8f3d3af5fae75ebb6744ab911f2f50d96c690d080dc1412a7a4ae5a942e9a34b

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
09/11/2024, 01:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8f3d3af5fae75ebb6744ab911f2f50d96c690d080dc1412a7a4ae5a942e9a34b.exe
Size 1.2MB
Sample241109-bkb3astglm
SHA256 8f3d3af5fae75ebb6744ab911f2f50d96c690d080dc1412a7a4ae5a942e9a34b
MD5 a1e227e383d57a0f5c23dbebb9423715
SHA1 673a1871e36e07fa37da7a0f9e0ddd6c45688d64
SHA512 b26d4a740938c414f4910124999e3099cd3ea1a74d7529f018b6d69019c7854b02ab2673d6eea91d34cecf0bb996e7472acb7efbd97edf5de56a959b982167bf
SSDEEP 12288:9JuXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:busqjnhMgeiCl7G0nehbGZpbD
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
444	alg.exe
2208	DiagnosticsHub.StandardCollector.Service.exe
3940	fxssvc.exe
1016	elevation_service.exe
2448	elevation_service.exe
964	maintenanceservice.exe
1296	msdtc.exe
5080	OSE.EXE
632	PerceptionSimulationService.exe
852	perfhost.exe
1712	locator.exe
4176	SensorDataService.exe
708	snmptrap.exe
4884	spectrum.exe
4744	ssh-agent.exe
4384	TieringEngineService.exe
2556	AgentService.exe
4364	vds.exe
1500	vssvc.exe
368	wbengine.exe
2264	WmiApSrv.exe
4464	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 37 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\b5ed91f394857919.bin	alg.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	8f3d3af5fae75ebb6744ab911f2f50d96c690d080dc1412a7a4ae5a942e9a34b.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	alg.exe
File opened for modification	C:\Windows\system32\AgentService.exe	alg.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	8f3d3af5fae75ebb6744ab911f2f50d96c690d080dc1412a7a4ae5a942e9a34b.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	8f3d3af5fae75ebb6744ab911f2f50d96c690d080dc1412a7a4ae5a942e9a34b.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	8f3d3af5fae75ebb6744ab911f2f50d96c690d080dc1412a7a4ae5a942e9a34b.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	alg.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	8f3d3af5fae75ebb6744ab911f2f50d96c690d080dc1412a7a4ae5a942e9a34b.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	8f3d3af5fae75ebb6744ab911f2f50d96c690d080dc1412a7a4ae5a942e9a34b.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	8f3d3af5fae75ebb6744ab911f2f50d96c690d080dc1412a7a4ae5a942e9a34b.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	8f3d3af5fae75ebb6744ab911f2f50d96c690d080dc1412a7a4ae5a942e9a34b.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	8f3d3af5fae75ebb6744ab911f2f50d96c690d080dc1412a7a4ae5a942e9a34b.exe
File opened for modification	C:\Windows\system32\AgentService.exe	8f3d3af5fae75ebb6744ab911f2f50d96c690d080dc1412a7a4ae5a942e9a34b.exe
File opened for modification	C:\Windows\System32\vds.exe	8f3d3af5fae75ebb6744ab911f2f50d96c690d080dc1412a7a4ae5a942e9a34b.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\spectrum.exe	8f3d3af5fae75ebb6744ab911f2f50d96c690d080dc1412a7a4ae5a942e9a34b.exe
File opened for modification	C:\Windows\system32\wbengine.exe	8f3d3af5fae75ebb6744ab911f2f50d96c690d080dc1412a7a4ae5a942e9a34b.exe
File opened for modification	C:\Windows\system32\dllhost.exe	alg.exe
File opened for modification	C:\Windows\System32\alg.exe	8f3d3af5fae75ebb6744ab911f2f50d96c690d080dc1412a7a4ae5a942e9a34b.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	8f3d3af5fae75ebb6744ab911f2f50d96c690d080dc1412a7a4ae5a942e9a34b.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	8f3d3af5fae75ebb6744ab911f2f50d96c690d080dc1412a7a4ae5a942e9a34b.exe
File opened for modification	C:\Windows\system32\msiexec.exe	8f3d3af5fae75ebb6744ab911f2f50d96c690d080dc1412a7a4ae5a942e9a34b.exe
File opened for modification	C:\Windows\system32\dllhost.exe	8f3d3af5fae75ebb6744ab911f2f50d96c690d080dc1412a7a4ae5a942e9a34b.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\locator.exe	8f3d3af5fae75ebb6744ab911f2f50d96c690d080dc1412a7a4ae5a942e9a34b.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	8f3d3af5fae75ebb6744ab911f2f50d96c690d080dc1412a7a4ae5a942e9a34b.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	8f3d3af5fae75ebb6744ab911f2f50d96c690d080dc1412a7a4ae5a942e9a34b.exe
File opened for modification	C:\Windows\system32\vssvc.exe	8f3d3af5fae75ebb6744ab911f2f50d96c690d080dc1412a7a4ae5a942e9a34b.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	8f3d3af5fae75ebb6744ab911f2f50d96c690d080dc1412a7a4ae5a942e9a34b.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe	8f3d3af5fae75ebb6744ab911f2f50d96c690d080dc1412a7a4ae5a942e9a34b.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdateBroker.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	8f3d3af5fae75ebb6744ab911f2f50d96c690d080dc1412a7a4ae5a942e9a34b.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_80171\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	8f3d3af5fae75ebb6744ab911f2f50d96c690d080dc1412a7a4ae5a942e9a34b.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_80171\javaws.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleCrashHandler.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	8f3d3af5fae75ebb6744ab911f2f50d96c690d080dc1412a7a4ae5a942e9a34b.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	8f3d3af5fae75ebb6744ab911f2f50d96c690d080dc1412a7a4ae5a942e9a34b.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	8f3d3af5fae75ebb6744ab911f2f50d96c690d080dc1412a7a4ae5a942e9a34b.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	8f3d3af5fae75ebb6744ab911f2f50d96c690d080dc1412a7a4ae5a942e9a34b.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	8f3d3af5fae75ebb6744ab911f2f50d96c690d080dc1412a7a4ae5a942e9a34b.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	alg.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdateComRegisterShell64.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	8f3d3af5fae75ebb6744ab911f2f50d96c690d080dc1412a7a4ae5a942e9a34b.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	8f3d3af5fae75ebb6744ab911f2f50d96c690d080dc1412a7a4ae5a942e9a34b.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	8f3d3af5fae75ebb6744ab911f2f50d96c690d080dc1412a7a4ae5a942e9a34b.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\123.0.6312.123\chrome_pwa_launcher.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	8f3d3af5fae75ebb6744ab911f2f50d96c690d080dc1412a7a4ae5a942e9a34b.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	8f3d3af5fae75ebb6744ab911f2f50d96c690d080dc1412a7a4ae5a942e9a34b.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8f3d3af5fae75ebb6744ab911f2f50d96c690d080dc1412a7a4ae5a942e9a34b.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002082ab5e4432db01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000409a425e4432db01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9908 = "Wave Sound"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006025d35f4432db01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000016c32a5e4432db01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009a0c965e4432db01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009a0c965e4432db01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
2208	DiagnosticsHub.StandardCollector.Service.exe
2208	DiagnosticsHub.StandardCollector.Service.exe
2208	DiagnosticsHub.StandardCollector.Service.exe
2208	DiagnosticsHub.StandardCollector.Service.exe
2208	DiagnosticsHub.StandardCollector.Service.exe
2208	DiagnosticsHub.StandardCollector.Service.exe
2208	DiagnosticsHub.StandardCollector.Service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
664	Process not Found
664	Process not Found

Suspicious use of AdjustPrivilegeToken 41 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1520	8f3d3af5fae75ebb6744ab911f2f50d96c690d080dc1412a7a4ae5a942e9a34b.exe
Token: SeAuditPrivilege	3940	fxssvc.exe
Token: SeRestorePrivilege	4384	TieringEngineService.exe
Token: SeManageVolumePrivilege	4384	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	2556	AgentService.exe
Token: SeBackupPrivilege	1500	vssvc.exe
Token: SeRestorePrivilege	1500	vssvc.exe
Token: SeAuditPrivilege	1500	vssvc.exe
Token: SeBackupPrivilege	368	wbengine.exe
Token: SeRestorePrivilege	368	wbengine.exe
Token: SeSecurityPrivilege	368	wbengine.exe
Token: 33	4464	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4464	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4464	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4464	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4464	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4464	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4464	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4464	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4464	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4464	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4464	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4464	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4464	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4464	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4464	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4464	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4464	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4464	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4464	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4464	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4464	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4464	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4464	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4464	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4464	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4464	SearchIndexer.exe
Token: SeDebugPrivilege	444	alg.exe
Token: SeDebugPrivilege	444	alg.exe
Token: SeDebugPrivilege	444	alg.exe
Token: SeDebugPrivilege	2208	DiagnosticsHub.StandardCollector.Service.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4464 wrote to memory of 4488	4464	SearchIndexer.exe	114
PID 4464 wrote to memory of 4488	4464	SearchIndexer.exe	114
PID 4464 wrote to memory of 2844	4464	SearchIndexer.exe	115
PID 4464 wrote to memory of 2844	4464	SearchIndexer.exe	115

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\8f3d3af5fae75ebb6744ab911f2f50d96c690d080dc1412a7a4ae5a942e9a34b.exe
"C:\Users\Admin\AppData\Local\Temp\8f3d3af5fae75ebb6744ab911f2f50d96c690d080dc1412a7a4ae5a942e9a34b.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1520

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:444

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2208

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:1060

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3940

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1016

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2448

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:964

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:1296

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5080

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:632

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:852

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:1712

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4176

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:708

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4884

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4744

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:2068

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4384

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2556

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:4364

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1500

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:368

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:2264

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4464
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4488
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
  2⤵
  - Modifies data under HKEY_USERS
  PID:2844

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
Size 2.1MB
SHA256 e21708ef55511c4448ed99d0ef2faaa44a4a09417bf0491a71c68fe46f64c721
MD5 672dcf3ec204b496e60a54509fb69ae4
SHA1 10a8d2974bd067b689e13f763705ca6f219ef40d
SHA512 0666f519bf5418a28be9a48b6f1ecc0972cf33a0621649bb9ae90187e63d79b4c7881aa8c661dd5dd314d337c45d4fbbfccaf8b5be4133d4683b3122d7bc9f66
SSDEEP 49152:quYk3H5koUzfTqkkYLO/W2buywzMbOX+T7z5nDmg27RnWGj:q7fTqi90bTD527BWG
MD5 SHA1 SHA512 SSDEEP

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 8ef1b937dbbc1edbe45971dade0011e28e22a62dc80cabfd853236529c573182
MD5 5631e23ab03b9c896302a8b9db6d82cd
SHA1 ebcd0a4c07e8e5d59667e9b3c5c94903feaf457e
SHA512 bcb1f32b59b25fd78460e172535457d1bbd96e384e4d514c5b836974364c7e1a76818ad7a81694f53ecdb3851a2f3ffc8db519dfafe5e6df2833e8ef8b9b59d5
SSDEEP 12288:lsixPwEsHuXznXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:lZFwVuDnsqjnhMgeiCl7G0nehbGZpbD
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 564121af18ded089779ecc10ccd54e3ade2004f4b4ef26cc644ba931f1a1001b
MD5 72b10f0e253fb0b2460607b3a7f0c4fe
SHA1 55f8b9d386c9c848eb13c50af5b52deb3bee291e
SHA512 d92116ec7412fc6c1a0e6a5e4e941407a8027d53749ab69b2dbac5f74eac8ed62d1139979d02a6148c6dfe65a5bb446aac1d63cf883e577ef30f715f3b1c06e6
SSDEEP 24576:a+gkEHfh4CoAsqjnhMgeiCl7G0nehbGZpbD:/gkE/SyDmg27RnWGj
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 6e26123863f439fe594f8cfd8b466c1ddbcd1958b8c15b5875e0339987774c75
MD5 c499d3dcd211ccb0bec6099cffe8c047
SHA1 50223b7a8d7461fdd4b1772d4b894785c4d955a7
SHA512 f21e87799358c9aaca204ad19cc14fe22bdc6656ac68b7353e592f33006bff6ae4cbcf0b0f8819a10938e57dd2cb3bf78279714f97ae316e6442c213fb261e4c
SSDEEP 24576:lBpDRmi78gkPXlyo0GtjrHsqjnhMgeiCl7G0nehbGZpbD:PNRmi78gkPX4o0GtjHDmg27RnWGj
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 b393a41732e2715d980b6f8bd979d2ddafdaefe5348ea06520bdeb68fdb5e8ea
MD5 a8e24b3b47d6a0ee8a9a94efd2246998
SHA1 595f20f0bf9be69f983de085c4057086fab415d8
SHA512 0a73268636f385f4836e4e97fb553f916ac80ef5101e9c313c6611fcb2fa4a592cf154dae99038a4ff613450e6760d98f2c7f20e6471672feabc1a4f04236340
SSDEEP 24576:wLOS2oTPIXVAsqjnhMgeiCl7G0nehbGZpbD:o/T/Dmg27RnWGj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 311581ed17514347f467354f614c924c778c17baf796973e8d3dca0bbc5dd649
MD5 2c9d46772cbd28e6e60e38ec5c8efe73
SHA1 84bb1be1627a01e3488221e8450fb544c0713fe2
SHA512 e0eff683cc27215df6b785d7c590075dde98d8410227e49f00b51ba6227a9d622568c662f4ba92309ac67d7455566a030072fee28f54dba8556c555163ce0725
SSDEEP 12288:Ot+Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:Ot+sqjnhMgeiCl7G0nehbGZpbD
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 5aff3575c747da9c0a390c7266636bd9556093bc8c9d91331605a7214719e062
MD5 9deaf7e8b6089e7d0d65c91125f03af7
SHA1 3f4ca8397f5e14bb73269273d3ff888b2590cb00
SHA512 6b95476bee5ffdf569457a1570df5e80d90faf5e2c4061353a7f94392fead7a4b4e1175408d9839a8ffb9c6a3f4c78854bb5984a592dc9ce9d7816d333895ca7
SSDEEP 12288:DeBNUbTVO86UtXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:DJIUtsqjnhMgeiCl7G0nehbGZpbD
MD5 SHA1 SHA512 SSDEEP

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 8f242d71cc61dcfc60894b606da5d2eaf0443491d6430c4d96777705050151c8
MD5 b8d50d91cf9a4fc16f1e6fda517223e6
SHA1 2c9a82a2d57086307afaaf8a7d8053101ad1e335
SHA512 e8b39036480f721b76ddae64e109616c99685e36c35b3fb0405660129dab9b1ce1c8d0fbc688a024a825cdc5a8a14b9c8a1afc9180494ca86cf21bf60abc9354
SSDEEP 49152:LQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3TH0:LQvGAdlCEL8c/DRNw5CAD527BWG
MD5 SHA1 SHA512 SSDEEP

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 0410a01050313676a079a4431a660fb0367baf13d141b00d51f7477dc763a723
MD5 d0bd76ca2f752fc985122020a96f7fec
SHA1 cde92d806d6d55b0450a2b6ed0ef5b3a99c25dab
SHA512 96788bf123c1762ec4ad8b10573bbf0c7e5ae43f419d7b57ae460763cc097b512b25e1289ffb0a6bbe46b02c6af4aa8a4399fc06896b652986bdc5d0b2979784
SSDEEP 12288:bAwSfxL/2Dc3RDLLmt0LDQewsAjvXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:E0ewsAjvsqjnhMgeiCl7G0nehbGZpbD
MD5 SHA1 SHA512 SSDEEP

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 2ea2fe881fa03579197e66e9054c88afb0f5fdb9118efed8083eff2d160963c2
MD5 a008fd94596d51d8d070bb61ed5cf429
SHA1 844b0b0e806028074c600bb0dfc65a0917283e3d
SHA512 95d84e07e24ce453a298fa8edc15ada59bbfbc6784ff82b22d7b8023573fe054a55d40f46b6a642c405623fcb379e0a5c19281e0011444234c6af7ed171bf703
SSDEEP 196608:qUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHrVQBWG:qUEtQevvqc2W1cpV2tI32CB
MD5 SHA1 SHA512 SSDEEP

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 2e4a35f9d05bee77fced32105cd781d2eebf24a8d9176620219d63e16b81382d
MD5 c0d2c86d9f4b33e9e647d9bc62e61e84
SHA1 517e32f15fd92336f6f4a8ce5cee5992fe9261e1
SHA512 5942b9f5035fe6195e7dea314de2d9c0b311e0e93cd5418d404effb779177f033b6b8333fe2bcaf5a5a31142824f12b47b610196e8fdf2b2af9fe2c3737f4771
SSDEEP 49152:eCbRquA/m2yL5zTfFiV+XenmE3/zzDmg27RnWGj:ToquVjnmsD527BWG
MD5 SHA1 SHA512 SSDEEP

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 b3098018ab4193a12f0e1ba21c7c4ac2cd4b7a77f2d76aad18fdc633a86fe664
MD5 49063bc71cdb11079589b68cf4167bfb
SHA1 b34ad80977c464b73499550199be8fad70d6f473
SHA512 d27c15b85fc33ef8eb3f8ed5ec1e8f126bd8f090511fce51f996ef0607e7f1c7e3ed8493d882a715e4d830a117c4c909da627826d61457df111e7e12577e683e
SSDEEP 24576:AAhGL3IFoiwtA5l7S53QsqjnhMgeiCl7G0nehbGZpbD:AAMUFoiq5cDmg27RnWGj
MD5 SHA1 SHA512 SSDEEP

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 6e3bbbaab1f0e65f7e37f839c9ccc1cd7ace8898afed94c76a0e77231f1003d2
MD5 218e57eacb45a5fd3b2dcface222c66a
SHA1 413e94d51e2a0c756399b58452a53b2113d73b8c
SHA512 9f424d1360ce4c15ff220716a5cd8700958c3c1e31d8420911925e671571423bd0a41679f5ce0647ec1c5b54de1193bd8f36a95efb8e49c2bb8e5c02e1a71376
SSDEEP 12288:Xmw5HEjsChNVBFgl0WDm+CUXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:2wu4OWLsqjnhMgeiCl7G0nehbGZpbD
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 80f40a2e9ff7e7fbec7e7616791cc6c30052a70b555e8be9f8390e61d689828d
MD5 dbf683088ccc68d254fec08d6f09f963
SHA1 8e404eff80910b25a7c4baeecf4103f779948160
SHA512 d9472f09f39a8fbc1c06f50932749b1f95d67c600f3ea021f3433a9193d2e256d32a772fa6f9f047c9f1e3209bbc91b87ede461ce47a86ec1a6410fe648c90e2
SSDEEP 12288:peZ1IyfXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:MZuCsqjnhMgeiCl7G0nehbGZpbD
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrmstp.exe
Size 4.6MB
SHA256 2582569501f50136d6fb543e27af3595704cc326aad2f20a717dbe704b43a1e6
MD5 f41f4c4513581952623f736afc997c6a
SHA1 0f6d8252eebc174949081acd8e5b69113d4d1847
SHA512 ced40a8772f0467594814e05bf89c302bfa71eb8d6f4cfdabc86cb0cf32cedb2d04a825971b64c9f83bfa96c4c6dd2ab001366e78fc3d055ddf265c2f1656892
SSDEEP 49152:kyEKQ5E3ieGR0PEtBFUow1b89eX611+2xmepn/TRijbqYW3qkCbDypSfe6qwiXEI:eq9ceqz+2xl/SSayAD527BWG
MD5 SHA1 SHA512 SSDEEP

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe
Size 4.6MB
SHA256 981d4956f061a3d92e83ada39f75375aa7d4d570275d290e898e5cd4d1645cb2
MD5 b4d0730c18b02c74d3c0beedbdb76b13
SHA1 90ea57fc124937c55819c7c88d7449ed6d9d207e
SHA512 857ab5f918c72d43f6a54589dcc417e931dcd85f2898eb06e48de13a47313a5d1170c9c0291794c7109df40b88621d469472af39c047fa9447ac00a5b8cfd9b0
SSDEEP 49152:byEKQ5E3ieGR0PEtBFUow1b89eX611+2xmepn/TRijbqYW3qkCbDypSfe6qwiXEI:Pq9ceqz+2xl/SSayAD527BWG
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\123.0.6312.123\chrome_pwa_launcher.exe
Size 1.9MB
SHA256 e007ee3174b3814d490468538de452efa6ee89ce452dd2ed7d70974febb7dde1
MD5 579478c2f69e2b5ed120d1d024446a58
SHA1 a6165655dc9b95230286b376834aa8038729f390
SHA512 8ed101118563336dae7c44fb5520c4e654b4c6c520148fab762cea1d275072092c65b09f9411bf57c427309d1e65d7c05bc25318b8d03c248b068da63f0ba608
SSDEEP 24576:XVN8FYh+50m/YOn/xvNSwsqjnhMgeiCl7G0nehbGZpbD:XVOyh+50zyxzDmg27RnWGj
MD5 SHA1 SHA512 SSDEEP

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
Size 2.1MB
SHA256 844ba0ea1fb46499dbf5f39448238c7e0c94235ff50e47a811b2e8cd9ee5c666
MD5 b2b38f99ae20c8445d4ff5f39452075c
SHA1 cc609dbf10701e364f04d45effc7193733dbf10b
SHA512 d3a3df07aa3e6144bd9855d47486f8a6b0b42b004af9785e08cc5358162835bf14f58382eddd8af99ad281420abc2708d095692bdb025dde8d16a05626098be8
SSDEEP 49152:Z59PYHvI7wi/2IKuLFrFXlMWGxbgdDmg27RnWGj:ZGg2IKgM+D527BWG
MD5 SHA1 SHA512 SSDEEP

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\123.0.6312.123\notification_helper.exe
Size 1.8MB
SHA256 341e952ca071d336ffeb35c991b490050b6375b570466cadfd9a6d838fc0e4d9
MD5 c361f0ccd8519887058ebe38f2f681e5
SHA1 2fcc9885bd67cf9d7c9ebb38dfaf9ba1cedb6686
SHA512 727b581365190a01e1c7a77e9abf263a763ac234890db683f0bf49dad6eddc22bd335cd3c58b58db6cc1c725a438762e013d146b87ea9c5a2b1394134504092f
SSDEEP 24576:Hb6+S3zFphRwMVCLDnyhECINqzWipIxhysqjnhMgeiCl7G0nehbGZpbD:HbrUzFjGMV8Dy9INqZLDmg27RnWGj
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 1.6MB
SHA256 fbcd588c161d65b2fc26a00a7dbcd52ee0132c50e8596cdbbbd10fe898d79acb
MD5 631f8ae1f37ab1797f4971091e226ed3
SHA1 6c20d134cf4199a5120d49616751d287c2718489
SHA512 aa048e65b164c4feb2cb538c66859f9f39319f316a45d0d9640b3926f3a37147a4168bd52790079ae681819c217ab64356c3bc3cad940f03fa9ca8f4aa1d3013
SSDEEP 24576:y436epN7wzPROWFW9sQ0MtJrsqjnhMgeiCl7G0nehbGZpbD:y4qiwzPASW9mMtpDmg27RnWGj
MD5 SHA1 SHA512 SSDEEP

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 318838dc0865d14b11c8d87c637b2332cf94c9dc8519fd519cfe509556dafeb1
MD5 a256a03a5e41464dab04637db96a3982
SHA1 5ef2390eb49f0403164b098d199549eeb2af7b30
SHA512 927cb93aefbc4302023cd4c9ebf97167c662505d1e177a7bb83319122909aee353cd53209e0e9f4f947c691b05884b653026cc07b5e4ffc261c61a9856db83e2
SSDEEP 12288:W2Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:W2sqjnhMgeiCl7G0nehbGZpbD
MD5 SHA1 SHA512 SSDEEP

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 7e62e77419246faf26d895262e8a31bf68708fcf6471aba265804bb72b512f7f
MD5 154339c544ed1aff4ff7d89d34cb95d1
SHA1 4fcde6df9490d9330e5c2d6f40040d46de6b1656
SHA512 51d87babf4cb3b7d46bf60da02e195a148335282ec690b9f148d562470ecd3bc8d4abfeda50302f90c27e755af10028f2b56f8aeb25ba95b047a55e44dacdfcf
SSDEEP 12288:STXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:STsqjnhMgeiCl7G0nehbGZpbD
MD5 SHA1 SHA512 SSDEEP

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 07817be2b81a7c5441e4154c22d501391aee5170a16bc3febbc3213872933abf
MD5 635e638b0abe6afb595f14398d94c767
SHA1 c9b9c301c698ed4294d1f0da13c4506b747daee8
SHA512 851198e2b03e0ec07db1da1a9cd29df41b9ed6603b56185e1f54fe203044241834957907fc5ca22f8072ec419d772a95906b65926ce83e1f18c2b7095ea1e8ea
SSDEEP 12288:mFXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:mFsqjnhMgeiCl7G0nehbGZpbD
MD5 SHA1 SHA512 SSDEEP

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 b6626f2bbb45e5cb2e90c80d00896d0d3b29169900149e2cf041cfae73628d7b
MD5 85c88e13f4a75f57af0e2a4227cc1e4d
SHA1 46b5e3356659406c10e39a6fa62979eb7f59c903
SHA512 c2d25f8819b03292361dae888c4228dd76dc178d91d1c891e6a9e637808fd2e58e3f30ff4cc0537f53ed359476dd0421d15cde05936c9e7b8d3eb915651fe5e6
SSDEEP 12288:oVwXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:FsqjnhMgeiCl7G0nehbGZpbD
MD5 SHA1 SHA512 SSDEEP

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 5f9dd36f229b2ec1d6e8854cc1e838067402a87fed063b33c00c7aa1e24f323d
MD5 0cbcb56c0d6a0a13f1f8a0d8a15e60aa
SHA1 0a359d453d27eeeac66ae5e58780cf7c5c2c2e4b
SHA512 a973e1216b1a11603ff2fdcbcccac15e23a7d745f2a8e96599a3c059bdb7a3e89ec5e3444f097d6031e1edfad1634c448f070d6c52c1950961b535eb59ebc74b
SSDEEP 12288:G4Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:G4sqjnhMgeiCl7G0nehbGZpbD
MD5 SHA1 SHA512 SSDEEP

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 385c65bf64d157633753c361ebc2e047e8003b3422326b34129c1c316974d890
MD5 5fcbd121efc3a9163462a74d24b86f60
SHA1 a780145c99eeb214b19f3f8c2c0386f17ec932ed
SHA512 bed80add26d360779ef4e4af90f5a2b1e0a116f6478eac37a813c8d3ddff3d26253e7c9db99a57f1a50589a508b5f1dcb823e865421801612fb7ab804ef2c17a
SSDEEP 12288:JHXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:JHsqjnhMgeiCl7G0nehbGZpbD
MD5 SHA1 SHA512 SSDEEP

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 da17688328d8edd74597d0a41960a8adde0f1410964be8fbeecdde09163229fb
MD5 4a476c582365ddbb05fdc73bf9cf322d
SHA1 684f1c02f6b1f864ae98ceca59e9339656d7289d
SHA512 4af64457f470b23c7dd17ff4560e7dd65d4f6621e0265522bc38a1c9d5d325413f82ba634c672cf807f2cb4ff90abaf43ebaa92b7a36efa298987c408eac7ce1
SSDEEP 12288:ebXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ebsqjnhMgeiCl7G0nehbGZpbD
MD5 SHA1 SHA512 SSDEEP

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 8addf0b7fb62d2772fb422df54983ecb820e0a5924283d7f52815ff2e9ed1aad
MD5 eb679b21a05d964a184d129941daa37d
SHA1 1e4ab20783d23775a8894867e2277309aa53c416
SHA512 b8acd87b2679e8aab3536b26ac09195fc330448e7824d6d350c86f7271529b42ab5f9f13d6785b7ae0eef139b56e53e94e3510cd8654b696b0a9ef18e5f0fe2a
SSDEEP 24576:QZMRzFVSOzsqjnhMgeiCl7G0nehbGZpbD:QZMRzfLDmg27RnWGj
MD5 SHA1 SHA512 SSDEEP

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 c607d14b06d729852269cec91c30112d6344d02d97ca7bb98ed865241c5d439f
MD5 35006e733336494330339d9bbe4b853c
SHA1 6d22d017e48a0038897e176840813b92a89efdaf
SHA512 30253e018b1bd05388de5ea4a1a84dc59ca8013f5627712dfd84616fbda1e9a9ef5f1f78c7aeb7375f9df89fbd58bb6a6e465e973ba488176dc68259e37f74b5
SSDEEP 12288:oyXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:oysqjnhMgeiCl7G0nehbGZpbD
MD5 SHA1 SHA512 SSDEEP

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 d4629dfad051b579a13fb96eac86e555bff4884e10aca7392293f8b32b107f85
MD5 0fe9ee3036016b1a30ac42d6e40cec39
SHA1 1c1459460c0dd813237fdf7ca9f0a7a718ada787
SHA512 ef9a74392139f9b0233fdd251f98102b405b78fe6eba90389d0398909e6b4a17ff14c1df47fcf1beca2ddb15e94c0c81dd16b283ebe1714774f7515b044c25f1
SSDEEP 12288:yuXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:yusqjnhMgeiCl7G0nehbGZpbD
MD5 SHA1 SHA512 SSDEEP

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 b6459c7c524af3c7cb94a53f94250e0486ec4063047b2575cb8a92197b2aea7c
MD5 947700ba22cda9b6b6e339829918943d
SHA1 2d925f8ecc166c01bf6522123188e1b96ed433fa
SHA512 e4fc372185fa165abafe9201acd7fad5d924a96b2685c3240464631d9f5a873fcfd663d879a6f0ecc24e811ade08f2ba7395c9480a033c9d879a584ccab0c1ea
SSDEEP 12288:jyPz5L8fXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:OzyfsqjnhMgeiCl7G0nehbGZpbD
MD5 SHA1 SHA512 SSDEEP

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 b2ac92c00330b74e62ac61e68e03fd820ed223498a6e06d1f1af57bb664fd6f3
MD5 3fb7c1383b06ac8dc50f939cadb0be13
SHA1 719686bd7401d6bdff9b5ea43cf8cbaf4878bd48
SHA512 83d6a4ac5f3c22067df09ad111e4514fc84d20fd1e1a4923a98c2532beed31a2ea9496da1a29fa73c6b623bb2533d0dba913deb7759ce7ce64e24b3e20b2e290
SSDEEP 12288:dyXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:dysqjnhMgeiCl7G0nehbGZpbD
MD5 SHA1 SHA512 SSDEEP

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 36ff9c25fbeb3b35ced6f5c19e09266f9f4de07f203ab7d8037236b8e61e2a24
MD5 84e7f86a6ac0f7a69dd6e1729dafad13
SHA1 0cac93d97a224a51cc3d95343d2cd87fa72d1a40
SHA512 268b85bce11fd2bb2c07220fdfcaef956db8fd939dca4550f8c89a5c7427890f9698efe41e2ef163d6cbb06926f441b4796afffe13c4c6c0c363230ef247e140
SSDEEP 12288:hyXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:hysqjnhMgeiCl7G0nehbGZpbD
MD5 SHA1 SHA512 SSDEEP

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 009823630a56b074832fcadbc9a6e914ee4ab44f256db7e32d103b271727845d
MD5 cfe8a3fb84d5e57ed95523505bdc9243
SHA1 2ceb5b76574c7e9a31f75b9abc847ad6f1531d09
SHA512 aff2b5fe4d785d0c641d300bb55304e3cf8e384c9c202be72870d080d45f1782d84466fb6669ffb87b6b99a4860357143ed87d1fb5f56d14c3b81001ae2dcc3a
SSDEEP 12288:EyPz5L8fXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:dzyfsqjnhMgeiCl7G0nehbGZpbD
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 29703f4ccbec903cb7ca7c09b1bad8bad601d6a65027789ad68fc774d6e2f9b9
MD5 8ef6a654923ed5c151d6eb9c3b1c6609
SHA1 9f6a1afd32d74cd8e5ac72402119b1a48185fb08
SHA512 4b8ecdd2d46c9b9f058d69ec0edc0be29db8d8862e8ba2bc6ab8ef241360515a98665a31db52ac5b9921e11c669ef6ce6e9bf16592bf935768c57b43a0802739
SSDEEP 24576:LTDaLl3z0zDVsqjnhMgeiCl7G0nehbGZpbD:LTuLljQDmg27RnWGj
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 12d59d27b7350bafb691d2bb3340df3aaf371167367e2ba30c288c578196be53
MD5 f53a374169fe660b6d6c93c7f23194cf
SHA1 913aabb6f4b86fbfc783cba7fcf6d4f20720c7b4
SHA512 4f2ee2d58ab66cbf4bc6a6a1ea1f425e6c9e5a4339f91d77bdd8ef3736f055b4b68ec598efbeb5574f23ec1f2f833ea5e8ffb4c4edb00ca4e0a805797dd489f6
SSDEEP 24576:w3vd9CHKy7GZZsqjnhMgeiCl7G0nehbGZpbD:6vd9CHKyaLDmg27RnWGj
MD5 SHA1 SHA512 SSDEEP

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 d5089b5c70d58b3016ea1683098f11ced41ddf652c1adf977f29fe67dcc7239f
MD5 4cf4589e430359c81bcf082a7cef1cd9
SHA1 ca4a58be5fc793150dafdcecc8e249438f1e1429
SHA512 b3851d4b92d79b615aea846e9dbd4ad8bd65ed46ee0c1344e6da9adf572e817baddba0907d3ad0dd9a5039f354eaba04e604adbc5314411fb69a2e60e298fc99
SSDEEP 12288:olXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:olsqjnhMgeiCl7G0nehbGZpbD
MD5 SHA1 SHA512 SSDEEP

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 5390395a421a078e8ebbd2a07e31674ae01d4ff7e03a0a70ad86646e90a043ce
MD5 67b3058d85005dde9aba4b2b98511731
SHA1 41fb2a7b8b73c1dbcfd22f057996c2dd727d04d1
SHA512 055d90ad52e91c54edd30c7070b60f95b31b713a76fc558299761824b0d76d50b4d0125e9d6a96311902c1ddd235749fd3871ab7040f491649888e319fe45e1c
SSDEEP 24576:dcP4mcvIjkGOxhKP2l71SNKbrh/8KBasqjnhMgeiCl7G0nehbGZpbD:iP4m4IpOO67N8KADmg27RnWGj
MD5 SHA1 SHA512 SSDEEP

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 dcbfebe4bc9d66a51ac4494ba685d0e5945eb7edfe96decbc8cc6e0125b8307e
MD5 040ec2915bbecb2dafedf8fbdc0c7973
SHA1 6ad08edb70dd53842bd6ed2a1c53c1ac28207886
SHA512 d2b19221b4ae382a76489796f3f7cd8ee473d398852d1ab084b3d57c3eebb089b56862d674ce8c7752282b6c3c6431d91847edbb6dfb6009e442cad620482957
SSDEEP 12288:AUFmDDLpXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:6psqjnhMgeiCl7G0nehbGZpbD
MD5 SHA1 SHA512 SSDEEP

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 2e1d5f15ffe199b5addf658f01f6079201dbb9bf4f884035a7829a2fc11b6cee
MD5 9b426686cc63a010735e5861ed398bf8
SHA1 77560fcd55d11d1c198704b676391667bb6ac135
SHA512 e0114f1d7b11c662b3adc5ea11e4ce1afcf11293f1089fb2c3086e73b8382606d15946d70f1bbe73d9e2d33ef567be6bd1c26c239798c006fa28ea58b9544270
SSDEEP 12288:kiXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:kisqjnhMgeiCl7G0nehbGZpbD
MD5 SHA1 SHA512 SSDEEP

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 297a1d17326a5e695963f4d129718b3b2067d5333b6f5db485ed2383092b4aa5
MD5 6615f431f122f3ac99208fe522b56516
SHA1 c6bdad088acb9dc041bc854f86c27c45e19eff42
SHA512 7530316f119de1e0cca0d63bebced90ec81a4340a31920fd059ae5562a9f5da1ae2ba85855fcde9a346e045432cd0ffae1301296a1490e34974f9e59d1b51878
SSDEEP 49152:xa0h2GEkuAe73q3pp46zwwQkDmg27RnWGj:xa0hNYG4JwrD527BWG
MD5 SHA1 SHA512 SSDEEP

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 744ed1e97c0728c6c3cdf7d82390a25cd8aa71f5b7d472a3e923686b6b501efb
MD5 91fb3a46f7b6f0260ac5c6268f85717d
SHA1 8b4ddac4ce85ddb7fc6602ad9cc2649124babd03
SHA512 5b9e0b451a0a632eb3fee0ddb9450a6323d69365258bd09a304c6c782f7488ba2159eddff1aa645030f0a668a499d2bc79e24a5dfd230d776d002b8d054f11a3
SSDEEP 12288:xhbHjfXjXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:xhbHjPjsqjnhMgeiCl7G0nehbGZpbD
MD5 SHA1 SHA512 SSDEEP

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 a9705a67b1e8c96b880e9e38cf3334712d46e29c16c58d4381e94814d81e823e
MD5 6c85da04d0577d206d6e4459da5ffd01
SHA1 c3378abcbf853e3fddcbf1905658a628a5efe0c7
SHA512 eeb0fbe314f7b3a4af694e0754e1160d8778c185f276c4bd1d1bf09375473b99e0a1d7315726a59ff86e4ca3976ebb7943ab53ec6590c8547ee36678c31d8ca5
SSDEEP 24576:S3YgnJcRTk4yti+R5dpR/LsqjnhMgeiCl7G0nehbGZpbD:SIgnaTk46ppR//Dmg27RnWGj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 bde7d88387fd9c4cbdaf888d36a93ac0d14109ad3d648ed32b6ea81e033b091a
MD5 71b7436f2d34924d514bfb38657bd264
SHA1 c186b5ab1d0c199afafec42c94675e833ebf9c51
SHA512 587c4c70125bed0c3f4b51422661eee87d580620a3fd803431906de946fb7fb887698f67b94cc36ef822fb4bef4d6e61bc11ebceada6b6efe10fcbb03c06cc3f
SSDEEP 12288:peXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:pesqjnhMgeiCl7G0nehbGZpbD
MD5 SHA1 SHA512 SSDEEP

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.5MB
SHA256 41ae8f00c803fc9d076d451befd26779317aa879b1fe76fa4e8b9371e64c6e8e
MD5 aa12ecc6cdd10d3b495202ba6fd3d2df
SHA1 502347caf2957f805639ddd8d57a1fb80364f1ce
SHA512 d71a0af2676f94cbb53ae5b02379c110874ac30718b5ae254c3bcfcc3f4d608ecb537cf8493e0582c2a385a0aca9518a5e26ebff5fb6db5b6f38bda904c3de54
SSDEEP 12288:dObfA4LWOsvAYFThXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9L:6bL3UThsqjnhMgeiCl7G0nehbGZpbD
MD5 SHA1 SHA512 SSDEEP

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 2279d7023ae234714591d126c6a3c7e4383bf7cfa23913c27e23e8578cfb4f57
MD5 8d37c9dbaf0cf07935d07415d48c3811
SHA1 ecbbfe3a73d2fbd4fb27b2e74375cf51af324941
SHA512 cdf3c7db52d7795e3e34a05a0dc93946bc2ba2dfef3b8b547a107f58aec77eaf05ed4497b7c7f52bdd78a717756bd55b7ac0026f08b4f3ddd3e05fe5449be4b5
SSDEEP 12288:upFtIONXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:1ONsqjnhMgeiCl7G0nehbGZpbD
MD5 SHA1 SHA512 SSDEEP

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 7f869ddaf1ed9a74ad0486efe6ed1e1de19fdabe19579b6e06e0c3bc193c2bed
MD5 fcae0f86c3162779b4cc23f7e5947080
SHA1 e2412f73b6f6e1fe4defd538e6839331bde760a9
SHA512 6dcec0d29c11cebab81903c34b66812c2c3c8688aa633f45b0f8c39b651422b851178179f4d740b63c3bd559dcf98aa00e97fcb1354313c44c38e67c197b18cd
SSDEEP 24576:o7NM9YmZqmWMUkPjZM48Mv6bEhsysqjnhMgeiCl7G0nehbGZpbD:o7cBWMpPjN8DbEhHDmg27RnWGj
MD5 SHA1 SHA512 SSDEEP

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 408b09bd40197d32af5bf0db44942aa68ebec3f317fb6e09afd0b8771354ab32
MD5 0f3ca755ffe1bc13d37f5d38545b78a0
SHA1 6e6487cc965b1091800612e18077b50d9bf5c332
SHA512 28d2b0a8ad5a85a643c72afbdb391e5f7b26eb450bea6fcf778584ab56367799f09832b0ad0a8b53d4cdbfca7ca2ff7c6e3a907c76f30acabc08fa79f23070ab
SSDEEP 24576:7W6BApg2YuyuNDYTabvcRvNYf8km1csqjnhMgeiCl7G0nehbGZpbD:7F2YuHNETovcvNYf8kmWDmg27RnWGj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 eded5d91940acf96b30f6f1efb4c2ff9508a2fe5763c438d8d6ca04ff2f3e6b3
MD5 2068aed90d41db3cea8690d313538313
SHA1 fd56fdb5af40f9c17009fbbe921391b65e216296
SHA512 b51bea9905ef20fccc8580d191d4f976437bfb6f5a8d47eb9218c70b38005c4ea12255ff2f464b8628237c7af84d8a8be9356328645a64333305663699456496
SSDEEP 24576:oAFs06+OmlfkNXEbToZsqjnhMgeiCl7G0nehbGZpbD:tFs060lwXuEDmg27RnWGj
MD5 SHA1 SHA512 SSDEEP

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 94f787cd1578497f86ad3896de7837275e74f5cb2fabdfed8cfa20a4573a602c
MD5 fd64133d9cde1a79f31d6e6d0d04cb98
SHA1 fb9eb69d2e55d3668f3b0a0ce0151553d975027a
SHA512 2a6405a550a900c2ef4a0a7d716e8e72a077a64e7a2a889ba7463c26b27d3b97a466fa89dfbeab4a690df43ebf36dd40bffccd0cadd20a44c6eb3bacddc32dfa
SSDEEP 24576:aJnJ5D3WtYsqjnhMgeiCl7G0nehbGZpbD:aJnJ5DGtEDmg27RnWGj
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 be08f9b1d5534f7b6aa3c2cdfe84f3b75222bf00a62e3302264b769ff54df960
MD5 8a243400c2cba32d609061014ab3cbc1
SHA1 7ad1a9aa391ad41b92a455c83c72359a36bcbd34
SHA512 118766a01f038650a0a96c0abee184810557f89b7aecacb7e48bf095be0141d41046498b8105859cf693b0cc49ce7a35ae53b991979d6b17b88a18b2e2391db4
SSDEEP 24576:wEPohm6/7IIXdwcXrif7qQncjlP65i3VuLsqjnhMgeiCl7G0nehbGZpbD:Po06DIKdwc+eQnSt65aV6Dmg27RnWGj
MD5 SHA1 SHA512 SSDEEP

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 32b7052bf0839377a2afec3efb98c6d9c7b089eacacca49299c19e9f5198a391
MD5 1511716bdcad9ac461a2c018b28d7703
SHA1 0b42f04e3f5538b2adbce7bdfff9a75bad406d28
SHA512 1df1cc3f4047ad139e6687de8ba97b74bec0e6e3516e28c02fce3d38c1c676f1ea7337d9cd4725087a962ed9e2e85b6fd42fa3a9c51a2677844c330ccad5074a
SSDEEP 12288:fEP3RrUXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:krUsqjnhMgeiCl7G0nehbGZpbD
MD5 SHA1 SHA512 SSDEEP

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.3MB
SHA256 1b60ae03fa94fbe1d7cae1a1cd5bd7255bc3cc70b5c7c660fb0943efe7cd9fa1
MD5 c5366470b4014a96750006c16879b709
SHA1 4f600d6e6ef4c21e7bdcc6fcbe345d32e2cf7132
SHA512 c2e14b7ab71bc37ea54085648eaa86b657f0351489e53fbc773ac5b7da71a67628cc1268b2b11241886bd4356e47fcfc00a618521af287c7f3a32c00755d06a6
SSDEEP 12288:pjkyTXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:pIyTsqjnhMgeiCl7G0nehbGZpbD
MD5 SHA1 SHA512 SSDEEP

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 bc8545a519260066a8af279d79c17b8203ad04466e31c7c9f94f6754632c7d2c
MD5 be78ad64eb47b2d196b3506fdc7f71db
SHA1 a1ee4441d92cb92e5f6bd1869a3dc0c17648a855
SHA512 b09c4e8bd876f7677a0afc1e5f15c65c5a566d193d0da1f4776f735028fffbea6ace5df8b499083eaf6347c8f5e19db204303ffa2d98f3ea04143d9088df4e98
SSDEEP 12288:BF9Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:H9sqjnhMgeiCl7G0nehbGZpbD
MD5 SHA1 SHA512 SSDEEP

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 e2c649115458178ac8475474d943369f39c558c6440f2d2f2a63b3710ab84967
MD5 34069862d25c2763c488e847051718f9
SHA1 4c2e1adea1e1e3d022f4ec0e993dcdb2dbef36b7
SHA512 b2abfeaa44d44caf0f854a7d0da0c2b06b6ca5958457bf72ced7689217766aee9e5f2e24aa9f26871d25ee340ae6b5a8b3b3399c9cc421dfe26c8d3fea62d755
SSDEEP 24576:LQ9MxZKdcz97w3qsqjnhMgeiCl7G0nehbGZpbD:LVKX+Dmg27RnWGj
MD5 SHA1 SHA512 SSDEEP

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 ea00c16d7cb0131a3b968a6c6a912ae4102dc810df04248ea73e1eca1ea4ffef
MD5 f2064dd2e61fe4ccdaba9230db4381a4
SHA1 a46e79c3419bf8395bb5c610b508d5638a171029
SHA512 556f4d991cc23ab5bc8dbab56288385d5d6b0a7745ed4c79b12131ef9efe6173ec766f2948d03d327917f21cba1c89f380fc8f32f9e5616d7d7cf7e29a79b93c
SSDEEP 12288:8yoKo2HRple9pvXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:8yocxApvsqjnhMgeiCl7G0nehbGZpbD
MD5 SHA1 SHA512 SSDEEP

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 07c113d7c5b0419139b61127cf663a73953e3ff3df59c9e8ffbe01e6ad15009a
MD5 3d5362587c109c071d5d0fddd94dab25
SHA1 f80b67572e51a7b1874d7fd544d9a435b66b92d4
SHA512 eb063699b893e5272c8cdfb92a11beaf21720e7be8b63f1a4dcc1727bdd0948b90718de524e72526b675afc3101c9d258ef950d6a9033751356b2eb813b7cfb2
SSDEEP 49152:iWcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIKTDmg27RnWGj:U0zuNIvD527BWG
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 cfe889391e837b2c8b57aaf548084889feadbcdfc8434918841e00d86f110598
MD5 af2290f73d5f1eec58478d83e0c244c6
SHA1 a305e800a0750d7b9f5439c56d30fd09088af8f4
SHA512 77d35cd21400176f7324963b7bead77825f7319a0b6b5f957db8f9390a6c73613ee8f454fc2f201c038901ad7f2871fc38a7315f6576a28bb1378ee92f445afe
SSDEEP 24576:L1QT7EcpfxR+N5AWAz3ooiYujMqbUsqjnhMgeiCl7G0nehbGZpbD:2TDxR+N5YzT4jMRDmg27RnWGj
MD5 SHA1 SHA512 SSDEEP

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.5MB
SHA256 301c481177b60080c54d264aeb6686907c223be9b8118b9f40d089e79f0f46e7
MD5 d4f282e6e2ba5200b694594fadf1070a
SHA1 cd46b476ca5bebb3b917b59809b742ebef8478ee
SHA512 ca11ba78ebf3fe64430a2ca9f9ba7788e34d10d748c5ed76e34991fc4c927ab02148bb9806640f04d9eb00b2cc13f125fad732e54e2ca40c556111d8ef5ccbcc
SSDEEP 24576:BTMdOz0FFS+bmSLwsqjnhMgeiCl7G0nehbGZpbD:r0K+bmSLsDmg27RnWGj
MD5 SHA1 SHA512 SSDEEP

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.2MB
SHA256 e9ee43c13bcede8dc029512ef9aa5414d5c74087e84935d8b12b00d7d9d491fc
MD5 a1b9f19f397b7565ec5ae1e64072119e
SHA1 26a9fc5b9145f3e85b69258f70450ea3f859b79e
SHA512 094d85e1d3b31564aa7cb54b92d0a67f2374732b3753cd5f424d5d45fafd79f6ba104a752c0ccf30937de390a914c2703ef851845f1c2fe296e7ae94428a173f
SSDEEP 12288:I47hXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:/hsqjnhMgeiCl7G0nehbGZpbD
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/368-542-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/368-260-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/444-12-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/444-21-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/444-20-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/444-82-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/632-237-0x0000000140000000-0x00000001401EA000-memory.dmp

Download

memory/632-116-0x0000000140000000-0x00000001401EA000-memory.dmp

Download

memory/708-154-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/708-322-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/852-129-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/852-249-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/964-83-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/964-73-0x0000000001A90000-0x0000000001AF0000-memory.dmp

Download

memory/964-80-0x0000000001A90000-0x0000000001AF0000-memory.dmp

Download

memory/964-88-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/964-86-0x0000000001A90000-0x0000000001AF0000-memory.dmp

Download

memory/1016-48-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/1016-54-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/1016-165-0x0000000140000000-0x0000000140234000-memory.dmp

Download

memory/1016-56-0x0000000140000000-0x0000000140234000-memory.dmp

Download

memory/1296-201-0x0000000140000000-0x00000001401F8000-memory.dmp

Download

memory/1296-91-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/1296-90-0x0000000140000000-0x00000001401F8000-memory.dmp

Download

memory/1500-247-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/1500-494-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/1520-2-0x0000000002370000-0x00000000023D7000-memory.dmp

Download

memory/1520-0-0x0000000010000000-0x00000000101DE000-memory.dmp

Download

memory/1520-391-0x0000000010000000-0x00000000101DE000-memory.dmp

Download

memory/1520-79-0x0000000010000000-0x00000000101DE000-memory.dmp

Download

memory/1520-8-0x0000000002370000-0x00000000023D7000-memory.dmp

Download

memory/1520-6-0x0000000002370000-0x00000000023D7000-memory.dmp

Download

memory/1712-262-0x0000000140000000-0x00000001401D4000-memory.dmp

Download

memory/1712-140-0x0000000140000000-0x00000001401D4000-memory.dmp

Download

memory/2208-32-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/2208-127-0x0000000140000000-0x00000001401E8000-memory.dmp

Download

memory/2208-34-0x0000000140000000-0x00000001401E8000-memory.dmp

Download

memory/2208-26-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/2264-567-0x0000000140000000-0x0000000140205000-memory.dmp

Download

memory/2264-275-0x0000000140000000-0x0000000140205000-memory.dmp

Download

memory/2448-68-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/2448-178-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/2448-69-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/2448-62-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/2556-202-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/2556-214-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/3940-38-0x0000000000D90000-0x0000000000DF0000-memory.dmp

Download

memory/3940-57-0x0000000000D90000-0x0000000000DF0000-memory.dmp

Download

memory/3940-44-0x0000000000D90000-0x0000000000DF0000-memory.dmp

Download

memory/3940-37-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/3940-59-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4176-142-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4176-555-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4176-276-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4364-236-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4384-378-0x0000000140000000-0x0000000140221000-memory.dmp

Download

memory/4384-190-0x0000000140000000-0x0000000140221000-memory.dmp

Download

memory/4464-569-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4464-277-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4744-179-0x0000000140000000-0x0000000140241000-memory.dmp

Download

memory/4744-376-0x0000000140000000-0x0000000140241000-memory.dmp

Download

memory/4884-351-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4884-166-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/5080-224-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/5080-110-0x0000000140000000-0x000000014020E000-memory.dmp

Download