486e9ef2abf7cbeb06c7a2aa9664b8acf139eef4d4e6a9dee596ff98426a60f7

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
08/11/2024, 11:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
486e9ef2abf7cbeb06c7a2aa9664b8acf139eef4d4e6a9dee596ff98426a60f7.exe
Size 2.0MB
Sample241108-n5rdyasarr
SHA256 486e9ef2abf7cbeb06c7a2aa9664b8acf139eef4d4e6a9dee596ff98426a60f7
MD5 44abe4d73380279d87ad9d55f3191130
SHA1 5d09ebc70512eb16d97f52470cc7fe01fc570a51
SHA512 f43b8a7534f73017df2aeb4c7ec844499b5215f14cc60102bd68966ca05b7b12b4798ca761281a98398e0a6bfc31071d04a4211cf93c5bda4aef26f843e98f20
SSDEEP 24576:wBxcqhG/e37rZ83+zdToZJoAOM08/85RkptVIJqoSkQ/7Gb8NLEbeZ:wQi7tbYOMjUfkptVxBkQ/qoLEw
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
2192	alg.exe
684	elevation_service.exe
1980	elevation_service.exe
3420	maintenanceservice.exe
2864	OSE.EXE
3780	DiagnosticsHub.StandardCollector.Service.exe
1904	fxssvc.exe
2392	msdtc.exe
3088	PerceptionSimulationService.exe
748	perfhost.exe
4712	locator.exe
3012	SensorDataService.exe
2236	snmptrap.exe
4312	spectrum.exe
3128	ssh-agent.exe
2460	TieringEngineService.exe
3652	AgentService.exe
808	vds.exe
444	vssvc.exe
4528	wbengine.exe
4888	WmiApSrv.exe
1612	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 26 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	486e9ef2abf7cbeb06c7a2aa9664b8acf139eef4d4e6a9dee596ff98426a60f7.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	486e9ef2abf7cbeb06c7a2aa9664b8acf139eef4d4e6a9dee596ff98426a60f7.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\143089f5c1221773.bin	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdateOnDemand.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\123.0.6312.123\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdateCore.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_73343\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_73343\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleCrashHandler64.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdate.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	alg.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdateComRegisterShell64.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	alg.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d1b769d6d531db01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000062d70bd7d531db01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009e79acd6d531db01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9926 = "M3U file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000065a8bed7d531db01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009152a5d6d531db01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration"	SearchIndexer.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
684	elevation_service.exe
684	elevation_service.exe
684	elevation_service.exe
684	elevation_service.exe
684	elevation_service.exe
684	elevation_service.exe
684	elevation_service.exe

Suspicious use of AdjustPrivilegeToken 42 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4216	486e9ef2abf7cbeb06c7a2aa9664b8acf139eef4d4e6a9dee596ff98426a60f7.exe
Token: SeDebugPrivilege	2192	alg.exe
Token: SeDebugPrivilege	2192	alg.exe
Token: SeDebugPrivilege	2192	alg.exe
Token: SeTakeOwnershipPrivilege	684	elevation_service.exe
Token: SeAuditPrivilege	1904	fxssvc.exe
Token: SeRestorePrivilege	2460	TieringEngineService.exe
Token: SeManageVolumePrivilege	2460	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	3652	AgentService.exe
Token: SeBackupPrivilege	444	vssvc.exe
Token: SeRestorePrivilege	444	vssvc.exe
Token: SeAuditPrivilege	444	vssvc.exe
Token: SeBackupPrivilege	4528	wbengine.exe
Token: SeRestorePrivilege	4528	wbengine.exe
Token: SeSecurityPrivilege	4528	wbengine.exe
Token: 33	1612	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1612	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1612	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1612	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1612	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1612	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1612	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1612	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1612	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1612	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1612	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1612	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1612	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1612	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1612	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1612	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1612	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1612	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1612	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1612	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1612	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1612	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1612	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1612	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1612	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1612	SearchIndexer.exe
Token: SeDebugPrivilege	684	elevation_service.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1612 wrote to memory of 2656	1612	SearchIndexer.exe	141
PID 1612 wrote to memory of 2656	1612	SearchIndexer.exe	141
PID 1612 wrote to memory of 4216	1612	SearchIndexer.exe	142
PID 1612 wrote to memory of 4216	1612	SearchIndexer.exe	142

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\486e9ef2abf7cbeb06c7a2aa9664b8acf139eef4d4e6a9dee596ff98426a60f7.exe
"C:\Users\Admin\AppData\Local\Temp\486e9ef2abf7cbeb06c7a2aa9664b8acf139eef4d4e6a9dee596ff98426a60f7.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:4216

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:2192

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:684

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1980

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3420

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2864

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:3780

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:4400

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1904

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:2392

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3088

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:748

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4712

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3012

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:2236

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4312

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3128

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:4436

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2460

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3652

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:808

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:444

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4528

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:4888

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1612
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2656
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
  2⤵
  - Modifies data under HKEY_USERS
  PID:4216

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
Size 2.1MB
SHA256 b70600e77c64f19253cfd940935d14189051a68a8d9790b65c8d1057f1ca6448
MD5 5581cbcd05be68889e188914386a9563
SHA1 d5e5b279971a5c358398b7bf703173ce190028e4
SHA512 808405fb3d421508bf109e9a4782b62c693e93d0abc4d69457aa36a38688562f3d6f0b27c317d9fd5015629596d522194a39a47599c1c3ad6d5440626331fa90
SSDEEP 49152:CuYk3H5koUXfTqkkYLO/W2buywzMbOX+T7z5EkQ/qoLEw:CPfTqi90bgqo4w
MD5 SHA1 SHA512 SSDEEP

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 f835587e46ec0acdaf46a994a1c02f4bce5360a40d7f46d83862e25e54ebf16f
MD5 4ec5f44f911fb86dcdb77d946a9c7ddd
SHA1 a61f8b7977a3b4fda198e4749fb5555899b0a99e
SHA512 0d7bae85a32b6b49ccf6883fe2f846499cf9144264566625724f65512c01d6f9ba1ff44dc612478a4ad0177fc875e92b09b8f08b333937a1bcd5f9d2698ee026
SSDEEP 12288:NsixPwEsHuXzUMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:NZFwVuD1SkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 600eefe56074eddac24788f5333e679859732845ea43229d81990b3307e1d883
MD5 bc3bce881bfc6021dca7e3a71390e7d4
SHA1 5fcee61285f5959b40ae87035c2a974466ddd788
SHA512 0aab76f922c20d0f6b1d15f695e600ce778cd9c04a3c682cdb8b082827e96a8fa8e5bfe33399333b2ead1bdea7376fcebb1a0bb1bbab2bc9a24d5fa7d195d022
SSDEEP 12288:57a3iwbihym2g7XO3LWUxfh4Co/MTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:M+gkEDfh4CoUSkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 5d2628d9955e28e4920606ef664905a727767355636c0fb14ea2bbc899eace90
MD5 531a3b6c5bc30432a6c84e7b959e7942
SHA1 6c66e0a67f39e985b0a3b2fcdc5c3d9c36bb12b4
SHA512 a2a8b71c55f0a8ab4342df210e40f1674526fcc1a1639b37aac3d771090a4a5a3c80f891ecee51623379edf0ae7f8e4494c2c6eace4f9c36d3641a4fb6b63496
SSDEEP 24576:0BpDRmi78gkPXlyo0GxjrVSkQ/7Gb8NLEbeZ:QNRmi78gkPX4o0GxjkkQ/qoLEw
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 20e92fa243241a3272ef98a3ff244ecab9b4172246adbcd53cc11bfd87090b49
MD5 76ad02551f7d48656b54232d12122e6b
SHA1 6c0701bea949082c0e6c6366e83eb43884b6e4fb
SHA512 b79cd6dccb97d43f1ccc6ea64e50a3ac5516203b7e57683525ffe87c97c073c74c5694762573bbbb5f9d3a18701b088be62f31fd0c3bed4222af0eddf316219d
SSDEEP 12288:3fC6Aj+TN5uixZN+8rKhUdTC/wE1MD0Ca5ZIXV/MTmkJR4Do07Y86gw5CtCjX+NR:vLOS2oyPIXVUSkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 2e5bfa21e050703f3955b5db65b23a30ab6b0f29caaf13b02f3b6c47b94eeb86
MD5 a1aaf7248c2aeca123a2899348db538a
SHA1 a4c3db6c34be6065404628bcf727d1fc08b1ffd9
SHA512 0fdf58c50148ca74b6c489f9379f20e432275637d1519cce17ec331448023e12e68d1ef7ea33de2642c1d17c440579356f78c7e175742b4225272471b69b8086
SSDEEP 12288:UMZMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:UMCSkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 3b44d4742fe130dc4b1852684af3dacd2fd7b92d760e4d5f41acee8ea22fc7c1
MD5 438f9c3459c14ddfb279a9e69bb9843c
SHA1 513dac6b24cfb253906544fdec33b502d339eb7e
SHA512 57d585cdfaa127f481d1b7fa992eb739ed63ddb15f07caa35717525979a66cf5413cd4212d4eb88f8020a91cd4c96fcb3e2439717359d6504f4bcc72d1e68219
SSDEEP 12288:weBNUbTVO86UOMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:wJIUrSkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 a1993e68f79d11c75e596c2ea96388ec3c9d71544fca229ba0eae81ddba7cc0a
MD5 5bbf1584e18c517ba9b1877b1c5a8a27
SHA1 f15dae8f546a475bff07a27281f2bc7ead59d90c
SHA512 f3c26be8f391c7cf25e44c0ffad8725ceb4db407e016c86ee7cf8be0e0c10a3e7569e168ce456205eab23f4d74688bc0157764f2d0352e4562d580db6c6635e8
SSDEEP 49152:MQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3TH+:MQvGAdlCEL8c/yRNw5CRqo4w
MD5 SHA1 SHA512 SSDEEP

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 1ef18f78a38eacf6b7d6ed5f80671a5207c74ba6cced0fb53e4fe1d8f76b07f7
MD5 16dd45a157403c3b14e71a2701da7215
SHA1 4cca3b15faa88ce1ca69d5a433c1c0412beb0051
SHA512 17a8ccb0eeb707f614b3c1005e783cd85c683122626b6e3ac8f2a7e80169fbef1b6a40ce3c73417b3ed5da38b2f150a29933b713ac16f62d630b8ca5141658b0
SSDEEP 12288:zAwSfxL/2Dc3eDLLmt0LDQewsAjcMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:s3ewsAjtSkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 4968b0c75e457bc9bd4ae2cf198e85ea48c305968ef3d73db20f71552bb47c7b
MD5 dc7f6ba8a3119f3959fa8e40c2f04843
SHA1 093c759eba406a9b531abbb12e9710a65a4bb420
SHA512 b2e3443c88e799408adc4fba50b75461b9c35382de53200259ed8b901154602930755eab9af2c6fcdb62d836542fa43e3fb246e6cd8a120138604fb278426f6a
SSDEEP 196608:mUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHY:mUEtQevvqc2W1cpV2EI32Y
MD5 SHA1 SHA512 SSDEEP

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 24a8b0f59f58d127c3a777c1a6069aab7db57cacd6c60f4d1d5ab8147e70df4d
MD5 677601775ace7eda735987c59394c246
SHA1 aa9d2887b3e68668392159074f7bbee1bc95baba
SHA512 9f89eadb283ed7e6e8c1f950bc43a894f325d18eb8f60f5aefa2ada8fa9730febf718c678c6e2eb62f9e0b5d3f661ee3a047d1de21facad6e9ae07803438a058
SSDEEP 49152:TCbRquA/m2yL5zifFiV+XenmE3/zAkQ/qoLEw:soqHVjnmdqo4w
MD5 SHA1 SHA512 SSDEEP

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 cbcdeafe2c6c1dc2bfaa8dfb85f5489926ae66ba1902f28540f62ef34dd6d7c4
MD5 b9f5333061575e70026c653dcda8c710
SHA1 62d65e619c22197e33b6f200cd1be2ada4066aeb
SHA512 66485b6ee6ef15e827ab2a1f899d1949d122e7eca26d08f8386fadbeb5bee4d95359821a2f566fa7486e4cac56d1aa2952f73a9123060af228147733f4d34bf4
SSDEEP 24576:+AhGLJIFoiwtA5l7S53kSkQ/7Gb8NLEbeZ:+AMyFoiq5NkQ/qoLEw
MD5 SHA1 SHA512 SSDEEP

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 37fa8933fd13001de4b333752c846d84cf7be034bf8ef07f180675c49d39d2cf
MD5 2e97fbeec512cf884776f00bb6602129
SHA1 bf8948ab149b793846e95e6da2a65a4b1e03342c
SHA512 6bb33bd052dac4e166603ff389c58a7a9b4de41683eaabdf5062979c08aaf0127898712cb7c614c50f2d4a020577a752e41b6e2cec29556268990957060f822c
SSDEEP 12288:Lmw5HEjsChN8BFgl0WDm+C7MTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:KwuxOWJSkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.2MB
SHA256 337ecc44c3daa10262a662e02dce8483f53b1557dc68963b92eb3b73993ba712
MD5 83d6dc2a2538d1281fa81c5a19c706ca
SHA1 2e4fb090c68b1f1cabb6ffbf5d180c690954c834
SHA512 1d6ff472f55f35352fc6335b5b8b35dcbba5b102850277363f70afdc61cd6adee40e350479b8c265a401058b98450eb2444182d2b8cd80be153f61f3a48832ba
SSDEEP 12288:54Z1IyMMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:OZumSkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrmstp.exe
Size 4.6MB
SHA256 b01ab7a7d6496966d6aa25d22f7d39157fa7d8b54c25907fb271085dbae9cbd5
MD5 a44af3a034bd18271b404c6664fddda9
SHA1 e8c1d3e1d6aad1f27d478c4d64e427c183541f2a
SHA512 2d64ce3a5801d823dafbfd8c571e813ade527227949a827889c26ce813634da651579520ef191c0b1ae87594c5e725c3d81fdee02e2e7e2619b265328d00ad20
SSDEEP 49152:vyEKQ5E3ieGR0PEtBFUow1b89eX61o+2xmepn/TRijbqYW3qkCbDypSfe6qwiXEy:Lq9ceqC+2xl/SSayRqo4w
MD5 SHA1 SHA512 SSDEEP

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe
Size 4.6MB
SHA256 4f013ad820e518bb6bd8d2de34a24573c5bd63072424008730e677b1316036d9
MD5 30dd39a91283189533f801139f96d412
SHA1 268f6428f2bc55b5096bdcf9b5ce1f744d4276c4
SHA512 aaf59ebbfeb3275d4c5a769d7aaa210c7e16df1d7d55ab6a4c796126973a1efbb74464fb4374f0f6cf5665fae7e2bf5615935e39ac5ec256e0f2f94f67ad6511
SSDEEP 49152:gyEKQ5E3ieGR0PEtBFUow1b89eX61o+2xmepn/TRijbqYW3qkCbDypSfe6qwiXEy:yq9ceqC+2xl/SSayRqo4w
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\123.0.6312.123\chrome_pwa_launcher.exe
Size 1.9MB
SHA256 ec8e07b17c2b4663d8bb3e92ea588ae446f9cfcb14d9a963421f22a075a26ae5
MD5 3c8af5fb1f581f65ff339c3fb177812e
SHA1 695c008a921b4583db6d8c84b4cfabba932c7a75
SHA512 1dbbdcb9cff7ae8a5dfa04f1e78558d93f000c10e7479eee8e9699fb8c010873ba292563f3674d2a1b5bb38cf3b2e654dcbc976a4ad04d43dcd6bfa14b9091e4
SSDEEP 24576:ZVN8FYh+50m/YOn/xvNSESkQ/7Gb8NLEbeZ:ZVOyh+50zyxAkQ/qoLEw
MD5 SHA1 SHA512 SSDEEP

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
Size 2.1MB
SHA256 5081cef8ed3883b86f827b124bef6b03536565de59b53913f2efec84645cb933
MD5 14e7b566603952b7dd8156db6f205ede
SHA1 e50d2b6d535da9e4c3f5b3d80e70e4b4be8f9b0c
SHA512 7907dc3c78008ed3a9faee2725a5dab60ec500d85916fd2014874635c1e6f289a656887cad4f2a1b9043d9741b4dbaa2ac0145e38534d31eaa9da7b0ed721247
SSDEEP 49152:/59PYHvI7wi/lIKuLFrFXlMWGxbgikQ/qoLEw:/GglIKgMTqo4w
MD5 SHA1 SHA512 SSDEEP

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\123.0.6312.123\notification_helper.exe
Size 1.8MB
SHA256 393805e6285e234b3efc2ccd2ea37c713a42b689d0602cd9a8cd0f26f13b8e8b
MD5 b8367760111c288d7746008450fbf57b
SHA1 63f0e82f149dcb71ac3cef4ecf73a8d2bf6c3dff
SHA512 1b79402a8b6a658c858e74ab596b31d822fef7280e51cd72d332eff55df7f2b4f0247c2169eaee7aa109dc61f53fd84fe3463ff9c4c46aa8859619db595cca7a
SSDEEP 24576:Fb6+S3zFphRwMVcLDnyhECINqzWipIxhWSkQ/7Gb8NLEbeZ:FbrUzFjGMVaDy9INqZIkQ/qoLEw
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 1.6MB
SHA256 dd822a5a2bcdfcd0fad4aa039ec791575d18c0af774daeb58064c64edc4c4a18
MD5 0452bfb89fbd6bfeb5f5160a58e3d45d
SHA1 5a2d3b24f86a117c4015e574b7a0817bb4c758de
SHA512 b5fcd1b3881e85fa142b25986a5e6af772223017a3a013c4ba4acc124a369214e73fe0d8c9996ec389c18461e3be17076142d2566dd7e4314a35f6616392e7e1
SSDEEP 24576:W436epN7wzPROWFW9sQ0MtJpSkQ/7Gb8NLEbeZ:W4qiwzPASW9mMt+kQ/qoLEw
MD5 SHA1 SHA512 SSDEEP

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 b226a9ca6d981a24620e40a169755ed815ec778f92f5acde14de76ffd44ad776
MD5 6a5358ed6d0ca30171fccc521455fb19
SHA1 918774476fc1afc783d14015f8122aee8745b77d
SHA512 e77b328400f8447776894b36b6f61bb386b080a12ef9ed05f9707d4ea33997ad93de0e0fa8b0c4b2767fdd6c85c4f795bee2ebdc5a77319243a82a36283d0efd
SSDEEP 12288:kxMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:kKSkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 e20cbbbd34e69692bce8ded696c2cc04bff2cb7a22c1c7f6de800efa28c75def
MD5 099b41535f5508c98a1e1cb555cee1eb
SHA1 97305e810007581c0f683951f74cb01a2561fb6d
SHA512 ba925a5b391020306ac541dbefe791e1dd1919a549b3a4e6f35819cbfd28d0253b5849d1fa5870a0403f2f81726d9664d5c04a8aab4ad3932c0ca0de922a3e80
SSDEEP 12288:MIMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:MBSkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 3fdc2d0cab1e6e6798cadac5c3f9d285bf3c827959186e7753b5ca0881f351c4
MD5 fb8e376541846da1fa50d260b75797f5
SHA1 91d3efc97d8679dc94405997c5a03487e0007cab
SHA512 9cb9fdb4e9b41e409d6e16c83a9355f1c8fbb1cdcb92bdb3e06dfe22807a192acaba0341792d3730ce0d9cbedc29a7867ff4405f46198e2c0c7650b1edd41a86
SSDEEP 12288:CGMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:CzSkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 fa73f7d15647c5e509f02b7822b9e5a73460d7634790d15d289e4f82046d2118
MD5 af71d399adb4654ec9b5311a65af01b3
SHA1 975a2ecbb907e1106c6ebf36bf32e50343103268
SHA512 06f222b9539011f691fd34aa9754e98bdc6ba8320111bd922ce503388656fbb87cdd41c9873c2d621a4fa29346d4f904140bc08991dc359499a50d2a79ff3a6d
SSDEEP 12288:vVvMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:ySkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 1194bcfb08e1ee037507c87968f20978a7fc84612de45e2de44e5bda087c38cd
MD5 05817a44fdba9d40d0c8153d2faf1899
SHA1 b48b41c207db82eb75fe3dadc613396924b276ec
SHA512 2f6c0c1265c730513d0ddab5fd34df32ec4f7d488086c8eb0af89561084f3066bd9fc7c576f2b29d0953dd988aa5ae38e3323314bac2f86d5ec6f152b0b9b243
SSDEEP 12288:Y3MTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:YcSkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 3762b50e5504803a939f2f102bb51c61ef97d905a92ee92db6e4037761eefa9b
MD5 09362d9a5859f0e2838bad6338b614c9
SHA1 9db0c3c6094dac3f373c6811de8ed5b2a0b9017c
SHA512 98f4a84b48045b21b2a5e879f895fa6c411331713ac3e7c78b95eed84d1ed00ae2b84b06fb8322a54ed4744e5f9d91e8c730a77187deea534949aaef45dbf847
SSDEEP 12288:i0MTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:iVSkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 31830d84b958c8e92ce7f1ffc6daf2487fdd1710b41571a8c7030c03d5319da4
MD5 cbf05c936c08bf33e753f1227501ddfd
SHA1 11bc3b81ac14bf8945e4d9e095972490496771f2
SHA512 19f7ccf5a28e497fcf4bff6e706505f89c3e821b43b973a341181707b08b6dc76b68246b929ee42199dafac2dbc3003314a89a9b7cc41a1cc1eeaab0e33e9a85
SSDEEP 12288:BwMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:BZSkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 0b2d93c9221d59077cd0956fa482ae327a9cb4ff02c6baf788880f45de2fa352
MD5 4a043564312d9e24326e8aa6cdaab139
SHA1 477a4c6742eb7b1f7773ef3777cd9d9af475dfa8
SHA512 f15c5a155365bcca5e9cbfb1492473a8a8ad7a12a14466a49105cfc4f6682b2ffcda17f7fa67f7597ced926685ce710c99575894caa4b2eb07ff389ae7520478
SSDEEP 12288:giZwbQzzFEoS2cPvyoMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:jZM4zFVSOhSkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 f69e0992ebc7d6825419e77472ed9b4878e49640520c8d44494121333e678d00
MD5 e9ac8088c64c39c2dd747780693ec2c4
SHA1 f0f48135f89102251c3c9b181f2003ebd92fa7a3
SHA512 d30288578c1e2314574a5a29abba497d8cbc1a769998f114de85bac7a1c6c869ea0dd52c8a024d9a981eb1317423875d9c8c00d0b6d0146ee060b87bb43f5e37
SSDEEP 12288:xlMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:xWSkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 feacfa596315dfac7832eb73cb5bbf9eb3120805113c397f6056b7cd81962424
MD5 aa5ef2cd98ac008ae195d727eae00c55
SHA1 f2553425950f144a874e8014603baa3688862f62
SHA512 0df9c0545394824946adb5c33d378862b2a6b6181d0da8687d28aef69ae6a94df78938708e1a7b19062272dfe67458866d62d843fbcdaac0d7c5edd978cd1284
SSDEEP 12288:PJMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:PySkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 fa6b188b205aa021d401bd2d3428b7a414f67754d742004ef029bacdb208ca07
MD5 50c32518fc7a32559799f7a5841026a7
SHA1 9c9474428e4952fff9ed938963a81259004cf9ef
SHA512 78b49373f24984fddba034ed4b49bccc4970d1bb433080f5b643421c49487f7e2af597b33522bb0b4dfdb0b79981c340a3fcf342d8de82ec8f91f799622399d2
SSDEEP 12288:HyPz5L8MMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:qzydSkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 9f617b0888187fea1a21987f389d3516a304fd82cfa2a8d02457ce33fa1d7990
MD5 4bdf28d24c57d7841e891f88278f7c35
SHA1 f1b4978113d06086de3af103c7290de651ccfa27
SHA512 68517de68a30c22596b9ca18d61915e0ef1a42fee2e8d2c60b514b05febc8509b005ca51e50f928daf7e2e1e331198f02c9d9d47a7f4d3bf776fa74d5c86b65d
SSDEEP 12288:rlMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:rWSkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 92dca73320913d95e6d13faae7994b0f6b2110bc0788ea771d43e4d62c6b3fc5
MD5 b98aff0dc82d6240e04201c86d322bfb
SHA1 209a68a7e8c5ca1f11ff87695bff5a9500aee602
SHA512 e6a4abbdbd67dfaab247ad6a7295218ff9cc625974ba9a341b6b84d6cd9ac496e22b53dca382db80e695fd6de57c3594d205102e3a8b5c9fa599d6578562be83
SSDEEP 12288:9lMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:9WSkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 63281ee17059572532b5447681c0e2186ecfdd833f2a5553926df5a2224a264f
MD5 a97455fd7c8706a343c98432d1b7ae3f
SHA1 c4fde67bae866b18d03a33a8bfc02b2768d76ccf
SHA512 c24086bf934f7240050fad757c1ffb7a10d0f3eb8a0663e6ee0409990842753f7511fe0199fed5c116bbd97cec27e2fba53c8e38e2fd038cfc8058951e2d8585
SSDEEP 12288:LyPz5L8MMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:mzydSkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 15ea83216849a5c8b950ef0fe882bceda0ad958f0d20a740990d62d7f3b4d753
MD5 345b4f7403032df0f4dcb6db64a28d1b
SHA1 20ed4ab01698bcd11929f0a9f7caeffb95ab22b6
SHA512 a0eb3614d442ea0edc5289fc470b361b11a8555a14349a981b0100d58577f1dab6916cfc55be4dd1ec83319501a5d3007e165f193254560dd791f6be99c4c47e
SSDEEP 12288:2Cd9wWYoaLHF3z0z04PDvhWMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:XTpaLl3z0zDDSkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 44e288d9f87ba13523c41d2612abd2a54b9ee54145e191057409550bd5a412e0
MD5 1cad5c5c9b7459878459d02a2e90f600
SHA1 e3ed23fc87a2be4ca8a009900cdb0ddffa8025bf
SHA512 b7e3535c5f0560c3aaf6f82e9b8d2cdef32e85afd37041899a175f683321a6e06c56107e06a25344472945fe1a49d23afd981f43da2beae54130a99d00425a0a
SSDEEP 12288:Si4e7NRdTfgwCHKy7GLbbdIvjMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:S3+d9CHKy7GZXSkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 23d643307f679eadc403916d2f369b3b7c66c0a360a3bff907bd5356d86878b5
MD5 fe5a006bcc15664fbe893eb72d7c6418
SHA1 02447f48d67f36fd14b91906fe4572754f04a051
SHA512 61fd27aeb2d7ef23e97ad238c844ee1e4c0e38f72aa488eb248bd5759e34337a00946db66c42195c7975853e2374e332b7a0643b966ce80d63c4a76dfe5d0ee2
SSDEEP 12288:+mMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:+TSkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 7d341224d1ae99c0dc7378a770facd724896fe30030abfde0424ff9485ec8003
MD5 ea38c0d980b406bf5657fe00226e50e5
SHA1 0866d5366e1b674d3d6c7aa18a4ece934fbcf517
SHA512 cd70964fe386e004b0fa3e4d96152221b9c6f354b71a03a350353518a2432698e7096626af23d0d7c4e61027a9bc85d051e61c0f663f63332c0df484908f4c3f
SSDEEP 12288:ksMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:k9SkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 c616cce9617a365248cf96859529e671ea56afe93b1205bacd66ef63fb4f72b6
MD5 1bcc2b00ba7d0ea20f357f0f33d38bc2
SHA1 1716e07799e9fc72c01df776cdead3b5ba09ee6f
SHA512 9dd6c1affe0d1ce5f9e462b722a278867bbde457411ccda01e225132377732eac4b4df868bcecc5fa6c697673d451a901bdd506b89d825b631c19a3c38b7e241
SSDEEP 12288:wjMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:wASkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 2477775e17570d2efc535be8ef8a0623b517593239382a6f95c893c72baf51f0
MD5 afc501f0eaa535a35d215dbdbec08940
SHA1 a5698dc73423708f3e693fc88b688f9788dd3abe
SHA512 d22a41258272f2413c6f049b9ccd03b86ef0e990f323a14dcbf4b879211edebc25a131cc6b94d8e0e2877ff479a9f38f637e86d2e561f351c7f01e9c223f4353
SSDEEP 12288:ylMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:yWSkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 1bf892d6111d53a917f4872525d43687836940dcc00ab6474f52548ca2bfb555
MD5 30a8b595c3f4d1d0650f1f309076518b
SHA1 0396a755bc6c2d137c5edeb8b6ae4bbfedc2f3e8
SHA512 fcf5b963d09d26eee82ba4b6805c321fb13909dd63a9b76934612c0b03552181ec46ead84edeea8d3123fa5a0d44681c80c804b5fd4fc7fb3b689b5265578884
SSDEEP 12288:NmMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:NTSkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 eb88ff5b4330f28b52aa57205b7418848a8a67b6f147ebefc175861d1f0d9d34
MD5 63f01489e0a1a13037e8e9f1a6565658
SHA1 bdbaf5f0750e70359f21d0c32fcbe24f03498478
SHA512 ef05784a4f0ed733f87941e04477c606791289cae74ad91b8a529d4c1b793c73e489a236ed5a15acb08b339bbff4534feae4a7335ab6b469528b1e657e41a4c7
SSDEEP 12288:xtMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:xOSkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 1196cc12bfbf7e5c41beec7bfa12d7de86b4cbda4eb168e2d3a95a5dd4a54067
MD5 1cd3802bb0143ff72c32c0434db75cbf
SHA1 588897961610c95942435ea6fb5a5a8e102c83a8
SHA512 91f804ad4da30ebde0a0a47b33901d34f81bb3ef5aaca4b6d8e92ce5683e3646069edd533f45cad05602f5f614497627bbd3fc8db136619b87f0aa812691e203
SSDEEP 12288:QUFmDDLiMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:qnSkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 0da1192cd3a760c302ef6db03b5b2b212b42405fd31cc3d95e72d4ec2868496f
MD5 cf1f7c3c21724b9943ab7fd2baf6478b
SHA1 20229d70fe18582b8433d6a9248ce3f14e104803
SHA512 65c4e11f58f9f67ec9f471955c4b582863f128fffdcc9c586a0d155cd2a6b5bd0eb5f206065a20261cfbaeb7bcf25b9747f25e4e935b6de6f1cd1217123d0b90
SSDEEP 12288:5eMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:57SkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 7b32ba3ee882fc4178aa4b46c307c94ace41acefe47bc06b7fb3efce03df776a
MD5 570380f5105672ba93b0995b6c133bb6
SHA1 01c695d8dbde1396c791389396b4d456a34044fa
SHA512 7e1b9baefa5a2f44ca9b4796b45defba70c8650e7e241c1a2c2dfacbad43684469e36b56f9e6d7213cc9f4741f160e8a47c5b650fbb9cb2cca0a650c58581cfc
SSDEEP 49152:za0h2GEkuAe73q3pp46zwwQAkQ/qoLEw:za0hNYG4Jwdqo4w
MD5 SHA1 SHA512 SSDEEP

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.2MB
SHA256 c3cbf131fc9dcc87ed26eb022b98c735ee40c078e4cc601fb7f1455142eee9da
MD5 0bbdeb87c4a50d328be20610f7d3bc15
SHA1 922453dde51716e20d54723be9591743d1d8278c
SHA512 4d2bdb0c82ced10054bb2373994479de4593a6bf5ade4a379657331bc00ed0f8cc048e922443f4e2e9bd3cac17ec24cbbe3b64b5403021c5bc3118d8f07c9869
SSDEEP 12288:UhbHjfXTMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:UhbHjPwSkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 317c7faa5aa13c4d168ba5e2e75cfdf0f80348562c6ca6783779435dca18ad9c
MD5 3de2c87d56acf1127b08d7961affddb2
SHA1 f6e795fa2c6ec719709e02089c3239d0d05fedb0
SHA512 f14cfba7dccb710d90f5ddbbb5cf27c359be7f921bec46d323bd57e3c3e15ec4b9a843bb997e7aa0a57eaf197b0f0a1ffb7535c304532781fdad075a9ad40788
SSDEEP 24576:P3YgnJcRTk4yti+R5dpR/4SkQ/7Gb8NLEbeZ:PIgnaTk46ppR/xkQ/qoLEw
MD5 SHA1 SHA512 SSDEEP

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 d8933a7970275c3e8b0b0252efc02218dd265b0a4b8186146a59721a82a9aed4
MD5 55c09e2cd74e80e07a5ec13cd5f165a7
SHA1 8bc78f4600832a73ef52991ac19baa93aec7e8e9
SHA512 50854de1fc0ed9811694850a380e57dcd22d468d9a7ab7fca31280c62179d706dd35d7b53e8a78a81c1055efa84ac81ad61f53f11855af9315fd8a8c12259235
SSDEEP 12288:ziMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:znSkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.5MB
SHA256 35a2ba264856889923aafae468f14b0dec6d31f229ea0fd7d44e7c309a67f8e6
MD5 ebbc90e85adcb05ec44cba6172a4d363
SHA1 24effca56f02d7447fab63e184cb5eae5d1fb56f
SHA512 0eff2ffc0768e23f8601aef6526d2a7c02eb0294c0c013a46914ccd4c97ef1688004d8fafb28ca0be42fbfcd954e3e02f8bc554b46278efe956f598cf10ef89b
SSDEEP 12288:vOb3A4LWOsvAYFTpMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:wTL3UTSSkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.2MB
SHA256 d2d24ab595f4804d43d63c36b8f6a92c2e630adde6e9c728e184b41b2de65782
MD5 d974d35e9d1140782c6a4ba8b1ccd570
SHA1 3bb98827eb53f90bc8e14d2557204f4a77370d67
SHA512 34d639da1f9670ef87e04d7398960c73d0130bfa19992553987cdf5603212476bc17cc990e6850fb9c948ad0313b1f1bcfe30a8cd78ee01d276dd2459c973ba4
SSDEEP 12288:lpFtIONMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:sOuSkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 29ba7429504d2a28b0ff8424371cfcb20f4653b7c42cefb782ddb491c3d70a75
MD5 5ee385b2272a2d8e3e3d577e0a5a540f
SHA1 a2299c0771c46772e9996281f92b1c3df789995d
SHA512 b85d4cae85257d8925674d407018473294e3c2d4a82671ed2050c5b7969f965efab66c095ae4c2060af474224c3cc7e5cf7f83e9a25481c61bcb854a0834b73c
SSDEEP 24576:W7NM9YmZqmWMUkPjZM48Mv6bEhsrSkQ/7Gb8NLEbeZ:W7cBWMpPjN8DbEhZkQ/qoLEw
MD5 SHA1 SHA512 SSDEEP

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 7e701f36388a87ef1dfd7aad0dd939da6e9a7616b44036e4c21ff2dcb89c0e86
MD5 84a89933ddcdb4d9ead8ad53b4699069
SHA1 7c5530ebea02fb11ed527aa65efd256209355f5e
SHA512 fd952a45ee8d4bb4a345b369641739819ced8abbad6577abd33a00b2a5a5308612dd3efea1fd82b4d5183f131c7ce1ca70c9def7d0cf56b7855ac7023360ce22
SSDEEP 24576:CW6BApg2YuyuNDYTabvcRvNYf8km1hSkQ/7Gb8NLEbeZ:CF2YuHNETovcvNYf8km2kQ/qoLEw
MD5 SHA1 SHA512 SSDEEP

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 497c9d9a8d899a9bd067dfe7f9ec7e1b4550acd13ee15a70307f95b883bd4903
MD5 5588d0b328d54e891ac2d8aa0f098fc9
SHA1 b8b908d0758d389b08b0448a40a0276a5d4e5e1a
SHA512 09a8a8b5a303478f9d6f42791a565957da5259916e5cf883ab28550d654e8a5a4a3aec72230026749a1afbadb8aff39b70ce8ba60945937d362b295ad70ece26
SSDEEP 24576:8AFs06+Omlf3NXEbToKSkQ/7Gb8NLEbeZ:RFs060lVXugkQ/qoLEw
MD5 SHA1 SHA512 SSDEEP

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 a97f7c9737c5a451575f7da52b9aa9d9893b60f0119d7ae49ab067264e7a1d15
MD5 3355c3da3d5fbac861cfb118d8472850
SHA1 83b229ec38b09c0db5572f6e379d1116835ce910
SHA512 41c33090e195ae98869c3dded10fed5d4cf68b993922e2c40e6025984bd8373833479160d2293896db149078e5a8675e6b62cab6a8f0ea357c7a1cb270949c89
SSDEEP 12288:pCJnJ5D3VkrzzxuMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:AJnJ5D3WHtSkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 94bd149c5d728f6c78afae680370370f3d9326a26d476af396c307e2584c4110
MD5 8938c7b28d5b14d5fc8ff4f1717ae7a2
SHA1 2939eb8935ec56f7b52bff6aa687e8cf59537326
SHA512 a8a8c8de832310cb97e4d08d90c58b4ee320a60ac1769dc466aaf92cb2af4a7cd2eaf322ff3d92dab0dea037c65a44865d5b849ebdba8553e14c4ffbceb19d49
SSDEEP 24576:cEPohm6/7IIXdwcXrif7qQncjlP65i3Vu4SkQ/7Gb8NLEbeZ:Do06DIKdwc+eQnSt65aVakQ/qoLEw
MD5 SHA1 SHA512 SSDEEP

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.2MB
SHA256 3c9f62e7aadcc66888558309493544ee429d50e219c64642594ab30eb4e5db6f
MD5 b870cd99db30c0754a3211739718179f
SHA1 49a9255d88f9877e738f269fdc5f4e7d0d8be6ca
SHA512 4f5b8396ac198ab3c16db5844b6c1726ffef3a9d91ba9c124ded81b0837bb794f843f4f59f2ff74cc08f08600d1c1a4ad7bb1f7052e9b36aaa42c54f3ede62e2
SSDEEP 12288:sEP3R1cMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:n1tSkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.3MB
SHA256 edac89d2fa7ebabedaf708a5d01be6e6e9c3926ea5abe8abbc9dda3ff38ebd2d
MD5 1101be126e9d3667bbd7918c7e3a4ea3
SHA1 6befd76fe93f5027781003b671e8cd16a9f117fe
SHA512 21afeedac9a8f3c0a1368a49c220f28a7c45f05ec760ecf05addfd42b07d6eb659339bfe8f45a888717ae4b9e06d9dbbd4c8cc37c34eb159a99e0b5ba9d344b9
SSDEEP 12288:ZjkyjMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:ZIyASkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 ac74aa981def6145fdddf7044f108848f109caafd5d415c4bcbdfc3ef8d3f70f
MD5 b6ee4c963e42774160e144a168c55672
SHA1 5223e40d84bbdc6c0f0d49d19be3779e376d53e1
SHA512 54850326fd23cc76ef977d8c885d2d88638ab4c18756c973f0721421419bc5d8da1ee3135e011a6ca3782ce5123c1d00b858eefe6bf22d1cc1322b190e55b7e8
SSDEEP 12288:0KdMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:d+SkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 ffcd43f5087ffd12ea95b62942fb00bee6289f4ce9e0277224b9d32197c86f88
MD5 18b3f7cdbca762a3ecb8568538374c82
SHA1 8d16466ead46235ec7de1a4ed88c47029cc42575
SHA512 c2b1a2eba6dc9101b3a457eee4ef1046f4446060131821d2177e1b67f53cfa2b1b3a76cb26477775db8da3b8218636801ef9f3b7106911470aa700e284585bfd
SSDEEP 12288:FLQZb3C97GYnZMv5zBcKY97MD32MTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:1Q9MxZKdcz97w3jSkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.3MB
SHA256 91451df5565dc07f6371405f2e033768cfcd76239dc0391124ed8f66b21ad515
MD5 ced1e7e1f66baafc21b072198e8eea19
SHA1 226788f543ea5de7089bedda4912ff4700651562
SHA512 57d9339dd810104edf2ac98adc27da001dcd7db836a761b81313e80d487e970c9af32f22f7408900b43df458970f2e1756726ddd8b0379d9c46806d5ba65cdc0
SSDEEP 12288:3yoKo2tRple9pXMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:3yocvAp8SkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 334b6730721e1549e0f4e0f62d492dfeb91fa59e7f91bcb0e0e88dbe972d301f
MD5 f418faf4e6501740ce127663a3e48750
SHA1 2b468bc555e0454b332226b04245c12dd5c60b50
SHA512 22eb5abcf61e07c2b39c5c03d37268e1eb659162351d3cad60f481fbe64bebf32cef4255d0e826ab27f7bc8d0ef09c50de500ad20000a00cc3a95c27045941e3
SSDEEP 49152:3WcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIKlkQ/qoLEw:v0zuNIhqo4w
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 8e0df5236e3fed9d3353abdcca784dd8089a661bdbc4bef4be4c9f48e01904d2
MD5 f7c21bcea6457ac3a0948cc7ca905d4f
SHA1 26e4d6d8681d31e3e6e565ca6be409ea1e1efa1b
SHA512 b3a1766d7c298d1b5c969d0fad694bb5fc1b7817e5017ddc1213204d16c04cb533d4ba049a8cf51433ebe51cfc13ce21808f202bcc16340415c22169a1ab59f5
SSDEEP 24576:51QT7EcpfxR+N5AWAz3ooiYtjMqbtSkQ/7Gb8NLEbeZ:sTDxR+N5YzTfjMjkQ/qoLEw
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/444-408-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/444-587-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/684-238-0x0000000140000000-0x0000000140234000-memory.dmp

Download

memory/684-38-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/684-44-0x0000000140000000-0x0000000140234000-memory.dmp

Download

memory/684-47-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/748-302-0x0000000000400000-0x000000000052E000-memory.dmp

Download

memory/748-419-0x0000000000400000-0x000000000052E000-memory.dmp

Download

memory/808-404-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/808-570-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/1612-590-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/1612-445-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/1904-274-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/1904-262-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Download

memory/1904-261-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/1980-50-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/1980-58-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/1980-59-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/1980-243-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/2192-18-0x0000000140000000-0x0000000140141000-memory.dmp

Download

memory/2192-219-0x0000000140000000-0x0000000140141000-memory.dmp

Download

memory/2192-19-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/2192-25-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/2236-526-0x0000000140000000-0x000000014012D000-memory.dmp

Download

memory/2236-340-0x0000000140000000-0x000000014012D000-memory.dmp

Download

memory/2392-395-0x0000000140000000-0x0000000140150000-memory.dmp

Download

memory/2392-276-0x0000000140000000-0x0000000140150000-memory.dmp

Download

memory/2460-532-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/2460-370-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/2864-80-0x0000000000420000-0x0000000000480000-memory.dmp

Download

memory/2864-99-0x0000000140000000-0x0000000140166000-memory.dmp

Download

memory/2864-74-0x0000000000420000-0x0000000000480000-memory.dmp

Download

memory/2864-244-0x0000000140000000-0x0000000140166000-memory.dmp

Download

memory/3012-535-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3012-331-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3012-444-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3088-288-0x0000000140000000-0x0000000140142000-memory.dmp

Download

memory/3088-407-0x0000000140000000-0x0000000140142000-memory.dmp

Download

memory/3128-531-0x0000000140000000-0x0000000140199000-memory.dmp

Download

memory/3128-358-0x0000000140000000-0x0000000140199000-memory.dmp

Download

memory/3420-62-0x0000000140000000-0x0000000140166000-memory.dmp

Download

memory/3420-83-0x0000000001A30000-0x0000000001A90000-memory.dmp

Download

memory/3420-87-0x0000000140000000-0x0000000140166000-memory.dmp

Download

memory/3420-69-0x0000000001A30000-0x0000000001A90000-memory.dmp

Download

memory/3420-63-0x0000000001A30000-0x0000000001A90000-memory.dmp

Download

memory/3652-381-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/3652-393-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/3780-250-0x0000000140000000-0x0000000140140000-memory.dmp

Download

memory/3780-251-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/3780-369-0x0000000140000000-0x0000000140140000-memory.dmp

Download

memory/3780-257-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/4216-35-0x0000000140000000-0x00000001401FB000-memory.dmp

Download

memory/4216-9-0x0000000140000000-0x00000001401FB000-memory.dmp

Download

memory/4216-0-0x0000000001FA0000-0x0000000002000000-memory.dmp

Download

memory/4216-10-0x0000000001FA0000-0x0000000002000000-memory.dmp

Download

memory/4312-346-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4312-530-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4528-420-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4528-588-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4712-315-0x0000000140000000-0x000000014012C000-memory.dmp

Download

memory/4712-431-0x0000000140000000-0x000000014012C000-memory.dmp

Download

memory/4888-589-0x0000000140000000-0x000000014015D000-memory.dmp

Download

memory/4888-432-0x0000000140000000-0x000000014015D000-memory.dmp

Download