a8ea267b638ca630326a6363de2585c322cad924edea28793257bf38f3ec75eb

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
09/11/2024, 17:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a8ea267b638ca630326a6363de2585c322cad924edea28793257bf38f3ec75eb.exe
Size 1.3MB
Sample241109-wk4grsskbl
SHA256 a8ea267b638ca630326a6363de2585c322cad924edea28793257bf38f3ec75eb
MD5 9b547d80a1bfb39c24954fbbd43b8aa5
SHA1 7f25f4385865b9230894dd3d2b3defb09d95ae71
SHA512 32207ff8e71eac57294ee035bc3013cebb27cffff7d6763f3ddc20744e86d774d6048c6c19279a489155c5b22778945c2788d30dd0c5251e7d9ba3a533817b6f
SSDEEP 24576:4IXgCWSpRyndSJVDsVu5unzqWvX1Eatr0zAiX90z/F0jsFB3SQk:LWSjaSJlsQuzqW/1EaB0zj0yjoB2
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
2664	alg.exe
3996	elevation_service.exe
880	elevation_service.exe
1644	maintenanceservice.exe
4836	OSE.EXE
5096	DiagnosticsHub.StandardCollector.Service.exe
772	fxssvc.exe
4944	msdtc.exe
1476	PerceptionSimulationService.exe
1648	perfhost.exe
228	locator.exe
4936	SensorDataService.exe
4272	snmptrap.exe
3444	spectrum.exe
3112	ssh-agent.exe
4864	TieringEngineService.exe
2864	AgentService.exe
3240	vds.exe
396	vssvc.exe
1332	wbengine.exe
4416	WmiApSrv.exe
4420	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 24 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	a8ea267b638ca630326a6363de2585c322cad924edea28793257bf38f3ec75eb.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\c9dea559c1221773.bin	alg.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdateOnDemand.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleCrashHandler64.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_73343\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdateComRegisterShell64.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\123.0.6312.123\chrome_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	alg.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe	alg.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	alg.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a8ea267b638ca630326a6363de2585c322cad924edea28793257bf38f3ec75eb.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000020a5f55ad132db01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006701935bd132db01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004e1a0b5bd132db01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bdc0f45bd132db01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001a77895bd132db01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008cb9e95ad132db01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ab04365bd132db01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchFilterHost.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
3996	elevation_service.exe
3996	elevation_service.exe
3996	elevation_service.exe
3996	elevation_service.exe
3996	elevation_service.exe
3996	elevation_service.exe
3996	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
664	Process not Found
664	Process not Found

Suspicious use of AdjustPrivilegeToken 42 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3268	a8ea267b638ca630326a6363de2585c322cad924edea28793257bf38f3ec75eb.exe
Token: SeDebugPrivilege	2664	alg.exe
Token: SeDebugPrivilege	2664	alg.exe
Token: SeDebugPrivilege	2664	alg.exe
Token: SeTakeOwnershipPrivilege	3996	elevation_service.exe
Token: SeAuditPrivilege	772	fxssvc.exe
Token: SeRestorePrivilege	4864	TieringEngineService.exe
Token: SeManageVolumePrivilege	4864	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	2864	AgentService.exe
Token: SeBackupPrivilege	396	vssvc.exe
Token: SeRestorePrivilege	396	vssvc.exe
Token: SeAuditPrivilege	396	vssvc.exe
Token: SeBackupPrivilege	1332	wbengine.exe
Token: SeRestorePrivilege	1332	wbengine.exe
Token: SeSecurityPrivilege	1332	wbengine.exe
Token: 33	4420	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4420	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4420	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4420	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4420	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4420	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4420	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4420	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4420	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4420	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4420	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4420	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4420	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4420	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4420	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4420	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4420	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4420	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4420	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4420	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4420	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4420	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4420	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4420	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4420	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4420	SearchIndexer.exe
Token: SeDebugPrivilege	3996	elevation_service.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4420 wrote to memory of 3680	4420	SearchIndexer.exe	136
PID 4420 wrote to memory of 3680	4420	SearchIndexer.exe	136
PID 4420 wrote to memory of 5068	4420	SearchIndexer.exe	137
PID 4420 wrote to memory of 5068	4420	SearchIndexer.exe	137

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\a8ea267b638ca630326a6363de2585c322cad924edea28793257bf38f3ec75eb.exe
"C:\Users\Admin\AppData\Local\Temp\a8ea267b638ca630326a6363de2585c322cad924edea28793257bf38f3ec75eb.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3268

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:2664

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3996

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:880

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1644

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4836

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:5096

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:5116

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:772

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4944

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1476

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:1648

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:228

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4936

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:4272

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3444

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3112

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:2876

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4864

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2864

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:3240

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:396

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1332

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:4416

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4420
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3680
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
  2⤵
  - Modifies data under HKEY_USERS
  PID:5068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
Size 2.1MB
SHA256 c1346040052d44eab70b356846d8a6eeab6484ee16c13a9834675db6ba163514
MD5 7a66aa1a5f00caccb7eaedaf55a23c3c
SHA1 b880edf08eee281f7e8549876a165ab829feccc5
SHA512 53c6a5dc91903c3f4d649f1b56e4ee3b0f57796cc427267a8b1f808fbafd0b713699ed7f09a023477d5bb614a8862e2db18f34f4e310a8453d4cd6a73b5bd6c2
SSDEEP 49152:CuYk3H5koUXfTqkkYLO/W2buywzMbOX+T7z5JaB0zj0yjoB2:CPfTqi90bcB2Yyjl
MD5 SHA1 SHA512 SSDEEP

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 b35607e38c9e9399f67c5479d4f641c0514d575b41f7fdcc124d27d69b908895
MD5 e9349aad2de517cb8ed5f157834eb6cc
SHA1 d7659aea9d94a2805dcb7d0b7fa7e55055810854
SHA512 7bef9e777d9d57d6b4182f18ba37f0cc219e7119e67463c9884cde520b4d5d81a93e5e9b90d1d444a99534c8d8010d42c0580dccb21535c6bbe605c7e8ecead4
SSDEEP 12288:MsixPwEsHuXzFUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8:MZFwVuDFatr0zAiX90z/F0jsFB3SQk
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 74045da1fec9e90df05bbbd0600b821f1f66a0cabf54cb6df9215dfd75f0755c
MD5 99c482657da9223289af18c8f8618a8a
SHA1 78daa3a3bd52201ee8f40feb6afe60f8b518dd2a
SHA512 93a5161e1633ddb41fcc20f704c785e123119362ab6ec2bb145347b3238c0a0e60c86c8d1ec7b7baa02ce153f9dec963db981678361d56d09306e7ac729c3727
SSDEEP 24576:L+gkEkfh4CoIatr0zAiX90z/F0jsFB3SQk:igkE8SaaB0zj0yjoB2
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 cf98e9618f7d8c4ae30a5cf181de78be9b8779dd5783bc57c6001f2f9ff1e43f
MD5 2c52bd15d92a16d665aebfb99a52b6c8
SHA1 0dab9bade65a5d81810bebe0a47406dfee355b74
SHA512 a55b93b239d41f3835b2a8c2d78e72f4cece91637837ee24300d6cc95b486d9336def7f5fc7c1ef51dd170acb0a4ab737091d9b2e2968d6f9240b01edd9be469
SSDEEP 24576:dBpDRmi78gkPXlyo0Gxjrlatr0zAiX90z/F0jsFB3SQk:XNRmi78gkPX4o0GxjpaB0zj0yjoB2
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 92cf3da535561ced7c9d5df817c322458a401670ec643ec6191f5ca77f0785dd
MD5 fa0d37413f696bd0a6c4374749ce9366
SHA1 92f2a38cb89027e80a87de1dd3fb73214ad1cb64
SHA512 b13b3fd0ebb75e307f0ba8de55b6c5466571aecb1aeb163ef03acbc429ae3ff321a045b6754a0eea24295c425f5d80ebd08f43cae7e9ba80230ac648384d8580
SSDEEP 24576:uLOS2oyPIXVIatr0zAiX90z/F0jsFB3SQk:O/yxaB0zj0yjoB2
MD5 SHA1 SHA512 SSDEEP

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.5MB
SHA256 41bba304c83a3ec2c07317fc14871830884786d69f64e6c2807a7c1f32e84db3
MD5 3e6bea066ed570bdbf8432e26067e3d3
SHA1 eab4e2ff5e9e80676d5ebf80a8dae06f081c9263
SHA512 9ba95a3526120a0e8c5e316291f2740a887c7c789516bbfccbd0f23852eeafdf8dc0b1b5015761e7a7919eac6f46f2fedac835db00e4def2d876139e6e479b9a
SSDEEP 12288:3d6UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8:3d6atr0zAiX90z/F0jsFB3SQk
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 f2c0b51839fb68e6d5c8f5a96be788bef76d14e3370681bf52e0d2c2660f4e12
MD5 0ba7f3495d1ea20f9d036f255bd96c53
SHA1 465f2dcea0c1c69f64de9cf7ac277695f9852bd3
SHA512 435f0eba5cc362e6d6a1739cc5e241abe849393d172deeb6388fb17907d93c60e468fc60c69703616434846928269366f3d8a95120e114b14fad9c7bb284c3b1
SSDEEP 12288:HeBNUbTVO86UXUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8:HJIUXatr0zAiX90z/F0jsFB3SQk
MD5 SHA1 SHA512 SSDEEP

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 89c360c1c5d442fe350922f2165daa765c5ec0f914fb719efbdd6a6c4dcaa458
MD5 06fab8f2f8b423365fb1637e756cf632
SHA1 31e79960379bd2e6dc673d32b5cd9502e3f658de
SHA512 f15e63a2a6785ffbfca926a97bb4898a7ed3e06db6db95e2c19580ff6a03be697eccc928686bae662826c43a2765e929d5fc8f1efa657201af535924b98ce774
SSDEEP 49152:8QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THx:8QvGAdlCEL8c/yRNw5CLB2Yyjl
MD5 SHA1 SHA512 SSDEEP

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 2326347ffec28af8a44b234904e9e37875823db7f981e8e018665595cfccb604
MD5 073c2d2ffbfeaa995759eb6783a92208
SHA1 fcebe2ff490482b2c41df50deb3ddac75bcbe142
SHA512 7675a8d2804d179b7b6cd05b4c16a0f441d2777f4ae17a11ee3d9153f0e064baa423e7c34400bb18a64d3046a3502d703a6f217d7fcf42f27cd723ce7879fef3
SSDEEP 12288:ZAwSfxL/2Dc3RDLLmt0LDQewsAjtUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHU:KUewsAjtatr0zAiX90z/F0jsFB3SQk
MD5 SHA1 SHA512 SSDEEP

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 463b6be3f62272095f6f554960e3e8945085a1c85138422496e50f0b989cc048
MD5 a8080ecdb67ed86ad22594095be460e8
SHA1 a63990e4d4b7e7a98858de15cce1f94d1a8ceba7
SHA512 2a9906cdb199dd118a958e4d303a9acd496e38b1a305f7e48f7b68b3d276da981b843b3a6611857efcaff22aef25c0e70c6f4956bbf6d58859660d1a2a4a6e98
SSDEEP 196608:PUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHkZ:PUEtQevvqc2W1cpV2EI32m
MD5 SHA1 SHA512 SSDEEP

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 0588924b48ce43cc9f48b22209174799f35770c9ee4e776aa42c1287ba610700
MD5 dfd4263fb010e5212dbb77c5bb735132
SHA1 7971080588f084565be6dcc773f1cd0e8caebd28
SHA512 0f39df658d447eecff9d19e7a1d6da77371b83d41f954be1e6092edca17c51a52933c364c35b14e57f256afb486808451fe8e5d133b7012222e801d7a495f8a4
SSDEEP 49152:FCbRquA/m2yL5zTfFiV+XenmE3/zNaB0zj0yjoB2:SoquVjnm3B2Yyjl
MD5 SHA1 SHA512 SSDEEP

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 d9659e0ece9b0b831ff95eb6e3ccc515c6e4dbb6a83b729a9c23f080ba87d4a3
MD5 2bbbc3ff53fcb1aca2b950231b78d785
SHA1 248898a4bb4bd0ef490429cd5696a469e958caf5
SHA512 6b1d6002f8655dab6198c5af234b5bcbce833df829a1340e1e95ae59e8f717c59d21854531e9a2cc6e082001246f6f09c8b3d3007c2d4aab9864b4aca27bef4b
SSDEEP 24576:/AhGLJIFoiwtA5l7S53Yatr0zAiX90z/F0jsFB3SQk:/AMyFoiq5oaB0zj0yjoB2
MD5 SHA1 SHA512 SSDEEP

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 2c5078729d93ae8fef861cd601e5a856fd2c512c9d195df90908c6c74b4a702c
MD5 1d08cab2500fe32fb32dec882c400251
SHA1 845bdbc646b69f4e164ebcff9e62bfa34b84724a
SHA512 e297080aa9c19c4f3221f334fea1dc1451aac1085057788b83715e3a9323ea0d4a9cee4dd99695e368b4445f67a4f8d81e31cb124e632996eb0cbbd34d2912a4
SSDEEP 12288:Dmw5HEjsChNjBFgl0WDm+CEUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8:CwuCOWxatr0zAiX90z/F0jsFB3SQk
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 0b762637db11218c832a1df0418f5fe534eaee1d7210b72d08385e17e575dd0e
MD5 d8e6fb49669a301d8fa8b5b024258c4f
SHA1 29d26edfd072b0803f10af0c57a2ae8181b8aecd
SHA512 59e512fdddc15af34a0882a720c0b0fb5d0e0e787e517acb91a26e92a014708ba15c5e61f509e9cf41efec5c11b89216d47d1465f375fd79939047b169b56296
SSDEEP 12288:XzZ1IydUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8:jZumatr0zAiX90z/F0jsFB3SQk
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrmstp.exe
Size 4.6MB
SHA256 28bdd9078ab1ae05d259fe3527199b70851d2cfe099f19b815fbb3427fe4ad31
MD5 fa98470171e3871529d909ac9ddf1695
SHA1 fae990a1e0300ad859efada87f35d410bea8a9db
SHA512 76395b01e3fd7e890c03904626ea31e703109b5be3aa516dca70e62cb1c8e88899379f9c5122d4c76c7c2863f7ac7f2a298eb153437e7dcfcdb94dc001d02781
SSDEEP 49152:JyEKQ5E3ieGR0PEtBFUow1b89eX61o+2xmepn/TRijbqYW3qkCbDypSfe6qwiXE9:Vq9ceqC+2xl/SSayLB2Yyjl
MD5 SHA1 SHA512 SSDEEP

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe
Size 4.6MB
SHA256 1663f66ca7e18120e93569e6a99d9e9b014a096da93c3c2b63df0a954f1f9d42
MD5 1e828de7b0806d814e77196ce7946e47
SHA1 383d5363710f4943c08935e42c9cd1f533d321f2
SHA512 190d2ab0932c4eb31bf666a83f6419dbcbdb62a63c9c342af19ac70871c5a1b17146ca8a209c10c1215f4a35cae199b695aa85f460559bab91f5711a7c3008e2
SSDEEP 49152:cyEKQ5E3ieGR0PEtBFUow1b89eX61o+2xmepn/TRijbqYW3qkCbDypSfe6qwiXE9:Wq9ceqC+2xl/SSayLB2Yyjl
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\123.0.6312.123\chrome_pwa_launcher.exe
Size 1.9MB
SHA256 aa40624aefd7ae6acd75ae177a1175930301cca2e4d7f1e43ce6c125839d2f9e
MD5 1a8ce5b3d04f357ee29108d624ac3f9b
SHA1 dbfde14464f35fd91ad49f0cf4caae9ad68f0c6b
SHA512 dcf7350295075fa073a05d06bf175cc723c157ea39501f896a94a3d0331e7ab4d97952f0c47d1420732ad044c5dc91e9165361281589d976e44e5a8fbee67522
SSDEEP 24576:qVN8FYh+50m/YOn/xvNS4atr0zAiX90z/F0jsFB3SQk:qVOyh+50zyxNaB0zj0yjoB2
MD5 SHA1 SHA512 SSDEEP

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
Size 2.1MB
SHA256 17a43c666859666b99c12127ab6ec95041dd5216f2c28bba34c6a1be73e48a3a
MD5 2d2ee8e245fa3c3f4e4f843e1e183df3
SHA1 4c32dd9c483168f281c30d27b1f8e208e7d33f1f
SHA512 33562329c8a3414ac54d63c032300cf02474386ca574b758364ed317dea1bca6b22c0baa972a5e1b81116e7f641e1abe15f46341e55b200f9d6bc049899712d6
SSDEEP 49152:O59PYHvI7wi/lIKuLFrFXlMWGxbgraB0zj0yjoB2:OGglIKgMZB2Yyjl
MD5 SHA1 SHA512 SSDEEP

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\123.0.6312.123\notification_helper.exe
Size 1.8MB
SHA256 eac1dc3c004ec7c86fd6dac91353ff4e17ec6548510af1052c33ee0d38e84653
MD5 f927afee8a056af943f3f822a0e3b9eb
SHA1 dfdbc907c48e5b5ae4ef5f396f40b06a4d4a0d95
SHA512 30cece1b46a46d039d4daf466cd64203700f1a4fe67dd01039be7d7e5b4f9c5dc49f072c088dde0694d9af8778daf5a4c4e664a8ad5eeae6a62e625035036862
SSDEEP 24576:8b6+S3zFphRwMVcLDnyhECINqzWipIxhWatr0zAiX90z/F0jsFB3SQk:8brUzFjGMVaDy9INqZVaB0zj0yjoB2
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 1.6MB
SHA256 6f3a4dacd7f76ba3b28108927c711a2b52d7b0c4649c1b11c8ca87f3bac53f95
MD5 1bce7c712bafeeb856b5d50db5cff441
SHA1 b8ef5cc55da61c9ab9e119645a0f3f09f27454c5
SHA512 e32bcb61c1b971f4f73baaf94f789998b5935327bb9f5b29208d6329d746d80ced08e40e2bdfe875ceea87dd2d65fd27e0d217ac57cb82e95f9de1f5a81e8e08
SSDEEP 24576:T436epN7wzPROWFW9sQ0MtJRatr0zAiX90z/F0jsFB3SQk:T4qiwzPASW9mMtfaB0zj0yjoB2
MD5 SHA1 SHA512 SSDEEP

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.5MB
SHA256 9e56ab65b01cde47f48aeb3b4d091e2a86ae06e3a9c755c140a85940931dfb6a
MD5 fa88e83ce6f68b329e71806cef3a494a
SHA1 8c0b92e8ef7e5f48b3be12d7216ce81e29e7290f
SHA512 4b9d473695abe5a54ebb0f91b12bed8d710e26b4990c69cc45861c7323bdd4ec5d7f85c3eeea373767696998abe89395707e843e8037c6107afb16bc89af57ed
SSDEEP 12288:CSUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8:CSatr0zAiX90z/F0jsFB3SQk
MD5 SHA1 SHA512 SSDEEP

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.5MB
SHA256 b5a59352efbca292b50e586b156fefa51f1601649b0e2bd0fd9f96bb0310cc8f
MD5 b7d2d98a04dc1bad1f30f3a21388ac8a
SHA1 69eac45fef49fd7bc517d5585cf674d51829889a
SHA512 cd06cb1035676827694a4fae826be7131df5ef461dbb0365c2876b54364ba2acda2fbf2614f713596ac13cde671479c5adb16bac187bb8ead95f537ce5fcbe52
SSDEEP 12288:D5UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8:D5atr0zAiX90z/F0jsFB3SQk
MD5 SHA1 SHA512 SSDEEP

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.5MB
SHA256 e484a2614e7528086b7987267e81444550b6bd777bfb54dae135ac3f04468988
MD5 7b28be61dfb98acfc6d682ee5f8ac5b3
SHA1 be3b42da8a6f227b6305fd62a285095287b9c36e
SHA512 70d0f1a87a5727552e0e900b4fcdfdbe99d04927c7dae2337a55c08e3e32df210360b4416ebf771b10467565efcbd4166efc09f8cf6586ebe6f2bd408deab5c7
SSDEEP 12288:7vUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8:7vatr0zAiX90z/F0jsFB3SQk
MD5 SHA1 SHA512 SSDEEP

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 db5bfd840e3d366a8334242810e8ce0c7cc6afc3dfb1e1230b4d3195b0f737f4
MD5 0e39705d9cfaa7467312c164530fd7db
SHA1 44073d2c8da7649de2992f946465a240a71a3378
SHA512 9ba8f4e203ed19b6825355f97753bd25e4f13e6cde2d8c49947141f68d54318e9b10ae12c71db4e5208a2ca37a1dbecfde672e1888c5880e6fb860e9b17da5df
SSDEEP 12288:9V4UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8:Qatr0zAiX90z/F0jsFB3SQk
MD5 SHA1 SHA512 SSDEEP

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.5MB
SHA256 695b0a2b04e1f5d846017a7fedc32c3e63e664de9bf4d14d300c4660818e4cb1
MD5 6e99b90696840804045ee9a734ef6ae0
SHA1 10c794c9f0113fae694997a323c92fc8c2a284af
SHA512 1017266aa8f4891517438441049456fe85e6bbcd4388303193c3c98816bcd296a85e3b789b62d308497053782529e221073d2999fecd934f69539481bde006d1
SSDEEP 12288:qAUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8:qAatr0zAiX90z/F0jsFB3SQk
MD5 SHA1 SHA512 SSDEEP

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.5MB
SHA256 5fc8e0b09ca74fd5f6153d799564b43f99b272344226d765a4c2507e53c5cc22
MD5 e14d54a42d90eee7732c660603d9169e
SHA1 9c687c960a538c10bc78c08b27378116d633f12f
SHA512 8a6049eb3fd415025aae31a50fe3b060b3935cf4bd111c7405d5fd40087d652b88f505ba5a1e4ab08664342b8c9c22d2790db50674a65923db1f26439307a88c
SSDEEP 12288:IlUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8:Ilatr0zAiX90z/F0jsFB3SQk
MD5 SHA1 SHA512 SSDEEP

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.5MB
SHA256 f6be55b6039af0275aa500a769a6dcf32efcb96c13e99e95e2860e4e2346aeed
MD5 6a3c06fc818a300588316880bdf66a20
SHA1 7c1a1666425e10c0a733c9674ed2a997514222bd
SHA512 1466c17bd428c4963c91cd177adf3dbc56ce1c74cf1e49605118db5730647a5d343844f39bcae2f9a71db2b22076a123c957822ceca36a640dafab25346e4ebc
SSDEEP 12288:6BUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8:6Batr0zAiX90z/F0jsFB3SQk
MD5 SHA1 SHA512 SSDEEP

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 9be8e6729ad1c432ba343bd739c5c183a5034abf68606ea62b6e4e25fb6f3690
MD5 d09a6c3c250f53e9db3e84fab7074eec
SHA1 920688f5d40b49714d4cac673c41e1e37a7238d1
SHA512 dcdd4ede7e21a8cb9107245825701bafe7ee0f679f2e501faae801d43850d109632f4ba122ddb6d7207a67fbb246e4c1fce3bacd6cddec7a91076ff6a0eabe32
SSDEEP 24576:IZMjzFVSOZatr0zAiX90z/F0jsFB3SQk:IZMjzfVaB0zj0yjoB2
MD5 SHA1 SHA512 SSDEEP

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.5MB
SHA256 fe8cc0837268376dc8572b6d4b59978a2d3e68ad00603a5ee0efb2e0b9dd8cb2
MD5 757845adb570550db49b138e9548ca28
SHA1 49e2ae44ef1618c40041dd95043498bb6c275c23
SHA512 5172115e7a20da9c3e65b512c6a82ddf442563537c3152c7c95c1433c2b9281fce5725355193f97b557b7b045c2a464352a2bfe89c35b47d22adee6ca1d58dc5
SSDEEP 12288:EWUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8:EWatr0zAiX90z/F0jsFB3SQk
MD5 SHA1 SHA512 SSDEEP

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.5MB
SHA256 92db0d55d2306201e86d217c842975aaa42b085935d0be37ce4add1aa5b92f65
MD5 e2d2f65997a72c8740ce3370c097558f
SHA1 c869f73234aff5cd1ed56026826a04cb3f375cff
SHA512 2f4aeb0f8b6ad3f4035d19a5bfebce12090588c355209b8eab3a0876dd0bb8df562b83b0b483ac49772b84a152165bd0a659ff29bad9945ba7e38559361c661c
SSDEEP 12288:fqUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8:fqatr0zAiX90z/F0jsFB3SQk
MD5 SHA1 SHA512 SSDEEP

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 2ffd35a683a2f909b9f82cf4424ec248ed2ac04b7123748005fe47d666c298a6
MD5 aae7dd48675d7632713d73ed8491cb1a
SHA1 728c3883c2c069fb97da09aff421cccd89d2e700
SHA512 1459dc2bc6f90aaaf2e316047f12e2df9cd10e33905035cbd49535004059fbfbfc533da5119b7eee7ea59e395bdcbfff4d0094f1a7cf7b55f4fb36372a785a49
SSDEEP 12288:gyPz5L8dUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8:Rzydatr0zAiX90z/F0jsFB3SQk
MD5 SHA1 SHA512 SSDEEP

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.5MB
SHA256 67d06611a7b5e05cc015e4d1051a82bb0ce62b6e599c2bfdf0fc29e0823669bc
MD5 65cb8fb8039b4dc168091cb83ae9b8a6
SHA1 4c128fe2546c5bbd1deb9ab5b3a41ae50ee4e901
SHA512 610e0d53fa6a91433b6ef76cda64bf4e78d17db75b961feac7278c907b10c1008c6962c37dc106f2e002342c36b5cb1ca4790b5aa24c869d3d7ed2f9ad2aa536
SSDEEP 12288:zWUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8:zWatr0zAiX90z/F0jsFB3SQk
MD5 SHA1 SHA512 SSDEEP

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.5MB
SHA256 d5715c2a29ec458c684c440c1ab73112548bab8e8028be8a01d29ea882427489
MD5 005e981c911dbc2bb1486ec4a022c728
SHA1 be72914995605e6462b51c4a88da04d0defe90dc
SHA512 723d35aa4e0b2b69d68f2a7865e2a296492be33a257c04b05a496ebcae784c1938ae6622869ca173bff089d003305a3fa64050df2c67e780ac5e82d48d058ae7
SSDEEP 12288:LWUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8:LWatr0zAiX90z/F0jsFB3SQk
MD5 SHA1 SHA512 SSDEEP

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 c89f4be1fb82d79cce2e1726006b9a30e1f2cc3d6b278daecadfa910b619c63d
MD5 f12e9c621957c66b1f37d0ee67674409
SHA1 b8fc730119a201f067cf517232ff82c4c6de7fe4
SHA512 ca0a8dd323c48c878a2add59522539ce185a0c1c25817f7eb6b35025598fc8a9b6b15cd513ea8036c1c318608329d8712c178d5be3d0e4ce2bece736f03fa7de
SSDEEP 12288:8yPz5L8dUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8:lzydatr0zAiX90z/F0jsFB3SQk
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.7MB
SHA256 d842e523c7d7ab2a6f3d00ec3516907ba6d73116e7457d687bd5396e73154eb3
MD5 049e60af78d80b2071164b9c3ca0def5
SHA1 e94400990e4fde8a55437a8ae294b7e8f8d1f6f6
SHA512 88b97391a4788cf2eba2852e2f844af5970c42e7fdac72871a7f3c5bc945b6199e267ffb90b0e24bae533db8fc1241d40350911903c90a510dbeea1bee4d2571
SSDEEP 24576:uTYaLl3z0zD/atr0zAiX90z/F0jsFB3SQk:uTvLljkaB0zj0yjoB2
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.9MB
SHA256 7b8a37be677a12321854ca1b45599500023dc3c8a4fa108ec1a718a64e695c8f
MD5 506bee84d8b9bd27056fe7cb28ece508
SHA1 a59ee4f0f05fb60a50d05daf4a90c7c4c3ca5186
SHA512 d418ecd3f8e798297855bd0926052515c1d7f8431a4a04cff4e85d57908f5a9a3fb98b2c99909310cc65f45413806fda157b41f41a7bbbdb374187352be32228
SSDEEP 24576:L3Jd9CHKy7GZratr0zAiX90z/F0jsFB3SQk:rJd9CHKyaVaB0zj0yjoB2
MD5 SHA1 SHA512 SSDEEP

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.5MB
SHA256 a0290c6cec7f76ed3c2c6668d355f8f9e62075123492a0f62af5ba00ad4e51f6
MD5 a5046cb2883f49d595926628a54e89b0
SHA1 96d1d836f496050341e1f0d312c5c01f0022a564
SHA512 e93f46cbfa970e4ec37a2e8090f05e4cd1d9d8b51d633104ec4abd80b8213a13f1155c2a942264adb022d15b0863c2f6e972dcdaa56b3a9e387ed4f17d97f9d9
SSDEEP 12288:8PUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8:8Patr0zAiX90z/F0jsFB3SQk
MD5 SHA1 SHA512 SSDEEP

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.5MB
SHA256 3335052dcdc4faa91934173994c42659cf3ea819fdb1e675e871086747571990
MD5 3936ca27825212d4ca27663fce0b3e5d
SHA1 75778db716a3d42f80c11f5776874a8025021abc
SHA512 9adc1aa6d2848ea301e90066901cd96caa66367841d0896128c5419f274d8fcce2b4e009bedf1157988c66890bacf0d9cd8c89b6cf8989d622266fc8e7f8cbbe
SSDEEP 12288:O9UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8:O9atr0zAiX90z/F0jsFB3SQk
MD5 SHA1 SHA512 SSDEEP

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.5MB
SHA256 06cecb5e990ab651d9c22ebd252186d00e8471b4e7a9484bb30598106d3816ce
MD5 2c740f0a9862cdfeea9372e9e33fa9bc
SHA1 35af90f2bee36d63ca6ca69d73df326e98549e9e
SHA512 5c23a3ac0aab01b62078830744783efe2d2693b7d1834eb6489ce08408579bbb66e3d5209444b224d363a4a74d11d5e500f39452f30f934209e651cccd7b5289
SSDEEP 12288:fsUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8:fsatr0zAiX90z/F0jsFB3SQk
MD5 SHA1 SHA512 SSDEEP

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.5MB
SHA256 acf08f879da80297c2d7d6b54c23852f393444d7e20843b9e31f636ed8232faa
MD5 2865f616274551ec8c7aeac632d22a1f
SHA1 ef850795bd7dfbcdbd8f81a27b171f33cdc26ec2
SHA512 aa928b013d5bc0922c47771f8d2fb40c178f1b01b2a3884850d99e4d95e2251d4089c096fba01b274ff81823263c3ea32a530dcf3671efd0e053260b3510cd73
SSDEEP 12288:rWUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8:rWatr0zAiX90z/F0jsFB3SQk
MD5 SHA1 SHA512 SSDEEP

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.5MB
SHA256 201d7bd221a68cfab1564f85da2219ef8c98e8fd555309acb6adc4b56b71ca91
MD5 da1779308f67f4ced67c504221f0991f
SHA1 64ed1d8604fa1bb005fb6a612af602060600b5c8
SHA512 feef8d90b7d3f4042ed64372add4e6ef3bf0513bf42632c0372279b419050ba376a9d5f5aeb81e0c7c457e8564df2839ededad313541d2082277933ee0c8f482
SSDEEP 12288:vPUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8:vPatr0zAiX90z/F0jsFB3SQk
MD5 SHA1 SHA512 SSDEEP

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.5MB
SHA256 336bccfb81067aa7c349112b70d7cf9b047d9d4d757439f574448ccd3a6450d1
MD5 77da44ad3edc46daf2bd554758e84989
SHA1 5333aa7a3c62c532e3aca442eab2360772d3bff8
SHA512 522bf8bca6806a033823c94b6ddefc70a0be972221fe654358a56725436f51d43db4d6945643aceee96babe9614f329a486d112f07de34df0225b8aba61a0867
SSDEEP 12288:deUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8:deatr0zAiX90z/F0jsFB3SQk
MD5 SHA1 SHA512 SSDEEP

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.5MB
SHA256 c6fcad2cb9169fad65b93d5a9eb082d7d59c82946f10606d6d79acc14f2bb181
MD5 b091963921421eaee69643fedfb137d0
SHA1 89c212f2dbcad6fa0a13439f35538937cf3050d8
SHA512 e624cd776e259277eb8df0c8e52370933d605c3c24af45b109a4806a33523aeac1423b0406573ebf228a6e8e2f13c3da6d52231be7d2a148e9b248893d9fe9f3
SSDEEP 12288:gAUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8:gAatr0zAiX90z/F0jsFB3SQk
MD5 SHA1 SHA512 SSDEEP

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 82b5a3940b56feacdb8d74c1e3c17abdccc3ceb6bcf00acc37851d7e30586de5
MD5 4c19208042698f1433c64cf18387d08a
SHA1 1b1684a1e0fd6b571f29498fb92bc5fee871cbe8
SHA512 b684f663995f2573df7328539de5a07763d3529c32b69e6c357197f506b3d16a6c207327029c80451b95eaa44aa90b1065f7a1d39edc84a9c848a15bdba65eca
SSDEEP 12288:UUFmDDL7UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8:m7atr0zAiX90z/F0jsFB3SQk
MD5 SHA1 SHA512 SSDEEP

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.5MB
SHA256 0f1b7492e8b0a38bab5cc0568d865aff180f8fa8a6e02bb808eae366290234ed
MD5 40d63211a4278d90ab6482927ab68679
SHA1 20669c64846279d79419a80da639fceeb367d74c
SHA512 9b9bc4f26d8e1c438dde7dc2b732fd35da9574e7db3e90009e6e433b77a1e034b5236e6782c7e6c117c98b71920544f4f1e598002ea3000f0ec8249aa0087080
SSDEEP 12288:KXUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8b:KXatr0zAiX90z/F0jsFB3SQkW
MD5 SHA1 SHA512 SSDEEP

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 de9563353af04482da00ebceaecbaa3206994fbf3a675dad04aad39208ff43f5
MD5 7a81c6982f7e71f9f7116b16fb6bba68
SHA1 313c833c8c4c5d45fd4f316364435cca31386e35
SHA512 f214216440a3429dbe37e11be9dc3f0bf512a320448aa34616a03b8c2e1e52dc677f3bed649322952f9ce3361342b21f48bf185054e771de453437a2bd1e85a1
SSDEEP 49152:ia0h2GEkuAe73q3pp46zwwQFaB0zj0yjoB2:ia0hNYG4JwzB2Yyjl
MD5 SHA1 SHA512 SSDEEP

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.5MB
SHA256 5be5b678015d73c0e9a034fb17bacdae243dd06381ba1856a6b6079c1ca4b2bf
MD5 67ff3ce23263fedb01aeff22bc7f1538
SHA1 88a69efe525bceda1bc91bfd858e3059fd77535c
SHA512 e812cf182e02a6ffecb9e01d7aab80eefc5c523d7d2aa0438af8939a0ea99d4ff46b50dd5462174f7090e0ed0e908a1fb737414da65a7524c6318ec825c1b458
SSDEEP 12288:LhbHjfXwUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8:LhbHjPwatr0zAiX90z/F0jsFB3SQk
MD5 SHA1 SHA512 SSDEEP

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 d44240b554e9e411680554f5cb20c9f0eb6aa41d4171728c2682b47bfbab0c8c
MD5 40e7a1f711469f93af9cbf3bbde8f376
SHA1 7f6bf277004359d9e0676ac6a826b2c4e4e225d6
SHA512 813369e532b9b2deb678f1acb6879a850bff197105b785b2ffeeac62e3968e0840016bbe0198601676fe2a76bb1df4ed42a111ac0f50e8c41fab14b9d886e654
SSDEEP 24576:+3YgnJcRTk4yti+R5dpR/4atr0zAiX90z/F0jsFB3SQk:+IgnaTk46ppR/4aB0zj0yjoB2
MD5 SHA1 SHA512 SSDEEP

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.5MB
SHA256 945a589a142428fc1ecaac4ec9a52bf5976225fa36577810ce3d8f3902a596f0
MD5 127dde18c02ad5afa9b51efd132d33c5
SHA1 6474f05324e25b449c1885b80a713ce30fe0fc1f
SHA512 0719b605019aa433a77c6cc02fb6fca4a15948d78312b310ca4d779508ad8cdc33ad2829a2fda50f67af232d456bb3d95e48798c5e0b18c9d133a0e8677c3510
SSDEEP 12288:W7UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8:W7atr0zAiX90z/F0jsFB3SQk
MD5 SHA1 SHA512 SSDEEP

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 a99dbda4f99a3bf9785d327549b609327101dd29eb5874166a04d0813e7af447
MD5 0fe45faad1dc8d47be969415869e75d6
SHA1 840b30de111e5b09988f7e5e8bf1b1075ce06cc6
SHA512 8f9b786840727a6cc05611eb83ea1de2259db1f8d69fcffaefc87e92ac1be05c50f4c34cb30befbc4c983c25a3279e1b77ce4e50ad393833e231164368ecdd21
SSDEEP 12288:BObcA4LWOsvAYFTOUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8:2cL3UTOatr0zAiX90z/F0jsFB3SQk
MD5 SHA1 SHA512 SSDEEP

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.6MB
SHA256 c5e1fd4f4e3c6c7b492b55254aecbf0ac066dd5ce655eb21a46cc32a0c4654c3
MD5 4f414c7fc5245147b2bdb5a7fc87cd2d
SHA1 0a846cd52fa4500136e82379037977bfa0ee274a
SHA512 0b064e8e545906c8385eeee57a740c18d398a1668d1f5ef882da16d2977b0034981c192a22abf19dd219c31afb763cf5ac69445170dcb2b491d83df5c1ac49a2
SSDEEP 12288:ZpFtvOiUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8:fOiatr0zAiX90z/F0jsFB3SQk
MD5 SHA1 SHA512 SSDEEP

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 8c38159dd5c379e8ddb4996032879f3917b958a62756ddfbf048617e8ce364a1
MD5 96c049e5f3728cb2841a5a517b4e2b36
SHA1 3b0ee21366e7340cd7a31730987832aba7d0898b
SHA512 d7ed53aa2639db70c23154b048245c6d5ab3c5f41ee4bd2fe11a7a5588ee4027cfeeb156eebdafc29df28358d3c329294b1c92ff4d2447ac2bb154d87b7252c5
SSDEEP 24576:M7NM9YmZqmWMUkPjZM48Mv6bEhsHatr0zAiX90z/F0jsFB3SQk:M7cBWMpPjN8DbEhQaB0zj0yjoB2
MD5 SHA1 SHA512 SSDEEP

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 f57a57e808cd18e118615eaf706244809cda0db0fca9e99125095ac968579442
MD5 d2ab2a5c0c561924a6a2661bc29f9dee
SHA1 10573f241be04a0925ca150585eb94aa5e011894
SHA512 e2c3aff678f8d20fd791dfd7cdd7cd8ad3149ee74402cbdc52819a2b9c353f7ffdb8f3320d609a8207947241f889bc488a970cbb7034c79e563ea818e0b6bd03
SSDEEP 24576:RW6BApg2YuyuNDYTabvcRvNYf8km1xatr0zAiX90z/F0jsFB3SQk:RF2YuHNETovcvNYf8kmnaB0zj0yjoB2
MD5 SHA1 SHA512 SSDEEP

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 414ba94a4e5273aeb2bbff52f1c0c41481d643117bf3c872ac1fd0309ad022fd
MD5 087e354dec8b605c87e67a7997783372
SHA1 2a9af88b86b5d4775b05303bb07613264419b83f
SHA512 2677db16b55ac4b1c0f46fee1d5f89b1ba1b72aec98e209f139f38858296d033d845679d1d059e260fd9e996b6b4bdb14181b41c7afa709c9483a26461361a45
SSDEEP 24576:AAFs06+Omlf3NXEbTomatr0zAiX90z/F0jsFB3SQk:VFs060lVXulaB0zj0yjoB2
MD5 SHA1 SHA512 SSDEEP

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.8MB
SHA256 0419c62b9fcb2eea7a727e5a57a555a32ef4427b00a26ab5e403574270606b78
MD5 213c3ff2a4abecd637460e1c91cb963f
SHA1 277bc6d7457211b77be90d6b05d149af80d68c28
SHA512 3e951d721ead382e8b2e873fc8649b4187e1a433c6ee2ac7405a767da51fdde418a23f969e1b0b6e79e5bffc9dd72deb79f0e47fea4d9f6f667c5bf5d97ac159
SSDEEP 24576:eJnJ5D3Welatr0zAiX90z/F0jsFB3SQk:eJnJ5DGelaB0zj0yjoB2
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 e4f1f9e016beb19f35a85483df7929bf5f9e80fd4b77baebb5e77c8ec2f841a1
MD5 d9679dc287e4aac4385166a3a07a2c73
SHA1 afd86efd68c94cd3087bf4fa97dcb3c1943eb0b7
SHA512 8f7cc8eb624b0c5c471e91bd11a4ada426f52ca13d83ab54d8964509e52acbafb23a2ba9b90e4c769a328bd73be25498450a4a5833c16c5602d7cbcca0b2926d
SSDEEP 49152:no06DIKdwc+eQnSt65aVzaB0zj0yjoB2:o4B2Yyjl
MD5 SHA1 SHA512 SSDEEP

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.5MB
SHA256 58fcb845523941fa20e3b0b279be8823f4a6188ec46ad528cd647b5e2c1db41b
MD5 79764e00dbea91cc47e52a5ce90bb6c7
SHA1 2f9280383628622901fe8d03fafc92d72617511a
SHA512 6e47eb3ac966793f7b6e13b7ff0a1d98b02853670eaef98f18c9a12e96367eb9a4614fdc5999e815dd187dd16e33cc730f23730219e9a14bef32c11d9e9f2bd5
SSDEEP 12288:2EP3RoIUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8:1oIatr0zAiX90z/F0jsFB3SQk
MD5 SHA1 SHA512 SSDEEP

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.6MB
SHA256 17c3ea8cfb3e83723d3eacb2e7a3b941f3e351a35eca0885c4e75b977bbf313c
MD5 721a56672219c6ff1d81af7f8bf8da6a
SHA1 6cfdb1b8dbb0504412451974eb2ff17fbcec905a
SHA512 f6b45a4ee0729a256f4476cf57bf4b8100039353c9fe3db3884cdd4e9d30882e3e48581c757692c5bdecce88a969e6c0ceec9b66adbcd5dbeb3306dd84815a49
SSDEEP 12288:FjkyAUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8:FIyAatr0zAiX90z/F0jsFB3SQk
MD5 SHA1 SHA512 SSDEEP

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.5MB
SHA256 81dfa855607a1a19d34c377870a6c6932d11dffe727dc9de5c6c833bcd0689a2
MD5 6a3720d70634dc75abef90487717fc2b
SHA1 ac624b55150a080fc25cd4f5dc6f88b22a2a456b
SHA512 3ca8c947061fd26739c98c5d477763bc0c2a4bb1d8f74bf18ee348150ca7b2a35205bc7f80b319d8b0602f4325499990c1154eeacdff004301b2b1e038650853
SSDEEP 12288:u7yUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8:iyatr0zAiX90z/F0jsFB3SQk
MD5 SHA1 SHA512 SSDEEP

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 04f74ed617c364cffc4eab017ce2962301c4655a5b23d7bb23c6210355a3d133
MD5 c6bc666ffeb2fc5de117e4df576a72ca
SHA1 efc5a200f8fefb47d5d2cf306cf2e482180310b2
SHA512 a44827f4a057e8d575652aecc97c37a9c8d5e0c318f9952a63483539f5210416e3ed752e362110d37dbe9a39813969fcfb7c522e75a262a311601a94799a898d
SSDEEP 24576:tQ9MxZKdcz97w3fatr0zAiX90z/F0jsFB3SQk:tVKXfaB0zj0yjoB2
MD5 SHA1 SHA512 SSDEEP

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.7MB
SHA256 ed74d48b0714bf1d8104d27b75c90e9d5b09028733affadfd0119651fa8e69e5
MD5 cbde47b8f769c06d01e11a9dd7b98a51
SHA1 5f7344367766cbb09969e766946de617b8dbb03d
SHA512 92667befa5ebf1efc337710c8781c375e7851e086e7dbf88a1be70b3e957dbd99a93a04b53034ce07c91c2cc2b400af721db8792df7601937d55768265be67ae
SSDEEP 12288:DyoKo2gRple9p0UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8:DyocmAp0atr0zAiX90z/F0jsFB3SQk
MD5 SHA1 SHA512 SSDEEP

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 0b036ad8279d2b35639abff6f32a0ceeab1227c8bb2a3704e6a5880832f8ae06
MD5 1d5656cf5e0602d8751639c0715a9943
SHA1 975685edc4357ab1822b5a1b11a1b6d7f00d8a2e
SHA512 63031bf245992fbe6e0c23deadc59cba12626426882464323bed94d91db704b07f896433d7e4f7d3ba680c9ab9d0a003d72e9bff2872c544eec3a386e5c8126f
SSDEEP 49152:MWcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIK0aB0zj0yjoB2:G0zuNIHB2Yyjl
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/228-413-0x0000000140000000-0x000000014017C000-memory.dmp

Download

memory/228-295-0x0000000140000000-0x000000014017C000-memory.dmp

Download

memory/396-390-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/396-583-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/772-276-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/772-251-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/772-252-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Download

memory/880-47-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/880-232-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/880-39-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/880-48-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/1332-587-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/1332-402-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/1476-389-0x0000000140000000-0x0000000140192000-memory.dmp

Download

memory/1476-283-0x0000000140000000-0x0000000140192000-memory.dmp

Download

memory/1644-51-0x0000000140000000-0x00000001401B6000-memory.dmp

Download

memory/1644-63-0x0000000140000000-0x00000001401B6000-memory.dmp

Download

memory/1644-61-0x00000000016D0000-0x0000000001730000-memory.dmp

Download

memory/1644-58-0x00000000016D0000-0x0000000001730000-memory.dmp

Download

memory/1644-53-0x00000000016D0000-0x0000000001730000-memory.dmp

Download

memory/1648-401-0x0000000000400000-0x000000000057E000-memory.dmp

Download

memory/1648-292-0x0000000000400000-0x000000000057E000-memory.dmp

Download

memory/2664-22-0x0000000140000000-0x0000000140191000-memory.dmp

Download

memory/2664-23-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/2664-203-0x0000000140000000-0x0000000140191000-memory.dmp

Download

memory/2664-14-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/2864-363-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/2864-375-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/3112-340-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/3112-516-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/3240-582-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/3240-378-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/3268-1-0x0000000002420000-0x0000000002487000-memory.dmp

Download

memory/3268-6-0x0000000002420000-0x0000000002487000-memory.dmp

Download

memory/3268-12-0x0000000000400000-0x0000000000546000-memory.dmp

Download

memory/3268-0-0x0000000000400000-0x0000000000546000-memory.dmp

Download

memory/3444-329-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/3444-513-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/3996-36-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/3996-231-0x0000000140000000-0x0000000140234000-memory.dmp

Download

memory/3996-35-0x0000000140000000-0x0000000140234000-memory.dmp

Download

memory/3996-27-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/4272-324-0x0000000140000000-0x000000014017D000-memory.dmp

Download

memory/4272-510-0x0000000140000000-0x000000014017D000-memory.dmp

Download

memory/4416-588-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/4416-414-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/4420-589-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4420-435-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4836-233-0x0000000140000000-0x00000001401B6000-memory.dmp

Download

memory/4836-74-0x0000000140000000-0x00000001401B6000-memory.dmp

Download

memory/4836-66-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4836-72-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4864-565-0x0000000140000000-0x00000001401C9000-memory.dmp

Download

memory/4864-360-0x0000000140000000-0x00000001401C9000-memory.dmp

Download

memory/4936-586-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4936-426-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4936-306-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4944-377-0x0000000140000000-0x00000001401A0000-memory.dmp

Download

memory/4944-263-0x0000000140000000-0x00000001401A0000-memory.dmp

Download

memory/5096-248-0x0000000140000000-0x0000000140190000-memory.dmp

Download

memory/5096-246-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/5096-240-0x00000000006B0000-0x0000000000710000-memory.dmp

Download