89c886ec48c10ff73cb28a7a37cdf0d87c1b043ceb73a032b0790f7202803018

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
10/11/2024, 01:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
89c886ec48c10ff73cb28a7a37cdf0d87c1b043ceb73a032b0790f7202803018.exe
Size 2.0MB
Sample241110-byfbwawkax
SHA256 89c886ec48c10ff73cb28a7a37cdf0d87c1b043ceb73a032b0790f7202803018
MD5 51fdb3da0a8beb24f83555bc6121a376
SHA1 d7f46a632f2f4159f3f76264e38a0c04e7b8f544
SHA512 3b8191e53b53c582c8973b1a3a93ac996e8e947109fd1be13a4f61ee5f210fe2ee127eb0b9f1fe46ae3f7b256f4ce0f29d261a873709e0a0621e6b7791cbaf9b
SSDEEP 49152:evRwdG2NcOMjUfkptVxmgDUYmvFur31yAipQCtXxc0H:epwdGVjUu5TU7dG1yfpVBlH
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
4012	alg.exe
2288	elevation_service.exe
3900	elevation_service.exe
1172	maintenanceservice.exe
4128	OSE.EXE
4664	DiagnosticsHub.StandardCollector.Service.exe
4812	fxssvc.exe
664	msdtc.exe
3100	PerceptionSimulationService.exe
4748	perfhost.exe
3724	locator.exe
736	SensorDataService.exe
620	snmptrap.exe
3024	spectrum.exe
3376	ssh-agent.exe
4556	TieringEngineService.exe
1468	AgentService.exe
3912	vds.exe
408	vssvc.exe
1556	wbengine.exe
2464	WmiApSrv.exe
3436	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 24 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	89c886ec48c10ff73cb28a7a37cdf0d87c1b043ceb73a032b0790f7202803018.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\ac7695a5674cc675.bin	alg.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\123.0.6312.123\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleCrashHandler64.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdateOnDemand.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdate.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Install\{F123CA10-B28F-434D-9884-6C3679B73C43}\chrome_installer.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdateComRegisterShell64.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ff4f4caa1033db01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fa005daa1033db01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d15ddbaa1033db01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9923 = "Windows Media playlist"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000748d28aa1033db01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006022e0aa1033db01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000063c480aa1033db01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008e1632aa1033db01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection"	SearchIndexer.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
2288	elevation_service.exe
2288	elevation_service.exe
2288	elevation_service.exe
2288	elevation_service.exe
2288	elevation_service.exe
2288	elevation_service.exe
2288	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
652	Process not Found
652	Process not Found

Suspicious use of AdjustPrivilegeToken 42 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2612	89c886ec48c10ff73cb28a7a37cdf0d87c1b043ceb73a032b0790f7202803018.exe
Token: SeDebugPrivilege	4012	alg.exe
Token: SeDebugPrivilege	4012	alg.exe
Token: SeDebugPrivilege	4012	alg.exe
Token: SeTakeOwnershipPrivilege	2288	elevation_service.exe
Token: SeAuditPrivilege	4812	fxssvc.exe
Token: SeRestorePrivilege	4556	TieringEngineService.exe
Token: SeManageVolumePrivilege	4556	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	1468	AgentService.exe
Token: SeBackupPrivilege	408	vssvc.exe
Token: SeRestorePrivilege	408	vssvc.exe
Token: SeAuditPrivilege	408	vssvc.exe
Token: SeBackupPrivilege	1556	wbengine.exe
Token: SeRestorePrivilege	1556	wbengine.exe
Token: SeSecurityPrivilege	1556	wbengine.exe
Token: 33	3436	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3436	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3436	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3436	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3436	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3436	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3436	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3436	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3436	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3436	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3436	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3436	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3436	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3436	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3436	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3436	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3436	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3436	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3436	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3436	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3436	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3436	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3436	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3436	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3436	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3436	SearchIndexer.exe
Token: SeDebugPrivilege	2288	elevation_service.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3436 wrote to memory of 2056	3436	SearchIndexer.exe	139
PID 3436 wrote to memory of 2056	3436	SearchIndexer.exe	139
PID 3436 wrote to memory of 4492	3436	SearchIndexer.exe	140
PID 3436 wrote to memory of 4492	3436	SearchIndexer.exe	140

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\89c886ec48c10ff73cb28a7a37cdf0d87c1b043ceb73a032b0790f7202803018.exe
"C:\Users\Admin\AppData\Local\Temp\89c886ec48c10ff73cb28a7a37cdf0d87c1b043ceb73a032b0790f7202803018.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:2612

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:4012

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2288

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3900

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1172

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4128

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:4664

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:3448

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4812

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:664

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3100

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4748

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:3724

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:736

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:620

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3024

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3376

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:4896

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4556

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1468

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:3912

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:408

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1556

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:2464

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3436
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2056
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
  2⤵
  - Modifies data under HKEY_USERS
  PID:4492

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
Size 2.1MB
SHA256 1150f2fbdec1bc7b917b5c8f75c36d4d11834f80108086081df100ad1fab2caa
MD5 17998e94d3c39a4ab18fb51469c0917e
SHA1 dc9dc2c5404300126fcb40a3e4df049eca788750
SHA512 dea110dc1a90d02b4c33b5f9bda106e4e77d34b5e814658f43fa94e72f3c2cae35934d44fec07573586a2127a6d4180735513e311f6bc69aa6c8ac6e3c0be8d0
SSDEEP 49152:wuYk3H5koUXfTqkkYLO/W2buywzMbOX+T7z52gDUYmvFur31yAipQCtXxc0H:wPfTqi90bPU7dG1yfpVBlH
MD5 SHA1 SHA512 SSDEEP

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 789KB
SHA256 e143ba21640abad3a7e5c68a2b8da1d6d0c3a6a5531960bbc5199f205f89a2fc
MD5 45513de7c7d38ce839e12f453562deb5
SHA1 5ecbdc808cc57560e09b979b1f09515b4cef6970
SHA512 fbd4d11352b9f932aefe880086fa0f03efa3c7ae27482395f3a4fbf0c2814485eb055179759a11fcbd8c75737fcd00499fa4fca21410c0ed6e34df39bed764b7
SSDEEP 24576:8ZFwVuDy8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:IFwVuOgDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 ae149c3f0a1f0e92e226d0656748fcc127e57cd3b9260a5e257b82d8d3a095d2
MD5 f9cf15e92a8a19243d04a05df2554afc
SHA1 ae1fc133f0d47da1a2fcec778c9fb393ea41906d
SHA512 882911c557ebe8496feb9ce02e75f7d630ccb17560a3756344fbc918065325411906271b6a81a21ff5e1ea8273da63797ce2abb275ae3721fc3cd64847466ec0
SSDEEP 24576:F+gkEVfh4CoH8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:sgkExS5gDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 23307b561a68fbf87d9d220cc0d08a622975898d94d11cf51ea76049db7919e5
MD5 f8a301ace196ed605c013161d51c4ca6
SHA1 ca06c9f45641449eaf3ee435bd6784e03a6c7803
SHA512 c5daab38cc5a0c4f36b73e6ec39d2b412bf74da9c822fdcaeadf5e4722b36c8da15811a95279efacd669d6b9102e985cae7795192b493aeff1185a8f51858fc7
SSDEEP 24576:mBpDRmi78gkPXlyo0GxjrS8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:CNRmi78gkPX4o0GxjWgDUYmvFur31yA6
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 b12138bfb80be96442dfc0e57ee282973e65b9d2980e24b89a5603a58a43d08d
MD5 f2955552477fb4dc265e7c35bddad6cc
SHA1 f3b704b4bc31b91620b10bea8d120cfa3ab6030b
SHA512 0f434ad4ec5193ba158c4ffa7b96fb5d626dff09b33072859a6bb337ed8ca47eb0b3f2f940b36a6784c514317900862678c365be2c5b4a62e45b146a1c9f58a6
SSDEEP 24576:NLOS2oyPIXVH8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:n/yegDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 0b5754b75738d4bd993a239b7780b7b44856ee658ad055d8c557dbba1d3051af
MD5 c1fa5294e31957ce783270b8949b4649
SHA1 b32d95e66be622608a4a2118cc69d3df15efb858
SHA512 7463fb97ef976bc522007a3e703b39199393f02a70a60cbb026db90cdf2d35eda64bbb9d410d17e66c6139c300376e87c69c78ae67a5bd78b3d9b3f85bd72370
SSDEEP 12288:9fZFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:9fZ8NDFKYmKOF0zr31JwAlcR3QC0OXxx
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 dd44ad1408e482fab1e249271863d91ae35a16ed289e4ee0f55d558d8e73e005
MD5 bfaeaa93f09375a6dd929ac7b6c37f4b
SHA1 d56a7d094c14b055903f242ccbcd55795d93f5d5
SHA512 cb722568968602ed0fe910c39ce250fcbf68943a33d3df2cf6aad8acecd17cfb06e58bf15d5cfb9565d4efc4c20a3c2f7469cdbc78ee47a577f2c310ff299406
SSDEEP 24576:bJIU88NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:bJIU8gDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 51a0a1afc0068157c1a26d4914df67a4b1427c8ed00d0539f66b9e12b5439daa
MD5 3ccc6216537310b8180d02dc8341e5f2
SHA1 f5f2635ba90159048e3c57983f862074da413ce6
SHA512 4f20a853bd1dbe0895f9137a2324a0beb88db48bf6d29f6cc1e4c77de4b99dd822ff1d912d360230fce11af16f51c76bfe26a0ff111d626a94913a6f2e5b4f2c
SSDEEP 98304:WQvGAdlCEL8c/yRNw5CmU7dG1yfpVBlH:XvyEYc/y3w8mUoiPBx
MD5 SHA1 SHA512 SSDEEP

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 0461ce06b3b4ed5f6a4202423812d4bc52ac2a75a55c841dd94d6785d64e6509
MD5 aec17a38f24cf6ad32405880201b18c5
SHA1 5416165ba8d9762f722a0aa62e54d88292f87ad3
SHA512 b0d190b0aa61faed4cead45327f7cf2a00add37d88d27a16f7daad2eb2f1c2bfbba886f67d29bccbb391e07dbb834618d4190d3f3acdd638d709dd727863ff48
SSDEEP 24576:mdewsAja8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:OljagDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 0c3e63393ead8cdfc5726b2a2aaa9fa180907116cee4774b8584fdb90ea897a3
MD5 b44b3f6350a6ed7ded27a6c5243cc4d9
SHA1 8a486be30935c72ed33c5dafde41f1851839020e
SHA512 1931ef8ab41b082298c54003ad9423f2320f86a3f7c7cc5ca3561c5e9c6e3995465530690969b8a1d57cbc970cf3fdb97c801bfa949d24735b69012203b5b9a9
SSDEEP 196608:hUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJH3UoiPBx:hUEtQevvqc2W1cpV2EI323
MD5 SHA1 SHA512 SSDEEP

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 2450fe621257af73270fe487aa05aef59a38c5cb92b9e96a97089b80846afcaa
MD5 a9a7b20dfa8a4be40e0f6a34346fb40e
SHA1 a1d20ad6445c88231e8529c3dde018ca818c1f67
SHA512 e6c6b64ace9d8fd02f8706e1643ecde9428c85a7f865cbf53944b0b88f577e6c842a56d175ccd795ccd6dd921efeacb39df9899ae821a009afe43d2e66ff1be4
SSDEEP 49152:jCbRquA/m2yL5zifFiV+XenmE3/z6gDUYmvFur31yAipQCtXxc0H:coqHVjnmCU7dG1yfpVBlH
MD5 SHA1 SHA512 SSDEEP

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 9bdf61cdd98a3f8f12a1ad5c9bc82bada7fe6884ccba2783798cd89a3b3463cf
MD5 92b6896d3f7d556a01208e8cc8536170
SHA1 8c0ed509ee4dfec7b7dd45c1b0e614fe4258db4c
SHA512 a4cd4db4a19282b2e9f611afbcfac621cd4a6944ca00ca69c595c764a16c3e763c9649a56f77506dd785c459899d81c21ae2fc62ded80aa3da79bf841ded8e4b
SSDEEP 24576:nAhGLJIFoiwtA5l7S5338NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:nAMyFoiq5ngDUYmvFur31yAipQCtXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 7bb2fbac40c058c7ddb24b532d1f7046e7930219f45ebca6aa756612f1043c5c
MD5 af67a09936d9d02c8b20cdfab1f95474
SHA1 7ed58d031fbc41c3f5544bc83cb35ba89a904af8
SHA512 a3380cd37706299d88da7160c4e8e45e4646d628b7ec6008f2761ee86998af13d7b5560d251173333be7e27b8e7ab3d7d65476c4a1a86fdf3d2ad5d1e75f914e
SSDEEP 24576:1wuoOWe8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:1wDOrgDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 9936fc914ed225c1d3b8d290d3505edc84f03c9d6175e8aff06d1e214978864f
MD5 b205ef4065c2b974c7ddd85c19e29f1c
SHA1 4757036e1dc1ea8795da4fa2f6606962df4f64b8
SHA512 936df8d040ca07e73b1bc1b4f012340c5664dc5b9a0d863c093bf9a12eca6df378341977a030ed42ecf1a681b7de6f8519ab1cc03d6f5536a85af1ffba3dfb57
SSDEEP 12288:NBZ1IyqFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:rZu18NDFKYmKOF0zr31JwAlcR3QC0OXn
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrmstp.exe
Size 4.6MB
SHA256 24fb85c30b42b68ba074943e2011cce01cddfe5436cad8a3a7c035c51cc7a30f
MD5 3dac0befc537de615071f389e02471fc
SHA1 bbd90d7c08a605348ee15cb12b26b763da4e281d
SHA512 f3f2dadb38c0cda5693d1f8f8ffb3815cf91905a44c795a0f27b6865c03a6a8073e2f139b27df9ede1c53450f4c0119dd2beb6f33bdc433f843a2a82d672d00f
SSDEEP 49152:GyEKQ5E3ieGR0PEtBFUow1b89eX61o+2xmepn/TRijbqYW3qkCbDypSfe6qwiXES:Yq9ceqC+2xl/SSaymU7dG1yfpVBlH
MD5 SHA1 SHA512 SSDEEP

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe
Size 4.6MB
SHA256 0c2d5c7038ccfe1876eee085b35dec25515698c20130c3a83e513e7f9e875393
MD5 6b297b71fc26b1ab74018d58777ea7ea
SHA1 72b5bb2b8c2d584a939e799fcb68487a13df309e
SHA512 8eb73f4cc89dcae37c4c3167c8a7bade0a2774985b5d424b555ac844208375ff61e1db5ac2ddc72d3223bf5f3f33e58fdb0c89396126e2e23a80b224b23e7cc0
SSDEEP 49152:2yEKQ5E3ieGR0PEtBFUow1b89eX61o+2xmepn/TRijbqYW3qkCbDypSfe6qwiXES:oq9ceqC+2xl/SSaymU7dG1yfpVBlH
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\123.0.6312.123\chrome_pwa_launcher.exe
Size 1.9MB
SHA256 fbe2d8cee48a13603971ca454f17f4465670d25eb767cf4512ff37fdf0988daa
MD5 5107c69711aa0660ccd2122aa0653323
SHA1 d48c234278c1f51941498c7072049610f2acd313
SHA512 53b2abfc60492aa278acf8ce4b29cc1d8aad1031762e95b428c0f76d6e27ea027f183a603595d1a585c62a367d63c6e766c91c71f9719142d8d7ac12ee6f9edd
SSDEEP 49152:WVOyh+50zyx6gDUYmvFur31yAipQCtXxc0H:Gho0zuU7dG1yfpVBlH
MD5 SHA1 SHA512 SSDEEP

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
Size 2.1MB
SHA256 bcffd892e5a27645dcca1807b73a69905a700a2f4b3ace87567edd279bc7ca5d
MD5 2a3ceeb20a2d2bc7df2e5fb00ceeaacd
SHA1 4a894ed2aab3c811e03f9a4e46b83bf0dc1fa756
SHA512 45fe339537a4aae4e0a8fac3c017e1df94cf2363cf99ffbec703606e8c76f7338d27fe27d43f3a71bc82b14ba34ce667b0bb305bb16fed9e1499924eb2f9804f
SSDEEP 49152:R59PYHvI7wi/lIKuLFrFXlMWGxbgggDUYmvFur31yAipQCtXxc0H:RGglIKgMsU7dG1yfpVBlH
MD5 SHA1 SHA512 SSDEEP

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\123.0.6312.123\notification_helper.exe
Size 1.8MB
SHA256 0998f999b228a319a9ef7fa544ba39d86d45bc65a2b547bba9a2e808d0a261d9
MD5 bb01a5bb336da9f348a4bd8c4fed87c7
SHA1 4cd59e00907f2aef5cdd6e794e72673344761fab
SHA512 7d7375e4b0bd8ea9061fdfffde7a688fa2181cfba305862ec87d4e923332afa548c60b9048aec1087541b285017c991973fa37dfa7b82943d45e1a55eb92343d
SSDEEP 49152:sbrUzFjGMVaDy9INqZigDUYmvFur31yAipQCtXxc0H:jLADyNU7dG1yfpVBlH
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 1.6MB
SHA256 d1edb5802aa8593c437d195a57f48ddc4c02003076d9b828758a47fad4f7aaa1
MD5 9dd88fa5a0129d5d7ee6116d8adad22a
SHA1 630ed5d6a212977b1d6f2c25ed522d149e446a60
SHA512 fe3ec919d4921e392101b9292e71048e299f3fb3841a6853ac607e9b91e3c614e763e0e90b56ac9d7681700c550581069e136c5027d5116c8dcfedf4395944a2
SSDEEP 49152:l4qiwzPASW9mMtkgDUYmvFur31yAipQCtXxc0H:8QPALlU7dG1yfpVBlH
MD5 SHA1 SHA512 SSDEEP

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 53a155bb644f9141f7ef8f59040e7d2acf86f74c6d513b61f62d31b4b3bdaa25
MD5 4e6e64ab40cdce93e195bf3277fe1d20
SHA1 0c16e00891bce5f148ffd99540db7fc58fac09a1
SHA512 a73ef34aa176edea3e6198d42615d4597e59d28e3998958f1fdca3ccdfcfbfd612579a5aa9041749bde1b026c2721e7e6c7595cc1a2221678f50cc44b97f612b
SSDEEP 12288:ZRFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:ZR8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 196c2345e6ed3a6a3d61bdcef28e24a54490fe53c7e66a760d339a23c8df883b
MD5 014a972b7f7f1078b246f850049e724f
SHA1 3d106dd34543eae62d90fd5fdb3e155af885d6b9
SHA512 0a5bcb557686b9ffd73a19963d27d2ced91db530ab7077e6d1accec0bc28026a38cd23d4bbb9a2c0845e7042a64be8d03414cfd0a25e6ce00740199d7e7273be
SSDEEP 12288:CGFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:CG8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 703ca9cd0202b633162d2decd816a9b36d74bd5675b0f3aa34f019ee27949bc1
MD5 a5b8c93ce88a3f66938d81a4dcdf9a30
SHA1 ba50ad895cd284062c37667ee362c2da0b1969b2
SHA512 c7af235662b70beb0a2283c19007fe3973c3e20c51f43d195c1b08dbb6f32259b8e33ed2c5abf53c9d8a08566ef8632258f3579f8a1de3dd7274bca52abb2556
SSDEEP 12288:fUFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:fU8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 c6af944011ca414fd9d79420d0a8b68b36440463b3cc898a31835d8498ea5f0e
MD5 06fc21ea297c7d1c46eb7b9600ed3309
SHA1 5595034528df7ee0088816f4e8032ce13def6d91
SHA512 12455b574c9474bcac89097cf896858abd061fab6129d4ede815cd55f9075d8162b7a0ad57015fa37ba19cd1b30b7009b9068b8cdca96ac92d3ea9507c2c59d8
SSDEEP 12288:IVXFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:08NDFKYmKOF0zr31JwAlcR3QC0OXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 4cd7cbbb0acd50826fd6f4dcb5d5f8f3ebe5ef0d9714c60b77dba37a4874ea0d
MD5 8dc4501c9fb46f9ce7c46da685a0d00e
SHA1 b2b07df717b8fd9c863e8c7c3498f5905614326f
SHA512 38efad8dcbde65ef3e84a99161d33e6bf6e0426ba656f5029120e0452be329190251fa47cffc7f90127fc4b82d7945be40ff2d712d2bd6e92faa8baa302605bd
SSDEEP 12288:K/FCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:K/8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 3c18b738733a8f00e8959169af4cdd3d975a5314d121401c8095cf28f7109160
MD5 ca52c16c3a3b01343d6027cd10a7bb57
SHA1 e40d1767015e02dd4326c1f7e0984dc5fb1ed96c
SHA512 547a79813f252c6a8c83912e36ee4c05bb9bb76786cda0c7b2d1801d2cf13d562058b41d4333c96af2e5608ddf17f49ac1467cbb74189503cf65a60a2e0aa71e
SSDEEP 12288:MSFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:MS8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 87b6d6543847d888fb86c9b222abdceb1b3ba5dc55e54ab0e8f1fe86aea9ad7c
MD5 4ef8ba7019cb9d3b2103eefe408441df
SHA1 c68e165ce6eee716011d1139c4e251bf81df555e
SHA512 0b391736f4cecf529ba38bc77da7a3a7abf2fbe29a513bbd0bccddec82777f1ea9027610358191147518792b5bb2271770c493640b25ebf35d1ecad75d9447cd
SSDEEP 12288:fOFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:fO8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 fefe4560dd54367b5ae2a0e47bc025a41a24022b1bf901fcb02ca888239b17c2
MD5 d303ab13104d3071816b469eca4406cf
SHA1 478b8042b75898a94faed9c491c19b0ca6ddb497
SHA512 22276d97c2df19df0c87496d10f5dd472ed5ebb7c534b16496de7bbef0b46f6f2b341f1ba228bcc22969fd3f6b7818e48907b1eeec00ddefafb93536ebb6ee27
SSDEEP 24576:jZMSzFVSOm8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:jZMSzfigDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 8a0ad371b9f3cf364978cff340fc44b537756bcc8d0d511859cc727bee364828
MD5 eeaa8ab8094fca9d2d695cded72f9b76
SHA1 020ab34286d112d607dcea40142d0ce087219470
SHA512 887a12f488126ea41c93ce92c4c997a2528ad185bc056ba72478261f0da640f698e53127f2e12c9f5c99789a2aebe9c458972c848c540d9ed844d9b52747671b
SSDEEP 12288:sFFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:sF8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 5ee1d00976552c21554ed28576afb4417277fee4399d1a4720dbc3dc161e8da6
MD5 2fb92188a8ccdb06069c9947c3e58dfb
SHA1 615001d8aeec56ca92a9f25609cfc7475d15ae13
SHA512 d15eaf7d1af6b839ffc6b3c4a67af48c3d12782dd2bceefddf4ae4ebe575661e7b01ca332a649e538f50d3e29fd13a01cdd848a2b3687973890b94a014897aca
SSDEEP 12288:GpFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:Gp8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 a7bc3ccd2535433572f3837a3fcb14b3acc140cf978aff1e4af3c9e8118d6069
MD5 009a6303b2848f04b3ab1bdcd13a71ff
SHA1 c6cabcf674067bad5a1d5b85fe5b34dd42ff190c
SHA512 69cfb9ce3a059be95eba6adb3ac230a20c48e969b14926008c4001cb05264231618a359bb63a4d07d0f01022a4467b9344a86a453ee634ba8600ead0113b0ad6
SSDEEP 12288:syPz5L8qFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:1zyq8NDFKYmKOF0zr31JwAlcR3QC0OXn
MD5 SHA1 SHA512 SSDEEP

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 d91d32492649e8742bab995ecd8deb785be264a9e4b2b92cbf7d5d438f47b8ac
MD5 b0af68333a0ce4226f2d0af63f3d6c12
SHA1 28897778cfa471536352837d097cbbd78700a317
SHA512 4148bcf9c4319867e91877239373fc110194849487c6fd9a8e049d1e0ccadaa7c66c44e58e66de0d902fbbca903068bbb1f900be15d03656611de63133389df5
SSDEEP 12288:dFFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:dF8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 f3fc49d5f084592586635437686eb3268b12508d3f4e6f832f31608e02922971
MD5 168a7cc1af230316df836b1845e4f91a
SHA1 c51b88d8e732888e92e8641ff1fcac7e444ff0f4
SHA512 218f6826bacb6451bacd79edfd2f74ce76188963946d7b83e3180f34dff7d4983e4a0306214595db4e5cf9c20f8c6b518f4e79eb943a09ccdadc016a6f474c7a
SSDEEP 12288:fFFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:fF8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 05cad63e82a4e801a47a621c42ecc8283b3c61b3dadbea988c424624705026d1
MD5 d7af4cf094f96ff80fac98e3c471910f
SHA1 c4621ff431b84fbc663b0859ee2e270968115e1f
SHA512 5bfa193dab9e9f28b996b1494c4d0bde15a90311f53a5012249b76f228b80a452a4f6e2f87798e005040985f53013d08019ee5bf1d93f6f1d9bc36ffc3356046
SSDEEP 12288:oyPz5L8qFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:pzyq8NDFKYmKOF0zr31JwAlcR3QC0OXn
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 a4bd42958ea4b66735d1f7e64aed8d330f2da0fad40c78dea30e41de613487d0
MD5 6092c3c0927f27b45cc747365b73fbf3
SHA1 7988ee3ea3aee56d9595b914d0697bd4fd83aa0e
SHA512 c3d244e9278b97f41e44ec9012e3585921f17e527b78c773c622d19f6df270154d3026b78b83b31c783a70b72ad6030ee51b8c6b1fb2ddb942ecdecfd92557c9
SSDEEP 24576:PTHaLl3z0zDE8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:PT6LljzgDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 a6bd2d11e73ed115f624f564e7f6d8c151766f42414ad94304fe4f5e3cc392f1
MD5 8be279d1cf31ee5ddf19b3824d089c33
SHA1 e5ee9efc557d7c25b38047a0fa9135e29b12cbaf
SHA512 dc8bc4e20306d062a13dd10e64b46f54e0c23a0a927f92f49a291a4f170a92b1bdbbd8c40c202ca4eabc2a3967e2604bcb81b217d5fb2a7dcd64c58cfdfa2c9a
SSDEEP 24576:s37d9CHKy7GZg8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:W7d9CHKyaigDUYmvFur31yAipQCtXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 1476b97300313007d928770e282fb78fea2c6915a26734b1623a57b1edc0f9e9
MD5 db075d70b634cb11dbc540e16e750db2
SHA1 d1d388d3bd6d781179aeba2368180f063166baa3
SHA512 65446cec5ee6e270b7aeb29a097a864a01c86b458298c202a79f7491299943d5bbf661d1b72ebafee72eb567a1d2f43930a74b824f2bd02d3ba9e5abec9acbde
SSDEEP 12288:v0FCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:v08NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 1b8d40fcf4d3c5507ebd1470dedf945f0f246fec74638a211eebb79e364b5f35
MD5 5f6aee1b843d294aafe180f9ddefd072
SHA1 21831e8474bb20f54118bd51c06fd848ccd7d558
SHA512 24e489ea6ff4ee2a2a8e2dc77c24614127fa9cc6a7722fcea94b0aa8ea2e2ee7d519ba6db1a2939fb53db2e954e3202ef24f70bc5dd71ffa9731b9512b59716e
SSDEEP 12288:uKFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:uK8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 7413881813145585519e77a57b9fc026989a9f26f1ebeb4794a539147f4c9dc2
MD5 b7aa50e65b104e165c441e9a37a86beb
SHA1 1bd469efc7625efe3e92401d545cfeb9593d83ab
SHA512 5d833915f92b4f26e3757b6ea108fd32dcdd1a5af0dcfd93c6bb719ddc312a6eca2556e077f32ffb40977fdcaab1771221b877aeafc8b0adb994c908074d7337
SSDEEP 12288:obFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:ob8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 52a9fad39cab80b9fe5749ad629e2993257f9e54f0cbe3ad297da81cb43e4cc3
MD5 50bb2f130fa808d9e79e1458c22d6c9c
SHA1 215c3e246e33eb0eb3bf7de57a4af8ee206f6139
SHA512 f65d9ffb1ae90c3e425e866a6abde3ce977562bdc02ecf0c7d983b07f3dbc8455694ec04da89ba949c4881b5eb66cb538566809cba46d5198c9ae50fc2f4fbcb
SSDEEP 12288:IFFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:IF8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 a19278b2ae0bf5516fa7ec196058469ddb4b976854ac3a8d86bf6614a26e8e6f
MD5 16740cc0ca4bc7de40a54b35f3748047
SHA1 0f119ddcd4357e34672e035adbaa0b7e8d4c1c90
SHA512 5f93077565a5372c091f788e137a9a2da661b09964cd5788e54c6c3dd50c4256e7a8456174bf32b6332a9fed4a0fc07415691ea2ac195f16fe5054d0b21622fc
SSDEEP 12288:G0FCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:G08NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 c0a2008122b520843d778417ead9fd6363b74de17aab3e21a0a303c7e2ac5a28
MD5 0815951065320664589a7f5588fe2331
SHA1 8c27fb33a2f68ce6779b274b147dceeb5e87ae04
SHA512 132f7716af539d5d51a9f0bd839570398a800e326048948649f1142af33591b23fe9bad9054597c1d4c7cb63858c10e6070e13f744e7621a701ec28f4fe6cde7
SSDEEP 12288:pNFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:pN8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 581KB
SHA256 1de7dd3775d84226f2551957e664f22168569833eb86e3a50fad3111ff5a55a6
MD5 c1b9bb8f98ff0ba163cda72ab6d4daa4
SHA1 7726bf8cad4130ad267b2a97c2390071f54dc2ff
SHA512 82ddf805382689514b5e9af2cb66719d23a107af6bbde4a51d3bbbe8867d8600fab32ffb0934dcecb0cdc23625aed398dc4d044f5a202a2ace54981c8d0106ab
SSDEEP 12288:a/FCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:a/8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 701KB
SHA256 53f74809c8207ce0f9b66ae6daeb14dd4a7aaefcd3b1d52f1e5ad8a7325cb393
MD5 6fa6d5366a0e7fefb422e00e3012cda8
SHA1 8e66889e4e32591a0741ac9f8423588c3b95e88a
SHA512 c65c8125e8f54160c91d3400f272a78f1527acb067d266e21a8db9f977a4ecf0137fc3d502d2c6de8676fee26683982e60d83f847f66f9b1bc0f50f5a44ca99c
SSDEEP 12288:3UFmDDLQFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:HQ8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 1d61168a911e4deacbd27fa265187e5a269df6918cec67b5393bd7fd65438a57
MD5 d1bcbfbf73a87a4d5058eb475daf2dde
SHA1 a21ffe3283b56464b08f3ffe4369a7d42567f2db
SHA512 d68a4810569a338df6147a35eaa448c0ae4c8f99df29a06d35d1a6d9dca2124a15363712e20e53e4feaafe259df13f26a8cdcaa63c801fca096cb375e0ad0b46
SSDEEP 12288:9JFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:9J8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 411df9ed1dc122e09583d94310b283b83c3426d05ccfd799e277fc8ea581c581
MD5 00b5fe04cb11fc1438579f752c658643
SHA1 469d4b22a3527d685ce68cb3d0df6661aaa1cce8
SHA512 d33f07339c8465fc5cb0e819b75719856b6dab965ff37060090836877c4ace2538bb26db0fc04d68705a20de19b278ac2f1bbc0bb4363edb97274f3c0496599c
SSDEEP 49152:ta0h2GEkuAe73q3pp46zwwQngDUYmvFur31yAipQCtXxc0H:ta0hNYG4JwvU7dG1yfpVBlH
MD5 SHA1 SHA512 SSDEEP

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 659KB
SHA256 99687ff6e67ab51e928c651951b4f4a94852328228307d207cabcac265186957
MD5 9ae295cb8be7855fc508397c2a11e976
SHA1 376f930f38b6946d00323a1b91c17416f096eb57
SHA512 efc3f5cdf90fcf6f8b49a81cec38eba9f46e80510375effa1dc5d35ac989cb7900ef9765ae0169ddc6867079518c0562d1e9cf33d7068bce7e1373573d1028f5
SSDEEP 12288:mhbHjfXmFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:mhbHjPm8NDFKYmKOF0zr31JwAlcR3QCx
MD5 SHA1 SHA512 SSDEEP

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 b621294c91c19d9c791975397659cdb7bd20335ed47dba80bfd1094691fdba26
MD5 6010b8c7819c09d3e69a36bcee094add
SHA1 7ad2c88a235929d3c7fb2b23c90fac452b99b596
SHA512 86d70813e7c9817484b0d9bb26ae25d3da69ab2eb3362bf9fd5bf0e92441cfea6f44caeb270b4b4922dc9db97c2a975c7c9d76e166ffe373b99f68916bf78f02
SSDEEP 24576:+3YgnJcRTk4yti+R5dpR/u8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:+IgnaTk46ppR/ugDUYmvFur31yAipQCx
MD5 SHA1 SHA512 SSDEEP

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 578KB
SHA256 a7666b300214fce88bbafe007f4015f85a39e5595b7d617759e2e05c4f75351e
MD5 2528b1d45abd59f69953704a342e6a2a
SHA1 6378cd425c281f4bfdedc866304fc37578904ed8
SHA512 6ef2a17f3c1912153081d79c396136d13c915fd8cb929239d7c948836c36eedc84920271ebb1133c28b9a933d858ed0efb91791b10c813f7d466a2f5555ea9d3
SSDEEP 12288:dVFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:dV8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 940KB
SHA256 58325ac94666fb24757d95cf17d72ce668d9b0e618127fa1b2e13c853eaea513
MD5 25b7efa7e010f9f6ba864c6357e1fab5
SHA1 57151f65057e84cf97fec799d3eb543b8258ecc0
SHA512 570085f00c390787be2845cb085eac10a4d25197a99ca36a04b937695641c512c31f9c51c4b5d6690e8726314ec376698ad8086c1fd457b6735e88faac4175b0
SSDEEP 24576:GpL3UTs8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:GpL3U4gDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 671KB
SHA256 0b1e6ff8b2b70967fdbe5a7c222a2e613092904ae801fd7017a99c4bbb979514
MD5 62eafa67e28b7cfb2581b4a37c9c048e
SHA1 c6fb7a9861ca34b4fccdfb614d592181969fa827
SHA512 9279a8c08f490ceb066c0603a0cea537599962a405e45969ad4337d6a149a902095bb71bcfebf378de74499a55abfb1796a4f69eff1bd9b34da70faec6de35bb
SSDEEP 12288:qpFtpOYFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:oOY8NDFKYmKOF0zr31JwAlcR3QC0OXxx
MD5 SHA1 SHA512 SSDEEP

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 5f98e2b472e8c70d17ca13dfcc970baacd5cd76de66698bba421ae605b061082
MD5 d387615e2e910f57c8bfe8ef56d24dce
SHA1 d20c392d7dd998a53120777402936e6f8d42a2db
SHA512 fab92abe020a969b0070899ed45cc7f630d7fc8e38c5912de0b7d95f6ab97ff0214d83ada20d6f38f20f172d582bd3c0111ae1603e87c6d1faffb69ec1ae5297
SSDEEP 24576:57NM9YmZqmWMUkPjZM48Mv6bEhsZ8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:57cBWMpPjN8DbEhGgDUYmvFur31yAipZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 d3a2efbdeefe310b476bc38560d8663b1132920cb6e88e48cd9c7fda793aa19d
MD5 ad95baedd99115ad3be3a73c26334458
SHA1 c5409f6b86c096fe0306b3810ef8736839f3707b
SHA512 dbcb263068ed7fbe1316850c9fcf61197be3678810ab55cda1c756522c77b1c365532d1a5955c5e0276215e942cd2ab4d493a997f52339b695ac55b115fc0e25
SSDEEP 49152:cF2YuHNETovcvNYf8km5gDUYmvFur31yAipQCtXxc0H:56tCf8kxU7dG1yfpVBlH
MD5 SHA1 SHA512 SSDEEP

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 e91b26cf69f7d241df9062d846181daf078ab32b50dc22dc283232eb4706d1a5
MD5 6b724882fe12648f51b39706c60d5528
SHA1 f4f17a38f7a7fa35aa2fc7cd9ec1de24cfe7bc2b
SHA512 256a0a42b4412982e3afdbdce7b580306c0e1af964699b983647b9932f167eb0a6dcd19280b073a48017dbfdd26160722e82f45dfd318f9b78ef10fded7ec361
SSDEEP 24576:GAFs06+Omlf3NXEbTok8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:vFs060lVXuHgDUYmvFur31yAipQCtXxx
MD5 SHA1 SHA512 SSDEEP

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 885KB
SHA256 83d87e6e448606249b6480b4474b4012db1d9d8432f0aa9cc827c899422e28c2
MD5 e401291a6b4b09b51cc4a8ba50c4b7df
SHA1 036b50dea1866b35c4526ee261fb2f71e4dc16da
SHA512 d9f83739ae78467b38ccb10f7fed55702b95821b8a4a7b5a206845eeeba4d2fbe7b2e89b5f9915ab6f65673968cb7105668089e7148d9e92bbbfd0b993d5c949
SSDEEP 24576:TJnJ5D3WtH8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:TJnJ5DGtHgDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 68e1de20d25805489f12ffc945b215ab007190ba89260ce1acff0ba2d95d09f4
MD5 872dcc5245aca161df6006ea47d3c372
SHA1 5812cc98744a8a64e553299b40df641621f458e6
SHA512 36a2d6489f35644857379822770c7f9553391acb7be8058b49271662d14390f61ca742b79dcca7fded638a2dfb75f8f5381cc1a2258f182cdd056247e01e5125
SSDEEP 49152:qo06DIKdwc+eQnSt65aVtgDUYmvFur31yAipQCtXxc0H:LOU7dG1yfpVBlH
MD5 SHA1 SHA512 SSDEEP

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 661KB
SHA256 d7abf3b95c673a31874af6afac52875388d1347e2d4925fe1c2aea6c0f6ccf83
MD5 1173f9c71d74745d9eb846a907813246
SHA1 7c21f97aa7b2842cf794516997792a1b231d1438
SHA512 4615610cddb48752265fbd237a8d61c7ccb12a35656afb31cb0157d0148e8758449425de73ca3cff8d89731e09f18673264e76248b4db1403754ffd350546479
SSDEEP 12288:pEP3RrKFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:6rK8NDFKYmKOF0zr31JwAlcR3QC0OXxx
MD5 SHA1 SHA512 SSDEEP

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 712KB
SHA256 ff4882c2ef6f326f29443820816c3ddf47f58cab0b506a7f49a87b05fb7026a9
MD5 acbf7991967a39358bbde11d167a69a3
SHA1 9d18a7041dba5782306a34e738a38a19e2f02521
SHA512 52b5cca2ad9fb85b284e6bd1a73256b2f9fc8cf2b156d42331b5981b9a80d42a3ad499d949878a48bf115eab1945f2fe3e76c5f1f174e74f717ac6268e333e62
SSDEEP 12288:wjkyWFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:wIyW8NDFKYmKOF0zr31JwAlcR3QC0OXn
MD5 SHA1 SHA512 SSDEEP

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 584KB
SHA256 d0c1a1ebada979d5c0166ea17f16986992bbe74ecab311391f6713b9cda18df4
MD5 52f6bb5c881fe90e374ec4778d428633
SHA1 95620508ad4b890c5e3c4fae98433e74b731dfbc
SHA512 e03f24ed6ed3a2ba81b5c2347445cc3d7b96907aba1a3ceaf7b1f4557fbd749fbc37348a98a7282f2931c232279e70d8c6a8dd345665c027bd5bbe59a7443986
SSDEEP 12288:iFIFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:QI8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 e7f90f8bbe87b0cd425d3d35dfb5d5678c5a1c8ea2a30f00898c34e30b64add8
MD5 8b714f1cd7c46f52a8bc03ca9fc14c06
SHA1 626a6d055ac681f3039f5fa18cb13507c66ff8af
SHA512 8b56b84df46429a89b609bdd960439f24fe8bea6b10e99f347700cef4565c66a9bb4d4eb91daa35e740c2df43ee6f565c560a5cb17c4a2783b4c97848044d927
SSDEEP 24576:yQ9MxZKdcz97w3x8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:yVKXxgDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 772KB
SHA256 5d198490a8de3b099d5eccfd64e81d25ef9f84113ca53d3b9c7cb814b03b81b3
MD5 819ca1b3e4b7312841e0726abc806803
SHA1 68e3c657f09136badac4d1665a675b5596fdae4d
SHA512 15271502e26847fe876caf4252a5179ef28575293f08fdacb1d61c778cde07625ea853ee7f7d9d8a555595aa385525d647951fc9218befb5cfd1bb0f10cbd13f
SSDEEP 24576:eyocxApS8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:jocxApSgDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 c89ad101a98881f7514001e681299d3d3f09419b096b4498d65873177beba611
MD5 4820fb7d425e2dd4d00deb353600daac
SHA1 43c064c2fe48ce426072c4c616886cb95d887952
SHA512 5e94bf83a9432107e39be45fc5ef2c9fef308151a7a63642e46faa7a34e8b452b14dae7e6a056c87215ad29f7ffe6be7a789abf9c051de48e8588c49cec37d33
SSDEEP 49152:kWcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIKSgDUYmvFur31yAipQCtXxc0H:O0zuNILU7dG1yfpVBlH
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/408-665-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/408-408-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/620-335-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/620-528-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/664-395-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/664-273-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/736-323-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/736-444-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/736-668-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/1172-69-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/1172-72-0x0000000001A70000-0x0000000001AD0000-memory.dmp

Download

memory/1172-74-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/1172-67-0x0000000001A70000-0x0000000001AD0000-memory.dmp

Download

memory/1172-61-0x0000000001A70000-0x0000000001AD0000-memory.dmp

Download

memory/1468-393-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/1468-387-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/1556-428-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/1556-669-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/2288-47-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/2288-38-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/2288-241-0x0000000140000000-0x0000000140234000-memory.dmp

Download

memory/2288-46-0x0000000140000000-0x0000000140234000-memory.dmp

Download

memory/2464-432-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/2464-670-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/2612-0-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/2612-35-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/2612-11-0x0000000002180000-0x00000000021E0000-memory.dmp

Download

memory/2612-1-0x0000000002180000-0x00000000021E0000-memory.dmp

Download

memory/3024-346-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/3024-531-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/3100-288-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/3100-407-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/3376-357-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/3376-548-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/3436-671-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/3436-453-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/3724-312-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/3724-431-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/3900-242-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/3900-50-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/3900-56-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/3900-59-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/3912-664-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/3912-396-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4012-23-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/4012-239-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/4012-22-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/4012-31-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/4128-243-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/4128-82-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/4128-76-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/4128-84-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/4556-370-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/4556-663-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/4664-257-0x0000000000680000-0x00000000006E0000-memory.dmp

Download

memory/4664-250-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/4664-369-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/4664-251-0x0000000000680000-0x00000000006E0000-memory.dmp

Download

memory/4748-301-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/4748-419-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/4812-261-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4812-262-0x0000000000DA0000-0x0000000000E00000-memory.dmp

Download

memory/4812-284-0x0000000140000000-0x0000000140135000-memory.dmp

Download