Analysis
- max time kernel
143s - max time network
147s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
04/04/2024, 11:07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-04-04_7e4a1054bc9579fed870d9f0b713b099_ryuk.exe
Resource
win7-20240221-en
windows7-x64
13 signatures
150 seconds
General
- Target 2024-04-04_7e4a1054bc9579fed870d9f0b713b099_ryuk.exe
- Size 1.1MB
- Sample240404-m77m9sdg59
- SHA256 e38043a7b546c280f67adb9bb6d7fa1ea303a7dd7e243944cba8754e2606e347
- MD5 7e4a1054bc9579fed870d9f0b713b099
- SHA1 dc42a6ad107423d1c412ab765f95c8406632056b
- SHA512 4dbcbacff7508fbb35540d6334019c90136a33c44097ac109f308efe804a5eb7769aebef0f3409a5ed09010ba9bc598a5272ccb96f34717b9a9dadc6b6707eca
- SSDEEP 24576:VSi1SoCU5qJSr1eWPSCsP0MugC6eT3vEaW44rECLyjZNQzJfzNkrhg8Q3do:NS7PLjeT3ctXdujQzfkrh6do
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Executes dropped EXE 22 IoCs
pid Process 2216 alg.exe 544 DiagnosticsHub.StandardCollector.Service.exe 4948 fxssvc.exe 632 elevation_service.exe 2904 elevation_service.exe 1016 maintenanceservice.exe 1596 msdtc.exe 2488 OSE.EXE 4676 PerceptionSimulationService.exe 2668 perfhost.exe 912 locator.exe 3132 SensorDataService.exe 2228 snmptrap.exe 408 spectrum.exe 4056 ssh-agent.exe 2832 TieringEngineService.exe 1760 AgentService.exe 4212 vds.exe 4108 vssvc.exe 5108 wbengine.exe 4508 WmiApSrv.exe 1056 SearchIndexer.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops file in System32 directory 37 IoCs
description ioc Process File opened for modification C:\Windows\System32\vds.exe 2024-04-04_7e4a1054bc9579fed870d9f0b713b099_ryuk.exe File opened for modification C:\Windows\system32\AppVClient.exe alg.exe File opened for modification C:\Windows\system32\AgentService.exe alg.exe File opened for modification C:\Windows\system32\dllhost.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\SgrmBroker.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe 2024-04-04_7e4a1054bc9579fed870d9f0b713b099_ryuk.exe File opened for modification C:\Windows\System32\snmptrap.exe 2024-04-04_7e4a1054bc9579fed870d9f0b713b099_ryuk.exe File opened for modification C:\Windows\system32\wbengine.exe 2024-04-04_7e4a1054bc9579fed870d9f0b713b099_ryuk.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe 2024-04-04_7e4a1054bc9579fed870d9f0b713b099_ryuk.exe File opened for modification C:\Windows\system32\fxssvc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\System32\alg.exe 2024-04-04_7e4a1054bc9579fed870d9f0b713b099_ryuk.exe File opened for modification C:\Windows\system32\SgrmBroker.exe 2024-04-04_7e4a1054bc9579fed870d9f0b713b099_ryuk.exe File opened for modification C:\Windows\system32\AgentService.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\locator.exe 2024-04-04_7e4a1054bc9579fed870d9f0b713b099_ryuk.exe File opened for modification C:\Windows\System32\SensorDataService.exe 2024-04-04_7e4a1054bc9579fed870d9f0b713b099_ryuk.exe File opened for modification C:\Windows\system32\msiexec.exe alg.exe File opened for modification C:\Windows\system32\SgrmBroker.exe alg.exe File opened for modification C:\Windows\system32\AppVClient.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\AppVClient.exe 2024-04-04_7e4a1054bc9579fed870d9f0b713b099_ryuk.exe File opened for modification C:\Windows\system32\dllhost.exe 2024-04-04_7e4a1054bc9579fed870d9f0b713b099_ryuk.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 2024-04-04_7e4a1054bc9579fed870d9f0b713b099_ryuk.exe File opened for modification C:\Windows\system32\TieringEngineService.exe 2024-04-04_7e4a1054bc9579fed870d9f0b713b099_ryuk.exe File opened for modification C:\Windows\system32\AgentService.exe 2024-04-04_7e4a1054bc9579fed870d9f0b713b099_ryuk.exe File opened for modification C:\Windows\system32\fxssvc.exe alg.exe File opened for modification C:\Windows\system32\spectrum.exe 2024-04-04_7e4a1054bc9579fed870d9f0b713b099_ryuk.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe 2024-04-04_7e4a1054bc9579fed870d9f0b713b099_ryuk.exe File opened for modification C:\Windows\SysWow64\perfhost.exe 2024-04-04_7e4a1054bc9579fed870d9f0b713b099_ryuk.exe File opened for modification C:\Windows\system32\SearchIndexer.exe 2024-04-04_7e4a1054bc9579fed870d9f0b713b099_ryuk.exe File opened for modification C:\Windows\system32\dllhost.exe alg.exe File opened for modification C:\Windows\system32\fxssvc.exe 2024-04-04_7e4a1054bc9579fed870d9f0b713b099_ryuk.exe File opened for modification C:\Windows\system32\msiexec.exe 2024-04-04_7e4a1054bc9579fed870d9f0b713b099_ryuk.exe File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG msdtc.exe File opened for modification C:\Windows\system32\vssvc.exe 2024-04-04_7e4a1054bc9579fed870d9f0b713b099_ryuk.exe File opened for modification C:\Windows\system32\msiexec.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\System32\SensorDataService.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\9a59c421205991d4.bin alg.exe File opened for modification C:\Windows\System32\msdtc.exe 2024-04-04_7e4a1054bc9579fed870d9f0b713b099_ryuk.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_77375\javaw.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\Install\{AFF521F6-AE33-4DA9-91C8-593A92655606}\chrome_installer.exe alg.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 2024-04-04_7e4a1054bc9579fed870d9f0b713b099_ryuk.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe alg.exe File opened for modification C:\Program Files\7-Zip\7z.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\Install\{AFF521F6-AE33-4DA9-91C8-593A92655606}\chrome_installer.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\7-Zip\7zG.exe 2024-04-04_7e4a1054bc9579fed870d9f0b713b099_ryuk.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE alg.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateBroker.exe alg.exe File opened for modification C:\Program Files\dotnet\dotnet.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\7-Zip\7zG.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe alg.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe DiagnosticsHub.StandardCollector.Service.exe - Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2024-04-04_7e4a1054bc9579fed870d9f0b713b099_ryuk.exe File opened for modification C:\Windows\DtcInstall.log msdtc.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe alg.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe DiagnosticsHub.StandardCollector.Service.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000 spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 SensorDataService.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz TieringEngineService.exe Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 TieringEngineService.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006ee2ba508086da01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008cc842518086da01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" fxssvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003b7953518086da01 SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000048f573528086da01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9926 = "M3U file" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9933 = "MPEG-4 Audio" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@windows.storage.dll,-21825 = "3D Objects" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000651732518086da01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" fxssvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009f41fb508086da01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a7f916528086da01 SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009f41fb508086da01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b1bad2508086da01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet" SearchProtocolHost.exe - Suspicious behavior: EnumeratesProcesses 7 IoCs
pid Process 544 DiagnosticsHub.StandardCollector.Service.exe 544 DiagnosticsHub.StandardCollector.Service.exe 544 DiagnosticsHub.StandardCollector.Service.exe 544 DiagnosticsHub.StandardCollector.Service.exe 544 DiagnosticsHub.StandardCollector.Service.exe 544 DiagnosticsHub.StandardCollector.Service.exe 544 DiagnosticsHub.StandardCollector.Service.exe - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 656 Process not Found 656 Process not Found - Suspicious use of AdjustPrivilegeToken 41 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 1636 2024-04-04_7e4a1054bc9579fed870d9f0b713b099_ryuk.exe Token: SeAuditPrivilege 4948 fxssvc.exe Token: SeRestorePrivilege 2832 TieringEngineService.exe Token: SeManageVolumePrivilege 2832 TieringEngineService.exe Token: SeAssignPrimaryTokenPrivilege 1760 AgentService.exe Token: SeBackupPrivilege 4108 vssvc.exe Token: SeRestorePrivilege 4108 vssvc.exe Token: SeAuditPrivilege 4108 vssvc.exe Token: SeBackupPrivilege 5108 wbengine.exe Token: SeRestorePrivilege 5108 wbengine.exe Token: SeSecurityPrivilege 5108 wbengine.exe Token: 33 1056 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 1056 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1056 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1056 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1056 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1056 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1056 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1056 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1056 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1056 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1056 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1056 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1056 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1056 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1056 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1056 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1056 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1056 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1056 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1056 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1056 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1056 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1056 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1056 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1056 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1056 SearchIndexer.exe Token: SeDebugPrivilege 2216 alg.exe Token: SeDebugPrivilege 2216 alg.exe Token: SeDebugPrivilege 2216 alg.exe Token: SeDebugPrivilege 544 DiagnosticsHub.StandardCollector.Service.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1056 wrote to memory of 3680 1056 SearchIndexer.exe 118 PID 1056 wrote to memory of 3680 1056 SearchIndexer.exe 118 PID 1056 wrote to memory of 1628 1056 SearchIndexer.exe 119 PID 1056 wrote to memory of 1628 1056 SearchIndexer.exe 119 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-04_7e4a1054bc9579fed870d9f0b713b099_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-04_7e4a1054bc9579fed870d9f0b713b099_ryuk.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1636
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2216
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:544
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:1788
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4948
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
- Executes dropped EXE
PID:632
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
PID:2904
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:1016
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:1596
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:2488
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
PID:4676
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
PID:2668
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
PID:912
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3132
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
PID:2228
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:408
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
PID:4056
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵PID:4408
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2832
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1760
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
PID:4212
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4108
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5108
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
PID:4508
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1056 -
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:3680
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 8962⤵
- Modifies data under HKEY_USERS
PID:1628
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
- Size 2.1MB
- SHA256 27c08ae9c49d115b2e0258a34b77dfed6fdfb1b5fdb5c21962703aa78c43c1c7
- MD5 d1a15c5c2f724f3a5aedebb1507ea579
- SHA1 e10561d2cb6c5a95922782057cd63f0ca12b909b
- SHA512 addb7efd6e0a2e503dc605891c98ecaed8c9101db5159c644f1de5e56fc2dcc176bacd5e340b85971ea0ad576e3ed75513f99e70a4f114dfe4514d19e24d55e2
- SSDEEP 49152:JuYk3H5koUUfTqkkYLO/W2buywzMbOX+T7z58ctXdujQzfkrh6do:J8fTqi90bsjoW
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 1.4MB
- SHA256 dda042aeed58a906c7f32256c4c83c57a56d18b86c54dd59dd5865f9a94e2485
- MD5 43ce2cc13abb7b838f2c860e393eda39
- SHA1 064af96b3b1d2db310fdd03ebfe03373fac85fa3
- SHA512 7b616aec2ea7d726e4fe574f424fc57e2deca523c6f57d55eb3b729c3288b85445fff92ba2fe06fe01c7b52be92d3fed98d26365144d69ecc62d2e3f211837c5
- SSDEEP 24576:jPsJcui/vEaW44rECLyjZNQzJfzNkrhg8Q3do:jwcugctXdujQzfkrh6do
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7z.exe
- Size 1.8MB
- SHA256 c900dc54481d979d5266b3df4d8d647b34ccbc4b59660e4708b366a5cdec4742
- MD5 d4e4c95ecb5369093d908484491a47ec
- SHA1 0c9bd52ea0804818a5e504cb4ad8dfc5ba626e33
- SHA512 03fa3ff14285c32175d676baa1ee97eab0c68ea3a30a0a5f627932de54163ed038c72d75e6749df6400dc304a549b85f24b9775a18aba48954ffef83046d4713
- SSDEEP 24576:t+gkEdfh4Co7vEaW44rECLyjZNQzJfzNkrhg8Q3do:UgkE5S5ctXdujQzfkrh6do
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7zFM.exe
- Size 1.5MB
- SHA256 902b23a748a57fb0ebd58547e53f2e42517a179ca24fa85057e0e1a1f001615f
- MD5 2197355c460e1b5a5ebdb71d7c882de8
- SHA1 3a0bbd6836e201b2fcb869cd3a91ac3dec729d43
- SHA512 a6235af0ce419c089fbfa5a93f463a97025229c273db8ba45581c96a43fec4671820355f5c7affe0384cfc35d4f3c4de7cdf351bcc688a3eab970f069f8a7eee
- SSDEEP 24576:2BpDRmi78gkPXlyo0GhjrIvEaW44rECLyjZNQzJfzNkrhg8Q3do:yNRmi78gkPX4o0GhjcctXdujQzfkrh62
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7zG.exe
- Size 1.2MB
- SHA256 152722e81e385c1b48fed99f9c26572341e6e318a1d99ac7b67abe3b118255bf
- MD5 a7e98b2535c4dd326599fbd1adbf89ff
- SHA1 2aaca4f5e44555ae6b1342f9bca5831bd01d21ef
- SHA512 3ffc0cc853ad830f760264847f406022fd75977c174829ed4940d3a490d5a00ec4f2907d1fb099d6b0ec0812584f9ed903b1735848594587c859e8cbb3575e3a
- SSDEEP 24576:YLOS2oPPIXV7vEaW44rECLyjZNQzJfzNkrhg8Q3do:g/P0ctXdujQzfkrh6do
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 1.2MB
- SHA256 5506d7c5e88380a7f311b375e28798f126020c901ff6fc99521deb77c0e19294
- MD5 43067911098fd4d6d11f163cde01e4ca
- SHA1 e6a1117b7ce2e26f2dffed6747179a045d70c326
- SHA512 c7633461e1499ab7b41f63dadb14960a55215cba89e3cfffda3d92b77953a42a6fba87b0a599fcb6d802b5fdd19fa2bbd4047cddc55525290b57dbbbbc258d5d
- SSDEEP 24576:GYZvEaW44rECLyjZNQzJfzNkrhg8Q3do:xctXdujQzfkrh6do
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
- Size 1.5MB
- SHA256 02cec63989a6ad8d66979415badc494d86cd3f2b7c26709f2ec6e62b7d2df6ac
- MD5 dd8818fcabbd35e6149d93294ca7b169
- SHA1 f75bd6102127a0bd2780fda4183aff4e2c8dfbbd
- SHA512 365024215c45e6db1bbfbc9dafc788d48a2484afb27e3a8cb5e71364264f07e6dd4136481fb5d1c0461dd8e6ee820909e809b61e2a739644c9bee086ee635f6c
- SSDEEP 24576:EJIUmvEaW44rECLyjZNQzJfzNkrhg8Q3do:EJIUmctXdujQzfkrh6do
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 4.6MB
- SHA256 7bc961a2fef217b50f63fe11f1a218c305edc38e565da3350a1304c2d3052e51
- MD5 f1d46e2002fb7bab6be7ac133af11b38
- SHA1 2b1ef18e657a987d1cc2d39d3984662f88de8894
- SHA512 e96594d019838ee38590a5a80e477137adb9e765ec15b638dbf4739233d839fe3762ec19332e47aabf5bd69b1c326f2136175eb0680572fc10cf74efce37d2d0
- SSDEEP 49152:9QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THq:9QvGAdlCEL8c/WRNw5C7joW
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
- Size 1.6MB
- SHA256 97948f85bbc8af5ec347253e53e98bc1342e87e46c98baae882c795a43899b4f
- MD5 9f7637b148b2a2b6aaff2993bc1947e2
- SHA1 543b7d6b908294cca9de97e4f9a0130fc65e1d82
- SHA512 6bf835013d9ca065d1df9490cf608630d008ad619c21554df6ec5f3c746eceffee4810c47e1be95a6a9cbf72b58c4b46f6d3de1831ca532a3f39caff4d9984ff
- SSDEEP 24576:3fewsAjgvEaW44rECLyjZNQzJfzNkrhg8Q3do:vljgctXdujQzfkrh6do
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
- Size 24.0MB
- SHA256 81c1f3086c1d02873e16691d8442ac0818492becf404950fd76418b3b4dc51da
- MD5 dff19a81021cdab408967ece14360fdc
- SHA1 87c0772665d0ba76713a44c4aa8feffb8809baed
- SHA512 c1f605694ee610f934127c94d3d988d4d857f6ff6109f14842e67aa4e5411c5c237ff9a1fba96e3c79394afc4c20b84fa9e47ca4b7e6a72ba13b953e45dc2844
- SSDEEP 196608:SUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHjp:SUEtQevvqc2W1cpV20I32
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
- Size 2.7MB
- SHA256 fa73f76d1a99ebe7ca15ab6cd2d3ccbd894913e6350801135095409e3785c2fb
- MD5 d13b07c15159ea4b45a642b1d36c7fa5
- SHA1 2b5340b8e34938c50517689e135fc3214a5d2ce5
- SHA512 b0d07f2da26947c2853b113b42c07e5cc0c0f158effd176ebdbd5df10ae9789b90edf67a9c0632c18fa3cea77745bfad4eb4e590af677b0e0d8521cb5a7e308c
- SSDEEP 49152:PCbRquA/m2yL5zifFiV+XenmE3/zActXdujQzfkrh6do:IoqHVjnmHjoW
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
- Size 1.1MB
- SHA256 215bf18eb7b0882a497adb526a511bad8e0ae1ad85e81c7e20281bc06cb6d384
- MD5 1314b23c64279a1ac357d4e1de6fb535
- SHA1 4e620fd11286c2302e6dd46b24699cd5dff33a59
- SHA512 9db5ea42f7a502719fdead36933767180c5e5b7e6313389e0f7ec49689e181aaa490eeae9adbb41c16ab5c555c7578f9f36ac916eb5b5f2005e5f4523b1ca9a7
- SSDEEP 24576:2AhGL6IFoiwtA5l7S53svEaW44rECLyjZNQzJfzNkrhg8Q3do:2AM5Foiq58ctXdujQzfkrh6do
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 1.5MB
- SHA256 34224dd9c92d27a2877724bef917e8200dd96ee6988d28a54ecf4b55e524cc00
- MD5 c078f472923a016c82e6e52371d8f942
- SHA1 628295c640edafb4dd3a1f6c7b075609913d0fc1
- SHA512 cef594fef6df448fb9a1b2052d2e54a369b4f6b889415825cc228960621b7039d02ebb8dc90ae2844c0b999e8747f6056f2be2a2d1d133fa993753c491faa9c7
- SSDEEP 24576:ewuROW0vEaW44rECLyjZNQzJfzNkrhg8Q3do:ewSOfctXdujQzfkrh6do
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
- Size 1.3MB
- SHA256 e2ebcd6f273e1df0618eb584334a677092fe83799279531e3abd4f873eb7ad2b
- MD5 95cd4e6e0278d15e08bee826d1b45450
- SHA1 215bca184edb9a1cb5778306896b7ce67e292936
- SHA512 1cec63ef94b39ace349bb9869e07ce51a14046dca4f874d2953d98d76166c0e65a54e3ddcf82546dbace15d818387741e8ec11ea8ac7a46ca53c6a26098f9d18
- SSDEEP 24576:SZuCvEaW44rECLyjZNQzJfzNkrhg8Q3do:CctXdujQzfkrh6do
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe
- Size 4.8MB
- SHA256 b22dda8fd5c59b8bfe279da1533ac0e5ab0db51f7acdff1a7e40e670eb71c028
- MD5 498f27d69eaa6fd1ead7910b5732ad6e
- SHA1 a632733f0f4791b856d5768bb5a6f259d57473f3
- SHA512 54b8470822a7294558ff2cb340933cac578d16e60ff58dc8d5bd09485e8700f3315dbc6e7b21f1535e6534e62be55a9a0ba4632dffa260549ad4fc08bf004ee5
- SSDEEP 49152:Lj8f3jtqiCLg9LK2hIOR+k9jdAsizqxSiZ4K5MZqkL92c6nkdmbDIiIerM1R6ZPQ:UrZ4K5M+XDIiIewG+x6xZ14FjoW
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe
- Size 4.8MB
- SHA256 e921fa7433868ace47b8c78741af5468e836c805b63c067987bfb92921cd9415
- MD5 eee809db0a301500e4982785cc31d590
- SHA1 e96f10ddcd346e16643a18e6c81be07d5230ad14
- SHA512 6014ff6822423008c7b2bff91fae378ddad6d281edcee797f3794d8ea5caa40cbc8fde36338d1bc05af70e7f613278ae7a6578e365d3753b8a94a2c160b95474
- SSDEEP 49152:Yj8f3jtqiCLg9LK2hIOR+k9jdAsizqxSiZ4K5MZqkL92c6nkdmbDIiIerM1R6ZPQ:TrZ4K5M+XDIiIewG+x6xZ14FjoW
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe
- Size 2.2MB
- SHA256 69f8f7d59a8577f2b0f9448cf7f10f416fcf102c395ab228429c84d91d84c10d
- MD5 bde2f64dca17434516896e2dd139c893
- SHA1 5a29df366d0e554d32a7bf527f794f822b54f5ca
- SHA512 3cc72a5e80f72f50a300af96d3fb05dc2a46f8f948db634f4420d238afbcb2e8234faa35d7318aa3d573a900bc2b0e1630516c611cbb9dfc694e61272dbe529e
- SSDEEP 49152:6fzabJ8llj+SWUi2mkx+X+disctXdujQzfkrh6do:/si2BjoW
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
- Size 2.1MB
- SHA256 ba91e1d4b2e5d41bb049d86c440bcdb8f0a8ced649e6df1b293254f5c6ccaa95
- MD5 b968fc9a203a9533034c0b866b6fb875
- SHA1 7ef212c7ba8de8f5860b8ec0d806c4d661e394a7
- SHA512 2697430d96b96e74eb63402a4802cd522d2e932f0ff35a46eba5982a8c045486e86a3526f74ba5f4c2371de4754fc1fc1ec2e9a810846ad32b5a9c6b99f59ca7
- SSDEEP 49152:+a/3xXBSZ4K5MJ1LvTMxbTsYBYSgxu9+fw4T+ctXdujQzfkrh6do:gZ4K5MJabTsYNjjoW
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe
- Size 1.8MB
- SHA256 52c50993385144c7695461ac666ffb70b88e347f61483fab88ca9d8c65f81083
- MD5 18ff986e274baef04a33b207ad84feda
- SHA1 01eb635d1b02a03a059768c58528e12f8eb21c27
- SHA512 963450ac2c16b731604ee88c5062ed67122aa4f620722a8003ebd13740cf039b2ca5ab87fc96471096e8eb16b464c4df259fad1776a563de21b62c5c00ec9361
- SSDEEP 49152:8gNJtUzDu/9gbPxHC4fctXdujQzfkrh6do:cPxNjoW
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
- Size 1.5MB
- SHA256 18a7e96ccdd770ffcfa70b3dc9aa8592880432f6bfd09f661349cc1d238696cc
- MD5 373d54d3bf460fdf50cd6d05f088c883
- SHA1 a3f67165a120006ebbcd452cadc971613528aecb
- SHA512 ccf4eb15aaedc98fd9ddc2346b1c15fa475a4e37e5f98ce46c996b9b4c4a734e32ce3c218b92810df0036699d9401c365428d5a597954f1da6f20dde5d2b6a71
- SSDEEP 49152:gOBynH1wM+v6UJPLQd7BHjdftctXdujQzfkrh6do:knaLQd7LFjoW
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
- Size 1.2MB
- SHA256 b15e03c6f85bc8e9a4e4d0840d793ad27ce05cf5aa6eb12820be9223b2bf7280
- MD5 4c00ef9bb762ff917f16070c5945bfa7
- SHA1 67c0f0391dfad319fe44b0b7a904b34b3aab7664
- SHA512 0c7c510c5bb18b3473b3a34ae79a59a6350c0e064266197ccf79a945de6911da0355009d72f9466153384f23e40b33663e558134b72f89e3f066f8b370beed1c
- SSDEEP 12288:xGvEaFo4w5rEC5sMyjZNQ37UqoIxleC08L6QQiF8prh2HAFDY8Q8EdoY:xGvEaW44rECLyjZNQzJfzNkrhg8Q3do
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
- Size 1.2MB
- SHA256 7785cdd825c8d96e96572fbd393779739504c25549158e3f8573a576bd4577b1
- MD5 3cb6fd3acfb8fb64b22252a338bda0a0
- SHA1 19c750689c4eae5a6a7df8296dd50abb4ba73912
- SHA512 fee859a73af3571623219b691199219b7a5dc03d5cf299e44284a6233119cb40221a8b370e96de4bcab4f46895e0146742d72fd89969d70ff960b8910706944d
- SSDEEP 12288:wnvEaFo4w5rEC5sMyjZNQ37UqoIxleC08L6QQiF8prh2HAFDY8Q8EdoY:wnvEaW44rECLyjZNQzJfzNkrhg8Q3do
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
- Size 1.2MB
- SHA256 2b88f869166fdc206defa153b0b30551a44ef7cceef3d2eddab716f10e0ad57f
- MD5 e4b7c41c37be07cd7bb5d71d1a2c9791
- SHA1 0615f35e28174d648cfa56ebbe6ac571fcef80c4
- SHA512 b686afd752cc56885f9c723aaf7568a3aad1c23826187aa261ebd3df143d25efd027cf6d9f2da6ff06f69487fe0a77ebcd882b32d7fdbf8989a9668d861e2a51
- SSDEEP 12288:JlvEaFo4w5rEC5sMyjZNQ37UqoIxleC08L6QQiF8prh2HAFDY8Q8EdoY:JlvEaW44rECLyjZNQzJfzNkrhg8Q3do
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
- Size 1.3MB
- SHA256 d98d9a58eaa716bb3e1f662c8742d7546f6a1de0da56590781cc311a69c47371
- MD5 0bab872dc181bd9c49652321dcb69c0f
- SHA1 5ff4f6c374a211950364eb90a3b57172d719776a
- SHA512 1988574ffa45bd78d7f07e1cba941e0cb9ab613640bc5478fadf435ed0f484e530cb30cc3b0c4bcace646769c3fe04e576072c63c9c83a7c53948458416b11a9
- SSDEEP 12288:8VMvEaFo4w5rEC5sMyjZNQ37UqoIxleC08L6QQiF8prh2HAFDY8Q8EdoY:xvEaW44rECLyjZNQzJfzNkrhg8Q3do
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 1.2MB
- SHA256 4fc1e9dae5cb276262fb69cffb77e1b766ad6c85339720647391e638f04af893
- MD5 66327ad8637ab6a8bd5ce0a4879a3df7
- SHA1 d2a7fbaf8feec0838ec2e217c85d16692c36022a
- SHA512 b1d07a65c791e3cb5bbb707fd8c8d926d65d73d26b67e76e7ae07549d715ef50b8f3a2f2bb64666808ff6c45f8f9b485cf5f3ce2d5e3429ffceb46b6c82654a8
- SSDEEP 12288:rkvEaFo4w5rEC5sMyjZNQ37UqoIxleC08L6QQiF8prh2HAFDY8Q8EdoY:rkvEaW44rECLyjZNQzJfzNkrhg8Q3do
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 1.2MB
- SHA256 d0c2bec75f1c623e0f844fd63df5efe32897765554c239b6feb91d76edc1e739
- MD5 cd6fb85543ad75e4f8195f034003f210
- SHA1 8090d831cc32c0279996e051c812f57d1f6070fb
- SHA512 ae9ae6429c8183ec6d072ccd71fe2f57f98d2c39c6fb2f7f7083ec337f1db6d271e9225aad430b88ff50da76e5a306ffec6e70ad4484268e03e09d31dc77b8f7
- SSDEEP 12288:Y7vEaFo4w5rEC5sMyjZNQ37UqoIxleC08L6QQiF8prh2HAFDY8Q8EdoY:Y7vEaW44rECLyjZNQzJfzNkrhg8Q3do
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 1.2MB
- SHA256 06cdfd59c83c209acb4c36850caeb240ddfe31911b927cfd9aef7d35f721539c
- MD5 f7ac7422bee1eb73c9edcc0b593445ef
- SHA1 a0748bc852bfb11e8d5573d545ed84983b68a2d1
- SHA512 9b4a874ebcb8206a38b9302d573a040fcc046970e7ecbca29712c68d975ff35fae43984741278d4e67e1a3b322a6f17a475d156ce96e5a1ba8402ee33dffb02f
- SSDEEP 12288:xfvEaFo4w5rEC5sMyjZNQ37UqoIxleC08L6QQiF8prh2HAFDY8Q8EdoY:xfvEaW44rECLyjZNQzJfzNkrhg8Q3do
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Java\jdk-1.8\bin\java.exe
- Size 1.5MB
- SHA256 d3b6a6fe0b4bb00509dbab750936338096fba9ebb3235b03659dff84920f85ba
- MD5 414be50bf8ad856e5be1145ac9915803
- SHA1 214de80100dec413e1b77e1f6af9807d439545fd
- SHA512 d5f8412859e8deff10784384a985c36c67bd118b9f900c65e7107a59f38257e50bb5066f9e072ced17c368fca354aa9b7399cc37935ce00748de851e4ef64204
- SSDEEP 24576:PZM3zFVSOHvEaW44rECLyjZNQzJfzNkrhg8Q3do:PZM3zfrctXdujQzfkrh6do
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 1.2MB
- SHA256 3e8d0f5f2fe4f3f95ab3a3c7e9d2e90ed52207b713f3a7bb772f4364db847c1c
- MD5 debb192f3fd0a84f3fa1abad2ec8e43a
- SHA1 6485957f440bf80eb49de72d0abc1ecc29e1fe42
- SHA512 3eff57bb734fc4c0af4838e833589c4d4a607f5549d2f20975d7e58af811fb70fd6cf8df27f69cdd6c29a3554a58511fea7d6cd23b4f918a01aca9a5db27ce98
- SSDEEP 12288:ryvEaFo4w5rEC5sMyjZNQ37UqoIxleC08L6QQiF8prh2HAFDY8Q8EdoY:ryvEaW44rECLyjZNQzJfzNkrhg8Q3do
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 1.2MB
- SHA256 2eb42e34103fd6f245c8180607edd67a84fb6f356b1587c05e5d8066afa908d4
- MD5 7e82d71d1bcd214c6e9b4e633c6babb8
- SHA1 9c19fb53ddddd9e38f90ef5de9e743f66c2a60cf
- SHA512 81f7ae3130b803665f6773ee39fa34f0eab51d27c07b0b705ca079809b8d2de8b151e98e968eb9e3413c94641fbeca76f116c8b363997a802801183d7199c8a3
- SSDEEP 12288:3uvEaFo4w5rEC5sMyjZNQ37UqoIxleC08L6QQiF8prh2HAFDY8Q8EdoY:3uvEaW44rECLyjZNQzJfzNkrhg8Q3do
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
- Size 1.4MB
- SHA256 e807724c252a587bf57f055b1beb0e351909125e9e84c9545d1edc30a233699e
- MD5 d41f3210b878850dfaee1d2a1f81af21
- SHA1 1db765b7edb88b084dd3841aef7f8c6b36651ad1
- SHA512 a74154412cb9ef9c1acf7c57bbfeffe5d2fbee3259335eb079efbdd1d8de590ff12103016c1aebbc4cffaee090bb729308be9c63c17de2786c7b0824c80813e4
- SSDEEP 24576:mzyDvEaW44rECLyjZNQzJfzNkrhg8Q3do:m4ctXdujQzfkrh6do
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 1.2MB
- SHA256 1d0355a37c79c07549c7049775452b16c4a595ec09765894cfdd83d0a2cc9652
- MD5 a4ceb5cb63f280ee79032c028ce4968e
- SHA1 a8e23d18ed097d51351a2987c54e43f480d91a3e
- SHA512 1ae4d3ddebce495bcb16c1638be27e051ba30be24051398d83dc5f417caa67ca4ba447e96b1d76bdbb6d5cfb279f2feafe909f4586fa6d814101810eddd25894
- SSDEEP 12288:YyvEaFo4w5rEC5sMyjZNQ37UqoIxleC08L6QQiF8prh2HAFDY8Q8EdoY:YyvEaW44rECLyjZNQzJfzNkrhg8Q3do
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 1.2MB
- SHA256 125981643b000674f20729af2b681af718182508dcc0edf85ad86461e1fcc594
- MD5 d30cbf761d0faf2cc99bc7c71c623832
- SHA1 5120fc9f3d9cd39e7407cadbdcfe050b716ded21
- SHA512 154f55fc960366bb67a2722cecf4e670175baf3aebb3930a3701e0baa05cc9aee8a5c1412eba253f7d04e9aba0b7fdd7bfdcd7cfff98831669ba227c442af5e5
- SSDEEP 12288:RyvEaFo4w5rEC5sMyjZNQ37UqoIxleC08L6QQiF8prh2HAFDY8Q8EdoY:RyvEaW44rECLyjZNQzJfzNkrhg8Q3do
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
- Size 1.4MB
- SHA256 cb5fc0bc671e6fc531d5b965c5c871c9bca1fc3b5235c8ec7b71833bff3de20f
- MD5 435017ca852e7be15885f665c7a33fcf
- SHA1 2cdfad1d242795594e635614a002c57697398d3c
- SHA512 d6571b6445aa9caf8f79b9d6b9e44c4c31d42c263a3413a57f3d7d6642a5946233ca4dfbf40619d8baf10d031260ab990bfba1a2a4ee2a751e0f30e8c17f0a00
- SSDEEP 24576:9zyDvEaW44rECLyjZNQzJfzNkrhg8Q3do:94ctXdujQzfkrh6do
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
- Size 1.5MB
- SHA256 48ac6d2cadd1508fd3657da6a71f56bd6d6bfcb76036b789a3c416ae96f0b685
- MD5 06ee3e0b59a9e4a18bc07f91e9ee3b87
- SHA1 c338694701049ba2fd17757ef3382d319a2f1d07
- SHA512 1ce68c255861c6e56c596cba781b142392ed0699c67b7cd40ffaf63a63532cb4bfbe701ab860870e8bba883b96785b68bb02ec3f40ec1665cfbc149d3e450610
- SSDEEP 24576:wT8aLl3z0zD1vEaW44rECLyjZNQzJfzNkrhg8Q3do:wT7LljwctXdujQzfkrh6do
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Windows Media Player\wmpnetwk.exe
- Size 1.5MB
- SHA256 e193fd828c31fa60b9ca79299d5782f3e9a77a27e75fc4e9a04e51d8c243ef90
- MD5 45c884c47ca687864b95e8e1e9aaf1cf
- SHA1 9f0d53331bd364d14a0095d1caa92af2ab5ea6da
- SHA512 a7b4ae2ae29cb56b79ec4922c4e4aafc9d87982d6b45f189276112bd17d4bbe05118962ff36b15c9b780e3895c716b3f078157336ee94afc86b9b334eb3b3a00
- SSDEEP 24576:HcP4mcvIjkGOxhKP2l71SNKbrh/8KBdvEaW44rECLyjZNQzJfzNkrhg8Q3do:8P4m4IpOO67N8KnctXdujQzfkrh6do
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\dotnet\dotnet.exe
- Size 1.4MB
- SHA256 32d1a033a68e69f0829c9717ae3210ee3e75a602d3f95667f88b34785e6b3166
- MD5 ada10d2f5c4adf209918318b28fb885d
- SHA1 b995aa8eb7077c69409b1a9c4f96cce1fef34c66
- SHA512 ae6cb945dfa9882042880624d659f1254bee085ae6e8fec8054f97203cd9b10daa020eb6fa22cca3aa4578ed194f9db62b8f61a86b40c961fc7042af4124595a
- SSDEEP 24576:3oSLvEaW44rECLyjZNQzJfzNkrhg8Q3do:3oGctXdujQzfkrh6do
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 1.2MB
- SHA256 53e22a487d7e8f6aaa369f78bc984d0838a31994ac12fdf3abb730c92aec40f0
- MD5 4334cf8e0b5264afc505269e52596a42
- SHA1 26b1d27811fec6805e74f28035ea65b00b14c1b7
- SHA512 83654176df65a7927b5fd13fd9792c2eb05daaf139e790bdec99ad428d90797a8d67d9d42de90cd6ac7161c97bc9f43cae4f02b85b14b06dd8fb302fa58efe59
- SSDEEP 12288:X1vEaFo4w5rEC5sMyjZNQ37UqoIxleC08L6QQiF8prh2HAFDY8Q8EdoY:X1vEaW44rECLyjZNQzJfzNkrhg8Q3do
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\AgentService.exe
- Size 1.7MB
- SHA256 085ddd134743b9d6919788b8362452662d73a340f41731d414d52a03cacad5f8
- MD5 fff4f0feae3d6a974b85f9204d1047d5
- SHA1 256926c2118bfe5a1c7519e0d8991ae9b0cf129f
- SHA512 a3b2fd2422162c3a8493c4b672dd6da0f26ba0e3934f557531f2c5214e951405247cc35791ba58273199f1685513a0b726a7c671cff1acc5145c7385395affe6
- SSDEEP 49152:Ea0h2GEkuAe73q3pp46zwwQDctXdujQzfkrh6do:Ea0hNYG4JwkjoW
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
- Size 1.3MB
- SHA256 d2d8150b0048bdbfb6a8c98d98bd2f0acba3b2e20a1db383c8781725101d30b6
- MD5 6e5241e9d1dd7129039222d79cd7b468
- SHA1 f4a5575c09130393177f210bce61650ecbe1765d
- SHA512 70c98f771a186536e3fd9cafedbf08664abd13833fa6645495fc5b0d84a0d8373563ba34761873ae2d5c0b49e80a082fb04252c3d97273f4078e66efbde48619
- SSDEEP 24576:ihbHjP8vEaW44rECLyjZNQzJfzNkrhg8Q3do:ihbHjEctXdujQzfkrh6do
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\FXSSVC.exe
- Size 1.2MB
- SHA256 9d35546c2628131c23ff036348a5caa7f14f9c4840eaa331b03c9566b283bc77
- MD5 ee423832995511bd5c25a362c81e886f
- SHA1 63a7f151eaae9d28c473620a084c151076db0468
- SHA512 a96222027ede995bb35ad4d958d4b613bab464676c70b8c654897bb113919ce8225df5917f3af05f5fcb502c4f90ddff1dbf01d9980518133e07c54005bdb622
- SSDEEP 24576:X3YgnJcRTk4yti+R5dpR/0vEaW44rECLyjZNQzJfzNkrhg8Q3do:XIgnaTk46ppR/0ctXdujQzfkrh6do
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\Locator.exe
- Size 1.2MB
- SHA256 32318318557b260d3221a20ee6bc98f1c20c3ea58390280ad7f7a4a2df7ac7c8
- MD5 f12dad7c0582044cbedba7e886cadaf2
- SHA1 00898daedc3bea6a21fc421f1ad4bcee2fefe0b6
- SHA512 532309eb1cad67f94a0958e84e3782ca31658d5600614c2cf3601351275171a94cce15f328651d5eec3451388d6746ed8320838d8058c8aefbe6eb2f7fa5128e
- SSDEEP 12288:55vEaFo4w5rEC5sMyjZNQ37UqoIxleC08L6QQiF8prh2HAFDY8Q8EdoY:55vEaW44rECLyjZNQzJfzNkrhg8Q3do
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 1.6MB
- SHA256 9b14f45fbd700e704ef97871f3105b7619c859fa0cee444bfb2a31e2ab336740
- MD5 997abcd2275a04ac2f4fbc096910ab21
- SHA1 4df42869e52d80304b4d0b63c30458e026091800
- SHA512 4fc1f7060d1af8117d5cef4c88d000298dbec31bb0665ef97c7d172d335a41018e9c507b2ae8d925f10e845bc30b5dd13797d85115a2b556732600e7998467ad
- SSDEEP 24576:fAL3UTivEaW44rECLyjZNQzJfzNkrhg8Q3do:fAL3UmctXdujQzfkrh6do
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 1.3MB
- SHA256 1566e46845775f597c503fc5ab3e6ffe8cbcbb41c07fb9a8d6dc4414d6e999e6
- MD5 ddf25da7b0c98ae4afdb3647059e611c
- SHA1 584986b23f8a45b652dc0e469ea1e7dc32f8dac3
- SHA512 a21d899a6b3987eb520c213996e76e9c6b50b86534534f1a1086018d7cd29ac828455f11320eb02723ee8a6f6ef141234fc77c864d27ee9cacfea56e9df02ae3
- SSDEEP 24576:1OGvEaW44rECLyjZNQzJfzNkrhg8Q3do:1OGctXdujQzfkrh6do
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\SearchIndexer.exe
- Size 1.4MB
- SHA256 5b682d7fea3bb518ff5f8963fd22a0525fc0e7d50203c8b7977db159030f8dd2
- MD5 b5509fb57e239a8ff92f7de89e60c6c7
- SHA1 6028468fbec0a609994dbdc7121ea5d817e1e130
- SHA512 79330391f5bffee2b40e555dd96d0d6dc67bc43467f6543164e47c746e661b8d1128d004ff1af4c16cd8fafb2960cc3c0505c49690ccaae94f42c34c59e15d88
- SSDEEP 24576:T7NM9YmZqmWMUkPjZM48Mv6bEhsFvEaW44rECLyjZNQzJfzNkrhg8Q3do:T7cBWMpPjN8DbEhcctXdujQzfkrh6do
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.8MB
- SHA256 e15b28b7a72538c5a1ce5e6b4feee1dcee2fdeee11c1b67e140c737fd0d77c8a
- MD5 c523bb81a262b75937be90166cd6b5ea
- SHA1 db5517b0c2d86a9f2f2d6ae518091552dea1124d
- SHA512 c2d62d407c14b87d7ec0e9fb30e6097ab525cb0d7fa34dc5dfced93491847836aee9a614bccd4676f39ea2c9eaf88dc8d16f50a58549a4737c6e774c9cd763c0
- SSDEEP 49152:zF2YuHNETovcvNYf8kmlctXdujQzfkrh6do:i6tCf8kujoW
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\Spectrum.exe
- Size 1.4MB
- SHA256 1feffb037a2d5773da286c9fe537e9eafbd2b9474caadd832bf9c566518d1615
- MD5 8e6eb371938dd40de1261ecf17e2798a
- SHA1 a0ac4dac5441686c8333629245ff053e3a7133cd
- SHA512 b7fae87ba8d31d9ba12f6b996b376cf90e213eb8c2930b81920dcebdb3b9b6d8b2879ddc2c36dda40136130911c2c493d64e73477ecdcc833f4a7706724ca55b
- SSDEEP 24576:qAFs06+Omlf8NXEbToKvEaW44rECLyjZNQzJfzNkrhg8Q3do:zFs060loXujctXdujQzfkrh6do
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\TieringEngineService.exe
- Size 1.5MB
- SHA256 14efdaba7670fa8db66424996ac27d32afc32252b46bf08f2e4dc97cbe05a143
- MD5 472e30871a6835c8f67f7b8b6959f8e8
- SHA1 1179c0de1f6a0f178a457d63d2f2eb4b4a785c2f
- SHA512 b091026af45006f1e7fd2f02d6b9412f33e5b18c9f6ee2e0f992d3dbcc4efee7f3e2295ddf2631b8c1767f512d773a716d8a4a183fcea255bc79172ad49786a5
- SSDEEP 24576:bJnJ5D3WtjvEaW44rECLyjZNQzJfzNkrhg8Q3do:bJnJ5DGtjctXdujQzfkrh6do
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\VSSVC.exe
- Size 2.0MB
- SHA256 d7f2134b303b2414f3ab8ad86e8beee916ae754d5e866135294c63d7da3eaaf2
- MD5 82d38f4df99f4774983e2024ada5963c
- SHA1 25112f3779ecb8e62f39aa0a9e478643ee11a3fc
- SHA512 a4295d0ede681e17e26079cbe8b1b2fc6a0247a8a30d9af52f03f57a751aa9ba18602a4177ec7d4f65e966c037ffaf741b293f101fe33ebe4d043928c60ae589
- SSDEEP 49152:Jo06DIKdwc+eQnSt65aVhctXdujQzfkrh6do:ejjoW
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\alg.exe
- Size 1.3MB
- SHA256 4db9c7bce98e8232ef0aff241a490325326ff157626331b90cff45d83e639b19
- MD5 586acd5748aeaf3ca8d3eae92697b4f2
- SHA1 ab8a151632dae069a74534676f18ddc3eb533324
- SHA512 5feb24535dbf2bab0e1c3d547b2e6c9890b951b7dc2fd70f41fc793058251d5264cd68aff1249f815fdd275c5b09d4898ba771cf7cc4db79e6e1c6264e292a3d
- SSDEEP 24576:QrXvEaW44rECLyjZNQzJfzNkrhg8Q3do:QrXctXdujQzfkrh6do
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\msdtc.exe
- Size 1.4MB
- SHA256 263b3705edac309b6d27fd7974456253e555703febffb8b38765a73e601a1900
- MD5 489add42e51517615e3ab835deaa6555
- SHA1 c939bac9d051991b1184573e2af289ac99b4ea83
- SHA512 d536e52c7f34e378999351ac5dd44bb53ee50916183f9a7406a74b4f64c58b1111d3e5e86d4ae1a6a5bdbd48aa65866cd54a0768d7f22b5d328be174d14b91e3
- SSDEEP 24576:RIysvEaW44rECLyjZNQzJfzNkrhg8Q3do:RIzctXdujQzfkrh6do
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\snmptrap.exe
- Size 1.2MB
- SHA256 e3a884fafd44cd2403b6fdd146e677686b2d05fb6a2c9a88b86ba45a18629d82
- MD5 cfb6dbf3901d59c2a29801880b01a892
- SHA1 f59f4b6101a03b7271621558116507efdb196afb
- SHA512 440bbda3dfd34cc852e784f97cee8654b47dd3d70b0519d39ea9776642e2917d0f54585956a5002ec6978a68a654c614db5103fa82f58578cb99c855c6756903
- SSDEEP 12288:+F2vEaFo4w5rEC5sMyjZNQ37UqoIxleC08L6QQiF8prh2HAFDY8Q8EdoY:s2vEaW44rECLyjZNQzJfzNkrhg8Q3do
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\vds.exe
- Size 1.3MB
- SHA256 a43ce897103e3b80fbd7b6e86594e54879386b7640bc74c692230cc44e494496
- MD5 d60fd56dfca2f68f3bc811dad408b359
- SHA1 5b3dcc7b45372adb6624e401d52de645ef848833
- SHA512 98cf00c42f20a6daf7a2351155fa97055956b884be19bd77a865ff2f072a1d8ead24315e036d12a98f62af832b9c8b973daf5db412befacef4ae6966e49a3044
- SSDEEP 24576:9Q9MxZKdcz97w3tvEaW44rECLyjZNQzJfzNkrhg8Q3do:9VKXtctXdujQzfkrh6do
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\wbem\WmiApSrv.exe
- Size 1.4MB
- SHA256 58d7f4e1c90419c4d57e699602dc899d52dd151d034c7341c9c949cfb90a1e1f
- MD5 02214d7048e4c77f358e45814cdc18a5
- SHA1 4b77db6aa90413708e0d525014011fb21534a1fd
- SHA512 50149e1cd7eecd49adb0bf111d0fa7569aa5c24ecbb90d59bea7d20895877179fa0c17d941bee6e16038a970070ded8e01fa2ceafab98d413ebc1610d5ea4ed4
- SSDEEP 24576:ZyocxApgvEaW44rECLyjZNQzJfzNkrhg8Q3do:0ocxApgctXdujQzfkrh6do
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\wbengine.exe
- Size 2.1MB
- SHA256 547a9520d58cbdc1a6b6c53ae19cbb6dc47c232b37a2d213fdf017b5c735555d
- MD5 00ad779e28c855cdbcea6fcc128336b7
- SHA1 36adedd15aa1f58695000e3fd2b4b5eb5e3f9ffd
- SHA512 faa53338538b4f39513af39d73a8697b5e7183e1854ba710e510239550b27c2edd781215a3b67738f81ddbfa7d823270f476d112bec5c1cc2238cc4c739647f5
- SSDEEP 49152:MWcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIKgctXdujQzfkrh6do:G0zuNIYjoW
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\system32\AppVClient.exe
- Size 1.3MB
- SHA256 c0702400a46567a01f47845036f06da1ae12c11c7c11d29a51ef98d5de8e3748
- MD5 b40899eff7d1b91cdd4c8e4634742611
- SHA1 f9f1d355e35b2accee3d7b9d87ea107c0bc96001
- SHA512 512e23d37372911a1feca0f19990386c27f8ad902f91e096457b34f712b59c858ae1e84c702f2db2331f1372852af851aaec0fe9d411766afd7d28e958dcad96
- SSDEEP 24576:t1QT7EcpfxR+N5AWAz3ooiYzjMqbXvEaW44rECLyjZNQzJfzNkrhg8Q3do:YTDxR+N5YzTBjMmctXdujQzfkrh6do
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\system32\SgrmBroker.exe
- Size 1.5MB
- SHA256 e4308afdddc30369b80a91466f826b1d7ee6d6e34f294d2c8a9d0b7bdfa7ff94
- MD5 ad554411eade795f6cdf72316a6acfab
- SHA1 9f5eb47eccf97453e3ae8ec1d197dae0a5a0f363
- SHA512 24355a9270e92dfb15898264ab4fd9b1315df42e807ca70958722cb09b4ea5860377347612f0055274200e1dcd136b6804e82e433d5fc794ea29dcfac12e90ce
- SSDEEP 24576:vTMdOz0FFS+UmSLrvEaW44rECLyjZNQzJfzNkrhg8Q3do:t0K+UmSLrctXdujQzfkrh6do
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\system32\msiexec.exe
- Size 1.3MB
- SHA256 8a6a44e039bedb1a8e24715db965db98d964866baa9735b7e480273968b0a970
- MD5 9f6352d1ea35eb284e3880ea0cbbbdd5
- SHA1 b5d702813b918086b02254571542450fcab79bf5
- SHA512 0b6cbe61f70db3774df72c49088c75f214a075fd76634c2a0ca34bbbcc6c15951204ab73111f7d259bfb3424d52a0fb70cb7a7be731bf1d3846c4c2a7333d52b
- SSDEEP 12288:u47ivEaFo4w5rEC5sMyjZNQ37UqoIxleC08L6QQiF8prh2HAFDY8Q8EdoY:1ivEaW44rECLyjZNQzJfzNkrhg8Q3do
- MD5 SHA1 SHA512 SSDEEP
- Path C:\odt\office2016setup.exe
- Size 5.6MB
- SHA256 3f4a09721463b27c234ffec6f33c3351b8503c234ee0348e7f2ca459f22ba8d8
- MD5 c321a200d477e9bf1d1b606fba43cb84
- SHA1 388228a0f1b23ec546782234acc45143882775ea
- SHA512 61351e1df648dae8fb219744ee8c98f68f55ea2b97b56c9a8326876f1cf34d9e97f80415f04a0587d261b3a9e19779ac66f002377c46e36b802d4bebf148865f
- SSDEEP 98304:h7M701RgX4iuSl1DtlEq81xZPGnzURnBh6gG9/QmvD/cTwY2h3FIjoW:FM7pTXexZPGzURnBh6gG9F+W3Cp
- MD5 SHA1 SHA512 SSDEEP