b61a70567d1e
SSDEEP 24576:/zyEWHRlMugdD+JsRgZRJ4fM430Eg6nET7M/IiN:/ixlMPdlR8v4UC0Eg6ET7M/I
MD5 SHA1 SHA512 SSDEEP

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.3MB
SHA256 4973a6d6da5d56d746f4029299ccaee47d09efb1bc77828ed1565efea21650b4
MD5 81af4f3dc7a53ec842b980c02e3e3bdc
SHA1 377769799a0878f7012ae3af99ed23d1d456f596
SHA512 a04256a0700d108f235758752478ded0ca09cd138179691c24f36cfd6069ff282580ea6e20cf3312b9099de14530464f72d0da98d6d6ba7fd581e4241c3fb22b
SSDEEP 24576:ilWHRlMugdD+JsRgZRJ4fM430Eg6nET7M/IiN:xxlMPdlR8v4UC0Eg6ET7M/I
MD5 SHA1 SHA512 SSDEEP

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.3MB
SHA256 01600bb1fb5369d3083e6c971df89c8e4a754bc299216e9e8fbf0c8000ffe69d
MD5 44169a0284496165b9fabee80bbb60da
SHA1 ddd3ccb1aee70a662979b968e726e330b337da23
SHA512 8ab731731f27a639aaea329047f4bc24be98382735c715870a40c54df7bc1ee8261935fb18661600ee4ea72edf9c3d27aac6dac7fa9baa67fb8571aeae97cec3
SSDEEP 24576:olWHRlMugdD+JsRgZRJ4fM430Eg6nET7M/IiN:PxlMPdlR8v4UC0Eg6ET7M/I
MD5 SHA1 SHA512 SSDEEP

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.5MB
SHA256 6589b66ec05005dc99468fe0010ccbf1e28d3f193729cbd929461b5b8fcd31ec
MD5 cbc7dc9fe895d17337437803fe6d925b
SHA1 6db9b6d7da6656d8642ba25bbd9669bd15793b5d
SHA512 a1c3ef03fe0501a555aa6052e7788b107f92828ac58d642ea70865c242b957765c28db096ae72b8b3015785c481063fec7b8cc67147bc5e50d6f6d393b3e3bf8
SSDEEP 24576:3zyEWHRlMugdD+JsRgZRJ4fM430Eg6nET7M/IiN:3ixlMPdlR8v4UC0Eg6ET7M/I
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.6MB
SHA256 06cce3b1c979ecacd17141e280b599fded49c850dea93ae8e77457cc3efca421
MD5 90bb72a34d1f1879745408997869cbda
SHA1 3c4dbec7aa746b6f5a179208206c832dfa20d02e
SHA512 3176ea17719fecd795e3ac91c1293dec3b1ba1ff26ee6b2c52e540ea2922f8c48f76dedc8137ed0f68f001ee18d1098bf6d02ccf35b34b5357ee59b3aacd4e8e
SSDEEP 24576:MTvaLl3z0zDWWHRlMugdD+JsRgZRJ4fM430Eg6nET7M/IiN:MTyLlj6xlMPdlR8v4UC0Eg6ET7M/I
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 74bb2a0049cfa3a82a5a3f46fe9ff0cfea39283c07cee9b9ccf2db74de3404b8
MD5 7e9f945b8fca1b291d0c636ee76160f9
SHA1 6b9018fd184003cf3a2c516e444c567f9ad160f0
SHA512 f29079e06f5b9b0edde7a7363195e20d85c3f910f6f0638abb38ea5139e1a86fbce74d06970fa421885b32bafcdf2c711c2946922a575f44c849796f605a827b
SSDEEP 49152:Obd9CHKyaFxlMPdlR8v4UC0Eg6ET7M/I:wCq/l2/V0cETQ/I
MD5 SHA1 SHA512 SSDEEP

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.3MB
SHA256 cc4930ee76da0a7d5477999eba258ad0603230ad375d788191c7f00e9010166c
MD5 85c61c29e8d2e399c605dc21c9689c72
SHA1 54d912612385a378060eee23c782f7b64d759b0b
SHA512 415a574399a5415052b27a841828d111d1edfb396d9c27e150e39a70e1b44f6a45030f6b5085ffc800b2db12778eed10eb1b673271039d112a45634c713dccbd
SSDEEP 24576:HGWHRlMugdD+JsRgZRJ4fM430Eg6nET7M/IiN:zxlMPdlR8v4UC0Eg6ET7M/I
MD5 SHA1 SHA512 SSDEEP

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.3MB
SHA256 5fd73ccf5fa5647832ce205d4b9efa3f7b715ac4832ecbefd82b7b081f052da9
MD5 0144864f9a2c335d4ad64b3a966946c2
SHA1 7950f5444a125708fc36391750d81f4be66bc044
SHA512 fcd0345032b0fc0d2aaf9d8126d6fe71fd92346cb6f2fc639bf16b23aeb35919b3f0e19e85b104d31d5d33be3b3be30f875ed13a5785874d1cff6911b9e08172
SSDEEP 24576:pkWHRlMugdD+JsRgZRJ4fM430Eg6nET7M/IiN:jxlMPdlR8v4UC0Eg6ET7M/I
MD5 SHA1 SHA512 SSDEEP

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.3MB
SHA256 f4c0303d8481a0077d66e01c2937162da11d89c1e3e354153dffe639287c23da
MD5 215dcaf485256925badc89029ccf4b16
SHA1 2fc25cf0257f4e39f715be0cdfacbe441026ada1
SHA512 c910c46e5ced07ca33e265b801a401c0b67b2223a0c7c4fdac04e7307049211f2b289fa767a2a8b868b0ec9a26efa53c8c08d1e220d5c974ef7cad7be2e09a28
SSDEEP 24576:2TWHRlMugdD+JsRgZRJ4fM430Eg6nET7M/IiN:bxlMPdlR8v4UC0Eg6ET7M/I
MD5 SHA1 SHA512 SSDEEP

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.3MB
SHA256 6f72d2a7e7ed3f1debd6e543998fa1043ba4eec947a8e81b9f5d69ba5ffe2b17
MD5 ad94fb9d4977fc5e6aa5a1d6e90d1dfe
SHA1 d2ae582af813bb37af72b01d99c54711c040e72f
SHA512 87a3c972a84e6b87db6c6753aa3b3332bc05d8988d41675566aa154e3aa960a03415550fade97da9a460802cfb5ec5e37a775f659e6c9977e305ac59106d5bdf
SSDEEP 24576:8lWHRlMugdD+JsRgZRJ4fM430Eg6nET7M/IiN:TxlMPdlR8v4UC0Eg6ET7M/I
MD5 SHA1 SHA512 SSDEEP

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.3MB
SHA256 26b2e63d11c44e61c03bd3d187f52071a6a682c287d0b3384768913c538dd3d9
MD5 60b0ad1eb3682421855fb590ce2d4f66
SHA1 f03b98f8758625fcb94958c2fe1d21295df43b91
SHA512 b179f60b2af6d276672b3b9b7ba610c4e2ec3a0938e6ffba9092b5265144939c8d012172a1e7a2bef44001f09f64e7408180acd9003cb6cb2fc15dcee408b1ce
SSDEEP 24576:bGWHRlMugdD+JsRgZRJ4fM430Eg6nET7M/IiN:fxlMPdlR8v4UC0Eg6ET7M/I
MD5 SHA1 SHA512 SSDEEP

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.3MB
SHA256 11e9e22d90e7a68a06fdc6fab7d5d029d8c4289f3df30374696557983188ab9d
MD5 c3d368a6707a577f68e4ee01130fe89c
SHA1 f77a50459ad68f8cbd4e62431da4aed84df5accf
SHA512 fbdd5c6a65a2acb36ca3824e516e0cf6843cdf8b0fb80b43374bcd70aac55848535a8c8c7cc1181e3bcfbb42730393b6ef2939c6c927a290419d08aa301f7e8e
SSDEEP 24576:XdWHRlMugdD+JsRgZRJ4fM430Eg6nET7M/IiN:QxlMPdlR8v4UC0Eg6ET7M/I
MD5 SHA1 SHA512 SSDEEP

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.3MB
SHA256 3dd441ead0a0da0319a722d090953743be833a480cb802e1e2766d8d2488c80c
MD5 e15e26b79fdf8a09d2bd5e8c2884bdae
SHA1 3f9168285030c933cde702d5bec5e97e0e7a875a
SHA512 04a63135cf52d526a3c27f79c7b9272c72078d7f0607ef79f772aeee36fc4503d6c58244028ff9700dff3bce152d5f25001714ae1916f41f5ca645e8846ede20
SSDEEP 24576:KnWHRlMugdD+JsRgZRJ4fM430Eg6nET7M/IiN:zxlMPdlR8v4UC0Eg6ET7M/I
MD5 SHA1 SHA512 SSDEEP

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 a3a8018715f9d90988c174fc4edffb400972fe5bd8208db7faaff1d1a947bd70
MD5 ea72927ccaa378b5faeb52001839984e
SHA1 1f95f7dc9f02f7a274f95535abbc0498a4665eb0
SHA512 6098662e3bf746c921e30afe09b27da05e7a1eb1a76e07672009ab2c757a634feff6b6f6f6dac1472c0d336e71f83f3d1189472ed17b5a1f1e6846a24598a2c4
SSDEEP 24576:byWHRlMugdD+JsRgZRJ4fM430Eg6nET7M/IiN:jxlMPdlR8v4UC0Eg6ET7M/I
MD5 SHA1 SHA512 SSDEEP

Submit Download

JavaLauncher.log

Path C:\Users\Admin\AppData\Local\Temp\JavaLauncher.log
Size 2KB
SHA256 055dac19931169d865fc647e50b94efe18fbfdc2532f3bcb7d74b58df0673c44
MD5 7fbe2643d8da790cea68a8d383832895
SHA1 d71cf710eb29960a47c9d42592ef60828099217b
SHA512 72256aea7ed9eb4ee7d04ce0cf243f01253db0c9d99cbc96341aa15b04d52637fee1bb0c14021505f187b96c0e3aa8096ab91b312d6588248a13da3c93c658de
MD5 SHA1 SHA512

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.3MB
SHA256 d850819c42d653453247f373e4822883a9d053374fe30054deced4db21d4b077
MD5 c637514484e796a5b25a40b303d643ad
SHA1 6b7a9208f1e4d41e17cbbf231c4ffd166e58f197
SHA512 d52d202a15ea674e60db73da319aed8d5bf14fc971c0182cab2ca3d20b0d765de5b1f2fb4c1b5ec05855ad984cf9dc307758bd4660fed4ccccd131be681a726b
SSDEEP 24576:wFWHRlMugdD+JsRgZRJ4fM430Eg6nET7M/IiN:woxlMPdlR8v4UC0Eg6ET7M/I
MD5 SHA1 SHA512 SSDEEP

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 c112ab382c68a69e588adb9b89e2b9719a37a15c64efe67c3c5d6dd1eb83b129
MD5 cc2f0abe78e7d8f20e951013332a00b7
SHA1 4d40ef5489ac87a36a51be4ef132d46cb7333fb6
SHA512 17fbe1b08766053b3fb911f98345f4c9bfe94ad88544fc00db4070cfc013ce692c6b54d0ceb5a29eb84f205aa30ae2553afdddbb5d038abf22a83edf30fc56b0
SSDEEP 49152:Ta0h2GEkuAe73q3pp46zwwQCxlMPdlR8v4UC0Eg6ET7M/I:Ta0hNYG4JwDl2/V0cETQ/I
MD5 SHA1 SHA512 SSDEEP

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.4MB
SHA256 11e136b525e06a1b8636996964de6138d3f8c3642021c5833739e24741f2b1a6
MD5 ca8be7042b2ad50515cae875907a292b
SHA1 bfdc24c638cf9d5409a5d526ee352410e348fbb4
SHA512 2fbe72bc4cb815d797c36ff4f08b0f4c2a1638a98c6a6dfb8cb5f2bbc26f3206116c2bf3f1432239a4fe6635fd4484b72feb294a8c5eeff2fe597f0f3aa06b94
SSDEEP 24576:KhbHjPcWHRlMugdD+JsRgZRJ4fM430Eg6nET7M/IiN:KhbHjNxlMPdlR8v4UC0Eg6ET7M/I
MD5 SHA1 SHA512 SSDEEP

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 657731d9a776d7b6b560851303220f169894108bb4dbf9501a9132b7e27c8894
MD5 74c4e596d5f8f149a87b8ba0a5a7a1b4
SHA1 fbcbf49453e49e3df1e45e7b71aa16c6702092df
SHA512 60fc07fae60555ae2640a95551340ec0f03f0c8c48b9d3c6cfa23f77567ee65a7fe2a8a7b2dc33d495130bd1388cc3f20242de8e89d998f7b8821ed6e444171d
SSDEEP 24576:33YgnJcRTk4yti+R5dpR/kWHRlMugdD+JsRgZRJ4fM430Eg6nET7M/IiN:3IgnaTk46ppR/9xlMPdlR8v4UC0Eg6EN
MD5 SHA1 SHA512 SSDEEP

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.3MB
SHA256 74232297077480cd900286f68216a9436edba69fbf46b822a9947af2f1c9c1a0
MD5 69a01433b678587f139a3d8b3ef0f1f6
SHA1 b3a25ff3ddf531357aeb3321c07f5eeeb6000ff0
SHA512 8b6617c53be62e93ca6d10728341622b238bbfcb56f018f5248bd6c3c887e149c392af0264f4b7506af46885d8f365c7eaf3a1c216a0a218bb939baa3342d159
SSDEEP 24576:/pWHRlMugdD+JsRgZRJ4fM430Eg6nET7M/IiN:/cxlMPdlR8v4UC0Eg6ET7M/I
MD5 SHA1 SHA512 SSDEEP

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 7cce8cf312d99c13b33b00ec07270ad14ff43a40f16501df9717f4f47b938a95
MD5 622798bb40ab33a0b6d1a2cc13aa9566
SHA1 d1db4385161cad424e4f76770e4ba53ce6faf40e
SHA512 80684c5021fec654a79d9455e510dd6f32095a9b3b50dd396cc906b12d92b662d75a6b9a1778c3ed6ae5bafae974fc6fca63d1afa4ba55bb2ba3e9ed18478ff6
SSDEEP 24576:dvL3UTqWHRlMugdD+JsRgZRJ4fM430Eg6nET7M/IiN:dvL3UrxlMPdlR8v4UC0Eg6ET7M/I
MD5 SHA1 SHA512 SSDEEP

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 61bb3f25b3f095f7625c895cf78fdc537deff44f16aab8c195fe696b98f51f6c
MD5 87b6e737e63b95b3b0fb1faa2bb2b548
SHA1 fc03b504cb99d91bf222d6741e3370f0441be3a2
SHA512 c86051752d4d16e95a1d23cde986ee6daa86e4559fabb96f095b15ce819e1392bee92c8196fc48817572124c201848fb9b8bea84c042cdfdc9a96712871984aa
SSDEEP 24576:ROeWHRlMugdD+JsRgZRJ4fM430Eg6nET7M/IiN:ROLxlMPdlR8v4UC0Eg6ET7M/I
MD5 SHA1 SHA512 SSDEEP

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 200a93a39f3eac222e590d4ec8c46214b86c8a2a149949a73d016101077a4e12
MD5 7dbf8144ca4b2d945e47336ba9677550
SHA1 1ed674697d8e51d3c111c6c203a01e0bc8c95e20
SHA512 2638c504bbb826cecdf2ca3aaa5e37000c53535659c62e8f49809b6bf3ff1f9c2db646300f52393bb9b14533ff18cfc0439de8a1760285f878348a85756c98e1
SSDEEP 24576:/7NM9YmZqmWMUkPjZM48Mv6bEhs1WHRlMugdD+JsRgZRJ4fM430Eg6nET7M/IiN:/7cBWMpPjN8DbEh1xlMPdlR8v4UC0Egv
MD5 SHA1 SHA512 SSDEEP

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 68ecf187331238975cef57174c03982b6d87f8ad4023b6f164bda3abb89cddde
MD5 e1e9b1b59962d776c530af80ca927ef6
SHA1 c4d81e606750b1b8764d72eee24af417cc15d8e6
SHA512 7ed6cdc0fb9dd722b25e3ba27a3a44618b41d19c6eb6d940651ae608b8535f78ba1fc3317ba246494289e2bd5ca4d12b10813fb41baab8a385a3c549eb415a59
SSDEEP 49152:4F2YuHNETovcvNYf8kmYxlMPdlR8v4UC0Eg6ET7M/I:96tCf8k9l2/V0cETQ/I
MD5 SHA1 SHA512 SSDEEP

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 d7a8cf93c89915fada352601439a0fc6e6c268c54ee9f89f7cb060c22aec297a
MD5 459d543dcb371d5f2c71be4914756362
SHA1 ba0e756723f0e790abd10c6df912ae0d58e7b6c6
SHA512 f740647c322614e3edfcc3a3ef96921f92c34568607207f7d45d19ba9b340a30d4c7c84ee4d618f0b684a57aea1b9e6eb06cc1f8b40a611a63471cb7e9a5a03e
SSDEEP 24576:gAFs06+OmlfkNXEbToiWHRlMugdD+JsRgZRJ4fM430Eg6nET7M/IiN:1Fs060lwXuixlMPdlR8v4UC0Eg6ET7M
MD5 SHA1 SHA512 SSDEEP

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.6MB
SHA256 7b95172a6a49ddae4c94aaba6c10e77c1ef551e5826b07392fb40c154ca306c9
MD5 1d3944fbfc18f489a884e8d47c2df852
SHA1 afd0d8b86c6338bcfac881a0e8fabdd3082f6458
SHA512 6ebe6dfb789e19ede30dc8a0f1a0a8c78058138e444395d9733ad17436b28116e8fa4b767d9850099282d1ab2d199c29a7d45c9a82cefed43f34bfd30bed09ee
SSDEEP 24576:/JnJ5D3WJDWHRlMugdD+JsRgZRJ4fM430Eg6nET7M/IiN:/JnJ5DGJixlMPdlR8v4UC0Eg6ET7M/I
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 d773179094318cb8dd473a1f9651056102e667abe603453e476571b642e70f15
MD5 28ef05cf64f73913b23deeb5a7b33b11
SHA1 58dc45ea5dbf39bfb9d151933e01a97c13fab194
SHA512 cf9f4392624d1509a496cb4b16c0513843e6364dfff0cacc696691657e887ab9710c85b8cb5bf9ba865d3ec2f87956c7c2af64ae70b9f7509f5d7e0f4dda40b9
SSDEEP 49152:Go06DIKdwc+eQnSt65aVUxlMPdlR8v4UC0Eg6ET7M/I:/6l2/V0cETQ/I
MD5 SHA1 SHA512 SSDEEP

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.4MB
SHA256 e1434b7af4ba185a73e10b3d35ff81a990925e9babd051571943a4d67f47d0bd
MD5 bf748dbfca7f1e6d57bee0beb7bf8652
SHA1 5136c099b1090d976736756d8aa00e0db8206ec1
SHA512 82a9ad0c09ec8bc16ecce7fb082cf6abb3283959f99239ca23cb343bbba463fa8edece79bb8390b4f517a69febf1a189a964cac9971bbc53c79cd35ba2645d79
SSDEEP 24576:A/GWHRlMugdD+JsRgZRJ4fM430Eg6nET7M/IiN:A/TxlMPdlR8v4UC0Eg6ET7M/I
MD5 SHA1 SHA512 SSDEEP

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.4MB
SHA256 19edb527cc9d6b21b0fc70fc479b8dcb5eb821af8ca7fc78dae674dd8d2d3c65
MD5 e9fc215d3d39d5592d3612e4f4a07b24
SHA1 3e4c40bfdcfe7d90c6b95cbe6ae88cb8b9ac23b9
SHA512 d720b5430f2a931fb721cd78b33de12172a9be580eb6dc26f40544310dcba11b111a983454c9146b9fc259aad7e0cf515063310c767a2b741d6150ac919584db
SSDEEP 24576:QIysWHRlMugdD+JsRgZRJ4fM430Eg6nET7M/IiN:QIyxlMPdlR8v4UC0Eg6ET7M/I
MD5 SHA1 SHA512 SSDEEP

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.3MB
SHA256 26d75cb43d5f641ae6fdaf10634ce309d4e91b4d188e9bc0bafa5bc728e9a61c
MD5 5d9fe12e99b7f097342dec145c83e701
SHA1 918cac23aa305a0528e417b6813a0e9dbc8ef887
SHA512 a884403a94e86549278a34ddad89a18330d5f4468d754f91ec03ec073ded42e91cb5172feb446e832d13f8b19136a7c57e7d0ebc993aac9500d496d9a4199bb4
SSDEEP 24576:MuWHRlMugdD+JsRgZRJ4fM430Eg6nET7M/IiN:M7xlMPdlR8v4UC0Eg6ET7M/I
MD5 SHA1 SHA512 SSDEEP

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 a570b332913d8df3fcbd1252244584e0ee4af0b3998321564cde8a08a408bea0
MD5 52c0c01332218334d159d9ecd668fa6d
SHA1 75779154952649a1b0ebe43098c861dc9b9ea77f
SHA512 e0491cc3d3ef32d5e6d7dd0caaa8005ed9bf6f43eb7989fc60ac3a57f0867c8312e6496d4d018628796eabf1b8af4903d8e8168d594ea300882df04257cbf0e2
SSDEEP 24576:xQ9MxZKdcz97w3tWHRlMugdD+JsRgZRJ4fM430Eg6nET7M/IiN:xVKXwxlMPdlR8v4UC0Eg6ET7M/I
MD5 SHA1 SHA512 SSDEEP

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.5MB
SHA256 5e8274229d4530dcea2e0e1fceaf596b0b4d2f39cea267ef5e21e462b250c355
MD5 0616e159ef01bbf3156552c76b400d3b
SHA1 4a448fe3f98af079c98a96da0e4eb12a7e60cbaf
SHA512 7e7e79d828761c4140095e798472bbd1f953f01588108a93a83ee6b71f0a1efb8a6b5ec931f0a85ac962d786601ed8d53777248170323a1e05327da8ef1f831c
SSDEEP 24576:fyocVApAWHRlMugdD+JsRgZRJ4fM430Eg6nET7M/IiN:aocVAppxlMPdlR8v4UC0Eg6ET7M/I
MD5 SHA1 SHA512 SSDEEP

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 fda9b7719783be46d72536050b99acdd6b7a4318b23f9c93cb9039188139b1b2
MD5 2e3b5eb2291c378724d66cf82f2f39e7
SHA1 df7c94a5d7c9bb80c15c4dec93b6aefd1f5e7447
SHA512 17793ba76581fbbc6ad6c7bb1709cde9c7f925b5cb9c5608f7e9633f73683408b0f88df6b83cd64d0f7684a5d0d3adfb635c80a2ce6ff49e43312c4a67b297e6
SSDEEP 49152:wWcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIKpxlMPdlR8v4UC0Eg6ET7M/I:i0zuNI3l2/V0cETQ/I
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/408-289-0x0000000140000000-0x000000014016B000-memory.dmp

Download

memory/408-401-0x0000000140000000-0x000000014016B000-memory.dmp

Download

memory/844-340-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/844-524-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/1156-277-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/1156-263-0x0000000000530000-0x0000000000590000-memory.dmp

Download

memory/1156-262-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/1408-329-0x0000000140000000-0x0000000140156000-memory.dmp

Download

memory/1408-522-0x0000000140000000-0x0000000140156000-memory.dmp

Download

memory/1424-390-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/1424-581-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/1452-352-0x0000000140000000-0x00000001401C2000-memory.dmp

Download

memory/1452-526-0x0000000140000000-0x00000001401C2000-memory.dmp

Download

memory/2040-22-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/2040-30-0x0000000140000000-0x000000014016A000-memory.dmp

Download

memory/2040-31-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/2040-237-0x0000000140000000-0x000000014016A000-memory.dmp

Download

memory/2472-649-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/2472-447-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/2608-303-0x0000000000400000-0x0000000000557000-memory.dmp

Download

memory/2608-413-0x0000000000400000-0x0000000000557000-memory.dmp

Download

memory/2772-647-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/2772-414-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/2812-531-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2812-438-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2812-325-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2824-648-0x0000000140000000-0x0000000140186000-memory.dmp

Download

memory/2824-426-0x0000000140000000-0x0000000140186000-memory.dmp

Download

memory/3612-35-0x0000000140000000-0x00000001401FB000-memory.dmp

Download

memory/3612-12-0x0000000001FD0000-0x0000000002030000-memory.dmp

Download

memory/3612-0-0x0000000140000000-0x00000001401FB000-memory.dmp

Download

memory/3612-1-0x0000000001FD0000-0x0000000002030000-memory.dmp

Download

memory/3744-68-0x0000000001A40000-0x0000000001AA0000-memory.dmp

Download

memory/3744-93-0x0000000140000000-0x000000014018F000-memory.dmp

Download

memory/3744-62-0x0000000001A40000-0x0000000001AA0000-memory.dmp

Download

memory/3744-70-0x0000000140000000-0x000000014018F000-memory.dmp

Download

memory/3744-73-0x0000000001A40000-0x0000000001AA0000-memory.dmp

Download

memory/4076-306-0x0000000140000000-0x0000000140155000-memory.dmp

Download

memory/4076-425-0x0000000140000000-0x0000000140155000-memory.dmp

Download

memory/4108-50-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/4108-243-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/4108-58-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/4108-59-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/4252-375-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4252-387-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4344-258-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/4344-251-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4344-363-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4344-252-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/4432-389-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4432-274-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4464-244-0x0000000140000000-0x000000014018F000-memory.dmp

Download

memory/4464-84-0x0000000140000000-0x000000014018F000-memory.dmp

Download

memory/4464-82-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4464-76-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4480-646-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/4480-402-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/4952-364-0x0000000140000000-0x00000001401A2000-memory.dmp

Download

memory/4952-564-0x0000000140000000-0x00000001401A2000-memory.dmp

Download

memory/5052-47-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/5052-38-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/5052-42-0x0000000140000000-0x0000000140234000-memory.dmp

Download

memory/5052-239-0x0000000140000000-0x0000000140234000-memory.dmp

Download