0b3ad575168e0457905f19bb5304a8ea8cce461d7b1ebd0964d1171374271e47

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
11/12/2024, 08:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe
Size 1.5MB
Sample241211-kbabsavlcs
SHA256 0b3ad575168e0457905f19bb5304a8ea8cce461d7b1ebd0964d1171374271e47
MD5 4bd5ab8c1d6eb0d7b601863a74471cf3
SHA1 660bd416b9570b16fa77e2e559989f8efb9fd8b4
SHA512 783e5707028cc8acfc022cf4ee50b81689b330faf3cc6312f91d699be4574f389938b60e171849c93e64f86ce7842e13f5665ae9f6f2435e49e8c04a964380bf
SSDEEP 49152:IW0c++OCvkGs9FaYwUPYyLNiXicJFFRGNzj3:jB3vkJ9TPj7wRGpj3
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
4824	alg.exe
4924	DiagnosticsHub.StandardCollector.Service.exe
2516	fxssvc.exe
2948	elevation_service.exe
1084	elevation_service.exe
3004	maintenanceservice.exe
2472	msdtc.exe
2348	OSE.EXE
3400	PerceptionSimulationService.exe
3612	perfhost.exe
968	locator.exe
3848	SensorDataService.exe
3020	snmptrap.exe
4048	spectrum.exe
4628	ssh-agent.exe
3648	TieringEngineService.exe
3548	AgentService.exe
4944	vds.exe
632	vssvc.exe
1276	wbengine.exe
1964	WmiApSrv.exe
1592	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

AutoIT Executable 3 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/memory/2332-0-0x0000000000400000-0x000000000058B000-memory.dmp	autoit_exe
behavioral2/memory/2332-82-0x0000000000400000-0x000000000058B000-memory.dmp	autoit_exe
behavioral2/memory/2332-146-0x0000000000400000-0x000000000058B000-memory.dmp	autoit_exe

Drops file in System32 directory 35 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\msiexec.exe	HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe
File opened for modification	C:\Windows\system32\spectrum.exe	HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\dc75488d38f5360d.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe
File opened for modification	C:\Windows\system32\locator.exe	HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\123.0.6312.123\chrome_installer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\123.0.6312.123\notification_helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdateCore.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4764	2332	WerFault.exe	81

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9933 = "MPEG-4 Audio"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000dc85d869a64bdb01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000031087d6aa64bdb01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d01d526aa64bdb01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000870c206aa64bdb01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f5b96e6aa64bdb01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003980546aa64bdb01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003efced69a64bdb01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000037be116aa64bdb01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008a4add69a64bdb01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4924	DiagnosticsHub.StandardCollector.Service.exe
4924	DiagnosticsHub.StandardCollector.Service.exe
4924	DiagnosticsHub.StandardCollector.Service.exe
4924	DiagnosticsHub.StandardCollector.Service.exe
4924	DiagnosticsHub.StandardCollector.Service.exe
4924	DiagnosticsHub.StandardCollector.Service.exe
4924	DiagnosticsHub.StandardCollector.Service.exe
2948	elevation_service.exe
2948	elevation_service.exe
2948	elevation_service.exe
2948	elevation_service.exe
2948	elevation_service.exe
2948	elevation_service.exe
2948	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
652	Process not Found
652	Process not Found

Suspicious use of AdjustPrivilegeToken 40 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2332	HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe
Token: SeAuditPrivilege	2516	fxssvc.exe
Token: SeDebugPrivilege	4924	DiagnosticsHub.StandardCollector.Service.exe
Token: SeTakeOwnershipPrivilege	2948	elevation_service.exe
Token: SeRestorePrivilege	3648	TieringEngineService.exe
Token: SeManageVolumePrivilege	3648	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	3548	AgentService.exe
Token: SeBackupPrivilege	632	vssvc.exe
Token: SeRestorePrivilege	632	vssvc.exe
Token: SeAuditPrivilege	632	vssvc.exe
Token: SeBackupPrivilege	1276	wbengine.exe
Token: SeRestorePrivilege	1276	wbengine.exe
Token: SeSecurityPrivilege	1276	wbengine.exe
Token: 33	1592	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1592	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1592	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1592	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1592	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1592	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1592	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1592	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1592	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1592	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1592	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1592	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1592	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1592	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1592	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1592	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1592	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1592	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1592	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1592	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1592	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1592	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1592	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1592	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1592	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1592	SearchIndexer.exe
Token: SeDebugPrivilege	2948	elevation_service.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
2332	HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe
2332	HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe
2332	HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe
2332	HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
2332	HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe
2332	HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe
2332	HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe
2332	HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2332 wrote to memory of 4020	2332	HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	95
PID 2332 wrote to memory of 4020	2332	HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	95
PID 2332 wrote to memory of 4020	2332	HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	95
PID 1592 wrote to memory of 3892	1592	SearchIndexer.exe	121
PID 1592 wrote to memory of 3892	1592	SearchIndexer.exe	121
PID 1592 wrote to memory of 4364	1592	SearchIndexer.exe	122
PID 1592 wrote to memory of 4364	1592	SearchIndexer.exe	122

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe
"C:\Users\Admin\AppData\Local\Temp\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2332
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Users\Admin\AppData\Local\Temp\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe"
  2⤵
  PID:4020
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2332 -s 1188
  2⤵
  - Program crash
  PID:4764

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:4824

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4924

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:4268

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2516

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2948

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1084

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:3004

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:2472

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2348

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3400

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3612

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:968

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3848

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:3020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2332 -ip 2332
1⤵
PID:5024

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4048

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:4288

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4628

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3648

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3548

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:4944

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:632

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1276

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:1964

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1592
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3892
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 804 808 816 8192 812 788
  2⤵
  - Modifies data under HKEY_USERS
  PID:4364

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
Size 2.1MB
SHA256 481332c87c1b329a9d087d4350af54fa9b2341c8cce1f51385644f73f28915cf
MD5 713a1c18cbe4008385f99e3b022a5c15
SHA1 fc0771c583e604359d797f4fcf9311333c07ae37
SHA512 fc884599437b7bd9244c2c4f57e3ee19e1daacbb89a577b1bc17bd0bdcc0af9061404db3b079a4bd5a354b200f1d5c1a709a8c87096765af4cd2a89ae5bc017a
SSDEEP 49152:WuYk3H5koUUfTqkkYLO/W2buywzMbOX+T7z5jLNiXicJFFRGNzj3:W8fTqi90bn7wRGpj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 477eea20e682605b67e6c5bee26ff9082056ef282c7c7d613b5e3f23a6f1ad16
MD5 d9e185d217a2a6b0f981aa6aeef0b3a0
SHA1 79e501e35039cd8889d22bcaf1ac20d94a0baf60
SHA512 3e025023c45b006356f67046b0a1c3174a1a79264db7511ebfd43dec19e2608343852fe69dee7d537762572eeb357d41c737b8a73667e468257e4fb87a013f07
SSDEEP 24576:kZFwVuDv/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:QFwVuLLNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 41e354ef133cec0d2bc209f04c84f9d65fd08dfc7036c6ba6732d9231814c188
MD5 f785ef562d8c41f68cac09e6c7d1024b
SHA1 e13e398a64a09f5ece6c812cdb2a67c20fb66372
SHA512 4b9066afcf0ebc23e1aad74da7cbf8e450406c05402fc522f344da063e2e50bf69dc9b712e2267b6218b9174bfa84b7f078b8757efed74425ae062d2fc4f5cde
SSDEEP 24576:n+gkEdfh4Coq/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:+gkE5SYLNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 8c86af905800bf992379ff11ce786c67b29a51c27489cf31c1c4cb0958b6dce4
MD5 8c2c8b9db831bfbc77b51a25ae52ee56
SHA1 75c19ba571a8dc1ca6165fc687d4c8217b38bb3a
SHA512 1a66fa9b59339c2dded7fcacef8d0e3ab95df1e8a49c3cacc0ef48a921fe9ecd37770bd6275a867352a512d1bf91776dafa6063b6ecfae422faf24877e2158f5
SSDEEP 24576:UBpDRmi78gkPXlyo0GhjrB/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:wNRmi78gkPX4o0GhjtLNiXicJFFRGNzb
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 c4bc1628bff003e014f6163461530e02be71c69256eb0a028bdf36ff0be022fa
MD5 682262d8d2ac2cd652b1146c8e238bd5
SHA1 23221ff361e67a2a2159f54acecc3851ec1b845e
SHA512 4baf3197eb3fa5ff21e5b7be7067cd886f87c76bab8b103b944a0f914d51956b2b042bd68568aa9f687f23a2b835f4461cfbc836d291d7bf1c7cc0da170ff799
SSDEEP 24576:tLOS2oPPIXVq/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:H/PVLNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 2f02810b0512138d32d731aca2c9d24da64dd247167e9e31131409edd271ab5f
MD5 5f28b353be08af734e5232edc488dc09
SHA1 5051e11a30a5cc0f15a5809afb8bb002925a51e4
SHA512 9fd6ea39477e0b6027af0be99a855ba1be1d16c2c7de472c0c5d7130dbcaa029642f89ececea7fd0bfeba8b58401ddad5713b2f0cfcb756301fd36154c28842a
SSDEEP 24576:EY4/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:uLNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 e6ac4ce7e203b1c80d609f07741a7d5705219ca53625015a8ac0aba55bd7c0eb
MD5 5ecccb49d1628104636f4d89d77d7c6b
SHA1 7fd1e9c6c453cfee8c30a1af49416f27229e5b57
SHA512 6c514317fdaf9eb261688dd3f2b2be26014112f595c8635a074b9ba2a45a27812728d82107da63f3cd63a6a04a67889be5b87cc47e6ad6b53ee76b7e6d88a085
SSDEEP 24576:+JIU3/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:+JIU3LNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 ac9ffef17fd8b09be75e459499b56e1b4947ce834f69721b57a37bc1eda68370
MD5 782fb0cc633334da47d73a164bb71fc7
SHA1 700493e048e12edd02134f37c68859fd2f20ca4c
SHA512 e16e4d8d890fa32de1f2564d03b320343aef8ea55b37473d71ed8dbf5c6f742eb04d1503611ba631ad1bd67ebc021fa37833f61be18fa546b5cb2823cd29db8a
SSDEEP 49152:0QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THD:0QvGAdlCEL8c/WRNw5C+7wRGpj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 b87c0f74b558effb09629a48401bb50841313ea7fd7ef6f6d7f23738652decb2
MD5 79769b85eaf323eeeac8d441417d2861
SHA1 07d4d28ca15cce52cca29ec625d0e1d1f5b8529e
SHA512 66ca423b5c5034018f579adbe90e2bf51d9175641cf2e43b9f49fd35c1381e65e2dc4b465d73b6be22c9baf94fbaafbf8abb5890ee05fe194d39278fdf6ec731
SSDEEP 24576:ZfewsAjp/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:FljpLNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 5d2830def3ab8c652493e4b413c9b386534a169b8b9bdc1d6fd3f6feda378fcd
MD5 1929bf31ed5a0e52455717c07acd8c26
SHA1 44e334c3b5d633a9ae8b7a9be37466a2d458785b
SHA512 e4df62617c1402d9ed457330269c85e76b80ed1b73a320cb116451a3a0df64d4a1ad422b58f208fadc5ada2746c2bd47f7aa9d57cb78060ed70022e071cc6ca3
SSDEEP 196608:OUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHVF9:OUEtQevvqc2W1cpV20I32L9
MD5 SHA1 SHA512 SSDEEP

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 d666fe4125bc680205d7fed3ca39550dcf9718c27b6d694ebfd88ca94b8916eb
MD5 81aff69e9ebc9e6b417ce69c1147037d
SHA1 0226a45225b7b5c54e48f963958b92a4409d3672
SHA512 64a96de9ba5749490f61bd4d5d981db5b8dc61d0cb96bf8e67c305263d5d3fc0a13108a31a36bc352e6715e2c77e7be257f69ace1fd8e4d14679a142192b5d76
SSDEEP 49152:+CbRquA/m2yL5zLfFiV+XenmE3/zJLNiXicJFFRGNzj3:zoq2Vjnm67wRGpj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 a9c16118c5a593f8cc3c9c059cac25251ac8907340073b6c6b533a1a05c35731
MD5 f82b7e90b663c92bdd207925b4c7ad9f
SHA1 9f30ddd9a2041eb388908d008c97540853b98100
SHA512 d7014d8d2d62f6062d71f304c8d508c1e81fdf7dd020958621efc661f1fccda64af2022994cfa43bb88fe2acb3daf7fffbdb60bc8e4c36abc54f85492c7580bd
SSDEEP 24576:6AhGL6IFoiwtA5l7S53a/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:6AM5Foiq5KLNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 68f1b05e2cc46f58750cbf79475787683d94bc6880fe211c91758a473b0fac59
MD5 5b1930f6f9429ecbe197309186f6cf82
SHA1 4a50fa94ac48e7f244063c3f5bc0a5aa285e83fb
SHA512 ef6d904c7902f57eb8a954498b78b22f89d2c48f694ba0024a3c4bbbc606c496162d31656989388ff93447b0f5bf851717d1607692de5bb2efb53a9c50cccf64
SSDEEP 24576:awuROW7/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:awSOsLNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 5eb2fd04c36e1285cd62dd74162a72dec840c9dd23a770f5bdea6cf544895c30
MD5 bd46881a83aaf01febf84f309008dc00
SHA1 1bc645f26102841514aa8bf7cfa0761f6c70ceae
SHA512 38631a98caf5bc4733ea1c113674d1544550c48060608fb5e7a8392dddfed7f278454a3706861aa51465e35e4190e8a2bc5ffbb7a9b6d343ca8a4d131e5875a3
SSDEEP 24576:CZus/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:cLNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrmstp.exe
Size 4.6MB
SHA256 83ef23493be250ab4a0e97782bd625a34aba1f0d0cbc2c414d48589de13db397
MD5 bf5e97e94eeef09a8f7317db862c1e28
SHA1 058ae95293ff9626ca652d6d38966162d132695c
SHA512 83ad441e9e68f4330c07725aec9b73035f6a61ff7923e55cd9a8f88411d76822a4ceae47b69b228d606b262ef60d10346ef0064f6d52ce42744f35cc64cbd06c
SSDEEP 49152:VyEKQ5E3ieGR0PEtBFUow1b89eX61S+2xmepn/TRijbqYW3qkCbDypSfe6qwiXEn:5q9ceqs+2xl/SSay+7wRGpj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe
Size 4.6MB
SHA256 3bf45734bc54bddf794d1f9cbefda57805273acc5f8bfd1bf3bf62ff2059edcc
MD5 aefaae306eb848044658f7759acb2392
SHA1 83c928cdf92c2eb70707f6474fdd282b184de816
SHA512 f84b7855dc57767ae92e19245adfbf7e72f7834614173f5806ad6a2176c9a34f1981bff29b2b8e0ebce1dfe4be407f328f35a21f604826ff4bf88e2e7eed1b04
SSDEEP 49152:3yEKQ5E3ieGR0PEtBFUow1b89eX61S+2xmepn/TRijbqYW3qkCbDypSfe6qwiXEn:Tq9ceqs+2xl/SSay+7wRGpj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\123.0.6312.123\chrome_pwa_launcher.exe
Size 1.9MB
SHA256 ca4f11bae8752cc05e38704720ad063f7c5d77cdb2520edd49df9687afe76119
MD5 7909b56a5549e858aef3fc3a2d759593
SHA1 8e1af5fa16ab181286bf8a88db218da5cbc24f2a
SHA512 1309ea29e21983dbde6cf67d9087d499ac538d2a84c1efc554a252c0a792f9aba6fc84f7a13597d7e72bef5958935e29e98f76655ff3a9d4aad60b510b73069b
SSDEEP 24576:UVN8FYh+U0m/YOn/xvNS6/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:UVOyh+U0zyxJLNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
Size 2.1MB
SHA256 47254a4b3132a7439b6b1e3810d3146cbcda7eb375021cc3bf678ecc980e0550
MD5 89d8e71008454d77332fb282a2ca71f7
SHA1 8ec06ccec9bfce98e8325c8b91d246356b442d88
SHA512 c3bdb34664c7ef44774b29c373c25fa7454bc48f54638fbe66cdba0024e5671373546de909bf1ef6a93a10cf9fd2908a65717eaf2c180ec60041ac3bf0185874
SSDEEP 49152:m59PYHvI7wi/rIKuLFrFXlMWGxbgRLNiXicJFFRGNzj3:mGgrIKgM67wRGpj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\123.0.6312.123\notification_helper.exe
Size 1.8MB
SHA256 4a1f6fc643dbbfda44968bb67c78f39b46c8df0daf66891f11ac428841843acc
MD5 bc6ac8c376c0d7059b05c1faebd82db1
SHA1 82fe41058434f2aa99614030732129cf6f5ac81f
SHA512 2fa340ce39052ae506f989073a4334d828e1b70d22468090b975689b7f421249203b439eb7ee0b55ed9e0cddef0342baaec32f6a1285783432c897099b52a920
SSDEEP 49152:9brUzFjGMVYDy9INqZRLNiXicJFFRGNzj3:SL2DyH7wRGpj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 1.6MB
SHA256 cb8e21e54310f99b9e6c7922aa70c16173ad9a1ab91a4042f86851377272dd2d
MD5 76b93c4e948b1c73ffa569a6dea1d95d
SHA1 bbead342424b404915cc152ff0734496c3f02197
SHA512 bbdc287be4f7f711c51a7aa44ccbfbe582418aec7e9b922f728cda4892f0066e308f2bcc00c161d80346c9e969f75e5d4b751c8c7ec1c0db3ce4ea01896786b8
SSDEEP 24576:8436epN7w2PROWFW9sQ0MtJ1/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:84qiw2PASW9mMt/LNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 2da4410877a8534c14df9eba4892003c06ecd2e9a881cb110f8d92ed4c8a3046
MD5 28494025cba21b677b757e672d47278e
SHA1 c299ad05a3cdba1159a50c6e668bbeb73052f69a
SHA512 88788efadb5542438b6a874234ac76ec920c869c20589eb1889c0de033a7465028bb33c7dec34434dbc11a674bc8c03f4bac42244b5f22e1c7c379c58bb56217
SSDEEP 12288:xmiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:xQ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5 SHA1 SHA512 SSDEEP

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 1e3acd0940a39e1f0b996933f791127d83b7a2b7a3975618937721f3b6dc5090
MD5 df86d8f9a3b52b88748b1e203c7f174c
SHA1 0bbb98f8dd0f208ed4a3399bc3a9ce92ad64df05
SHA512 e51d078b246cabfdb70f3b022f985c1d49192e315b8653186fff45590df27a12792f5735f9a17d3f5039ac684e33aa36c77f33fc3c9dfffb3467946dad0b515b
SSDEEP 12288:vRiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:vd/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5 SHA1 SHA512 SSDEEP

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 a4cb288b04360650b7636cf33e04d4041b4447a5659d4e4dbb7d4ad37e7060d4
MD5 07fc3de1eac6c9100b075d2bf7baa0e0
SHA1 ea259194de725b37b338a257fcf4c02498bb4a77
SHA512 26a2030c7c9909e61b54c8e14d907605227fa5030c6dff1290cc308265afaaabaf2df72ed9d1ae1d717a37520868d3344ccb5c0ab4e50616962bf4722764cab2
SSDEEP 12288:o7iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:ov/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5 SHA1 SHA512 SSDEEP

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 fb023080ff69810bbd66a006e1a2b39c8dcb9eb9a6eaff7efe85c8e0ace98db3
MD5 5d210889ab827ff5099071841aab4848
SHA1 cc51056b1a9d196bcf0da41fe99f3ddb3ed5024c
SHA512 37c5853480e2f7834be7638a37c10e7603d0c44566245db454539291df57fd8d7cbcbbfb5fb4b9d48de3072493e78162d909f46788b1d48c2d0dfe2ae7f401e8
SSDEEP 12288:rVIiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:8/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5 SHA1 SHA512 SSDEEP

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 6aa3afcf633dcabdad2223aaa29f6e7af84c9da8794c0b8a30f13094d42e93c0
MD5 60f999f3c27df289a1371845351e3829
SHA1 9318dfb4dd9c6a3e9b32185758d0d7f2c5d6ec89
SHA512 ab15d608617a5c2bd4654db2518f498dd815b3f71c626d4a04a157c589cee30af909d204cde4d12a1845c7488f8c511c3c24caaf015777390d28c01be7dd9c74
SSDEEP 12288:IwiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Ii/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5 SHA1 SHA512 SSDEEP

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 17255c0e7aaf4e2786617b8e2970f3f6090628231a0ca3ead1ce89a36db1cf48
MD5 ff0726bd12616db72965bec0ecefade6
SHA1 f286f06097a1fcc83a5f120e89f642186497a105
SHA512 80d35a9aa4748cf9019fce9127bc9c1790b1b44283cf3b838d3e931e131542f4743780e79d9c25b0544f29157bfd3160aeaac82b40d677cadd911baba2bd93ad
SSDEEP 12288:BdiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:BB/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5 SHA1 SHA512 SSDEEP

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 ed83af2f021cc6b9db119b603c9f9d2e9d36b33f5f698576207a6fc352d36cee
MD5 22bc9299583e99be412b087f6b30cfa6
SHA1 e6094e85345eab5019d039517a9811cc5706e2b2
SHA512 3dc08dd2d8d6448fc03b9805155f3375317e3e3be218da88dbcc94e318f6571194f117e90581671cad79d914024b48c9bf521329920426fcdada3fe75d3d3345
SSDEEP 12288:/ZiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:/F/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5 SHA1 SHA512 SSDEEP

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 dc3f9ad2a9cc0880931deee94d5fdd05e33e2540cb67adcdc335588231ff21be
MD5 b0ff6883a390feb5ac7fa2291128fffb
SHA1 5911ffd19c6675ed0a88027c55966a7d16eefeed
SHA512 06e615bf184c407a41749a2f7afd898560a3697b290c298cf32e361fe33e1a1ec7930cd48e07485c157f3f0f6159a0d3b186aa716961feb9ae54a91bfa02ebc9
SSDEEP 24576:LZM3zFVSO9/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:LZM3zfRLNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 eb7d05f8344f37a02db78ebda57f48b468453aa6b1772845babe7f92ae3e9c89
MD5 6859463157ab07ca956cdf8c94a4cdeb
SHA1 fc96a914cfd9565581f18a9abe28e0610c93813c
SHA512 be078656e744f136575a5e214177d3de57ef7613aacf2e0db1fe51a098f870251f7710f158fd17b4cd87019ae4697d130ac3d69332bfaf210c6db9839f4ba2fb
SSDEEP 12288:KaiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:K8/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5 SHA1 SHA512 SSDEEP

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 4d1b863bd761b6045fa101d31df5751cf97fdb60d84ca7690da59335701c7180
MD5 5280d4f3a0b54fd23eaef950573f9443
SHA1 7b54f93004135ed237bc288a491efee9a2fca665
SHA512 cfb0f3b280dcc535eb33e678e53c64d5e350c1d89321aed68cd9013ca5a090891bcff9cab95e62438319e9dd7565ddd3dd3acccc65bc6fb5afacc9b8b6ece158
SSDEEP 12288:M+iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:MI/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5 SHA1 SHA512 SSDEEP

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 80167b0986a3a8f43f20d14a63b366fc620bc8df003fb02aff52ea135a851073
MD5 d19f8125109d257572dd48ff3d589d13
SHA1 e18652bea50bc4faa2c59893e2e1bff6533a71d0
SHA512 bac9f7ad7aab5e759f8219856aeef85268970463d90ce85a0681f9dd48d051aef3ff33fbbbb4d65ea29cbb9c0a010295f28f1e417b790feb742c75fb7d575eb0
SSDEEP 24576:uzy5/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:umLNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 f39ec9e761cc31e028c34c7ec89d86e3341bddbeb2f56a9584e820359f8f06e2
MD5 2b70af5a546a48ba3228820642e61126
SHA1 781f510a2d574fb0b0d03eb450239ed0bf9a7484
SHA512 6ebca93a69a12cb3cc17ed5973e8548c5e3510043ab8f87e8f37030b6933974d8005aa924aeed1b24e150f68d084d45c9418a4bbe27b77cefe5f53ceb3fe0d11
SSDEEP 12288:EaiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:E8/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5 SHA1 SHA512 SSDEEP

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 34836b1c817c80efb7dc144ab601c26fd31fc688224f7dfaeb8625dfb7d786e2
MD5 fb5a28880398d0bca91454fec66aeaae
SHA1 afd5b740e47b4e05b7297c20745380cf315460c6
SHA512 410dddee9eae18947b6c51806fcf2077e21f3d0273ae8e05fef77ca3b8ab50c51cc030b211d45ca0c54e9d99541b674d574ad88143b4089fd28b6712b67aba55
SSDEEP 12288:aaiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:a8/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5 SHA1 SHA512 SSDEEP

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 f02475d303dabfef5814e5d8b90e84b7038ac5c8fdd4478cd9f71bf83a94609e
MD5 db5e4db3e6bdf97214319d2c6acf7bac
SHA1 2f9612c98f46c61709a8273935b74aeb7891af76
SHA512 048a93cc00be27f0de3b7e938cb40ab65bb2bc6310cdaf24fc8206cfbe13c888e4e8f83896f14f107ed18205c0f9d5dab1c71b3b79c02811dfbb1055beff4f04
SSDEEP 24576:Yzy5/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:YmLNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 8763b44f1f0370e6cbc1659fecc2e37caaf376383e12aecd759539a77dd117de
MD5 fc25427085e339493929ec4525bee1b1
SHA1 719bab58cbc2188d9454b977a3a7b5a6ba6c8030
SHA512 6561bb6dd763baa0dba2edaf6759212fec29a0de37fac09ac664121f32cb567d686096d60265cbd806c95f91f0e34cb8f694a686d6e9668aa3a0eda4bae0e60e
SSDEEP 24576:vT8aLl3z0zDf/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:vT7LljuLNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 f1866eea662f3f8dcf3ef57885ef27ed0f9e3507084495c886cb823aff1e3e82
MD5 22130440934c1ccb2250e2099970fce6
SHA1 3ea0d9de13f6edf0d98e48063b4dd581bd36d699
SHA512 4480a425bc66c691712e1482971e887f7b588d812a33a7fcb46a3ed2282b9c935a8263af52afdf7189d5e761d1a354d7bb4897205414705c87fb5199978eda80
SSDEEP 24576:03rd9CHKy7GZT/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:+rd9CHKyaRLNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 45511a22772366a908dfce48f4d88bb1ad12320e9520b02b1d877b7e9a3b28ee
MD5 6da17991f26792e88fdd6d0bcc9a53f9
SHA1 4b768b9a7a0be8df21b547813695ae8c4bc53c29
SHA512 e4b4c958e0f4deb892b074e14254be0c9ac02937516a17742d5d685dd21550da4ae7ec094c4da48fa1599c129f37e7d50b1d829a6264bbbfa5e63327736f884b
SSDEEP 12288:ubiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:uP/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5 SHA1 SHA512 SSDEEP

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 912dfb516b72bf80c751737517076f5b7d08923bfa0b13053daf58223496eb73
MD5 1143c9dc384c2d7baaf153a3af49117b
SHA1 82cbcd6380d2407af2227dd2f3dadf4e5a766e44
SHA512 7cf5a4ebaf00d717a225bdcd68dc0a2b5c57f5084034a2b37158ed83a81d1a69a49b594ea6d0ea00fbecb3d5965b8c9fb2112c5e43dd556f8a962d4143706549
SSDEEP 12288:E1iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:EZ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5 SHA1 SHA512 SSDEEP

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 49a1bcb9e60c1b68d06a04936024cdbac75be797f943f980cf6db8e83a14d45b
MD5 a20032cd4b616a628ed6989c36183a92
SHA1 d05313aa672af1df5e6b8256bd2dc83f93188c0e
SHA512 30d15878d9bb95404dbbf5ff26f5482380411e7c6fbbb0ef909fe27c504d040d042b02245cf79c714b63e7040e8e7768957e2713e47310cc0a2f3c8f3445996c
SSDEEP 12288:gUFmDDL3iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:aD/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5 SHA1 SHA512 SSDEEP

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 8ffec81f251c86414eac58fe8d9085a2f25540b5400f0aa766d6dabc469230c7
MD5 8356f5d276196a02c4d08d51867ea209
SHA1 769451132fc12c03699c6463ccde483c3543d476
SHA512 0484cc1a07a8184ced74711dc6f9c0cfffcb3e77772cf28bdd1046065db47dd54191095a14e7427dffbb128f0d844857850cb44074519ea5ecbaffa9ff075b07
SSDEEP 12288:TQiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:TC/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5 SHA1 SHA512 SSDEEP

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 4b5b7dba1e818d400a27231f389f888f5e5712cece3f8be02ffa813842a8b5fc
MD5 95fe4c4cb16ea3c3b6505529f8c1c2ed
SHA1 eadeb6dcb3a719c1cfdc91a37ef069af84adc4ac
SHA512 4deb5a38d2d89df985ceb6489205221901a846fd4c1dcd53e88d6fe8bdfadacde42550ec6c203b4c1f8a8ef941a4f072eeffb2bbbaadb1dd03b5b5226ac67b83
SSDEEP 49152:ua0h2GEkuAe73q3pp46zwwQBLNiXicJFFRGNzj3:ua0hNYG4JwO7wRGpj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 f3d4a463d36d3b5482303b9e73fb602cfbbe0c079c80827c35f02e36bf19f720
MD5 dfcfb588e4314b6a686d77098a2093bb
SHA1 72ce53d9f6f22bb450a8c732f822d749a9919e26
SHA512 4df43155f04211d4d3c9992fdb1b94f2df54d0d2f6ad332cb87cef0290cf0f2ca392a1a54c6ef26ebcf9aed4d12180a317ccfa38e015ef6ce4e1fc91b629ec6c
SSDEEP 24576:ghbHjPj/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ghbHjLLNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 ef141862e730fac8fde5be30164ca56f6c6e1835b5aa9d3890b471d903b40540
MD5 80279bf6c08ee8dda21dc55c0c825ef8
SHA1 1d9d382f223f594ad727550de729b728f2442920
SHA512 4d9c7b726db508890034a2308ef2ccb6c920f0c6733414850a13959725ed813cbd4b010fcf3c117eee3a77dd4c46e2453a585c720597cfe12630b594ea39c3f5
SSDEEP 24576:c3YgnJcRTk4yti+R5dBR/7/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:cIgnaTk46pBR/7LNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 dd5a649b7c06312f57ab68aa9ce815a2ae18a6469f2266cfc189de17d0dae626
MD5 3f9933b298817568072cafa9ab3f87bf
SHA1 6ebeff72b61c7d4754757b4cb0500e5bc474c06d
SHA512 75aaea1d4a20a6e7bcbeb81457edddd120799e34e35129254ffa16efc5446aaddbf8996631fd1185fb8b42fd4c900ed4fac69ccc5440ec19d28f9cf9acf60b25
SSDEEP 12288:iMiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:i2/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5 SHA1 SHA512 SSDEEP

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.6MB
SHA256 cc5787a99e6899079a980078b77882ca2628e720528af834351312ef28422e4a
MD5 d9701a53a1d658a5fc92babe5b1e50a0
SHA1 18da07264d802baf7dffaf96bcab63230db87722
SHA512 fdda50e79764bbc9ce1cf0bed60592e5ca125c8502e1717724e23c851ee4547c7bd46c70410c7c5ca47cf58d2bf0648daa09cc36a90198c846632828d09747d2
SSDEEP 24576:tAL3UTJ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:tAL3U9LNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 d1f27a5062a9230b838a4ddfea1e943f24e5d42ecf8cf314560f764f159e320f
MD5 13d9fed79d96171cb3328795aa41416b
SHA1 cefadf9aca3da307d952a4eaba9766c8db475ba9
SHA512 d8a6c42c34ed96bf4239fce12f99de41a6730cc9d0444d443a9b2e0e325d1f21171865482fe6463e429a7e395510bf3cdc13655ae1607c7cc6b87afbc43bf6ce
SSDEEP 24576:JOd/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:JOdLNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 0d33dba60fdf061a9e7a53bef2744a4e2e68c417b129c306c4c4183a4b110541
MD5 9278f0bc78337275ea951177f81bddeb
SHA1 1ffa8a0c8dfafa34c78aeb4128a81a60ce7ef124
SHA512 ff42b2575fdb8d4a9b8563d8638e3ead70b2ccd030ccf851224385a8f3a2ebe651e9acbde1748c59331752288bcd1de48d2cf2529f5816d74a4a05bcd6c8cb22
SSDEEP 24576:h7NM9YqZqmWMUkPjZM48Mv6bEhsn/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:h7cBWMpPjN8DbEh6LNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 fe85bd9e9ecdde2e89cf5d992a51f1aa73c9b65457ae0070837a0ad128f04f6a
MD5 cafc759750942a9f6ee4de0851061cd2
SHA1 ca816bc37de39dec0f7a412851c4a489b06609f8
SHA512 957725614157a42e79c3461cae67e6ecf21a59b4785e6e0eec09a2d84679219c0021196e31fdeaf84ec7d997c9433999932fea9fd8244854a16416513149d40d
SSDEEP 49152:lF2YuHNETovAvNYf8kmyLNiXicJFFRGNzj3:A6BCf8kd7wRGpj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 212853be9d8dc4fb69751692fbcffbe21b47dedb11ca85a2c909578bded5a183
MD5 f411baaf0b24013b7217362e074cbb6c
SHA1 9ff00a2ed3cc7f87c9c4f70e2cb1fa97eb67a901
SHA512 bfc8ab82fda2d460f0fadf219834e746134ebef92dcc662d82519be38c14ffda25f5b3e65317d9ee9ded730de809df46606dbc2e5ed00105e17c403a7e50de1f
SSDEEP 24576:XAFs06+Omlf8NXEbToR/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:wFs060loXuwLNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 a609ab87b3a13c79b4fd14d753720b0b04a0e87902b7d2405fcf40892e5bca0b
MD5 6d29206b8fbc392ed14940e5b16dc0c7
SHA1 2231ca5687e395328966be8e9e057d0ecd42a5ee
SHA512 d602de84d84fa372d29a5eec4aa6446b7dc7cb1bc6449a30e8021e2b2dafe4023dd67468c181597dece31bcab959008f8dc38c21477291a009fdf5fae872fc56
SSDEEP 24576:2JnJ5D3WXh/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:2JnJ5DGXhLNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 57e5050e732a6d69ba67df7275b4a4500156cd58e454e7e41eb15590165c3610
MD5 a267934476ac0e635d45794d2562d368
SHA1 9a745936c1f7947fdf9553f3669d7616a7f20477
SHA512 80d3d27c10c8517114509943e04e0a577aff0c4242b18514740541b20902755a897eeb1a941d8a8c9eb6f65c4a03d57bc3764455a278f0c78dbbd3479bb2d10f
SSDEEP 49152:6g06DIKdwc+eQnSt65aVLLNiXicJFFRGNzj3:TF7wRGpj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 ddbea7a2d02863ef82ca0134e38742b27f26f4732b01ab3086cc95ea286e37ba
MD5 e7fbb56074b5573cbff9f59cbd9ba517
SHA1 eb40e8e147e1e9199d4102e1f45e7609c6c2166b
SHA512 3249081e6c8421e88e8788866fabf12d55f155750b925e77168d71c0ed0d8da24e7ffcac7c9d070bace03900f27b4d3ab04e01dbb759cc62f7f5152ec20d8c8d
SSDEEP 24576:dnk/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:dnkLNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.4MB
SHA256 6a6f8172b93dc19a0c00122915b6cdc60ff54d752c41a7da63a3b2675446eb23
MD5 3d98391818e2c9331e3c1b672bc2622e
SHA1 c2173920752e0842d5bf672a29b869f2b43640f1
SHA512 a47c5c0cf1c97b65dbaf94361294b3fcbbac1ad41215ed57eb48da3090e67059b8dadf74879981abec7bcdbaf9cab850b0e072d9e0bc6b9e591c94869dea2b09
SSDEEP 24576:7IyT/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:7IALNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 baa593bbc4247ec3919b8ddc58c7d032bc0d59f821e4d67b1ce2cef3fd952543
MD5 f1a724fe78bf84fa88a7269cd963337c
SHA1 f08b53355df826c699abdb8cd817045d81ec7a1e
SHA512 9959609ca4e7f57a73f697bc4f8715f6e771ce166b5c4b361d73107673112e0a607c6922e2f136309a045cc55ba4cfe92dc86bc4ee435bf3ca90b407abd6068c
SSDEEP 12288:WyhiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:/N/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5 SHA1 SHA512 SSDEEP

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 df8a01b6d77385ed12289ca5cc3314b85b4fb666613f8016e31fb944866cafa0
MD5 0e2a0ea9afc8450314bd31837198e091
SHA1 13ec55cbf0ec98824c424d8e2aae5420232ad02b
SHA512 324dfe4caf4a93bdbaf9198f5890c50b19de309decdd49bcc9854bc2f5eb6c09cda01810ca8c481cc82fec4df47cf8121627bb5c05984550aab17169f82c43f4
SSDEEP 24576:1Q9MxZKdcz9dw3P/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:1VKZPLNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 6f4ab99cef6a2a6369ec25c078a0c080f74e900867b936d92c0b13b62fa640b6
MD5 4e9b4a1c2ecf8c4583061400306bd2ad
SHA1 f3bd760b1755c44fd41d6d341ce30b51efcd82db
SHA512 8637d3b2311ae68a40f6b809c61b93e91675e547257cdea9f1707ca900c66dd688ab7d4c476bb829bc7fa07a675f36e7c10a6bc65d7cfe6ee96031ff84217e52
SSDEEP 24576:3yocDAp2/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:CocDAp2LNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 f827d776895428e23e3a78163113e51acda298551071f2920eba0d87c1bc1ca5
MD5 1457fbfde7d438957f4add53ccbe1eca
SHA1 318df979ef1159efb416a103413effccd94cf28b
SHA512 b0494c3c8a4fdb15ba3038f35d44e4da5de891c7db5d23815f756bb23a1c273cc4eebd21e39373179a60d5bf40168d40d83b031551fe93e0c943a2b25eac03cc
SSDEEP 49152:PWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IK2LNiXicJFFRGNzj3:30zuNIE7wRGpj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 bb03fe61eca23b45aa50d0c903f1f229710a9231e5494708746b94d4c67dd702
MD5 62b89b6f2bd37d40f1d31a261f6ba8cd
SHA1 bebb127e36fde7de2670eb56f9fa8258e673317e
SHA512 d9a19c8b7d293e374197a5d571a810307b16638acd5cae793e6a2ae9c2226dd418481b2f18ecda45123902fe239156ca19b27a5cb8e78db96739443115f173f8
SSDEEP 24576:V1QT7EcpfxR+N5AWAz3ooiYzjMqbk/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:QTDxR+N5YzTBjM9LNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.5MB
SHA256 60a06c7ec1b6e30e6d26b25a7cda01833fad39a7e936040901a332acab143e8b
MD5 1fdeae803dd8b83e3294b487ca9c6904
SHA1 4d3aa31e98a21fa400dbed56926ba8c8580f5009
SHA512 085b033f1de1241421d5b9227c71c1024fffe165fb6f35f9ff6108bcf5ce91ee36c9b4dedbe93402d200c1d5c9908e7146f52c3ce3897039c794ce01cf943301
SSDEEP 24576:9TMdOz0FFS+UmSL4/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:H0K+UmSL4LNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.3MB
SHA256 bd95456ea63ebcd8c1a5cd32cdefda35c38975c30967201cf109216e44a13ae6
MD5 6573c67aea74a13d0ca5c42ac148a3de
SHA1 e328e672df672c2e723a2827476ab9947909abd8
SHA512 253568e993c58f502c56ddf916c8998eec5c56361b1937995167e9eb699d6eeda3184c38c52f9dbb3bab7ab83681665f069a724f4bc75240fa6f38449f9c00ae
SSDEEP 12288:L4KFiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:XJ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/632-341-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/632-443-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/968-317-0x0000000140000000-0x00000001401EC000-memory.dmp

Download

memory/968-118-0x0000000140000000-0x00000001401EC000-memory.dmp

Download

memory/1084-178-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/1084-57-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/1084-55-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/1084-49-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/1276-444-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/1276-344-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/1592-351-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/1592-446-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/1964-347-0x0000000140000000-0x000000014021D000-memory.dmp

Download

memory/1964-445-0x0000000140000000-0x000000014021D000-memory.dmp

Download

memory/2332-82-0x0000000000400000-0x000000000058B000-memory.dmp

Download

memory/2332-2-0x0000000003340000-0x00000000033A6000-memory.dmp

Download

memory/2332-8-0x0000000003340000-0x00000000033A6000-memory.dmp

Download

memory/2332-0-0x0000000000400000-0x000000000058B000-memory.dmp

Download

memory/2332-146-0x0000000000400000-0x000000000058B000-memory.dmp

Download

memory/2348-83-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/2348-91-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/2348-311-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/2348-89-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/2472-286-0x0000000140000000-0x0000000140210000-memory.dmp

Download

memory/2472-75-0x0000000140000000-0x0000000140210000-memory.dmp

Download

memory/2516-47-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/2516-34-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/2948-37-0x0000000140000000-0x0000000140234000-memory.dmp

Download

memory/2948-136-0x0000000140000000-0x0000000140234000-memory.dmp

Download

memory/2948-38-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/2948-44-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/3004-68-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/3004-60-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/3004-70-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/3004-72-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/3004-66-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/3020-135-0x0000000140000000-0x00000001401ED000-memory.dmp

Download

memory/3020-319-0x0000000140000000-0x00000001401ED000-memory.dmp

Download

memory/3400-94-0x0000000140000000-0x0000000140202000-memory.dmp

Download

memory/3400-315-0x0000000140000000-0x0000000140202000-memory.dmp

Download

memory/3400-95-0x00000000004F0000-0x0000000000550000-memory.dmp

Download

memory/3400-101-0x00000000004F0000-0x0000000000550000-memory.dmp

Download

memory/3548-336-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/3548-334-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/3612-109-0x0000000000670000-0x00000000006D6000-memory.dmp

Download

memory/3612-316-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/3612-107-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/3612-114-0x0000000000670000-0x00000000006D6000-memory.dmp

Download

memory/3648-441-0x0000000140000000-0x0000000140239000-memory.dmp

Download

memory/3648-331-0x0000000140000000-0x0000000140239000-memory.dmp

Download

memory/3848-320-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3848-121-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3848-318-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4048-321-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4048-137-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4628-149-0x0000000140000000-0x0000000140259000-memory.dmp

Download

memory/4628-322-0x0000000140000000-0x0000000140259000-memory.dmp

Download

memory/4824-105-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/4824-13-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/4924-106-0x0000000140000000-0x0000000140200000-memory.dmp

Download

memory/4924-25-0x0000000140000000-0x0000000140200000-memory.dmp

Download

memory/4924-26-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/4924-16-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/4944-338-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4944-442-0x0000000140000000-0x0000000140147000-memory.dmp

Download