6fcd4872b361df517b9814a36dad567fd8c8e0bf011c6109de5b93a9babd565b

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
08/11/2024, 23:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6fcd4872b361df517b9814a36dad567fd8c8e0bf011c6109de5b93a9babd565b.exe
Size 1.5MB
Sample241108-3ylx7ssfmc
SHA256 6fcd4872b361df517b9814a36dad567fd8c8e0bf011c6109de5b93a9babd565b
MD5 e598377ae3dea8e38c0f44c5538dff37
SHA1 bb846cafd4526b97b826aff53ba9925da58ff790
SHA512 8b9eb51ff72a81ea4cee817f244f3903bcdfed77b152618a84256791eed8698fed1d0dd0a9b1df32e7e82cbf75e6792917ae4b939f7cc3d27b0359ec7f8029ba
SSDEEP 12288:ywz2DWUHCAV2vFd4hU5dRpxLkefh35F28hJhxPad620Kr4QSx8:Nz2DWGCAV2v93jxLlh35FPvhkdLrb
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
4752	alg.exe
4628	DiagnosticsHub.StandardCollector.Service.exe
4848	fxssvc.exe
4332	elevation_service.exe
1708	elevation_service.exe
4484	maintenanceservice.exe
4032	msdtc.exe
3432	OSE.EXE
468	PerceptionSimulationService.exe
4340	perfhost.exe
3928	locator.exe
1332	SensorDataService.exe
2688	snmptrap.exe
3976	spectrum.exe
2948	ssh-agent.exe
2088	TieringEngineService.exe
4764	AgentService.exe
2656	vds.exe
5012	vssvc.exe
740	wbengine.exe
2160	WmiApSrv.exe
4508	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 37 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWow64\perfhost.exe	6fcd4872b361df517b9814a36dad567fd8c8e0bf011c6109de5b93a9babd565b.exe
File opened for modification	C:\Windows\system32\spectrum.exe	6fcd4872b361df517b9814a36dad567fd8c8e0bf011c6109de5b93a9babd565b.exe
File opened for modification	C:\Windows\system32\AgentService.exe	6fcd4872b361df517b9814a36dad567fd8c8e0bf011c6109de5b93a9babd565b.exe
File opened for modification	C:\Windows\system32\dllhost.exe	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\alg.exe	6fcd4872b361df517b9814a36dad567fd8c8e0bf011c6109de5b93a9babd565b.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	6fcd4872b361df517b9814a36dad567fd8c8e0bf011c6109de5b93a9babd565b.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	6fcd4872b361df517b9814a36dad567fd8c8e0bf011c6109de5b93a9babd565b.exe
File opened for modification	C:\Windows\system32\vssvc.exe	6fcd4872b361df517b9814a36dad567fd8c8e0bf011c6109de5b93a9babd565b.exe
File opened for modification	C:\Windows\system32\AgentService.exe	alg.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\6af67654674cc675.bin	alg.exe
File opened for modification	C:\Windows\system32\locator.exe	6fcd4872b361df517b9814a36dad567fd8c8e0bf011c6109de5b93a9babd565b.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	6fcd4872b361df517b9814a36dad567fd8c8e0bf011c6109de5b93a9babd565b.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	alg.exe
File opened for modification	C:\Windows\system32\msiexec.exe	6fcd4872b361df517b9814a36dad567fd8c8e0bf011c6109de5b93a9babd565b.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	6fcd4872b361df517b9814a36dad567fd8c8e0bf011c6109de5b93a9babd565b.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	alg.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	6fcd4872b361df517b9814a36dad567fd8c8e0bf011c6109de5b93a9babd565b.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	6fcd4872b361df517b9814a36dad567fd8c8e0bf011c6109de5b93a9babd565b.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\vds.exe	6fcd4872b361df517b9814a36dad567fd8c8e0bf011c6109de5b93a9babd565b.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	6fcd4872b361df517b9814a36dad567fd8c8e0bf011c6109de5b93a9babd565b.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	6fcd4872b361df517b9814a36dad567fd8c8e0bf011c6109de5b93a9babd565b.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	6fcd4872b361df517b9814a36dad567fd8c8e0bf011c6109de5b93a9babd565b.exe
File opened for modification	C:\Windows\system32\dllhost.exe	6fcd4872b361df517b9814a36dad567fd8c8e0bf011c6109de5b93a9babd565b.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	6fcd4872b361df517b9814a36dad567fd8c8e0bf011c6109de5b93a9babd565b.exe
File opened for modification	C:\Windows\system32\wbengine.exe	6fcd4872b361df517b9814a36dad567fd8c8e0bf011c6109de5b93a9babd565b.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	6fcd4872b361df517b9814a36dad567fd8c8e0bf011c6109de5b93a9babd565b.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	6fcd4872b361df517b9814a36dad567fd8c8e0bf011c6109de5b93a9babd565b.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	6fcd4872b361df517b9814a36dad567fd8c8e0bf011c6109de5b93a9babd565b.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdate.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	6fcd4872b361df517b9814a36dad567fd8c8e0bf011c6109de5b93a9babd565b.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	6fcd4872b361df517b9814a36dad567fd8c8e0bf011c6109de5b93a9babd565b.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdateBroker.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	6fcd4872b361df517b9814a36dad567fd8c8e0bf011c6109de5b93a9babd565b.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	6fcd4872b361df517b9814a36dad567fd8c8e0bf011c6109de5b93a9babd565b.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\123.0.6312.123\chrome_pwa_launcher.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	6fcd4872b361df517b9814a36dad567fd8c8e0bf011c6109de5b93a9babd565b.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	6fcd4872b361df517b9814a36dad567fd8c8e0bf011c6109de5b93a9babd565b.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Install\{F123CA10-B28F-434D-9884-6C3679B73C43}\chrome_installer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_75187\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	6fcd4872b361df517b9814a36dad567fd8c8e0bf011c6109de5b93a9babd565b.exe
File opened for modification	C:\Program Files\Mozilla Firefox\minidump-analyzer.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	6fcd4872b361df517b9814a36dad567fd8c8e0bf011c6109de5b93a9babd565b.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	6fcd4872b361df517b9814a36dad567fd8c8e0bf011c6109de5b93a9babd565b.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	6fcd4872b361df517b9814a36dad567fd8c8e0bf011c6109de5b93a9babd565b.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	6fcd4872b361df517b9814a36dad567fd8c8e0bf011c6109de5b93a9babd565b.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	6fcd4872b361df517b9814a36dad567fd8c8e0bf011c6109de5b93a9babd565b.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	6fcd4872b361df517b9814a36dad567fd8c8e0bf011c6109de5b93a9babd565b.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	6fcd4872b361df517b9814a36dad567fd8c8e0bf011c6109de5b93a9babd565b.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	6fcd4872b361df517b9814a36dad567fd8c8e0bf011c6109de5b93a9babd565b.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	6fcd4872b361df517b9814a36dad567fd8c8e0bf011c6109de5b93a9babd565b.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	6fcd4872b361df517b9814a36dad567fd8c8e0bf011c6109de5b93a9babd565b.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	6fcd4872b361df517b9814a36dad567fd8c8e0bf011c6109de5b93a9babd565b.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	6fcd4872b361df517b9814a36dad567fd8c8e0bf011c6109de5b93a9babd565b.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	6fcd4872b361df517b9814a36dad567fd8c8e0bf011c6109de5b93a9babd565b.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	6fcd4872b361df517b9814a36dad567fd8c8e0bf011c6109de5b93a9babd565b.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	6fcd4872b361df517b9814a36dad567fd8c8e0bf011c6109de5b93a9babd565b.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdateBroker.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	6fcd4872b361df517b9814a36dad567fd8c8e0bf011c6109de5b93a9babd565b.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9933 = "MPEG-4 Audio"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000291308b43932db01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d7a9dbb23932db01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001247d9b23932db01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a8f8cab23932db01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e6f246b33932db01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
4628	DiagnosticsHub.StandardCollector.Service.exe
4628	DiagnosticsHub.StandardCollector.Service.exe
4628	DiagnosticsHub.StandardCollector.Service.exe
4628	DiagnosticsHub.StandardCollector.Service.exe
4628	DiagnosticsHub.StandardCollector.Service.exe
4628	DiagnosticsHub.StandardCollector.Service.exe
4628	DiagnosticsHub.StandardCollector.Service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
668	Process not Found
668	Process not Found

Suspicious use of AdjustPrivilegeToken 41 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4036	6fcd4872b361df517b9814a36dad567fd8c8e0bf011c6109de5b93a9babd565b.exe
Token: SeAuditPrivilege	4848	fxssvc.exe
Token: SeRestorePrivilege	2088	TieringEngineService.exe
Token: SeManageVolumePrivilege	2088	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	4764	AgentService.exe
Token: SeBackupPrivilege	5012	vssvc.exe
Token: SeRestorePrivilege	5012	vssvc.exe
Token: SeAuditPrivilege	5012	vssvc.exe
Token: SeBackupPrivilege	740	wbengine.exe
Token: SeRestorePrivilege	740	wbengine.exe
Token: SeSecurityPrivilege	740	wbengine.exe
Token: 33	4508	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4508	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4508	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4508	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4508	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4508	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4508	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4508	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4508	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4508	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4508	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4508	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4508	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4508	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4508	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4508	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4508	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4508	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4508	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4508	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4508	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4508	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4508	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4508	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4508	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4508	SearchIndexer.exe
Token: SeDebugPrivilege	4752	alg.exe
Token: SeDebugPrivilege	4752	alg.exe
Token: SeDebugPrivilege	4752	alg.exe
Token: SeDebugPrivilege	4628	DiagnosticsHub.StandardCollector.Service.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4508 wrote to memory of 1800	4508	SearchIndexer.exe	116
PID 4508 wrote to memory of 1800	4508	SearchIndexer.exe	116
PID 4508 wrote to memory of 4352	4508	SearchIndexer.exe	117
PID 4508 wrote to memory of 4352	4508	SearchIndexer.exe	117

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\6fcd4872b361df517b9814a36dad567fd8c8e0bf011c6109de5b93a9babd565b.exe
"C:\Users\Admin\AppData\Local\Temp\6fcd4872b361df517b9814a36dad567fd8c8e0bf011c6109de5b93a9babd565b.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4036

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4752

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4628

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:1248

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4848

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4332

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1708

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4484

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4032

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3432

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:468

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4340

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:3928

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1332

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:2688

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3976

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2948

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:4144

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2088

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4764

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:2656

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5012

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:740

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:2160

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4508
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1800
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
  2⤵
  - Modifies data under HKEY_USERS
  PID:4352

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
Size 2.1MB
SHA256 7b03f91fd4d54ad5b50710adb3f4920b46f4d5f32a273ed9b5ac37d8fa6db2d8
MD5 23f4c336c55637089d0eec4c16186cc5
SHA1 1565005ba2ce7a7e88acef816e294505261d721d
SHA512 0519c2df905b4dae1a56e2cd74b7ffd48a8b54fa5ac7968a3af9b628ea7328f0c9d28a922d50fc3a2b798a46cf9f9819386d2127ca4da478c8e59c5a9f9842e1
SSDEEP 49152:TuYk3H5koUXfTqkkYLO/W2buywzMbOX+T7z5Kt9xh35FPvhk:TPfTqi90bi9xvFP
MD5 SHA1 SHA512 SSDEEP

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 f380dcc1500fa4406dbd2357f43c72adfe15dcad4970a3cb14b2c2cff218f495
MD5 c5049400adf85984b7cc84eda0dc8002
SHA1 c7e0a230108fe3b86f49056f0d682b66895f9902
SHA512 0ca8f2d2fac4d222c8bf38642598326b4515f16e8353235a20e07f08915ee7b9e9e98b4289155a52dfb83a07ddc97136b784ad4cca8c123746901dc31dcc5c4a
SSDEEP 12288:RsixPwEsHuXzTCAV2vFd4hU5dRpxLkefh35F28hJhxPad620Kr4QSx8:RZFwVuDTCAV2v93jxLlh35FPvhkdLrb
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 87d97785db94a76cb6aeed009100806224eeda0f0ff9147509eaff86f3f7252a
MD5 bba5886d6cffb9c2d26dfe66639bba59
SHA1 467abff6f786bc66b87773b4c866e9c97f542b53
SHA512 574028815fd1b7ff2302cb8e19ab86100487d33957a0e3ce3fae2465784c75d430e161a7b5bfd4624525ff4c92eeaa6404fafee99cf357c0884109a715076390
SSDEEP 24576:l+gkEHfh4CosCAV2v93jxLlh35FPvhkdLrb:MgkE/SJt9xh35FPvhk
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 fa59f70032b831afb5c4529a6cae151e3b6bdb4f13a3e481ec01edee3f6983fe
MD5 1b1e699b386b73f1a27907892256a274
SHA1 26f86bd519ca495206eb7007baf9764ea67eedf6
SHA512 38bea00c0c752d9580488d8d3323087b330416ee6ab2c41749537a2b6f20a29ed934123380a869291642a5f8e687ffc46c8f9bd5e3b2dd98d7bf11c7833e3a99
SSDEEP 24576:hBpDRmi78gkPXlyo0GxjrzCAV2v93jxLlh35FPvhkdLrb:zNRmi78gkPX4o0Gxjqt9xh35FPvhk
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 7ca25f5a14ad6437da9e1efe5709e92fe6dceeb4c7faaff11305a282f36a445f
MD5 1367842d0f7a9c293dfa3a2d71cb7f0f
SHA1 15670c68929e45fc6adecf271f420ee745307ce7
SHA512 350a6447ef5e777a97cdda52ba4cebd2c279c00ba6c4b69ab01f32f182fd402f5d826142e62dddd1d285ff3f3e2062ae39b1992c5d3a8418cddea51b7ba5bb45
SSDEEP 24576:ZLOS2oyPIXVsCAV2v93jxLlh35FPvhkdLrb:j/yyt9xh35FPvhk
MD5 SHA1 SHA512 SSDEEP

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 9b426f7dd27f90e265c9207fa21aaac57dd1750e07abbab67b4ddcc9d4b9cc3f
MD5 1932a7e29640ac5be43266dd6c152a01
SHA1 453a431d96440f9acf2d0c88e54d62a14a710d38
SHA512 f7ed82fbefda98471ad5539b2cff6778d708798d6b6aee6ec9540f5e570efe012f82a6d2cd3c88debbcc6bd63f5ef75cde3d0da2d092821543dd1f36726bcb39
SSDEEP 12288:FteCAV2vFd4hU5dRpxLkefh35F28hJhxPad620Kr4QSx8:FteCAV2v93jxLlh35FPvhkdLrb
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 46b60c9f35823c790373ea3ea1dab6efbf0f288cd118f4f2ceb62dad74ee98b7
MD5 c70fd76421bd0eef08a5ef0a3e20f540
SHA1 8c422afe99759f9809016a82ef473e59c57de0dc
SHA512 0070f03306ee51de274e1ef69408c07ebd3921ac0f06da38a93904d5b145cf304def9302efa379f0709f66269211b4b6686945aea922c212e4c3f2306406b9ac
SSDEEP 12288:yeBNUbTVO86UVCAV2vFd4hU5dRpxLkefh35F28hJhxPad620Kr4QSx8:yJIUVCAV2v93jxLlh35FPvhkdLrb
MD5 SHA1 SHA512 SSDEEP

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 405d791cf57b34ceb31b5e606a3a22fddff251eab4c7c3571d2ab3fd80193a8a
MD5 6f2b67d58b551a14975b72e8dd69f622
SHA1 fb92f7e83fb7a07323d58ae6557ca186d1c01ebb
SHA512 8adb2239d7f2175cc3edb517719fc85f4bdc9fef8d656cfa96834a5f00f404f8de456f815cc987efd15a9c464633a1e13cbbd9b6892766fe7d86d40c4cbfaafa
SSDEEP 49152:RQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THp:RQvGAdlCEL8c/yRNw5C59xvFP
MD5 SHA1 SHA512 SSDEEP

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 86a4300733afb01c2eb2696bb5ba075b6e361e8232d27d025e4fe3f81b6fc6ff
MD5 c4f4cb8bbc3074b497923a5f349d7bce
SHA1 bc48e34874a3cb0feadc7d636d78d3a3ac90996f
SHA512 30bb5ebc7797ac7025d5c5a3b7ca94543d460d780450c9895e01efd69189332b0aed86cd641777172263c83a3e337718d886cad4685dda631941a258eebf55d6
SSDEEP 12288:hAwSfxL/2Dc3SDLLmt0LDQewsAjrCAV2vFd4hU5dRpxLkefh35F28hJhxPad620U:C7ewsAjrCAV2v93jxLlh35FPvhkdLrb
MD5 SHA1 SHA512 SSDEEP

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 37b5469a181a2ccf58e65858f630c2e9583665008f4e2a88fcc4f91c03b840b0
MD5 42cf90976c91ee7632c2e260e1a0821d
SHA1 8b6cc190292af22a39ea79955419627bd780ea10
SHA512 a382103cf47d4f560ecd6f89f9e2ac325a67850e862882b7eaf0f630a3ac39287f62896c66dcb04d9370f41d7963a0deb1dffda49b8c2ffcdd4739401bc5172c
SSDEEP 196608:GUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHg/:GUEtQevvqc2W1cpV2EI32s
MD5 SHA1 SHA512 SSDEEP

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 3021a270cd226041f65f41457cd034b20b41afa470b7caf6067588f1b0c61127
MD5 a5d81eab91112af299fd7c2386336886
SHA1 3bb491c2be45e7bf0a0c5bc5663a69a822337456
SHA512 e508fc30fef1d589baacee10033c277b57998856c8c4db6fc222f53ff3c730c8fac940dcf8288444329dee565b73ed4ebc92668f743c9a03998beb13a7f02ddc
SSDEEP 49152:pCbRquA/m2yL5zifFiV+XenmE3/zmt9xh35FPvhk:moqHVjnmt9xvFP
MD5 SHA1 SHA512 SSDEEP

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 3539121b4447284190be9d4dbc550f6ad684e8a60b440fb8534f422f5e057c2b
MD5 90fee24d618ed118375218e40423f38e
SHA1 b8b191a42b1605563985fafa375ee041b40388b0
SHA512 19cea420728c7ccaecbc0b14fbbe6090136d08f53644512ba8571c71aa06600dbbbef010825a6455a3f0fb98a068d8b1045043037c6ad002137078ccc35f1f34
SSDEEP 24576:LAhGLJIFoiwtA5l7S538CAV2v93jxLlh35FPvhkdLrb:LAMyFoiq53t9xh35FPvhk
MD5 SHA1 SHA512 SSDEEP

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 d67105a429c8dfaa64553510f40b88a9e4d325dce757dbf2100c1df56f155d36
MD5 4980cb0bce74e54d0de8565ec6019abe
SHA1 a982013d24d8027fbd28a5e911912c31fcb4df7e
SHA512 ab2b4d38e51571c79658da702d4b9ca8c3bdb44aa09ffd60bad309bde38d944887f64d9e44d4f4d2d9a04eb016f083c1891e1a121095c82e91e713b78235b207
SSDEEP 12288:Pmw5HEjsChNzBFgl0WDm+CACAV2vFd4hU5dRpxLkefh35F28hJhxPad620Kr4QSO:uwuSOW3CAV2v93jxLlh35FPvhkdLrb
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 392f4483ef81da2d24698f5fb54c823068720459a67c0171bb242d004aac4a35
MD5 fbdab279bc7f62d808c4a72a9ae74213
SHA1 ade7af04779858c4ea47b470942f0f181fa89d1d
SHA512 6cccabb53fa31974829f126c6bee43366e25bd32ec7fc1cf82a202fbaf32c901ff01df60fe117948bb096964b7aba72140395821476c55cf8daa4d81b9c21326
SSDEEP 12288:TjZ1IybCAV2vFd4hU5dRpxLkefh35F28hJhxPad620Kr4QSx8:vZuyCAV2v93jxLlh35FPvhkdLrb
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrmstp.exe
Size 4.6MB
SHA256 421be9f49b25b06906fa074d4653bd928b2fb3305077dd724c1328c70aadb880
MD5 7706894f950d596f8bf5f5c13df4e835
SHA1 d6081740a0c6debfbd47a09dd60aff5e19e8aa2f
SHA512 538e1f379a26b9e4d7a08c220838e08099f9078c0da9a623dc02d953eb5623479fab340cf4bceec724891aa0c4790ced9e78025abe1a02d4cf721f23481d2406
SSDEEP 49152:AyEKQ5E3ieGR0PEtBFUow1b89eX61o+2xmepn/TRijbqYW3qkCbDypSfe6qwiXEF:Sq9ceqC+2xl/SSay59xvFP
MD5 SHA1 SHA512 SSDEEP

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe
Size 4.6MB
SHA256 abad52fdb4a523a3278e58ce6e615fc81e725f28bf3d7842f4965fc92f596dd8
MD5 9ae484df5cddc7d3059e640ce3132853
SHA1 3a30d2b3719cb5893f27076b9c7b3193107e5b72
SHA512 99296853ec857fcb8ff954199a38a0bde086c8325cbe6617cb53199bd22b0efdb740f41b2f3c8b69d38714c0556ce19b840d694df965429b851b1127875926ec
SSDEEP 49152:ayEKQ5E3ieGR0PEtBFUow1b89eX61o+2xmepn/TRijbqYW3qkCbDypSfe6qwiXEF:0q9ceqC+2xl/SSay59xvFP
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\123.0.6312.123\chrome_pwa_launcher.exe
Size 1.9MB
SHA256 0f4068e8c6dce2fff304753ba111ba1452118135768047cce0262f34e64b65ea
MD5 fdab08f1a45b61f716134635fc9285c2
SHA1 4d5a3813d4332e03486cecacd38db5a77df47a9d
SHA512 4ef76977aa084ca7d0a4ae0cf84e0c54f7b1d15f6c668511b551d66393253df8f2bc6abf41620ae865cf18233d437cc1dde1f4ccc6bab4ee1c289e4a72b8a7cb
SSDEEP 24576:3VN8FYh+50m/YOn/xvNScCAV2v93jxLlh35FPvhkdLrb:3VOyh+50zyxmt9xh35FPvhk
MD5 SHA1 SHA512 SSDEEP

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
Size 2.1MB
SHA256 38a601414224a5d8f8610f4d70e6649b9f6a2ea7c303f1e80b1a41b30e70b35e
MD5 765f766cb13ac87922b30c681a6a1010
SHA1 da01c79fe81562adaa63962c981e6ee0c0504b2a
SHA512 a161615e8556d4ec34c2d30601168f9bf53e5f62bb6170ba716ce2f87aa05e78ecc5a801852fee6be3d299510039e3ad5c3ba0ad97dd071df6cdd317ab30755b
SSDEEP 49152:z59PYHvI7wi/lIKuLFrFXlMWGxbgEt9xh35FPvhk:zGglIKgM/9xvFP
MD5 SHA1 SHA512 SSDEEP

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\123.0.6312.123\notification_helper.exe
Size 1.8MB
SHA256 74a2d318ef522eb0d9bd2b6c514fcbaa5ccc55b0ee890b3c58c093dbfedf187a
MD5 cedb080a27cf39c495c922c599b83f4f
SHA1 40d1238814ebd8839c54826694b5f82c29ec6022
SHA512 0825daebbbd441e3bec964f685e703f03c26caa3ef9f6fe1d0cf4d2155d35c7e061685de6d18490f735239bc750af1bdba12632342fef437a7e54e431170ffef
SSDEEP 24576:Bb6+S3zFphRwMVcLDnyhECINqzWipIxhiCAV2v93jxLlh35FPvhkdLrb:BbrUzFjGMVaDy9INqZut9xh35FPvhk
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 1.6MB
SHA256 7b9ddd305827231add154fc4b6f25bc02d6c776b9cfa218151376fc198b7086d
MD5 5ce5e572c8f0754a9a5cfaa531e077ad
SHA1 b27866291413b5cb7969657185e6ffd520363e95
SHA512 2ba813f8c2cf43f46ba0c7aeb52e9033770b581cce338903e9e220b2779b15a7bc74d80d14ab61b897d24027490fb1fabbac36c6e5ad2483a36a0a349042f443
SSDEEP 24576:m436epN7wzPROWFW9sQ0MtJXCAV2v93jxLlh35FPvhkdLrb:m4qiwzPASW9mMtAt9xh35FPvhk
MD5 SHA1 SHA512 SSDEEP

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 ecaf89d148c7f57d1b32679665e98c49514634f7834f840d963acbf0c4c1e2f7
MD5 32a9140c6437600e12d174d8c03535e4
SHA1 1bb827e9bacc162515ce01d2172b33735368a195
SHA512 69f7d1cf7e32d8cb7595c914575bf5cee039605b49a8c10ca85c9117ee0962825b21e8517cd27e7de38e0e9c04293e67746ecc4060d1e169ce9c69fa582f489a
SSDEEP 12288:9GCAV2vFd4hU5dRpxLkefh35F28hJhxPad620Kr4QSx8:9GCAV2v93jxLlh35FPvhkdLrb
MD5 SHA1 SHA512 SSDEEP

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 fb0ce2f1ea40c209ce7b1598761e28edc7433c55c67709988903e867d73f4855
MD5 2bc1f1f28807b76c8ff2ca764f4513a9
SHA1 d4fe9ab8c210936ca43cf19314eee8c0dcb80561
SHA512 6927847944521b5e7707d35e58ce5cd724d0ab257686c540c30c4e2b8a20d7a80e2ce8ccf5c3515e19cf0e1893363a609552428aeb40ae11874b7477d61adf7c
SSDEEP 12288:8vCAV2vFd4hU5dRpxLkefh35F28hJhxPad620Kr4QSx8:8vCAV2v93jxLlh35FPvhkdLrb
MD5 SHA1 SHA512 SSDEEP

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 0268931547c82b82c15f1fc4dabf436512c85fbc4205dc29b6b5068e668b1745
MD5 d9f4ac131673abbc0ebc62833e4fc08c
SHA1 72b3da21673d312c8c3a0e79f8c32c062da515cf
SHA512 3638e622f3e93f4c316ff4882d5b93dbb913e93fcf68ccd173824bd0adf670e4d8cf4d77c67efbf4a6cb27ba5c25bba3c8e2d1535ffcfbae46988c4773e2f06b
SSDEEP 12288:v9CAV2vFd4hU5dRpxLkefh35F28hJhxPad620Kr4QSx8:v9CAV2v93jxLlh35FPvhkdLrb
MD5 SHA1 SHA512 SSDEEP

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 4c5040df308c93687f163f69779fda5da3babe8f41b00ed016ac7ffff6dc5018
MD5 356ef9fb4df728e263f0ef1eac1fa63e
SHA1 3af5ff08a248d9ace54a4b7ca1367fc3e36f4881
SHA512 905adace9020876d9b6b14c04eea4756a9212e12d398dfe603e027f0d6828b28cd6137439f00418d5e252ae6b6790b3d1af03ac93f8a079c3ff7cf6d61c938a5
SSDEEP 12288:wVcCAV2vFd4hU5dRpxLkefh35F28hJhxPad620Kr4QSx8:VCAV2v93jxLlh35FPvhkdLrb
MD5 SHA1 SHA512 SSDEEP

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 331c4f83f3f3c1c57a4470403cca4a854082c265da7a4b7987c36c624bb0531b
MD5 abdfa4b592384111f4df905878188a2d
SHA1 22ca95f82deb45f05baf7251abf69ac1c4f3a969
SHA512 76a7e501d62f856fff232a916142f23b8e722262f57ae6e87b7daa64806eaf3dbd17df6e97dade0ff7d416ebb075843cf3cc9ae8ac2acb11ab64f3713cb5adf1
SSDEEP 12288:mUCAV2vFd4hU5dRpxLkefh35F28hJhxPad620Kr4QSx8:mUCAV2v93jxLlh35FPvhkdLrb
MD5 SHA1 SHA512 SSDEEP

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 e279520175ea55735230c3a336a0f2a6f050b8e1ad0b778ab734bde05a6c7290
MD5 9ed26f2decbdf1d43df761a314a26b8c
SHA1 1ba6ab4f16c0bb5b750b4686de2d7d61d8a64da8
SHA512 a02b56186aee46b25a46566f057e0e9fd915f8e018f2466d74d29993668dd0d98eae2616f3933094f84caddcac2a1d1c4ac9b9a00df51933f4eaaee7c45be86a
SSDEEP 12288:czCAV2vFd4hU5dRpxLkefh35F28hJhxPad620Kr4QSx8:czCAV2v93jxLlh35FPvhkdLrb
MD5 SHA1 SHA512 SSDEEP

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 c9299463de8badccd4e969faa5b9ab56a00758c94ef33933136cc203549bb707
MD5 4d383e37c7d0f9767671a1357b3fe7e5
SHA1 df53075bb71692f654922be65ef48948cd16c391
SHA512 926eb373f64ac2a960ab8dfbd46506cd1ca2afc2a3073ff123f3c778912edf1a0da4dafc23ed039712857abf0f591670fda445bd501ac1f73b29763d54149b33
SSDEEP 12288:4HCAV2vFd4hU5dRpxLkefh35F28hJhxPad620Kr4QSx8:4HCAV2v93jxLlh35FPvhkdLrb
MD5 SHA1 SHA512 SSDEEP

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 62f01c3cc23b269526ac4c0ed3326523531168171e81638ec1cb60cd21bdcc04
MD5 1158db741c49915e741e31f812bc635a
SHA1 69611b5315cf1effd548a481a38e6bd96cf11cec
SHA512 5b97be131f59cf7ef19523f5e5a78aa0b440694d3c93d1f20b4c0fb12f2e685d20fc49a7dfa9fa69f8edec61f645c8c7a5335b78fdfb7d56fb16feebfa61d2d7
SSDEEP 24576:uZMEzFVSOPCAV2v93jxLlh35FPvhkdLrb:uZMEzfut9xh35FPvhk
MD5 SHA1 SHA512 SSDEEP

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 b7d97032cfb25160b98581cecd85d9607310f6395a029fe16f14bb1d2fe922c5
MD5 f50135f9ce56e0e873d83aa736ae7d54
SHA1 90118cd0c7404c8ed65b692a024a8ba62c3654de
SHA512 7bda864b24ab15d467b5ad1adf8af58150ad053a8ebde8a5df04f503f2086d8ef5754a0ae9ae8d38a3c239261250dbfe5bcac626632f30a359b3d2a8db655d30
SSDEEP 12288:ziCAV2vFd4hU5dRpxLkefh35F28hJhxPad620Kr4QSx8:ziCAV2v93jxLlh35FPvhkdLrb
MD5 SHA1 SHA512 SSDEEP

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 c5f066a55f83dec718b46220117769f4dd2a4b57b4481cec8a082e40ac26969a
MD5 8ded6a05f724106049f0df665c42aa28
SHA1 552ec0db063f62d17a113a4f96bd64ab71f27a45
SHA512 445d91abcb66f967b6cdcedbfbde5da592f29ea5edca719d77313f10622aae5a821f2a4f49bca6b357d84b18a107887f0b2d6319932429a83cbbeda7ded6708e
SSDEEP 12288:pOCAV2vFd4hU5dRpxLkefh35F28hJhxPad620Kr4QSx8:pOCAV2v93jxLlh35FPvhkdLrb
MD5 SHA1 SHA512 SSDEEP

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 c3b770b2ff6e5941f716380a409adf17e884db724bd97b1716f32382fb601ee3
MD5 31869c487edf675f651b04aaaed9f211
SHA1 b55e2bde5935981e5a24e6f71f200c9b7ed3afcb
SHA512 4d35f630e22eeef029d0e841d1ba873511683bcfd61a6e25816fb62f14d27734588d1a077698d7fa1725c20354d514a71f7a46df816770fafb2f533d1ce3a1dc
SSDEEP 12288:8yPz5L8bCAV2vFd4hU5dRpxLkefh35F28hJhxPad620Kr4QSx8:lzybCAV2v93jxLlh35FPvhkdLrb
MD5 SHA1 SHA512 SSDEEP

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 3a4dd0ca2a60d577a8d06cda98707d10a264962f548c7506182039b4698dd7db
MD5 96a45a12d94a6f08b0c0ddcc7f5d0615
SHA1 9b3d8935ecff9fb301b3cda255afc7aae2ac8e5c
SHA512 c7410c6406ac3b627cdb03dfb2b009ba127bbcea5c7e779f238d4e8a46001a8f96e01e8d499721afcca8db61043b6780046d6801952a82dcba6d7ed98e426033
SSDEEP 12288:EiCAV2vFd4hU5dRpxLkefh35F28hJhxPad620Kr4QSx8:EiCAV2v93jxLlh35FPvhkdLrb
MD5 SHA1 SHA512 SSDEEP

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 598e7c02c6b895038cb2f0006abacc56eac132972ec0443ed1cf00f0c48114f8
MD5 14bb3ffa117e06bb8d44c90643c623d5
SHA1 56d50a4cb95f286b930149bff82493151b30421d
SHA512 9eee7662928260c09d2fe2bd95b9f820e8434b64f68bf13447cedcfcdc9a7b2f183b9a38d2f470618d6cfe0cd7807d70feafa3e2458f059aa221100eee37c43d
SSDEEP 12288:JiCAV2vFd4hU5dRpxLkefh35F28hJhxPad620Kr4QSx8:JiCAV2v93jxLlh35FPvhkdLrb
MD5 SHA1 SHA512 SSDEEP

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 8ce233b27a2a0eea80b31a6f393efa9c6a441b10630e7d58adb6456e39263de9
MD5 aedfb10c30e60810bc0de524e50b3229
SHA1 7343b77824c21cb7231369f2f2e4462cec6fea25
SHA512 8d36efb1ef5e5871bdbc1ea8e73219b3fe7a4e43d13352afb37c31df7ca11328b9a36e6f84ef87b9cb813ce05cf2035b589d01a25f2d15bfae9385c02feef0bc
SSDEEP 12288:LyPz5L8bCAV2vFd4hU5dRpxLkefh35F28hJhxPad620Kr4QSx8:mzybCAV2v93jxLlh35FPvhkdLrb
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.7MB
SHA256 06484354f1cb6336340c0cefd2cbb4a23c30ef52beb73436a014e1ee47d8f36b
MD5 789f5d097b648cd26fc854673e763db8
SHA1 b600eecfd3233f1a9637f1a8d8e3f9be47b5aa35
SHA512 06ba00a694c9c1bb20514617183d058f16c892e49bf79fdbdd6754bfb33894bcebe0c0a51366a7406114979a5cd10093da6edf1cb2553a9b3f15d7fc5d2d84cd
SSDEEP 24576:YTdaLl3z0zDNCAV2v93jxLlh35FPvhkdLrb:YTwLljLt9xh35FPvhk
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.9MB
SHA256 071273f68b5fc02ee350bdc53dad1afedd2d6516d5803791397956ff3a528127
MD5 00afb24f6bf402800938bf9dc66e527b
SHA1 46a5f272b233c4a84fe1de1c50a7ec7858668f5d
SHA512 0fc48dae0bfbda24f1be4533165a35c25461372b93c0252b7ab75d8e2ec47f76c45510e261793ec6d11dbb7cd35be59bce5b5fc9a8c0fe0d73c330f82044de79
SSDEEP 24576:y35d9CHKy7GZRCAV2v93jxLlh35FPvhkdLrb:U5d9CHKyaut9xh35FPvhk
MD5 SHA1 SHA512 SSDEEP

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 46c831b16cda9f6b15bd2bc72142b2bacf99d6feb19fd6388022ea03257fca95
MD5 03bbe6542c5251666f656ddfcae4585c
SHA1 bb79747909dba28bcc268e6a686e6abac8b034ca
SHA512 9618ba3f220fd29fa99457bf48aaa6b525da9a8e892b11042b01a90f63ef9d45841ea2ea303517a615fe5a216ddf183886d836fb9cb3f88ebcbb70d1194e8258
SSDEEP 12288:8dCAV2vFd4hU5dRpxLkefh35F28hJhxPad620Kr4QSx8:8dCAV2v93jxLlh35FPvhkdLrb
MD5 SHA1 SHA512 SSDEEP

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 85102d46b973bd541c99d18b5918079c93319b74e2e145676ee59c3106410339
MD5 bcd3386778a65a8bd8af1459e0913292
SHA1 906d3b740bbf6ffe55d10d58ba8e975f69ff3692
SHA512 a0ebfeb1d5f895eebbfee0e5b5bb43edc4ae673c0616433b2dca1684a07d4a8e5cb0706122b8a711d04895f831ee6f137e207d2cd0b58e0a22bbe8222c6858dc
SSDEEP 24576:HcP4mcvIjkGOxhKP2l71SNKbrh/8KBaCAV2v93jxLlh35FPvhkdLrb:8P4m4IpOO67N8Kbt9xh35FPvhk
MD5 SHA1 SHA512 SSDEEP

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 319487190df334754bb2c2aa4014828c1df462fe981c74e168dc16e317b8e47f
MD5 430512b3a1cb0e5959ec36ebbd51820c
SHA1 e7a8861b5a35f2ec5f5be3f20468af1a5e12d9a9
SHA512 dba9651ed866c4fae8c9f977885e57bae9cf4ff7b90f0fbbacbacd1bc6c195e677669ebe54c11b9b5d32561f7cf21279c892c44d65cc430258a1bfdba239efe0
SSDEEP 12288:MUFmDDLhCAV2vFd4hU5dRpxLkefh35F28hJhxPad620Kr4QSx8:OhCAV2v93jxLlh35FPvhkdLrb
MD5 SHA1 SHA512 SSDEEP

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 8bb1e1d675d7be384dfdcbe407929384f809c3b96e8daa615e8c0dfa4030fd79
MD5 90f3a9ca6e12117bb852a7a935db633f
SHA1 343af99838f2a67db4006fe0ad4f3b4445e2ec87
SHA512 e4076b7558bbc71ba3a86268e5de0c2d3c1f3d66c61900eb05fa85c13c32b4d13553ad29ba70c13c5ce10f983ca6c84e5b7bd1f1c374a9043384c2f14840f3d7
SSDEEP 12288:zSCAV2vFd4hU5dRpxLkefh35F28hJhxPad620Kr4QSx8:zSCAV2v93jxLlh35FPvhkdLrb
MD5 SHA1 SHA512 SSDEEP

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 15cabcdaa9b6dee3ad8b3eb09d524f7bead4392cb066c56747a788f323525917
MD5 c9762413dce49e8d3cecfdae677c288b
SHA1 82cbf0b2dec050d971a63c5f35493a32fe13884d
SHA512 8bef3a0e9da0b3079f376fef0d47a8d0135f3f9ceb686ac01b61ce9ad66b240e15b62d9b8712833f69d8cbdedfa254bacd7972d662bf1bbfb108f8dae087e4fb
SSDEEP 49152:pa0h2GEkuAe73q3pp46zwwQvt9xh35FPvhk:pa0hNYG4JwK9xvFP
MD5 SHA1 SHA512 SSDEEP

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.5MB
SHA256 099ae914859e07f6b09b6fafd7fd224abc5656f4f2be516891f7c8302523944d
MD5 5245044c7981ce76fdba3b287b00fc38
SHA1 815921240e4a90c54988b54c556512649976902b
SHA512 4653cd70f22654c227dac4e0c539555b869906d9dc8da59a06ca44730fbfd54540f87ff0d7eace83a862a9ab9be945c868b4524778357c15ee55c7da4f76b2e4
SSDEEP 12288:xhbHjfX/CAV2vFd4hU5dRpxLkefh35F28hJhxPad620Kr4QSx8:xhbHjP/CAV2v93jxLlh35FPvhkdLrb
MD5 SHA1 SHA512 SSDEEP

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 3ae0752e562b3c21b895b425ad74f2bc4cd2c9f3907149b9ff839c9adaf5db8a
MD5 25acb4b6299cb85efa2a3fe61107e12c
SHA1 b1d45fc013723228f10fe2dde607e85f17ac2686
SHA512 4c8b7bc69f7af6f4de28a9009565531fc2e6c3a6db13ffa181e8f0db1bd77987dab93a9a167b0a2a53f4045eab2ac26f063595fa34f0176e58921d025e022ca7
SSDEEP 24576:C3YgnJcRTk4yti+R5dpR/3CAV2v93jxLlh35FPvhkdLrb:CIgnaTk46ppR/yt9xh35FPvhk
MD5 SHA1 SHA512 SSDEEP

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.4MB
SHA256 a36af0200559e491adb556526eb921f6fd27c9d726effd012788c3c40ce824a3
MD5 87cfc1673283f1639e8af06605bf368c
SHA1 f147e871856dd571d22cd9f0e061eb5423c60ce6
SHA512 e87a36b2abc0e40c51b33de8ff65231fdc7e41b7a08498df938fd040c2fd5725ce234b83e8d868f4bdba258e1395dc61e25b49873961eb3af44d90e142e1e5f9
SSDEEP 12288:h+CAV2vFd4hU5dRpxLkefh35F28hJhxPad620Kr4QSx8:h+CAV2v93jxLlh35FPvhkdLrb
MD5 SHA1 SHA512 SSDEEP

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 7ac4c5a9b2476f6c1d9be7a0d24afba426de1cf4d99575f0ee968b587a4bdc3b
MD5 b1d3c74c2b3c583689cb6f0beb908271
SHA1 32decda476296da9a04d56c286078b097f742e64
SHA512 aff8234866f328971735f89f046e33b8e916869c0c95f06a96c909dae8bfa3b05ea3adbbb10bfd91a82ad802a653bde141a8358c25ca566f850afe933b6b9b6f
SSDEEP 12288:4ObrA4LWOsvAYFTpCAV2vFd4hU5dRpxLkefh35F28hJhxPad620Kr4QSx8:VfL3UTpCAV2v93jxLlh35FPvhkdLrb
MD5 SHA1 SHA512 SSDEEP

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 327f758d3fccc88d2a66ed068284f621595cc7b62a418562ffe3aff3eac4d7b5
MD5 2f0f74cb5499008d56745453c01f6681
SHA1 c8762378a98e18424189eab30078523ebe927fb8
SHA512 9b5eb7acdbd09aea2e5f8f49686d1e3713bfa88b0de4dfbe9963ff0edd360ca161f8d93d1107bf1a496893ea7b2cd3968532ea2bafe10c928bbe32c8dec1cc75
SSDEEP 12288:FpFtfO1CAV2vFd4hU5dRpxLkefh35F28hJhxPad620Kr4QSx8:LO1CAV2v93jxLlh35FPvhkdLrb
MD5 SHA1 SHA512 SSDEEP

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 a378894ef907d6b80034863b3f2e857378bc3ad5796fec41af30f2051ea13033
MD5 91113eaa59b5f3d8be12afb223630743
SHA1 b2547a3d1f6b46cbc4f00151159c017139b91c12
SHA512 62cb4721f462b55619e9218d71d24e758aaee8c98bf359d6c8e18e7b258cf66c75db315873105011faf8e2466aaadd98a77baffe2bf7d0e7a54eecdce373c6f0
SSDEEP 24576:i7NM9YmZqmWMUkPjZM48Mv6bEhsiCAV2v93jxLlh35FPvhkdLrb:i7cBWMpPjN8DbEhqt9xh35FPvhk
MD5 SHA1 SHA512 SSDEEP

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 06feb255eed5c78dfbae3f09d1d77c20812e74a214a3e6ab56f5a7ae240599e9
MD5 bb5a82ffbf3b96167e6bd79e76628a57
SHA1 dac14d0a9cb2644b16f954fc1f85440c2cb098c2
SHA512 2e4a5bbf17c0673f62f3e234891aab5bb81495d775245b9989fb38a1927ec5d38995f132659c5d436d92bbb9b0b465ec160f52f7e3ec28b56fa3688492d435a6
SSDEEP 24576:4W6BApg2YuyuNDYTabvcRvNYf8km1YCAV2v93jxLlh35FPvhkdLrb:4F2YuHNETovcvNYf8kmNt9xh35FPvhk
MD5 SHA1 SHA512 SSDEEP

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 8e58e6da7554db849c8857807279825f197cf665006bdb20a81311a5da7a9e73
MD5 925de14411cd983688146a7aa229c9c6
SHA1 94b44e12a0797d8726f072345d76fa7bd7b1e8e2
SHA512 eba8721ab63b7b1e6217656da9e58f9a9fbf287a3d998acd172f5d382e2c0fd26c7fe5d486738cfc4d21363a263fa239472906aff7efd050f0ec0eaf6b222454
SSDEEP 24576:/AFs06+Omlf3NXEbToRCAV2v93jxLlh35FPvhkdLrb:IFs060lVXuPt9xh35FPvhk
MD5 SHA1 SHA512 SSDEEP

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.7MB
SHA256 88627721cc31147cf2cc8a7bad14fb528c83694e749a99114ff165730820f3a8
MD5 8783eecc26a6de5edbadbfef8a9d0e38
SHA1 d9956adcfc60b647089c3519b188014217fea0ef
SHA512 9211e7f49a4c5c821687cd906a79f25a73c1eae2b08e0a053546b08191fb5f251313efc2f3985c39ec924b7ecf58e263742be74bc6a174884cdec682e3c54ca1
SSDEEP 24576:0JnJ5D3WL0CAV2v93jxLlh35FPvhkdLrb:0JnJ5DGLPt9xh35FPvhk
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 901607fa2643a9ab54d21a965ca17dc46a291abc3a4f179d762e4099894860a3
MD5 c047ad935aab5df5d01d1ca5fb7b4f0c
SHA1 62be8599005bc2ff75e0187a0e745bbee78886be
SHA512 b6dec2517ff0bdb265add6d292cbeec89c269d7f1a24b2e44790395e6060e21ca230864ef2fd0070e078890a636fa66b55fe637354e3b8a22815dff5c93c7211
SSDEEP 49152:eo06DIKdwc+eQnSt65aVBt9xh35FPvhk:XR9xvFP
MD5 SHA1 SHA512 SSDEEP

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.5MB
SHA256 1354b24c8ad8637fd41e8f023eb42abc776c43f0414a35a8bab5c0e80654e022
MD5 2beb6e450559d9010937c79c9ad38201
SHA1 1e44c690aef33e4b3e3612877bac208a29d9f52d
SHA512 8ed2bd38f13266e8abc823ada1e32b5bbbc04c46288a93296fddbf2a6452322fc33d2d7cff455ba9c32e0e92193ca1416757b106081dbeae818fb1575bf3d749
SSDEEP 12288:cEP3RBACAV2vFd4hU5dRpxLkefh35F28hJhxPad620Kr4QSx8:XBACAV2v93jxLlh35FPvhkdLrb
MD5 SHA1 SHA512 SSDEEP

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.6MB
SHA256 0a0a40417e98faaa4f4ac2349212ca73e3bc4f0d769cbd2f4969c9930eb4336d
MD5 cc8f90e1e7d9c07a2cf85aee29bd9237
SHA1 9e75d15a9de8b9de617ec82ca940e8f790a58086
SHA512 3d495caf49e0f760d162d35fb32e93549e32c1bb8ef9734f01120817ed0c8603a0c9119a0192ce2a7480b3a189d7a818c21502e1a949e54bbc273977ee5a1ad8
SSDEEP 12288:qjkyvCAV2vFd4hU5dRpxLkefh35F28hJhxPad620Kr4QSx8:qIyvCAV2v93jxLlh35FPvhkdLrb
MD5 SHA1 SHA512 SSDEEP

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.4MB
SHA256 31202c6f6fab8d18a4fc09ea411a85b2c8148b39256ad3356b0821bb7e25fba8
MD5 38ab69dbc058119d892827b74b9fcca9
SHA1 1020990ae29f0e6419603b4d7be4b8b84b4b8620
SHA512 1720428b272a00b475b9d3dd5cfd886b262a929528fc78edbcf86685bb116420878394d1ba30b58dafb758732370dc5d562a8b19dfa09bec51ade3ca99acd0ff
SSDEEP 12288:trlCAV2vFd4hU5dRpxLkefh35F28hJhxPad620Kr4QSx8:dlCAV2v93jxLlh35FPvhkdLrb
MD5 SHA1 SHA512 SSDEEP

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 5862700ff81fc54a60f569124e3ff9a3459222e0748b14f4f52cf06284127c0e
MD5 1c1ef21a10add70735cf5127b93e4d64
SHA1 324e25ea9dacde9b0895a435d26a26a8ec879351
SHA512 7ea86a7be3a3e91a14bc34a9ad61a45f06b2a5e8cd390ebb15ae39afdb4870fbdb77dec90989dccb53868755f536fd8a84535e80f0cfa1227e1f958d51f96593
SSDEEP 24576:rQ9MxZKdcz97w3qCAV2v93jxLlh35FPvhkdLrb:rVKXFt9xh35FPvhk
MD5 SHA1 SHA512 SSDEEP

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.6MB
SHA256 b1303e228818ec9e9769caa5fa17db09e5d9eb5307508b256e1f26876ef4be2c
MD5 ab85a0776e92d6271b593c913b0a5393
SHA1 2d7675a64115699c17850f74bd119e78f8e75edb
SHA512 455194543692f1bca1ef16b95df06f8240a3c18a2c0ebd541e261fd6b73c5f6825c91a9afaad51ece08dd44b39605086fd40fbffc08024302add0dfd3ddc1253
SSDEEP 12288:xyoKo2hRple9prCAV2vFd4hU5dRpxLkefh35F28hJhxPad620Kr4QSx8:xyocbAprCAV2v93jxLlh35FPvhkdLrb
MD5 SHA1 SHA512 SSDEEP

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 cb549e96f77db2d9edeed5fc79dfd179dfc991b5aa4a13018991170c82f5d2e9
MD5 2b9f161ef2b918f86cd75af4a9265d4c
SHA1 efafea498f4c8f4bd0948db505a7c08116cfa49b
SHA512 890fd6d84a808c22496a9930728fd8dfa3a457d2b153e604b2260e56f2d3d66e2bdfb3003c7865a837103c4a448fb627e680e677dfa907fa667f2b6411294ef9
SSDEEP 49152:SWcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIKGt9xh35FPvhk:E0zuNIm9xvFP
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 6cd146104f0f5ee033798997221060a64e2b7fd5631638ebf6fd11e43a5c25d8
MD5 2388d4f191ce71980932b1635aa752e7
SHA1 8a56c1f19d72c8250635ae01b333ffb83e2cde2c
SHA512 efd7ee1e3a10c4b69ad41a89ac9c5cfd3e92730643250ed216282a0a7523d32da6c32344d0ad51fd07758e67d820f7d35d6e84749266564ecc6e27bb4cd66df7
SSDEEP 24576:V1QT7EcpfxR+N5AWAz3ooiYtjMqbACAV2v93jxLlh35FPvhkdLrb:QTDxR+N5YzTfjMYt9xh35FPvhk
MD5 SHA1 SHA512 SSDEEP

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.7MB
SHA256 42e18b411aa5c9418375eae8d09bb9353de2a0c7a80676e20fa4271f800e4f63
MD5 6ccf7952305836227b493655e0c979a8
SHA1 97f59af59324f66535b1e35291a2c0e7fe0fbb9d
SHA512 310d238e07688d5fe87b3099f3b274ec9f1dda379505c16eaa889e42eaf7239164faa00bb061fef1b96031f35d971497930bf575460d549c7255604ca7bf81a1
SSDEEP 24576:FTMdOz0FFS+kmSLcCAV2v93jxLlh35FPvhkdLrb:f0K+kmSLnt9xh35FPvhk
MD5 SHA1 SHA512 SSDEEP

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.5MB
SHA256 bc92b3dc7ad93c57ba01ac124377ea0e9eb8946feae6304d0d4890b370c1c247
MD5 10d876419971111602e38c169115b3f4
SHA1 c613007f7bd01b21c90e2da4427286ce63da87d2
SHA512 20cb84ec205e2834b162630355afb741ef5306cd6d7c8123f579ffce352ac952dc31788956eb39a70d1e667ab863bbf3628474e269eccfe1cd48ca37796dbc6d
SSDEEP 12288:R4ppCAV2vFd4hU5dRpxLkefh35F28hJhxPad620Kr4QSx8:WpCAV2v93jxLlh35FPvhkdLrb
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/468-120-0x0000000140000000-0x000000014018B000-memory.dmp

Download

memory/468-239-0x0000000140000000-0x000000014018B000-memory.dmp

Download

memory/740-260-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/740-579-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/1332-571-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/1332-153-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/1332-276-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/1708-67-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/1708-189-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/1708-74-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/1708-72-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/2088-504-0x0000000140000000-0x00000001401C2000-memory.dmp

Download

memory/2088-201-0x0000000140000000-0x00000001401C2000-memory.dmp

Download

memory/2160-580-0x0000000140000000-0x00000001401A6000-memory.dmp

Download

memory/2160-264-0x0000000140000000-0x00000001401A6000-memory.dmp

Download

memory/2656-228-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/2656-542-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/2688-403-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/2688-165-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/2948-190-0x0000000140000000-0x00000001401E2000-memory.dmp

Download

memory/2948-501-0x0000000140000000-0x00000001401E2000-memory.dmp

Download

memory/3432-115-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/3432-227-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/3928-263-0x0000000140000000-0x0000000140175000-memory.dmp

Download

memory/3928-150-0x0000000140000000-0x0000000140175000-memory.dmp

Download

memory/3976-442-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/3976-177-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4032-94-0x0000000140000000-0x0000000140199000-memory.dmp

Download

memory/4032-212-0x0000000140000000-0x0000000140199000-memory.dmp

Download

memory/4032-95-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/4036-464-0x0000000000980000-0x00000000009E0000-memory.dmp

Download

memory/4036-1-0x0000000000980000-0x00000000009E0000-memory.dmp

Download

memory/4036-77-0x0000000010000000-0x0000000010187000-memory.dmp

Download

memory/4036-463-0x0000000010000000-0x0000000010187000-memory.dmp

Download

memory/4036-0-0x0000000010000000-0x0000000010187000-memory.dmp

Download

memory/4036-9-0x0000000000980000-0x00000000009E0000-memory.dmp

Download

memory/4332-57-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/4332-176-0x0000000140000000-0x0000000140234000-memory.dmp

Download

memory/4332-51-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/4332-59-0x0000000140000000-0x0000000140234000-memory.dmp

Download

memory/4340-132-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/4340-251-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/4484-89-0x0000000001A70000-0x0000000001AD0000-memory.dmp

Download

memory/4484-78-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/4484-79-0x0000000001A70000-0x0000000001AD0000-memory.dmp

Download

memory/4484-85-0x0000000001A70000-0x0000000001AD0000-memory.dmp

Download

memory/4484-91-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/4508-581-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4508-285-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4628-29-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4628-37-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4628-131-0x0000000140000000-0x0000000140189000-memory.dmp

Download

memory/4628-27-0x0000000140000000-0x0000000140189000-memory.dmp

Download

memory/4752-13-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4752-21-0x0000000140000000-0x000000014018A000-memory.dmp

Download

memory/4752-22-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4752-93-0x0000000140000000-0x000000014018A000-memory.dmp

Download

memory/4764-221-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4764-224-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4848-40-0x0000000000E60000-0x0000000000EC0000-memory.dmp

Download

memory/4848-48-0x0000000000E60000-0x0000000000EC0000-memory.dmp

Download

memory/4848-39-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4848-63-0x0000000000E60000-0x0000000000EC0000-memory.dmp

Download

memory/4848-62-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/5012-578-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/5012-240-0x0000000140000000-0x00000001401FC000-memory.dmp

Download