7e6d6b8536b8ab1ae7413da451928f02b499817ceea7aafe524479bf261c6efe

Analysis

max time kernel
137s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/09/2026, 12:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7e6d6b8536b8ab1ae7413da451928f02b499817ceea7aafe524479bf261c6efe.exe
Size 1.0MB
Sample260916-ppp2lszgnf
SHA256 7e6d6b8536b8ab1ae7413da451928f02b499817ceea7aafe524479bf261c6efe
MD5 0965df96c0d74634399f5f4fe3a093bb
SHA1 aa9df708213e4142a446ece2f94f718c30c78009
SHA512 6e002b0d13dd850150af50c049d5138af3e984161b9d6a93cf5001dea88f16535c0bb38dd4136e74a9973af037aa01c99595d20436235dfd8334767f9fd81860
SSDEEP 24576:MFoH6ThNF4Xx7AYIaPZ7KSltdMosreGOL3Lm:8oHGFEBAnQJlGrelL3K
TLSH
T13935D089A75440E0E1B6C13889439846F6717C015B71EBDF13E8E63A2F776E19E3AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence privilege_escalation spyware stealer

Malware Config

Signatures

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 15 IoCs

pid	Process
4508	alg.exe
3028	elevation_service.exe
2728	elevation_service.exe
4252	maintenanceservice.exe
3868	OSE.EXE
2504	DiagnosticsHub.StandardCollector.Service.exe
984	fxssvc.exe
4128	msdtc.exe
5084	PerceptionSimulationService.exe
1132	perfhost.exe
3788	locator.exe
1672	SensorDataService.exe
3252	snmptrap.exe
3840	spectrum.exe
1184	ssh-agent.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 19 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	7e6d6b8536b8ab1ae7413da451928f02b499817ceea7aafe524479bf261c6efe.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\3663dbe4862f6ed0.bin	alg.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	7e6d6b8536b8ab1ae7413da451928f02b499817ceea7aafe524479bf261c6efe.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	alg.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_104187\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_104187\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	alg.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe

Modifies registry class 52 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib\ = "{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}"	7e6d6b8536b8ab1ae7413da451928f02b499817ceea7aafe524479bf261c6efe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{11AC3232-E7D7-49CD-ABFE-501700100B3A}	7e6d6b8536b8ab1ae7413da451928f02b499817ceea7aafe524479bf261c6efe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\VersionIndependentProgID	7e6d6b8536b8ab1ae7413da451928f02b499817ceea7aafe524479bf261c6efe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\LocalServer32\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\7e6d6b8536b8ab1ae7413da451928f02b499817ceea7aafe524479bf261c6efe.exe\""	7e6d6b8536b8ab1ae7413da451928f02b499817ceea7aafe524479bf261c6efe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\AppID = "{11AC3232-E7D7-49CD-ABFE-501700100B3A}"	7e6d6b8536b8ab1ae7413da451928f02b499817ceea7aafe524479bf261c6efe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}	7e6d6b8536b8ab1ae7413da451928f02b499817ceea7aafe524479bf261c6efe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\FLAGS	7e6d6b8536b8ab1ae7413da451928f02b499817ceea7aafe524479bf261c6efe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib\Version = "1.0"	7e6d6b8536b8ab1ae7413da451928f02b499817ceea7aafe524479bf261c6efe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession.1\CLSID	7e6d6b8536b8ab1ae7413da451928f02b499817ceea7aafe524479bf261c6efe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\ProgID\ = "IntelCpHeciSvc.CphsSession.1"	7e6d6b8536b8ab1ae7413da451928f02b499817ceea7aafe524479bf261c6efe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ = "ICphsSession"	7e6d6b8536b8ab1ae7413da451928f02b499817ceea7aafe524479bf261c6efe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{11AC3232-E7D7-49CD-ABFE-501700100B3A}\LocalService = "cphs"	7e6d6b8536b8ab1ae7413da451928f02b499817ceea7aafe524479bf261c6efe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\ProgID	7e6d6b8536b8ab1ae7413da451928f02b499817ceea7aafe524479bf261c6efe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\ = "IntelCpHeciSvcLib"	7e6d6b8536b8ab1ae7413da451928f02b499817ceea7aafe524479bf261c6efe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}	7e6d6b8536b8ab1ae7413da451928f02b499817ceea7aafe524479bf261c6efe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ProxyStubClsid32	7e6d6b8536b8ab1ae7413da451928f02b499817ceea7aafe524479bf261c6efe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\IntelCpHeciSvc.EXE	7e6d6b8536b8ab1ae7413da451928f02b499817ceea7aafe524479bf261c6efe.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{11AC3232-E7D7-49CD-ABFE-501700100B3A}\LaunchPermission = 010014809c000000ac000000140000003000000002001c0001000000110014000400000001010000000000100010000002006c0003000000000014000b000000010100000000000100000000000018000b000000010200000000000f0200000001000000000038000b000000010a00000000000f0300000000040000ce4a9359b9cf0b7575c0f29bb2b4c298d446ddf9027a87ec14651177d6e996550102000000000005200000002002000001020000000000052000000020020000	7e6d6b8536b8ab1ae7413da451928f02b499817ceea7aafe524479bf261c6efe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession.1\CLSID\ = "{C41B1461-3F8C-4666-B512-6DF24DE566D1}"	7e6d6b8536b8ab1ae7413da451928f02b499817ceea7aafe524479bf261c6efe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession	7e6d6b8536b8ab1ae7413da451928f02b499817ceea7aafe524479bf261c6efe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\CLSID\ = "{C41B1461-3F8C-4666-B512-6DF24DE566D1}"	7e6d6b8536b8ab1ae7413da451928f02b499817ceea7aafe524479bf261c6efe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}	7e6d6b8536b8ab1ae7413da451928f02b499817ceea7aafe524479bf261c6efe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\LocalServer32	7e6d6b8536b8ab1ae7413da451928f02b499817ceea7aafe524479bf261c6efe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\FLAGS\ = "0"	7e6d6b8536b8ab1ae7413da451928f02b499817ceea7aafe524479bf261c6efe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\IntelCpHeciSvc.EXE\AppID = "{11AC3232-E7D7-49CD-ABFE-501700100B3A}"	7e6d6b8536b8ab1ae7413da451928f02b499817ceea7aafe524479bf261c6efe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession.1	7e6d6b8536b8ab1ae7413da451928f02b499817ceea7aafe524479bf261c6efe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0	7e6d6b8536b8ab1ae7413da451928f02b499817ceea7aafe524479bf261c6efe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\0	7e6d6b8536b8ab1ae7413da451928f02b499817ceea7aafe524479bf261c6efe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\HELPDIR	7e6d6b8536b8ab1ae7413da451928f02b499817ceea7aafe524479bf261c6efe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ProxyStubClsid32	7e6d6b8536b8ab1ae7413da451928f02b499817ceea7aafe524479bf261c6efe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	7e6d6b8536b8ab1ae7413da451928f02b499817ceea7aafe524479bf261c6efe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib\Version = "1.0"	7e6d6b8536b8ab1ae7413da451928f02b499817ceea7aafe524479bf261c6efe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\CurVer	7e6d6b8536b8ab1ae7413da451928f02b499817ceea7aafe524479bf261c6efe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\CurVer\ = "IntelCpHeciSvc.CphsSession.1"	7e6d6b8536b8ab1ae7413da451928f02b499817ceea7aafe524479bf261c6efe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\0\win64\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\7e6d6b8536b8ab1ae7413da451928f02b499817ceea7aafe524479bf261c6efe.exe"	7e6d6b8536b8ab1ae7413da451928f02b499817ceea7aafe524479bf261c6efe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ = "ICphsSession"	7e6d6b8536b8ab1ae7413da451928f02b499817ceea7aafe524479bf261c6efe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib	7e6d6b8536b8ab1ae7413da451928f02b499817ceea7aafe524479bf261c6efe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}	7e6d6b8536b8ab1ae7413da451928f02b499817ceea7aafe524479bf261c6efe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	7e6d6b8536b8ab1ae7413da451928f02b499817ceea7aafe524479bf261c6efe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{11AC3232-E7D7-49CD-ABFE-501700100B3A}\ = "IntelCpHeciSvc"	7e6d6b8536b8ab1ae7413da451928f02b499817ceea7aafe524479bf261c6efe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession.1\ = "CphsSession Class"	7e6d6b8536b8ab1ae7413da451928f02b499817ceea7aafe524479bf261c6efe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\ = "CphsSession Class"	7e6d6b8536b8ab1ae7413da451928f02b499817ceea7aafe524479bf261c6efe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\CLSID	7e6d6b8536b8ab1ae7413da451928f02b499817ceea7aafe524479bf261c6efe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\VersionIndependentProgID\ = "IntelCpHeciSvc.CphsSession"	7e6d6b8536b8ab1ae7413da451928f02b499817ceea7aafe524479bf261c6efe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\TypeLib\ = "{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}"	7e6d6b8536b8ab1ae7413da451928f02b499817ceea7aafe524479bf261c6efe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\0\win64	7e6d6b8536b8ab1ae7413da451928f02b499817ceea7aafe524479bf261c6efe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib	7e6d6b8536b8ab1ae7413da451928f02b499817ceea7aafe524479bf261c6efe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\ = "CphsSession Class"	7e6d6b8536b8ab1ae7413da451928f02b499817ceea7aafe524479bf261c6efe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\Programmable	7e6d6b8536b8ab1ae7413da451928f02b499817ceea7aafe524479bf261c6efe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\TypeLib	7e6d6b8536b8ab1ae7413da451928f02b499817ceea7aafe524479bf261c6efe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp"	7e6d6b8536b8ab1ae7413da451928f02b499817ceea7aafe524479bf261c6efe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib\ = "{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}"	7e6d6b8536b8ab1ae7413da451928f02b499817ceea7aafe524479bf261c6efe.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
656	Process not Found
656	Process not Found

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	960	7e6d6b8536b8ab1ae7413da451928f02b499817ceea7aafe524479bf261c6efe.exe
Token: SeDebugPrivilege	4508	alg.exe
Token: SeDebugPrivilege	4508	alg.exe
Token: SeDebugPrivilege	4508	alg.exe
Token: SeTakeOwnershipPrivilege	3028	elevation_service.exe
Token: SeAuditPrivilege	984	fxssvc.exe

C:\Users\Admin\AppData\Local\Temp\7e6d6b8536b8ab1ae7413da451928f02b499817ceea7aafe524479bf261c6efe.exe
"C:\Users\Admin\AppData\Local\Temp\7e6d6b8536b8ab1ae7413da451928f02b499817ceea7aafe524479bf261c6efe.exe"
1⤵
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:960

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:4508

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3028

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2728

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4252

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3868

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:2504

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:2744

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:984

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4128

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5084

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1132

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:3788

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1672

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:3252

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3840

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:1580

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1184

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
PID:4752

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
PID:4024

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
PID:4292

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:4812

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
PID:4572

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:692

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
PID:3724
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  PID:2120
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 920 924 932 8192 928 904
  2⤵
  PID:5000

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 b30edd575a8f123be099b359acec0f62f13ba3b1b651f71d00555768884d5bd0
MD5 ff8a9acb57defc83918f97b4e2ab789b
SHA1 08b4cffbb7d0b599afb068f802bf034286f290fa
SHA512 44dca7e31002ac851f79faedb6db6ffe9f210df395af7ffbb528965272b05aa706cb19da04ccce5034e5f335335de36826c04449d7c86d7461f94e15eafd0a92
SSDEEP 49152:2b+632BuPkFKRrdE6oh7stBhuXjfS4LWxn/QJlGrelL3K:o3q6gjB1JlGT
TLSH
T1DCD59D03F2D901E8E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 849KB
SHA256 acbcb6a61617e83ecaa7b8fbe4a4b1e7a716cd83dd01ab60087729bfe624e9c3
MD5 46d19a32a0f3274efa8743d651cde2e2
SHA1 bafbd6c1b402016b1a069030736e1a89d4fa2b1c
SHA512 e738dcfe4691c19197871ef22039e9f904b441ad96e6ba41052c051b43e9e303b4095dd5e57fbb9349972e9577e9d2d5e298cdc54bc7d8780f308ce5daaff2f6
SSDEEP 12288:C1XLsAwWkxy2lRq2czAQeVCf9sPmQUT2bM+tySvgVAtdCvOdhSreGBHJkk8LKmqn:IXY7DtczAQwIaPZ7KSltdMosreGOL3Lm
TLSH
T12F050169B7D409F8ED67817CC9A6C422F632788547A0F78B03F489260F632985E3EF55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 47e92a0c1dd3712c6c68c6a86057b7a2800baad3a1b19e8d09e0974049ae7972
MD5 7b0f8c4254d925dbcafff3f9a6b6d0e0
SHA1 3ef8153e986868ea2fbfe98383112b3e462df35f
SHA512 64cf07f3550474a6cc438764989061616d116c5d2e28bf25756de1e5f81ec144e5bbbcb52f3277c06bd3d162c6490c57d65954f10251695bfd6e53ebf1b8dc10
SSDEEP 24576:F00eZ3h0FmxOrMTIaPZ7KSltdMosreGOL3Lm:F+3h08oXQJlGrelL3K
TLSH
T1A845AE66F6748771D073C0B9C5D2A69EF97130821B308ACB4296C77C2F676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 ef4acf1dcd62c3f082b93a7e35c8362ba229e76dea938b67ad16e0baa95dd240
MD5 465c623fa3b846722a0c12342f079e3b
SHA1 18977f70bae1d3549b12c5a29d34c24ac1014faa
SHA512 bfa5a8e02f33344d32ba326b511b34966aa19ce21ae25407d23bb294d7295804c0fd97d9632e0e3d440d6c7ad63ce4bf07977d02539c2dee3956dd5fb06efe38
SSDEEP 24576:6rJ/ezSC6vUyD/aqgrvW/6q8wyuxIaPZ7KSltdMosreGOL3Lm:S/ezSC6vUzPvuHjyXQJlGrelL3K
TLSH
T155756C55F5788323D0B2D0BAC5D6BA9AFE3230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.3MB
SHA256 6acaf441679c1f76e1aba9ea3077af91bc8a7afb475d694b83b0d162ba9bbce5
MD5 0328d3ae148516c0ec51898ea7a5e61e
SHA1 3f8ad2d71cb245ca309c8ad3df0a7785718fe2f8
SHA512 4d9ab128e1b182089eb9b1a402d6fa17d5fda324db05cb3737a33e21274ce1bdd3b9743a3a72bb72bf5c33f677acdf5881f37f228b3d80043227a5fdfe28ebcd
SSDEEP 24576:xabePVC7qv/l+dXIaPZ7KSltdMosreGOL3Lm:xa8C7qXl+CQJlGrelL3K
TLSH
T1E855AE66F6748331D073C0B9C5D3AA9AEE3234425B318ACB1246D76C2E677E6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 603KB
SHA256 8e6c527371f1e57df090771f5a4c72c383bc67fc20d601cc497008e352f3da24
MD5 87a19a23acc70a625455d02be3194837
SHA1 8ebf3ba5e7a6987c668d3628468e307fc177d6bf
SHA512 ec11c735338ce603c4883d7bcc96948cce3786296c0b9a9b6d5be322dbffb05dbf610bda233dbd9e1bee54a2c8a9de4959289e3ae9b011663d41c713b7ca32a7
SSDEEP 12288:+WpXVCf9sPmQUT2bM+tySvgVAtdCvOdhSreGBHJkk8LKmqU9Lm:+WvIaPZ7KSltdMosreGOL3Lm
TLSH
T10FD423CFBB144FD0FBB2647807CEA47736145EC554C03B9A52F52A268EFA05A8016F4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 863KB
SHA256 b2e69e5f3841f4cfaaea01957c90d1ad1b524e230655c37459b8ce6291a5f296
MD5 29bf4319e19d0ca49b8355f512cb13bc
SHA1 b0251e358828de73633b8ae77e2f25d97fa4778a
SHA512 4113cf44bf455127f5232d475ad1c7c3acb1ff994ee7a02d2ab932b8feb845d9dc18fdf3e2052a6e4bde807e651ebfc13ad3dd87578174b8480bf5d1d87cc9d2
SSDEEP 12288:ueBNUbTVO86UCVCf9sPmQUT2bM+tySvgVAtdCvOdhSreGBHJkk8LKmqU9Lm:uJIUMIaPZ7KSltdMosreGOL3Lm
TLSH
T18815DF7BEE28FCD1C27A8DB85B91C600A77278704B51A3CBD175820ECE235E55E7AC19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.7MB
SHA256 3b14508137bb2fb89ea38d945c0acb223b31edf071e1de9ca7ff240d859bba01
MD5 4f6b0c2bbc5ac0e94dfa06d38f52cbfd
SHA1 52243184a2dc04fe10c8dfec8c03e7d0ec495801
SHA512 888452cf2af4d2ddc7fff671cb28ac3a9fdcbbd5004fbfdc2f5a1d8fddc5d1ad0c17a7c506d9431126e6d5172adbc85f0ad5475d872097e1999a3c9b850e47fc
SSDEEP 49152:5QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJk9DN5JYNRV3THr:5QvGAdlCEL8c/kRN85CvJlGT
TLSH
T164366C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 932KB
SHA256 d29225bcd2980cde0b03770012cab78993dce66fbf5931d5c3f485242c40c874
MD5 e2a13047e8b69ade2e8bdc49f0321417
SHA1 7d83dbc61655d401e40763b4575859f6da411302
SHA512 af6a93d126c0646a56dd4d6ebe28a821642ae0efb022350824c1dc3806759126c206a0228483dcf68258aa39e21aa270a8d255a8b73e7305573b0ebf7cc523b9
SSDEEP 12288:JnwSfxL/2Dc3bDLLmt0LDQewsAjgJVCf9sPmQUT2bM+tySvgVAtdCvOdhSreGBHv:RmewsAjgnIaPZ7KSltdMosreGOL3Lm
TLSH
T1B215E071FE74D432C7BB0DB51B2AD716242C6A604B912AC3E3F84E9E59741D22336E1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 6.4MB
SHA256 9f4fb254032b8507372e0a36e1a551e540dc84e236963de8808e8186ac89ab1c
MD5 3d139d2a5c198fe0384cefe26832c21a
SHA1 3c7799d775ac73729c6286b6fa575ddd0db2f64b
SHA512 f12044db5c4564ba738606f7d6c71606cdabcfc964021a72ee3f2490feca19411db6be14aeb8d47a47d7eda5e0cf987497d71792a6990736ae611c59c94aa266
SSDEEP 49152:0YVCPaBGkaXESCMBB7bu+zQ6zFZcDYObMOpTKd6z0EEQ86fHxq455QJ7R9+Ju6a6:7VJ3MXEJqyQdetVbvC+2gslOxf
TLSH
T1A3668D8657B801F6D56BE088C79B8537FBF078050534AB9B46B1CB5B2F37A316A2E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 aff732bdb0e3793995751c5cc100f3655ecd25183e3de7019581f031e21f445a
MD5 647d2b42e4c0f7e2856e354c0c23b707
SHA1 4b08820955f8ba822d142b289ed75a5dc94091d6
SHA512 d5187bd3ffe81ecfca09ad98e4bb7983d1fcc3406503296c3224dc2f18855e3d354b58d735327fdd1ebbc9b3d052edcbe0856dc6c9acb05fea32888c736cfc7d
SSDEEP 49152:0ybRquA/m2yL5zMfFiV+XenmE3/zdQJlGrelL3K:toq1Vjnm/JlGT
TLSH
T10FD58E0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 6b9054e63347a6110a7b24f6fa2c3724e1f1b91fd498ee36126ba4bced193181
MD5 cc95f022eadf131e5ef0b7a446f4ec5b
SHA1 7a42b826e5fec3039c03e8498473a412265f8eaf
SHA512 dd74b63c7f3eb8c4be340e1cded8bdb24cc06884c1d26a4180f518b40b9a0121f6ceb575b7f388505b88d0747f0ad84887da685ee5f7cf0d39b0376801c1b030
SSDEEP 24576:bAhGLvpFoiwtA5l7S53lIaPZ7KSltdMosreGOL3Lm:bAM9Foiq5SQJlGrelL3K
TLSH
T10A45AE81E7F955D4F5F3AA7899BA9171EA76BCA65E30D20F2160C11F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 829KB
SHA256 e56df3aa31a20094c639a310be652d13f6382c99b487368fe91154eb2989936f
MD5 2eb2fc3295f409f90bf89909aa116900
SHA1 13f680da85f05c073c0152e4a2d5935d5ca111dc
SHA512 db3b7a42c5e3e21787159c0dd37987baa953457396e6275c42f2c55d73e2ae6eebccf60dac84970300f6d2b4f113627f2addf1541cea36af8d248534852061b8
SSDEEP 12288:5mw5HEjsChNRBFgl0WDm+C+VCf9sPmQUT2bM+tySvgVAtdCvOdhSreGBHJkk8LKs:UwusOWdIaPZ7KSltdMosreGOL3L
TLSH
T1AF05F18A77A40CF8E9775138868BC136F7B2BC412A61DB1F13B0C65B5F772616D29B20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 678KB
SHA256 f603067dc445763efd33e37023349091d47e166cf4b03fb9cbafa7b9aea7a7ed
MD5 e86ec11f3a2ff94235ebbedffbd2d5f4
SHA1 15d9699c7166e9089965278032d8f813fc13cd7f
SHA512 3b345622381a1e792257d12d7e4d8ff656a8667639ddd4611679e5d262c1ab57aebe9bf89291294347b7a8c1aa5dc0d8b6319dc82db7956ccc99ed8a4f3552a3
SSDEEP 12288:Nhx1I2ZVCf9sPmQUT2bM+tySvgVAtdCvOdhSreGBHJkk8LKmqU9Lm:nxuoIaPZ7KSltdMosreGOL3Lm
TLSH
T132E412CE33A426F4E2B3513C8AD99516B3717896236113CF12B406661FF76D60D3AF2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 4.7MB
SHA256 42b376f883b4107654c1d87f72078e7f319a44309832cf7654b7290213cd45c1
MD5 2408c1ee68750983b603a5b60154bcd2
SHA1 062c63e128a0a848bdabd97c02bab6ece61a576b
SHA512 aa4b952f65750cdd5ba3c7c676b0f2b842d39930bdb8a55813e7f3887f1fe2bfd5c4b85cfdb71eb4522c4206d4f005cfbc3c3d53c18c4c6ef333d09377ec29b9
SSDEEP 49152:Uj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeIAaLSF259ruMHwpXMi4FqJLd23UM:LQRQyi36YOcP8Lvw2gAz
TLSH
T18C365B53E3A511F8D41EC8B4CF1DA522AA29748E47F5A3EF29D846E21632ED4773CB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 3.8MB
SHA256 c074ef20405578429902ea14bd8ab4bcbba9e20aa240550be1cd661e99280555
MD5 6b82e35899b095badf3cd8560e937eee
SHA1 b9b91dbe7bfcb92e1f343136589f43b5ae9459c5
SHA512 86da78c5975ed5d153b991644428d893cd5808113ff0014206f2b7703b2059d8f983d1aea47443a5d3c7f850629538990ae4c7b05893ba24aa1d80c86698bbca
SSDEEP 49152:Uj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeIAaLSF259ruMHwpXMi4Fi:LQRQyi36YOcP8Lvw2w
TLSH
T1C0065B93E3A511F8D41ECCB4476D6522E969748B4734A3EF0AE84A721673ED8673CF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 8b6e8b650957306ebe803cd4f2e15879ed37e8dae554a876edeaf086526be08b
MD5 57e02461b00e7d28512b988b184d6194
SHA1 1192f3f18bd4d61f5fd47551f10a62aa333062ec
SHA512 71a022a006da3fc49deeb2cc7170ef2cab4ef0a168b36c7977ad8a883224e4c9c369533e3875862e2ba3a157d5f01665ca2dbe4de10a6dbacbca31b610aeb01d
SSDEEP 24576:1wvLof6SRQ+rn/fDboqxN1nnh6/7DaHGTNHu7PNU3/5W/ohL0NIaPZ7KSltdMosT:x68Qg55nhMeWu7PNU3/FQJlGrelL3K
TLSH
T1A6B55933B2F600A9C45DE1769F4A8731A6D17C758FE0E3DB815172061BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 9c034cd4c6f4b3c3c90eaf2d69ea961c65238550f9c1e9163cc2d949b89d8a89
MD5 8a306140f46da146d88277d48e2bcd80
SHA1 675f8b4a2bb105ed3ed1c7a91f8dd64495600877
SHA512 6a1eb5282935d0051eea6c9667f7dfbec44c245f3730e099392314c71eb555164eba3e213965f4cf7a8e128d1a8c1c0246fa105c413cca506afa3e4531059e14
SSDEEP 49152:P3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbWN3Oh6tznm2FQ/nho2qkrk999:iy5112gYy5azzVv569nLKnhZpJlGT
TLSH
T160168B13F29901E8D01DD1B9874A9232EA72BC474B25B6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 49a637204fc807593f3f99aaf5681bbeaec94ccdd9f774c9e479bf50a6388dfd
MD5 b8543a51c52d120555afd590c8d015e7
SHA1 d8a8a7211c62d800244c7bc06cbfd8085f03840d
SHA512 9286d760d589c834f66b12ee8f46423a11a6f345585b237e74cfee8dff525eafa5a6e5293e88d6788bce5463c5d4c424175ca6a83a66f21f8b7fd1fd31a311a9
SSDEEP 49152:PB+taZ3usBWOBr4tEGp0bqx0z+n217aau1glmQJlGrelL3K:xu6JmTxd2dRJlGT
TLSH
T17AD59D13F1DA01E8D06AD478974A9233FA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 f9262797a111e33599af47557a18b4c8e64e584ea8f73d070f92f68531c9cf8e
MD5 4fd86d6fdeeb382a9ac7ca76c69db38a
SHA1 9d1432363de1623f55caa6f54f2506515ed4aec6
SHA512 b53fb862d876a46729d457e2a9207d00c527b5a7a11b73fc51e273fc16d0d3d6039853b4de88087a5b129bc10b2fc16026806b457dbe724c9b2f85c4ab484130
SSDEEP 49152:31hpsNoJpF1A6UU44CwH7R4xuQJlGrelL3K:3mifPbReJlGT
TLSH
T1E6B5BE13F2D901E8D06ED178875A9232EA62BC460B34B6DF0A9077961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 313af56bd28c61411884c4d83fc073a6fa4f2f4e8d9073c9d1478623845b21b9
MD5 c0d0b016baa81f9a8840730f8653f9ca
SHA1 96411ab865da55490e001d7a3d7cf3808a365e53
SHA512 9f98f32bd5a5e048a413acfea9ba3f5e0527712f8081fa4788271e86fd88a6ba36fef2c38e6e690adb7ea9ef876c14c73dc1fc8d1b6e21895fde8437219003c8
SSDEEP 49152:pSuZQIY0Be2K6RVtOnks6NMHqqQJlGrelL3K:n5dKoi61lJlGT
TLSH
T106C5BF03F2E941E8E0BED67887669232EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 3c344a1f68073592622372d9f09c36f379b34a3c1accf045bd2b0d066300eb94
MD5 b10dd9f256205c8b10ba5064a37d4c65
SHA1 d9f3daca4ed345e744eecc3d1549985f0bc86905
SHA512 c443b6d38836a95a76cbe4173e63faa96cac7df55b8ff1b878159c25d098de31c66acf9aadfe397174f9329da52fc5ee0233bf508b49b196e525c1fc3c783e09
SSDEEP 49152:FhtSn8EApI0figTgiDn0AP5wZQJlGrelL3K:0X2iyphBJlGT
TLSH
T109A5BE13F2D901E8D06ED178C7468632E962BC160B24BAEF0A9077561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 602KB
SHA256 21b09a77b9643943584065c95b883ea72aad105bc70f45a29ccdd46f91656238
MD5 5d3b7b5b64e21d6f0c0f5dee8220d2c0
SHA1 b002819a529e55099544ecfbb69530b0db62c9b3
SHA512 1c93f3555cba66716f705ab0533dd8fedf992bdd102b201ed0dd83ba61e8be311f898f33057bf640c032515fcc73510c96036b717cf075ca7dde44e61fc142c2
SSDEEP 12288:JLVCf9sPmQUT2bM+tySvgVAtdCvOdhSreGBHJkk8LKmqU9Lm:JxIaPZ7KSltdMosreGOL3Lm
TLSH
T100D423CFBA598FD0F67265B847CEA07B35185ECA65C0379A62F905224FFB06B0016E4D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 602KB
SHA256 bf18545fe55fe4dfd75bd86f5a5bb3c27787489a92f4c5a944ad7b32176bbb3b
MD5 1043ef0bec194803d23b5de31d2184a0
SHA1 67d56acee59621266955be84a3a78c1d27fdd53f
SHA512 b92745805fb5bc7b4f316e3705a91d84071fe6f38eada7b97ed9684fc875754baec6ee014b070c736ce3e868468785fb481dae21a6737ee95c0063e12fabab28
SSDEEP 12288:T5VCf9sPmQUT2bM+tySvgVAtdCvOdhSreGBHJkk8LKmqU9Lm:TXIaPZ7KSltdMosreGOL3Lm
TLSH
T1B6D423DFBA598FD0F672647847CEA07A35185FCB65C1379A62F905228FFA06B0006E4D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 602KB
SHA256 5ed9cf4f0d5c438f16d4bec96128025df766c95ca73882be29278621ef40f47b
MD5 d6626fd62367ac3c375f6efd19ddd51d
SHA1 d580db8b6e85a7bf3b46f7092e95aabe0ef2ca36
SHA512 53b9d4a48d1df0c1bf57e32a94629af2aa5f86ff0cb33984e0e910f63f13754d5d54aa7ac74671d9bcdfb13075c3049fee31360571de68c616c8074eb5c7f7fc
SSDEEP 12288:d7VCf9sPmQUT2bM+tySvgVAtdCvOdhSreGBHJkk8LKmqU9Lm:dhIaPZ7KSltdMosreGOL3Lm
TLSH
T1CBD423CFBA598FD0F772647847CEA07B35185ECB64C1379A62F905228FEA02E0116E4D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 622KB
SHA256 c16eadd4e416ffecc0ebd0a08c8f68c3f882efd60389e89eaf084bb1778bb006
MD5 857ae8f5a904616403cc0151792648bb
SHA1 edbb7e15ff58ed5f4280556b931949e7efb87636
SHA512 c59156013d854bb57950eb48cfec83f29f436ebdb4fb744d0271362da29bc85cc516b03edda83b4d1da3426adb7e956d107772d0797913be5c036ad937e68128
SSDEEP 12288:rl/VCf9sPmQUT2bM+tySvgVAtdCvOdhSreGBHJkk8LKmqU9Lm:LIaPZ7KSltdMosreGOL3Lm
TLSH
T165D423CF7B594BD0EAB3A1788B8EA07632747ECA6551379F53B409160FF622A0016F5C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 602KB
SHA256 6dd24f714f347e1759382b108b507358459dd815f051f485eabf22a7aefd8332
MD5 f0d5f5fbfc29bbd01081b8fca4c8d47f
SHA1 3bc2ce524188413978be07729cf1a319d44a16e2
SHA512 f668b70f88d696a53557c5f1341f860199173977a60530098ae916189a50e822c391c9df99795ac1bfc0061b62dc40443d64c4a66e925a0c00b7e95afb919a33
SSDEEP 12288:c/VCf9sPmQUT2bM+tySvgVAtdCvOdhSreGBHJkk8LKmqU9Lm:cdIaPZ7KSltdMosreGOL3Lm
TLSH
T17AD423CFBA598FD0F672647847CEA0BA35185FCB64C1379A62F905224FFA12E0116E5C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 602KB
SHA256 aa5769b3e6205944ceea92c083bb600601a91cefc0ba4e2507765ea6cea05257
MD5 b1a59f5da284d9ecc174d6041cb31758
SHA1 010e3f0fd4ceb8f381763801d974865007fe3cbd
SHA512 16b54dfabbcf593e417430b2300ef6ab2d4837619672f84b1c8eb007720254656a8404503d4c588d932f8ea3e84c92a0a7921421ec07de62a7085c370de64092
SSDEEP 12288:38VCf9sPmQUT2bM+tySvgVAtdCvOdhSreGBHJkk8LKmqU9Lm:3mIaPZ7KSltdMosreGOL3Lm
TLSH
T148D423CFBA598FD0E672647847CEA07A35185FCB64C0379E62F905264FFA02B011AE5D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 602KB
SHA256 12c090e3015fbcf509a470236bde5a95bbac738dc8e84de039900929c909d3df
MD5 cd33048ae5b5486fe2886c59ee3cf16e
SHA1 fff1e81e88175e3c5467a38aaf0bf41d9fc8bf19
SHA512 ed2ca2de749cce678c06882823ab2fea9732718106ed2e46031d91313282f95ac3c4fa7ee6fbf321f04f9e9ef461c48a7678079128fffe75db9e0ccf44597177
SSDEEP 12288:OtVCf9sPmQUT2bM+tySvgVAtdCvOdhSreGBHJkk8LKmqU9Lm:OzIaPZ7KSltdMosreGOL3Lm
TLSH
T1D7D423DFBA594FD0F67254B847CEA07A35185FCA65C0379AA2F905268FFA02B0006E5D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 863KB
SHA256 7de475fd599239e014857fcf4483f16d384685f175f6e6ddc5286d5f13a98e0b
MD5 a215ef13e951bdb2890a300b03e02015
SHA1 4b16372ef991e0e7b02c32254d134b79f6f86595
SHA512 61520b8c42fb02f67ef74a453e8a9187f1a39115281b4d4b3db26f5dd329194ff8bd0ac682ddbe19dc365ea78fd094f4d164260f91bcdd15331cbcecaacd6892
SSDEEP 12288:kiZwb9nzIZRSncPvyEVCf9sPmQUT2bM+tySvgVAtdCvOdhSreGBHJkk8LKmqU9Lm:HZMJzI/Sv+IaPZ7KSltdMosreGOL3Lm
TLSH
T13815F1D9B3901DF4ED73813D89599816E2B27C5A0AA0C71F13F836265FB3361182EF99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 602KB
SHA256 cce1d5ba207697b113242f7e8c19c6b6707622c8228d28f9e9172e51a6292ebe
MD5 d2dcc41850cb2a0e5bdab6230397994b
SHA1 70661f790d1e1a616e259ff74a33e51620aea018
SHA512 f51d984fc852e346690eae90e007098aebeca11a2e36ab5280304dcb784c2202478e6825da367b828232f09f64b16e9f2b3e380fb480ead1546a4f09cebd5e8b
SSDEEP 12288:h9VCf9sPmQUT2bM+tySvgVAtdCvOdhSreGBHJkk8LKmqU9Lm:hDIaPZ7KSltdMosreGOL3Lm
TLSH
T14BD423CFBA594FD0F672547847CEA07A35185FCB65C13B9A62F905268FFA02B001AE5C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 602KB
SHA256 445fc45fade1aae60f3719840b8f0faef92a9c0553398415ca4dc5fb8b40cc9e
MD5 8bdeb1c5331829920f011c9701d1d40a
SHA1 c14d1be70557613e94bd27d0501c206b45cbf3c5
SHA512 8cf3971f7eaa33b5fa9e59473831db2a334418641f22414292a3c6be914c41886cc130545ee6b5926e68fb1a0c89bd29575ff86c29b17e9d13beccc218364240
SSDEEP 12288:z5VCf9sPmQUT2bM+tySvgVAtdCvOdhSreGBHJkk8LKmqU9Lm:zXIaPZ7KSltdMosreGOL3Lm
TLSH
T15ED423CFBA598FD0F672547847CEA07A35185FCB64C1379A62F905269FFA02B000AE5D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 740KB
SHA256 b0b3680fc1f7bd6d5b71228ac46d5cc705a88700b8a0530ed420957586e3e364
MD5 cc54a5cd89b18ffffd7d84cf0f0f0fba
SHA1 ed5b269e904c99428a860b2380e5ea076d52579d
SHA512 2a2c1cae3d379279dbe8720b03563725c71c2313e043ec6deee85efd688bcfa5814173ef6f3e677392ab38ca51bf3d9027d8fcc4cd3ba8de02445de2ef56d99e
SSDEEP 12288:nCPz5L8exVCf9sPmQUT2bM+tySvgVAtdCvOdhSreGBHJkk8LKmqU9Lm:azycIaPZ7KSltdMosreGOL3Lm
TLSH
T1C4F4128B73A121F8E1739138899A5922B371B87607509FAF13B407361FA72A15D3FF24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 602KB
SHA256 fd35a15baa7ca3f41e6c60f0629625f5572f2e3cd7d76e74548b586f3d51fff4
MD5 39d81f9ee0a4e8158e444b50557af932
SHA1 db2392fc8cc1e0a96dd04684e83a7f51519f401e
SHA512 381b432b10761eb31fde6e000ad99fdbbe1f6e903636a64c0b199450870ff21171793205f57a1b812af9c64af897fa545e28aab5f7d31ac8f3ad8c16bf52ac49
SSDEEP 12288:tzVCf9sPmQUT2bM+tySvgVAtdCvOdhSreGBHJkk8LKmqU9Lm:tpIaPZ7KSltdMosreGOL3Lm
TLSH
T153D423CFBA594FD0F672647847CEA07B35185ECB64C13B9A62F905268FFA16B0006E4D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 602KB
SHA256 64dfafad13efc6704c6d6391bc204648a56774957a8cfc27a965f49822d6d8e4
MD5 6e50873ee45c3931770d2ee9f9a1b724
SHA1 8e46bc2c13078e57339ee73389c5757db903f1eb
SHA512 b681013e2f54f7cdaeac7a0d5df20519b4cc47bb54bc2a3b87e67b18165251a620efb2cfa2fcc243dd4531cd66b22cfe7704d0999dbfe1db95a75b199a48358d
SSDEEP 12288:FNVCf9sPmQUT2bM+tySvgVAtdCvOdhSreGBHJkk8LKmqU9Lm:FTIaPZ7KSltdMosreGOL3Lm
TLSH
T161D423DFBA594FE0F672547847CEA07B35185ECB65C13B9A62F905228FFB02A0106E4D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 740KB
SHA256 00fe3b37b9e421b8255c3e7c9df95e9d1074dfbd40e06d594b82c20ebd1debc2
MD5 cc48e3054a0a3f8a7c1cbfa5034824b7
SHA1 b018832f16078e7693524974a719a97bfba6666a
SHA512 a87796dde306d281ade29fa11f1a1f649422ed8fabfe25edaa5e1eb1aa67a362d77aab556568b369c2726f0428ba557be50827d5f256014c5e102e0fc1e109f1
SSDEEP 12288:uCPz5L8WVCf9sPmQUT2bM+tySvgVAtdCvOdhSreGBHJkk8LKmqU9Lm:TzyYIaPZ7KSltdMosreGOL3Lm
TLSH
T19FF412CB73A521F8E1739138899A1922B371B87607509FAF13B407361FA72A15D3BF64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 863KB
SHA256 a7bbdc6aa5dfb9505b63b244ab8f73df17cc27a1ac816699735e00f83915726c
MD5 6f30f9fd9d093cf120b751c2a72fad86
SHA1 aa2d3554556d0be67124a326e92abc449c04e25b
SHA512 bd47113d7c5c0a31fbfbb5bddfb846ef6e18f67e9e9c5f3a776e99a11bf6434398f953801003f248479caf99904634f4cf077bda30440b27035c19ff57ae88dc
SSDEEP 24576:KTYaLZ3z0zaYNIaPZ7KSltdMosreGOL3Lm:KTvLZjZQJlGrelL3K
TLSH
T1F615F1D9B3501DF4ED63813DC95A9916E2B27C5A06A0CB1F03F836265FB3361182EF99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.0MB
SHA256 3d67b000ee182ed3bd473f6951d27f82af21242cb0c985f0704d3d6a942c9cde
MD5 5aef92ae956eb77ac6c4559f4853e541
SHA1 a3fec5a4650f3089f06104e6b13157cf5b4fdb88
SHA512 1d3400bbaad8a0f2310182b0e7a5f1d821616e1a770a010e10e2ffb116ff5642ab4ead8a2c71ce6691b0dbc601ededf0498b2acd03d03fb0c82a05c19929331e
SSDEEP 24576:l3IdMCE4y75ZyIaPZ7KSltdMosreGOL3Lm:FIdMCE4yVLQJlGrelL3K
TLSH
T1E935DF90F3E415E4F1B39A348D669512DA767C9A1B60DF8F03A8261A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 602KB
SHA256 2e6d4786bb580a85883e238edaace401b0d0dcd493fdd9227d33716f76f74a03
MD5 581ea529bcea14340792acb1f42b5ab0
SHA1 caed7f8300f1868b8adefb3d9f3152c87a9ca92a
SHA512 fd31c801272cf851a66478ee83699041a6aa3cde2fdcbef890643dcc5530443fb821c0c9deed63c6f80fd9bc513f655937fbe43a1c2935c198ca4c9085239f17
SSDEEP 12288:7tVCf9sPmQUT2bM+tySvgVAtdCvOdhSreGBHJkk8LKmqU9Lm:7zIaPZ7KSltdMosreGOL3Lm
TLSH
T188D423CFBA594FE0F772647847CEA0BB35185ECB64C13B9A62F905224FEB11A0116E4C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 602KB
SHA256 7e5d1f0d5d8991a3be6dcd7aca0dd2cceba82dd799844990386aad45339bcee7
MD5 bbe797b48ddb004727ed34b07c25e5a5
SHA1 2355064d98acec78210be1e6947fe48c27e211e6
SHA512 43146c3a50367d81c54f48830dd6ad5231d549d0a06b1fc202f922a26cc3cb202e47010eec99173e6cf38bc26ba0dc0e97418c1b5597c95666b6f2de666f2920
SSDEEP 12288:jEUVCf9sPmQUT2bM+tySvgVAtdCvOdhSreGBHJkk8LKmqU9Lm:jEOIaPZ7KSltdMosreGOL3Lm
TLSH
T14CD423DFBA594FE0F67264B847CEA07735185ECB64813B9A62F905228FFB01B0016E5D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 602KB
SHA256 cd85d7f4744d3fb1e28033532277faf2e77fbdf0d208bd717646055352675b15
MD5 b156ba4d44fc1075f25a46e60c3cc7a8
SHA1 e60ef269f96eedcb48c5d5634657681adae3cf0b
SHA512 ce8a84c0fc9cd4a47e8d187cfe8238756dc4a2a31f55a83bcadb70de49ae5905f5a751f3ed1e205230dc93a8cc8e21365e6e99859023fa6d0ce8bc9e16b8006f
SSDEEP 12288:AwVCf9sPmQUT2bM+tySvgVAtdCvOdhSreGBHJkk8LKmqU9Lm:AiIaPZ7KSltdMosreGOL3Lm
TLSH
T143D423CFBA594FE0F6725478478EA07B35185ECB64C13B9A62F905228FFB02E0116E4C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 602KB
SHA256 d112e3294607a38990065854edaac066c550ac79eefc27d66a7398e406fd9924
MD5 92f37fabf0e29c6fdd1546a40d930bad
SHA1 c89278f1ce6e8705625256b1a059b9220815a2c0
SHA512 5d13aee690a91aaabfd61ae31b10e42e4608c8a9324086b0393dc527b4494475dc3a39cfe00078330aa176f1b8f947282a7ab2535ae950b14cfc37689ca50122
SSDEEP 12288:LXVCf9sPmQUT2bM+tySvgVAtdCvOdhSreGBHJkk8LKmqU9Lm:LFIaPZ7KSltdMosreGOL3Lm
TLSH
T16CD423CFBA594FD0F672547847CEA07B35185ECA65C13B9AA2F905228FFB06B0116E4C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 602KB
SHA256 eefa52eff77efab1a966ffc4b63feb75a01738e1a857325ac09497d991dcfd9a
MD5 978a26a467510a43761915d808df0096
SHA1 f859f2ad43c2b177644804c87e814ebc70cecbcf
SHA512 855c76e5612a8dd13aae776782a97c6ae84ae4b6dd62570ee1385421dcabf9fb4bc706f844f957830a43347c005abf7b44b328d3d1cb65e6c05b1a16da0f25bc
SSDEEP 12288:VbVCf9sPmQUT2bM+tySvgVAtdCvOdhSreGBHJkk8LKmqU9Lm:VBIaPZ7KSltdMosreGOL3Lm
TLSH
T184D423CFBA594FD0F6725478478EA07B35185ECB65C13B9A62F905228FFA12B0116E4C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 722KB
SHA256 75384d32dc8545402086220ac1410745e94bedf09c087418770b84bbbb93956b
MD5 997453ebda6277e475742343debe838f
SHA1 5ee19e2d18192f57f296f682b8a39f63a38a5e15
SHA512 137a022c9a563e289076d135c676f73c742cac40f22452761c2d521db03fbda7ec006a1e10390b7d37038a1b5ba383e12ec9f3cfdba657ffad0a89156c1d7be4
SSDEEP 12288:XvsfLVCf9sPmQUT2bM+tySvgVAtdCvOdhSreGBHJkk8LKmqU9Lm:GxIaPZ7KSltdMosreGOL3Lm
TLSH
T1F1F4018AE25802E4D06E6178C78A9551B3333C6593E1A3CB53E0F53E0FBA1955DEAF07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 609KB
SHA256 0405d2b587aba378bb73f9f796ebff56456fa2daf1bccef92f6dae6ad707ec84
MD5 4e09a87860e7087a316d66bfef7d9c10
SHA1 841bd28446af2c2f3af532cdfa44e660fce9a012
SHA512 4ac32271b8a2ed038722a22df4f5b5a8dcd72fb608559a8e0059294ed0302f42cde5b216e3a20dad8583cfc90c14d23e68dbbfa7d158e375ea0a48f2176ef1ab
SSDEEP 12288:z2eVCf9sPmQUT2bM+tySvgVAtdCvOdhSreGBHJkk8LKmqU9Lm:z2wIaPZ7KSltdMosreGOL3Lm
TLSH
T1E4D423DFF7588FD0F6B26574078ED03632187BDA5980678BA2F906254FFA06A4416F0E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.8MB
SHA256 1b6225e8461a026788ab9dd5955f88b82a682999ae5adb905e9f7ad709e9df34
MD5 62493e919d0bd48f306050ba2da04df4
SHA1 aa0e651abaf35361a8429011d8e6524016ed59e4
SHA512 f4fa5ad2663e0fa4df1bbabc6ab0f0ed65076413ba116ed949afa4529d7ec1418f69d2328c039fad4e3bcdcf33c81a600dfeb1cc0ab207688fccc3cabaa0e33c
SSDEEP 49152:Za0h2GEkuAe73q3ppt6zwwQmQJlGrelL3K:Za0hNYGtJwkJlGT
TLSH
T1FB85AF1E67EC82B5D0BAD278C9A6814BE6B2B4260B3156CF1191853D3F37DE44D3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 680KB
SHA256 12cfeba96a616bebe54b37436a119c497266c97e7941c144d7b159bb9d739290
MD5 b2a2c6baaa887fd9908e9ecd0bbb2e77
SHA1 5cbdda240620591142f03222e12bbc4fb20df538
SHA512 310cefda8016decd0b7cc8d7c3d23d6651a4f45ccd4d64347be9ad9e567f56735537e589124b5ab5e9253a007f1dd4e46b3e00c0666b46cc9cbfd71da8f6757a
SSDEEP 12288:VhbHjfXTVCf9sPmQUT2bM+tySvgVAtdCvOdhSreGBHJkk8LKmqU9Lm:VhbHjPJIaPZ7KSltdMosreGOL3Lm
TLSH
T12BE402FE26AC16D4F672A17C468A851AF330B856170167EF23E1423A4FBB9E90C35F45
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 5cf97394dac83223e5d5439694f34cad713a9bf8aae64cdca33f51bc7509abd7
MD5 2898be14f9217bfb742766eac6f1973d
SHA1 e493a957306ee13afb95358636a4fa2939b06c86
SHA512 8bf080133ef588dca14a05a8c968cc448d460226fa6b585f3da905084217c2d49a3956d00ca62885b52f49f71992f445ffd7fdec07acb463ebf5e2e48dd618bc
SSDEEP 24576:sPYgnJcRTk4yti+R5dUR/tIaPZ7KSltdMosreGOL3Lm:sggnaTk46pUR/qQJlGrelL3K
TLSH
T14345AE2EF2B910F8D8A6D136450547B5BB71782D1F209ACB01B0C538AF1AEE85E39F5D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 599KB
SHA256 499ae97c8c55d7f1201c6cfe4f9f313ae507fc3e8edf00128950628c416c4105
MD5 aa2c488ed12395c806509ffaa2d9a6f1
SHA1 163a980bf63f606195b3a4368974696ca546bc1b
SHA512 92ad3702fb75a7e17c1d6923a1fb8f2d0b949779e3548d51999c4716a4ec32532bccfcd557ec478682aaa18a6ed629a56bdea3d37374bef53a531621259bc253
SSDEEP 12288:S6VCf9sPmQUT2bM+tySvgVAtdCvOdhSreGBHJkk8LKmqU9Lm:SUIaPZ7KSltdMosreGOL3Lm
TLSH
T106D423CFB7598FD0EA7265B8078EE07B31146B8625813BDA61F905264FFA06F0126F4D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 962KB
SHA256 320b98508335b2e6037d2ef81cff274d77cb8943187f56c548af63de4f4b3c6a
MD5 aeac47898ed48a457704d57f66293742
SHA1 998998e4af861634dfb3c1398a17f08d40207163
SHA512 b440af1fae5b4e5bb83fe0982ecb15d0110d96ec783bd915459bfef3808773da465c62ec4352475ec03c91239c0ea1749f2b701eab7e63f98369cead69346612
SSDEEP 12288:bObzA4LWOsvAYFTpQVCf9sPmQUT2bM+tySvgVAtdCvOdhSreGBHJkk8LKmqU9Lm:kHL3UTpCIaPZ7KSltdMosreGOL3Lm
TLSH
T17C250199F79404F4E977913CC9A68526F272789D0360E7DF03A84A651FA33E64E3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 692KB
SHA256 ae6746900ef0c884291d583587a3240b603791442fc5511dafeee32bb5467357
MD5 ec3f71a94c98e150f8ea609a8a789c8d
SHA1 2d7398f759de26228eca6949573f43452a08f2f3
SHA512 7b9d386a4c2cfb2471be79fe0c71ab326568f4edb4215fc879ca3e8858789b0629b606d2c3e0ab73ba30d2ef1eca92eecf53b6f6bc379e86ac1e5140618be21a
SSDEEP 12288:KpFtzORVCf9sPmQUT2bM+tySvgVAtdCvOdhSreGBHJkk8LKmqU9Lm:uOfIaPZ7KSltdMosreGOL3Lm
TLSH
T184E4029E379C15E0E176A13C8A8A921EB331B896075127DF02E0417E4FE7AF85C3AF55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.5MB
SHA256 1b2300adb0d54aaabc6f94173940e58a566eb4fb4db155ed194ef707a80812cb
MD5 6ecd83ca19bb10945039d0fc628ebe4c
SHA1 c491b33f0b3361fcf8126849fb5e336dfcd230c1
SHA512 f6851859d8267aee033815a000b8b44746fbbbdd7c0ddfb383376444df6ff9b2f0a812e443f013dfd25a943427e0670e800a42096456c13202eae1418436be03
SSDEEP 24576:l7NM9YeZqmWMUkPjZM48Mv6bEhsaIaPZ7KSltdMosreGOL3Lm:l7cBWMpPjN8DbEhSQJlGrelL3K
TLSH
T1A165AE6E6BAC81D5D577D13DC9D28206F2B1B4611B318ACF1162833E6F37AE44E35B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 2154e1ab48a0564800001e8b264f4940ef22ad364a7cfb97c83a7c5f71f52ab2
MD5 7278e4bb0b65fafb116c6e2bff27280f
SHA1 2db9843780faeb3cfa621008859205b700192237
SHA512 c08643c5cd2d91cfee406e711c475b38e826acddbd5a9e7015865eb5db94e8f4b9093b659e74e494320e73c97cb5c8113ee59a0dd7f24273e8aa5b8994329044
SSDEEP 24576:2W6BApg2YuyuNDYTabvc1vNYf8km12IaPZ7KSltdMosreGOL3Lm:2F2YuHNETovIvNYf8kmXQJlGrelL3K
TLSH
T1FD858E6A27ED80A4E0BBD27D45B7D146FAB2B8511B3056CF0255862E1F33AF44D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 7401e31931441ea6b0432189b53de1b74b667a46802c107a83a179bafed36d30
MD5 10b46716ef8558c80a920d25c3b66cb3
SHA1 dfb960aeb3eaebaa35a725e2c73f092fa09975f2
SHA512 844ae329cf97223ee1b97b53de00eb93814fb0679c32b8a9d8fc580aff87adc25e4182d1d9e9d317913a9fb2c9776d03d16ffd4c774b3cec6aac79be5ae7a6da
SSDEEP 24576:UAFs06+OmlfzNXEbTo1IaPZ7KSltdMosreGOL3Lm:ZFs060lBXu9QJlGrelL3K
TLSH
T15065BF6F66EC00D5D07ED17D8A97C91AF6B1746307216ACB0160863E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 907KB
SHA256 09a76900b36e9a6d18c2b97e7d677354909363a0b59240e436b0e782e9b70ad6
MD5 4a12614bcca6506a1fd3e2cb1b0f1732
SHA1 c32f2e34a8f7ef07568823e81fc25e2b6bc4de53
SHA512 165ad7fff3080669a6c11fe30a52a21eee755a2a89ffe5b61aaff35d3b5ff7f258ec4d0c3779b67f4ee3dcc1a14c084caa0e3ecf12dfcbd5e8c0d6e85b3b8504
SSDEEP 12288:oRJnJ5D3VkrezxWVCf9sPmQUT2bM+tySvgVAtdCvOdhSreGBHJkk8LKmqU9Lm:KJnJ5D3W2+IaPZ7KSltdMosreGOL3Lm
TLSH
T18A15E06DD2A810E4D4B7C274828E5756BF72387D2F226ACB24B4D5353F12EE09979F08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 0d4b465e8330ae6bd8045fb74b9e6767752f03163a6d6a55d1444591b09da60c
MD5 f1a139e5f7d35132045991816fa0b1fb
SHA1 c83c481f0c7d7c98c2eaf593053c735578205d30
SHA512 531ebf0f9e785a6adb021a4993b50c557c62dfce951dfa46546f37141294aa38547de258e6648ba50ebf18e77437e88c7e603ac48f62cf7da92ad08f194e1299
SSDEEP 24576:NEPFhm6/7IIXdwcXrif7qQncjlP65i3Vu1HIaPZ7KSltdMosreGOL3Lm:6F06DIKdwc+eQnSt65aVNQJlGrelL3K
TLSH
T1B0A56D16B7EA5294E8B3CAB1C96291169B327C509B34F7DF0AC0C92E1E33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 682KB
SHA256 9e7726dedb77828c104d584a8b57edc28ec5e6b6cb6e03836fbfae56b2f27206
MD5 97f306ec946ae31484251e4ff9806ae8
SHA1 c3f13f0588bad4bebf039d64a178cdcc43b4af0e
SHA512 b066c1d54e7e4ed1ecc480c5ccef33616527c6728649b1b651f29dae43ad946498d4a4447a0de9d3ac3bcd6cb4b012034099952dd05c2a4ce4db9ad7963e5fd1
SSDEEP 12288:QEP3RisoVCf9sPmQUT2bM+tySvgVAtdCvOdhSreGBHJkk8LKmqU9Lm:ri/IaPZ7KSltdMosreGOL3Lm
TLSH
T1A7E401DE779C61E4E136A07C86898116B371F4A52B4227EF12E1823E4FB75EA1D39F04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 733KB
SHA256 1d7a57b8bb184b8a079bb98765de8622d966c78247a24dbc445988c1777e7896
MD5 e663306fb88d39fa6a8bb4bdb89ca3b6
SHA1 1d06373ba5e660d939cb3f94456cf0df027da5d1
SHA512 16e92534732e89feb9b4fb8ffdc0113058a21d08d2e62ac4a2d8d2378516723fb52e5c9b2a21cf8cdea974c8a0208a706b3c4d003ded4d52871cae73fad42acf
SSDEEP 12288:kjky5VCf9sPmQUT2bM+tySvgVAtdCvOdhSreGBHJkk8LKmqU9Lm:kIyXIaPZ7KSltdMosreGOL3Lm
TLSH
T19CF412CA73985AD0E6B255388B9B80B53A34BC601F0067DF61E0A63E5FF76E55831F09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 605KB
SHA256 3fbdf040f4f44f431f83882581723f7c7d85a0984174dd66d2e2efa8ed268c8e
MD5 f8fbb2cf88cd0108117c3b1c844858f4
SHA1 585432e62145f43f9669e8c1c2b7fd2986600b09
SHA512 2a64ef3c3c686e91b1d7456c2e1372c807d8c8b57122ffa5e42d9e3a03eb84aa9d29e7e6cf51d4bea615260b303d5d7368cd35472b1837a04284f8bb8e4d4765
SSDEEP 12288:0+BVCf9sPmQUT2bM+tySvgVAtdCvOdhSreGBHJkk8LKmqU9Lm:NPIaPZ7KSltdMosreGOL3Lm
TLSH
T117D423CEB7555FD0FA7254B8078EA47632247A9A26803BEF61F455368FFB05B0026E4C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 0485145d3dd70ac5bc419576d3c9ebfd0430f1c3efd51cf28f0f92a93769bf7b
MD5 c90b41dea0b62274caec43b51535c896
SHA1 90c4d79ab6cdea6f1f3bf566d7afed0cbed2e7ea
SHA512 ac07440db0d22a081aa990fd915c2538a234cfe9533c82d0d21e93e9d1a518eba2bef501bfb6504bf79d81d7eb9bbd26e7e02c4f0121f7858f7234eefbb72b38
SSDEEP 24576:qQ9MxZKdcz9ew3EIaPZ7KSltdMosreGOL3Lm:qVKirQJlGrelL3K
TLSH
T124557C2DABE909D9E173D27595A650C3B633B4311B31D6CF2048D03D4DBAEE8AA74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 793KB
SHA256 cb4ba223adf58fe82f15e2f44000d4b12f6739de6307f79bfca646de3e774d39
MD5 43244f4149519f4aca4ec56a7f2f8822
SHA1 836db6142cd61b7d3263bb2a2a171045ed90c8c8
SHA512 716e7d791a449f58c37efda97ff7d2b0cdde7f56a9ca7debbfab95dbbab24fc07322757ce9836d0eeae6db43f7439ac25203ef2c77c54e48a34ad27b94f8a406
SSDEEP 12288:vyoKo2mRple9psVCf9sPmQUT2bM+tySvgVAtdCvOdhSreGBHJkk8LKmqU9Lm:vyoc8ApWIaPZ7KSltdMosreGOL3Lm
TLSH
T13A05E09FBB6940E1E172813C89898255F773B0701B5267CB62A1833D8FA79E9BD34F05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 ff709f237c264766d0554b6222dbe85ca7f8224fa68df6e8dfaada4224433a3f
MD5 49a51ab245cfb3e2ff08ea51d7487f87
SHA1 41e68317c97645ce2895d717c722df9af4ccdd78
SHA512 6dbf99e43db7398124e8da3b9514b6829e27d0120db06979d625e89969b402f5247e22c4ac6aa055e43c9c6373a18dc6e143ebeb203b89193aef658a10fb47f4
SSDEEP 49152:aWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK2IKPQJlGrelL3K:c0zuNIYJlGT
TLSH
T161A57C3DA2BC00A8D9AAC375C5451366EA71742E3F2055DB01B0C57CBF2AEF19A38F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/692-369-0x00007FF721B00000-0x00007FF721C3B000-memory.dmp

Download

memory/692-371-0x0000019BF0540000-0x0000019BF05A6000-memory.dmp

Download

memory/692-370-0x0000019BF0540000-0x0000019BF05A6000-memory.dmp

Download

memory/960-22-0x00007FF7CCDF0000-0x00007FF7CCFF3000-memory.dmp

Download

memory/960-0-0x000001BDCA5F0000-0x000001BDCA656000-memory.dmp

Download

memory/960-3-0x000001BDCA5F0000-0x000001BDCA656000-memory.dmp

Download

memory/960-2-0x00007FF7CCDF0000-0x00007FF7CCFF3000-memory.dmp

Download

memory/960-19-0x000001BDCA5F0000-0x000001BDCA656000-memory.dmp

Download

memory/984-247-0x0000016C1B180000-0x0000016C1B1E6000-memory.dmp

Download

memory/984-249-0x00007FF7C15B0000-0x00007FF7C1838000-memory.dmp

Download

memory/984-241-0x0000016C1B180000-0x0000016C1B1E6000-memory.dmp

Download

memory/984-242-0x0000016C1B180000-0x0000016C1B1E6000-memory.dmp

Download

memory/984-240-0x00007FF7C15B0000-0x00007FF7C1838000-memory.dmp

Download

memory/1132-359-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/1132-272-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/1132-273-0x00000000005D0000-0x0000000000639000-memory.dmp

Download

memory/1132-278-0x00000000005D0000-0x0000000000639000-memory.dmp

Download

memory/1184-320-0x00000196B7B80000-0x00000196B7BE6000-memory.dmp

Download

memory/1184-466-0x00007FF6B6F00000-0x00007FF6B70EF000-memory.dmp

Download

memory/1184-319-0x00000196B7B80000-0x00000196B7BE6000-memory.dmp

Download

memory/1184-318-0x00007FF6B6F00000-0x00007FF6B70EF000-memory.dmp

Download

memory/1672-379-0x00007FF777590000-0x00007FF7779FD000-memory.dmp

Download

memory/1672-292-0x00007FF777590000-0x00007FF7779FD000-memory.dmp

Download

memory/1672-293-0x00000155F4CA0000-0x00000155F4D06000-memory.dmp

Download

memory/1672-294-0x00000155F4CA0000-0x00000155F4D06000-memory.dmp

Download

memory/1672-440-0x00007FF777590000-0x00007FF7779FD000-memory.dmp

Download

memory/1672-438-0x00000155F4CA0000-0x00000155F4D06000-memory.dmp

Download

memory/2504-233-0x000001D3DB9B0000-0x000001D3DBA16000-memory.dmp

Download

memory/2504-232-0x000001D3DB9B0000-0x000001D3DBA16000-memory.dmp

Download

memory/2504-234-0x00007FF61F6D0000-0x00007FF61F7B4000-memory.dmp

Download

memory/2504-327-0x00007FF61F6D0000-0x00007FF61F7B4000-memory.dmp

Download

memory/2728-37-0x000001C26BA90000-0x000001C26BAF6000-memory.dmp

Download

memory/2728-35-0x000001C26BA90000-0x000001C26BAF6000-memory.dmp

Download

memory/2728-34-0x000001C26B8D0000-0x000001C26B969000-memory.dmp

Download

memory/3028-26-0x00000165B1B10000-0x00000165B1B76000-memory.dmp

Download

memory/3028-28-0x00000165B1B10000-0x00000165B1B76000-memory.dmp

Download

memory/3028-25-0x00000165B1F40000-0x00000165B1FD9000-memory.dmp

Download

memory/3252-302-0x000001CFE48A0000-0x000001CFE4906000-memory.dmp

Download

memory/3252-303-0x000001CFE48A0000-0x000001CFE4906000-memory.dmp

Download

memory/3252-301-0x00007FF7F43A0000-0x00007FF7F444B000-memory.dmp

Download

memory/3252-429-0x00007FF7F43A0000-0x00007FF7F444B000-memory.dmp

Download

memory/3724-378-0x0000024D5B7E0000-0x0000024D5B846000-memory.dmp

Download

memory/3724-386-0x0000024D5C750000-0x0000024D5C760000-memory.dmp

Download

memory/3724-402-0x0000024D5C980000-0x0000024D5C990000-memory.dmp

Download

memory/3724-418-0x0000024D64D40000-0x0000024D64D48000-memory.dmp

Download

memory/3724-381-0x00007FF7785E0000-0x00007FF778934000-memory.dmp

Download

memory/3724-380-0x0000024D5B7E0000-0x0000024D5B846000-memory.dmp

Download

memory/3788-286-0x0000018A4D1A0000-0x0000018A4D206000-memory.dmp

Download

memory/3788-368-0x00007FF667FB0000-0x00007FF668058000-memory.dmp

Download

memory/3788-285-0x0000018A4D1A0000-0x0000018A4D206000-memory.dmp

Download

memory/3788-284-0x00007FF667FB0000-0x00007FF668058000-memory.dmp

Download

memory/3840-437-0x00007FF653E50000-0x00007FF654174000-memory.dmp

Download

memory/3840-310-0x0000019D564E0000-0x0000019D56546000-memory.dmp

Download

memory/3840-309-0x00007FF653E50000-0x00007FF654174000-memory.dmp

Download

memory/3840-311-0x0000019D564E0000-0x0000019D56546000-memory.dmp

Download

memory/3868-57-0x0000021F2C7F0000-0x0000021F2C856000-memory.dmp

Download

memory/3868-55-0x0000021F2C700000-0x0000021F2C799000-memory.dmp

Download

memory/3868-56-0x0000021F2C7F0000-0x0000021F2C856000-memory.dmp

Download

memory/4024-337-0x00007FF75AC50000-0x00007FF75B079000-memory.dmp

Download

memory/4024-341-0x000001CE5E2D0000-0x000001CE5E336000-memory.dmp

Download

memory/4024-336-0x000001CE5E2D0000-0x000001CE5E336000-memory.dmp

Download

memory/4024-343-0x00007FF75AC50000-0x00007FF75B079000-memory.dmp

Download

memory/4024-335-0x000001CE5E2D0000-0x000001CE5E336000-memory.dmp

Download

memory/4128-254-0x000001FB1DF10000-0x000001FB1DF76000-memory.dmp

Download

memory/4128-252-0x00007FF6F87E0000-0x00007FF6F88F4000-memory.dmp

Download

memory/4128-346-0x00007FF6F87E0000-0x00007FF6F88F4000-memory.dmp

Download

memory/4128-253-0x000001FB1DF10000-0x000001FB1DF76000-memory.dmp

Download

memory/4252-44-0x000001C98B040000-0x000001C98B0A6000-memory.dmp

Download

memory/4252-52-0x00007FF72C2B0000-0x00007FF72C418000-memory.dmp

Download

memory/4252-45-0x000001C98B040000-0x000001C98B0A6000-memory.dmp

Download

memory/4252-43-0x00007FF72C2B0000-0x00007FF72C418000-memory.dmp

Download

memory/4252-50-0x000001C98B040000-0x000001C98B0A6000-memory.dmp

Download

memory/4292-347-0x00007FF7D28B0000-0x00007FF7D2B6E000-memory.dmp

Download

memory/4508-11-0x00007FF7112F0000-0x00007FF7113D7000-memory.dmp

Download

memory/4508-61-0x00007FF7112F0000-0x00007FF7113D7000-memory.dmp

Download

memory/4508-12-0x000001CE9A2B0000-0x000001CE9A316000-memory.dmp

Download

memory/4508-14-0x000001CE9A2B0000-0x000001CE9A316000-memory.dmp

Download

memory/4572-360-0x00000182A6FA0000-0x00000182A7006000-memory.dmp

Download

memory/4572-365-0x00007FF7AF3C0000-0x00007FF7AF8EB000-memory.dmp

Download

memory/4572-361-0x00000182A6FA0000-0x00000182A7006000-memory.dmp

Download

memory/4752-329-0x00007FF7EAD00000-0x00007FF7EAE8F000-memory.dmp

Download

memory/4752-326-0x000001DBA9060000-0x000001DBA90C6000-memory.dmp

Download

memory/4752-328-0x000001DBA9060000-0x000001DBA90C6000-memory.dmp

Download

memory/4812-356-0x00007FF7BE4C0000-0x00007FF7BE99D000-memory.dmp

Download

memory/4812-351-0x0000022E43FB0000-0x0000022E44016000-memory.dmp

Download

memory/4812-352-0x0000022E43FB0000-0x0000022E44016000-memory.dmp

Download

memory/5084-262-0x0000026B3FB80000-0x0000026B3FBE6000-memory.dmp

Download

memory/5084-263-0x0000026B3FB80000-0x0000026B3FBE6000-memory.dmp

Download

memory/5084-261-0x00007FF74EDF0000-0x00007FF74EEDA000-memory.dmp

Download

memory/5084-350-0x00007FF74EDF0000-0x00007FF74EEDA000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads