16e8416212c215111a7122461eb6daaf1eed15cd19424889e1344176cd4e9347

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
04/04/2024, 11:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-04-04_8c2d4f53240789f2704c71c1eb0b5d7d_ryuk.exe
Size 1.1MB
Sample240404-ncz6dadd2x
SHA256 16e8416212c215111a7122461eb6daaf1eed15cd19424889e1344176cd4e9347
MD5 8c2d4f53240789f2704c71c1eb0b5d7d
SHA1 893805e351442df74442ff623f015f29763c25f1
SHA512 a3d15d2bcd9aa4512476b8d39de891fed38528fc96810995a666305ccc24314b90815e9a996d40357683d9a3028d14bf857971499345b3aa4953b75b4bfd947a
SSDEEP 24576:1Si1SoCU5qJSr1eWPSCsP0MugC6eTHXN4qLqEIH7sTrvIr:tS7PLjeTHd5/IbsT0
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
3988	alg.exe
1676	DiagnosticsHub.StandardCollector.Service.exe
2328	fxssvc.exe
4568	elevation_service.exe
912	elevation_service.exe
4080	maintenanceservice.exe
3968	msdtc.exe
1004	OSE.EXE
2772	PerceptionSimulationService.exe
3236	perfhost.exe
4868	locator.exe
552	SensorDataService.exe
2344	snmptrap.exe
1640	spectrum.exe
4068	ssh-agent.exe
1396	TieringEngineService.exe
920	AgentService.exe
4280	vds.exe
868	vssvc.exe
776	wbengine.exe
3180	WmiApSrv.exe
4564	SearchIndexer.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in System32 directory 37 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\alg.exe	2024-04-04_8c2d4f53240789f2704c71c1eb0b5d7d_ryuk.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2024-04-04_8c2d4f53240789f2704c71c1eb0b5d7d_ryuk.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2024-04-04_8c2d4f53240789f2704c71c1eb0b5d7d_ryuk.exe
File opened for modification	C:\Windows\system32\dllhost.exe	alg.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\53fd9a64c4fd1e7a.bin	alg.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2024-04-04_8c2d4f53240789f2704c71c1eb0b5d7d_ryuk.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2024-04-04_8c2d4f53240789f2704c71c1eb0b5d7d_ryuk.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\locator.exe	2024-04-04_8c2d4f53240789f2704c71c1eb0b5d7d_ryuk.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2024-04-04_8c2d4f53240789f2704c71c1eb0b5d7d_ryuk.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2024-04-04_8c2d4f53240789f2704c71c1eb0b5d7d_ryuk.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2024-04-04_8c2d4f53240789f2704c71c1eb0b5d7d_ryuk.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\system32\AgentService.exe	alg.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2024-04-04_8c2d4f53240789f2704c71c1eb0b5d7d_ryuk.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2024-04-04_8c2d4f53240789f2704c71c1eb0b5d7d_ryuk.exe
File opened for modification	C:\Windows\System32\vds.exe	2024-04-04_8c2d4f53240789f2704c71c1eb0b5d7d_ryuk.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2024-04-04_8c2d4f53240789f2704c71c1eb0b5d7d_ryuk.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2024-04-04_8c2d4f53240789f2704c71c1eb0b5d7d_ryuk.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2024-04-04_8c2d4f53240789f2704c71c1eb0b5d7d_ryuk.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2024-04-04_8c2d4f53240789f2704c71c1eb0b5d7d_ryuk.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2024-04-04_8c2d4f53240789f2704c71c1eb0b5d7d_ryuk.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2024-04-04_8c2d4f53240789f2704c71c1eb0b5d7d_ryuk.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2024-04-04_8c2d4f53240789f2704c71c1eb0b5d7d_ryuk.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2024-04-04_8c2d4f53240789f2704c71c1eb0b5d7d_ryuk.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2024-04-04_8c2d4f53240789f2704c71c1eb0b5d7d_ryuk.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	alg.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2024-04-04_8c2d4f53240789f2704c71c1eb0b5d7d_ryuk.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2024-04-04_8c2d4f53240789f2704c71c1eb0b5d7d_ryuk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe	2024-04-04_8c2d4f53240789f2704c71c1eb0b5d7d_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2024-04-04_8c2d4f53240789f2704c71c1eb0b5d7d_ryuk.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\minidump-analyzer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2024-04-04_8c2d4f53240789f2704c71c1eb0b5d7d_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2024-04-04_8c2d4f53240789f2704c71c1eb0b5d7d_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2024-04-04_8c2d4f53240789f2704c71c1eb0b5d7d_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2024-04-04_8c2d4f53240789f2704c71c1eb0b5d7d_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\106.0.5249.119\chrome_installer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe	2024-04-04_8c2d4f53240789f2704c71c1eb0b5d7d_ryuk.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Install\{CF7C447C-1801-4EDB-B846-242A67BD0D01}\chrome_installer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2024-04-04_8c2d4f53240789f2704c71c1eb0b5d7d_ryuk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2024-04-04_8c2d4f53240789f2704c71c1eb0b5d7d_ryuk.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2024-04-04_8c2d4f53240789f2704c71c1eb0b5d7d_ryuk.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2024-04-04_8c2d4f53240789f2704c71c1eb0b5d7d_ryuk.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004f052f828186da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003e53a57b8186da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9908 = "Wave Sound"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000daef59828186da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ff677a7b8186da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ad3f927b8186da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006da2947b8186da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
1676	DiagnosticsHub.StandardCollector.Service.exe
1676	DiagnosticsHub.StandardCollector.Service.exe
1676	DiagnosticsHub.StandardCollector.Service.exe
1676	DiagnosticsHub.StandardCollector.Service.exe
1676	DiagnosticsHub.StandardCollector.Service.exe
1676	DiagnosticsHub.StandardCollector.Service.exe
1676	DiagnosticsHub.StandardCollector.Service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
652	Process not Found
652	Process not Found

Suspicious use of AdjustPrivilegeToken 41 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4480	2024-04-04_8c2d4f53240789f2704c71c1eb0b5d7d_ryuk.exe
Token: SeAuditPrivilege	2328	fxssvc.exe
Token: SeRestorePrivilege	1396	TieringEngineService.exe
Token: SeManageVolumePrivilege	1396	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	920	AgentService.exe
Token: SeBackupPrivilege	868	vssvc.exe
Token: SeRestorePrivilege	868	vssvc.exe
Token: SeAuditPrivilege	868	vssvc.exe
Token: SeBackupPrivilege	776	wbengine.exe
Token: SeRestorePrivilege	776	wbengine.exe
Token: SeSecurityPrivilege	776	wbengine.exe
Token: 33	4564	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4564	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4564	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4564	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4564	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4564	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4564	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4564	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4564	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4564	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4564	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4564	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4564	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4564	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4564	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4564	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4564	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4564	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4564	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4564	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4564	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4564	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4564	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4564	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4564	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4564	SearchIndexer.exe
Token: SeDebugPrivilege	3988	alg.exe
Token: SeDebugPrivilege	3988	alg.exe
Token: SeDebugPrivilege	3988	alg.exe
Token: SeDebugPrivilege	1676	DiagnosticsHub.StandardCollector.Service.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4564 wrote to memory of 2508	4564	SearchIndexer.exe	117
PID 4564 wrote to memory of 2508	4564	SearchIndexer.exe	117
PID 4564 wrote to memory of 4324	4564	SearchIndexer.exe	118
PID 4564 wrote to memory of 4324	4564	SearchIndexer.exe	118

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2024-04-04_8c2d4f53240789f2704c71c1eb0b5d7d_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-04_8c2d4f53240789f2704c71c1eb0b5d7d_ryuk.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4480

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3988

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1676

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:1860

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2328

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4568

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:912

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4080

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:3968

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1004

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2772

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:3236

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4868

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:552

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:2344

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1640

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4068

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:5116

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1396

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:920

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:4280

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:868

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:776

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:3180

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4564
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2508
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
  2⤵
  - Modifies data under HKEY_USERS
  PID:4324

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
Size 2.1MB
SHA256 e40467d240fc956b5c4e60a887ff6f75f62b52d69bbea2d8b306018f93ed1a7b
MD5 b2880c0083dd33e912101af9337bb451
SHA1 052c2df81418100a19cde1ff4b230bf8c0055f0f
SHA512 9ac103b8f137e7bf1e21c3b5bdc6fb4b19330e4a6358fe9cee0ff0abbf4dd60e5359a663595b56cfd6bd0195f71b61380cb60737f5b786044a2d5f86bce61f83
SSDEEP 49152:IuYk3H5koUXfTqkkYLO/W2buywzMbOX+T7z5Md5/IbsT0:IPfTqi90bo0bs
MD5 SHA1 SHA512 SSDEEP

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 a582b8d9240ecce60042d5e25fcb2341654ed632328c27ed2a83c635defe7fa1
MD5 4415a9bf6f2831ee94542be7b9c49786
SHA1 828bc08db7bf4f60d80dd07af687a48cd75aaaea
SHA512 41ebf5b9f5b10dfa688b2940424fe4dc0c8144d634dba0f464a5bb499e231a21cf223fb8908d7fc03d1dfe63edf5c3e070f6df5c68ebe379db4f123932ecd1ee
SSDEEP 12288:eCiP9Q/Jcui2cZRXPiqwIkFPqQKj8DkBIHCP2sEMLRv1vIVq+:sPsJcuilXN4qLqEIH7sTrvIr
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 3b87e1567d978709d0a5d8dd140eb0a27583d83865f05fe3cd5d4769d216e301
MD5 8ad86d280c88b51ba3f34a07fefb4c23
SHA1 a45cdf69e24e446280387d81f7bb5b2397378379
SHA512 b28fa1da5b9f9ece8231e9b771f681654cc9f47cf520aa3235e6560f898b29934733367bfa17d7350018e573eb20b6959ec33c8ce865be7fa3fd57ca5d820bb4
SSDEEP 12288:/7a3iwbihym2g7XO3LWURfh4CoicZRXPiqwIkFPqQKj8DkBIHCP2sEMLRv1vIVq+:G+gkEjfh4CoJXN4qLqEIH7sTrvIr
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 46b6af1eb2bcaa18fcc756187dfe1bda829f508ddfd83cfadb44adf91726c8ef
MD5 af72ff3895a31eea9f43dffd05b63339
SHA1 d41eed1548b8718dacff4f75f2cd9d8192eb0a1e
SHA512 b2691837916e8d0dd48f0ff935586680a41d52d7e3a728defbd08fb4d96db5fe551f2f139b0f0dce64f23bacab994dfccffc297942c326c2ed4b27fb7845c479
SSDEEP 24576:rBpDRmi78gkPXlyo0GxjrAXN4qLqEIH7sTrvIr:dNRmi78gkPX4o0Gxjsd5/IbsT0
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 5f4cad12faf15e0b1361853ae3fc229f2268f7ab9e6d2c32c7435f4694ec1542
MD5 3f730b0fe9916c8c4996d3881f01f87b
SHA1 f072702e7312189d1b603ae11a1c5e6b08f043de
SHA512 1286e4cad3999f347557d0059c72192df481d9f44e748405a45b7748ee04d5f5d2981fe58c42ad91e43f61248cbd7deac417d097cd6770d7d6fcc0aef8847553
SSDEEP 12288:VfC6Aj+TN5uixZN+8rKhUdTC/wE1MD0Ca5ZIXVicZRXPiqwIkFPqQKj8DkBIHCPQ:tLOS2oyPIXVJXN4qLqEIH7sTrvIr
MD5 SHA1 SHA512 SSDEEP

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 76887eb42c9187d7f4af11a8e625c460bf5c2b9453c8cbe170c31fd362b0aac3
MD5 b091ff9a13ad837becdbdd694957a718
SHA1 2368c000946629897ff68fc3d80db9cd259ce638
SHA512 fbac38b1bd5a4ae0d79a520291028ac5afc4a8d4e47c86913ed78659ffcca52bb85d78396015ab5880bca0d2b91dad770b54442bdf24940f15fb2f113e198cf4
SSDEEP 12288:tx4cZRXPiqwIkFPqQKj8DkBIHCP2sEMLRv1vIVq+:txLXN4qLqEIH7sTrvIr
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 7042449afc60aa8ea0eb2c9a936b719a5e86789a2fb4317ac82b365f662a76de
MD5 5ed91ee256c932134685718aaefc427c
SHA1 bc708c7646f3291b932d10a62a5a7846c1d89587
SHA512 4d1d37e95c2f75d0275fe7f7c5aaa16003e20f719583f84f0b0680863d8d6d2be83e8d9e69b4e7f1b4b303a25bda10304f0348d6f73dda8ee405a8b0a72edec6
SSDEEP 12288:aeBNUbTVO86UTcZRXPiqwIkFPqQKj8DkBIHCP2sEMLRv1vIVq+:aJIUKXN4qLqEIH7sTrvIr
MD5 SHA1 SHA512 SSDEEP

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 17a87f7ea2fc1febf793804f19751da2758747e15a9b07f19f0599d7bc5fd7ac
MD5 94ea3cb3bd6a59811c48a71dbdcfc1e3
SHA1 ef5f1ab1a33f28219c849d409b3f6ff457eefad6
SHA512 99dc6536201c9cbd72b18bf2430dc5d4157ad22b76230b2530c1e7469f297bf64b92deba68d33eb4e7fe88b6de185103fa488135870d55c263fb51bab224dae5
SSDEEP 49152:NQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3TH3:NQvGAdlCEL8c/yRNw5Cd0bs
MD5 SHA1 SHA512 SSDEEP

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 729d6c2e925683cae43abd5163d4b392b0219c1f8fd413ad46da8a02de2d61ea
MD5 31904eb5448655d46df4b1d958102571
SHA1 754bd18977476e76b44ee8513756a760d3637e26
SHA512 747194715ae62ff5f1180a49a062c81c362978bf5364a2623ba4a48257cce8df5bd0f692820b306b75aa0afc5b9e30970d98d0db71374603923550b50490f9ec
SSDEEP 12288:mAwSfxL/2Dc3ODLLmt0LDQewsAjdcZRXPiqwIkFPqQKj8DkBIHCP2sEMLRv1vIVZ:7HewsAjoXN4qLqEIH7sTrvIr
MD5 SHA1 SHA512 SSDEEP

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 44f3c092613c6a9f5451c89a12b55752c6e53d0f88afb81df5bf9af5aa1ec4d9
MD5 4865e082a72c4b60844c2c4239995f9b
SHA1 bbdeea5de7b9ecec427dd677e775d0b0ac54d432
SHA512 4f46ee9e06198f7934f32503ad4636b79e95f7989972644e95caee10b1c333ce7393118debd1cfd238f5db04f4c37eef18f7ddb1a5fac4e5031547d7e7aa9fc1
SSDEEP 196608:eUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHw:eUEtQevvqc2W1cpV2EI32w
MD5 SHA1 SHA512 SSDEEP

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 5a8e91c6c58ece0e6d2f2b6e939efac33f3fb96c1f473c76ba6c1b4c360272b5
MD5 01b4321cdb23ba2f4ac5ea0b66a432b1
SHA1 184e042cab92a2d118f9ed60fa1075ab34a06132
SHA512 996ad503486bedd00a1edff11d5d9a9b688c10f40524436159225450c1be86d73cf76394908ecfd42d4d36a974a5f68f6b50b87f8222a03e55d713da5456d6aa
SSDEEP 49152:kCbRquA/m2yL5zTfFiV+XenmE3/zId5/IbsT0:toquVjnmZ0bs
MD5 SHA1 SHA512 SSDEEP

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 11e76935b5598ebd4e7e1d67f647224a54006d977a0e4df1dad9ccf9bdfd1264
MD5 01cac903b5944ed2efbf839ebf676b0b
SHA1 7139f0401639f1e2ec5b02a03fe04aeac5f2a8cf
SHA512 565c461d1480aa766c713cf5c308fee5dbe311e55ec13db5839305ff0aa844d00dc85f567f92bcc9ce0974db311b46e7dd5ca66851a2530226102343f42b9596
SSDEEP 24576:KAhGLJIFoiwtA5l7S535XN4qLqEIH7sTrvIr:KAMyFoiq5pd5/IbsT0
MD5 SHA1 SHA512 SSDEEP

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 c96555b73caafcc26456bd8bb975ae20f30e28fe666c96609ea3b9b2680c0758
MD5 f2139dabffeba1e761e82ef6f21ce65e
SHA1 31a1701e87cfe390de929887a07cd303193c99ea
SHA512 231ef4a494a0f1ba92c57b292067695ca61366db4c9a3aa7fda408ea7a91bfcacec69faa127c099bb63b2c4f6e0297f2dd14f3147ee6fca61a420050bd8113f0
SSDEEP 12288:bmw5HEjsChNnBFgl0WDm+COcZRXPiqwIkFPqQKj8DkBIHCP2sEMLRv1vIVq+:6wu+OWUXN4qLqEIH7sTrvIr
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 a63f41fa403d17c98b23ffda95fd4b3965c04aa3270e1f494e60a844de807915
MD5 4a8ff4b02a53a9e55b8bd6e16a746b00
SHA1 892556db2bbe88da2195cea3abec327c7d701f51
SHA512 fcecffa31d84564e78b2a64ed8fba645824ba595528abf75f57ba1343cca6a6fb00bef7ed7d2d78a50c7d13184be5809f87b51d8f8d8fa44721b166f18d86089
SSDEEP 12288:e3Z1IyNcZRXPiqwIkFPqQKj8DkBIHCP2sEMLRv1vIVq+:OZuPXN4qLqEIH7sTrvIr
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe
Size 4.8MB
SHA256 03ad0e5d846ec4031d5d7d918da31deecf0af26b3df4dc1f73ad72e62aac8f52
MD5 8f8428115fc1dc6389721472fbf33b28
SHA1 0c270ac54e0991c865f1579f415e505ee33f5232
SHA512 6bdcada5794e2da180681822a641709803c44883598f5e231c5f79f04cb3357801853d26c24914c1b1998a8be0bc4b6d19a9c424bef07caf438146214de4ce61
SSDEEP 49152:9j8f3jtqiCLg9LK2hIOR+k9jdAsizqxSiZ4K5MZqkL92c6nkdmbDfiIerM1R6ZPK:mrZ4K5M+XDfiIewG+x6xZ14y0bs
MD5 SHA1 SHA512 SSDEEP

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe
Size 4.8MB
SHA256 6862bc4b106b9250b4e90f73d9f1e206c62be9fd9ecb4dd2e2132eb3f9d29cfb
MD5 23dc64c3f5e967f657f5af1b02660b02
SHA1 c7bfaeaf86b5e275aba076d62f3bf4d2b082702e
SHA512 1503e8a389e01c870b194f4246e9968da69e93db3df892b25096e2d955c2c9e1384beec2f215f8359dcd443ceb8eab760bb2f8187dcfa8540a6465bcb9a45fca
SSDEEP 49152:Pj8f3jtqiCLg9LK2hIOR+k9jdAsizqxSiZ4K5MZqkL92c6nkdmbDfiIerM1R6ZPK:4rZ4K5M+XDfiIewG+x6xZ14y0bs
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe
Size 2.2MB
SHA256 8b6543cdefe94105255757e8ebcb11ea82f5d94d2637210cc6b817f1ca74c744
MD5 093c3e7d80d266e4934c1a9c32218713
SHA1 cab7982701637153ecd996ae9ce5f965760f0254
SHA512 da66baf147f91ecb48b1ae904f415be8794422331431bc0aba6ae94ecea6cdb3fc93f6bfe60109dec8b920e77cc1de8a4f1f1ec664e05d8f4e0f2b7ed7103bb8
SSDEEP 49152:gfzabJ8llj+SWWi2mkx+X+di5d5/IbsT0:hui2W0bs
MD5 SHA1 SHA512 SSDEEP

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
Size 2.1MB
SHA256 906e61b4831b0f20a2ef545dcc1d3c1868fa8667199d249ee808c24f58c99443
MD5 7fd38ba65bb97d49cf3ff72cbb93c83e
SHA1 5716978e73d12237f2537831e6964468b84c154c
SHA512 94b49eeee737c2a02f4dd3d8e63a5a60e6e4a7c961c16225cdb42e6c9c3d3c2a14bf28eee4e6b85237ee227782f74a53a0499c1cb095851f85253dfae5bff933
SSDEEP 49152:0a/3xXBSZ4K5MJ1LvTMxbfsYBYSgxu9+fw4TSd5/IbsT0:2Z4K5MJabfsYN10bs
MD5 SHA1 SHA512 SSDEEP

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe
Size 1.8MB
SHA256 bf89ea70489711374bc8384d83fed64e957fc23429c8bab095998d0cc72a4672
MD5 123ac5b03ca5b3ce5cc41ed39755aae4
SHA1 4ef460344cf692cb0c40bfab9c3fa832311ebf0f
SHA512 ddb5b32356301c0ad938277679a8adfbff36ee925c2ecc575ea6fe3518e743334b7e1a29c0861e7d6266f113c364d834257bcaf9d241c10cfd0c7d30a84af1b1
SSDEEP 24576:WgNJw85yUKzDu/9gKPlfLO8C49BgKGXN4qLqEIH7sTrvIr:WgNJtUzDu/9gKPxHC4Ed5/IbsT0
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 1.5MB
SHA256 cfa3916664119bb09a13f61583727bd03cb07f09216c9f98e7e91a48246c0814
MD5 31a07591f5e86b192836f66ec82d5181
SHA1 172facbd8191cb7c947c6161c4cdc68da01f9b37
SHA512 f2a6ae674924b7ac851580f7f8bdb5016f2653bf7e6b4080a2cddda0f54feb9c9262d4b7bcdc7d87e5a1936a2c0f52c688e4d234658a97e9aca14799fe74ff46
SSDEEP 49152:UOBynH1wM+v6UJxLQd7BHjdfad5/IbsT0:Yn4LQd7Ly0bs
MD5 SHA1 SHA512 SSDEEP

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 b5a5b47496aeb43254b7b17772cf202a85199212fadbdbc01d91baed57aee362
MD5 7b15b2ce7a0f3796aab68da6e6463642
SHA1 9a88b6080e40020d4903b8e2defb7c23b3ec0e54
SHA512 9dbc6d4c5792d160129302ca69db19e637a3065a5245386dd9d95b87a7fc22f241c2be0d80705a3991bed73f73704a1e952bf5c7f0d3a0583f6e728194dfe34c
SSDEEP 12288:qgcZRXPiqwIkFPqQKj8DkBIHCP2sEMLRv1vIVq+:qDXN4qLqEIH7sTrvIr
MD5 SHA1 SHA512 SSDEEP

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 c1d34d6a9413c0ba4d897b69953641665629995d8754c5f4fa575a1776f1b10a
MD5 38b7debc72121b83f0d2b9dbfa1d750a
SHA1 4d98e3055e6c3f6739f0a3ce6ed7227260c5362f
SHA512 b15e2baab790b2dc4f8d877ce97423111707ee1556f2fa0c5b4591c6d5192af1cbb8787a06d220b8c37dbef5373683be0f8453ff377bc4618c95d6ab4c5e760f
SSDEEP 12288:Y5cZRXPiqwIkFPqQKj8DkBIHCP2sEMLRv1vIVq+:YcXN4qLqEIH7sTrvIr
MD5 SHA1 SHA512 SSDEEP

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 d8e629d8f7dfcec20a3987b57261dd13e8b3df6168e0b4716f91e828d4d47636
MD5 88387ced6e67c431a08d924b83149ff1
SHA1 4cd0304be01dc5e0afcf0754b6b0930addddec78
SHA512 9ea549bfd6d1957dc49f234851de5fd73e21ed76dc4c6ea027ee9d499f7a87fe6c5654038052af8b0cf7e9d685d738d15e50b4e5c9607ca74122e9bde59aa80a
SSDEEP 12288:CbcZRXPiqwIkFPqQKj8DkBIHCP2sEMLRv1vIVq+:CiXN4qLqEIH7sTrvIr
MD5 SHA1 SHA512 SSDEEP

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 6edae9feffb571ff266e4aad56784e20e687d1b5fc81b7b42e168478d1e89015
MD5 0edfb76171dc38546140ca5d1b3d14fa
SHA1 da8cca67c402d5caa02b24f27d7200d10aa73c6a
SHA512 4d7d568016383a496b5a69716befb20c474e6038aa3faa593f1f4c9e7805e98319c82bdc2b9c175cbdb7dde5b2e331b15548a0a873237233eceadc1776791c4e
SSDEEP 12288:qVScZRXPiqwIkFPqQKj8DkBIHCP2sEMLRv1vIVq+:MXN4qLqEIH7sTrvIr
MD5 SHA1 SHA512 SSDEEP

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 6619e80c106b7a6c0570958c8a33a89f45577215b08abdad6b6c63e2888c1079
MD5 ce59d06b320ef94f24675405d04c76ea
SHA1 5d48c70b565bf8900a1631df09155b582258c9fe
SHA512 a3c4a2abd8d99c409a4fa41984bf5178663fcfff57976461fc225b61f8a5487b306f8920fcc0f10467e2654a443546c3ed1e00c6f90412c8103b4c92342ead17
SSDEEP 12288:lKcZRXPiqwIkFPqQKj8DkBIHCP2sEMLRv1vIVq+:lBXN4qLqEIH7sTrvIr
MD5 SHA1 SHA512 SSDEEP

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 19aa3c0ece9a9717ac632484ed79a7107795e0d63118900101c506147e74b171
MD5 77a603881f08adecbd35013bc4d5af31
SHA1 d1f229251aceed24cc82c8f3ff7729c81412c6e0
SHA512 f3f05983469bc9f2525c70a27ccde03e28c30a4d26395e5e15dfff22c1a26823e1f5ece627116e184ab0556ddade89117da2b0d529efcb33ae70cc5929d7222b
SSDEEP 12288:1lcZRXPiqwIkFPqQKj8DkBIHCP2sEMLRv1vIVq+:1AXN4qLqEIH7sTrvIr
MD5 SHA1 SHA512 SSDEEP

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 f3e76ab85d34d0b473bfb67be6f1af8b0b04aef91fe27230a5bb518e6fe2552d
MD5 dfa04008a3e543d2d95b6bccfe1ffa5d
SHA1 e6dc506a545103ed4c69ac4f1a7b610234799001
SHA512 309ba49cfe5c7c69c4731ef8b5979b631c58cccc334b713a971d7aa5fd63af6d072e385f8809abb69fe77a6642570f6e69c17b95afc5a7b73daac1205e316626
SSDEEP 12288:KxcZRXPiqwIkFPqQKj8DkBIHCP2sEMLRv1vIVq+:KEXN4qLqEIH7sTrvIr
MD5 SHA1 SHA512 SSDEEP

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 974b60c1d25553a0291924e1e1471227bba0ab4dbfc16d8827325b5141f169b9
MD5 2114ca4757f20a5c74824cd0fdee7b47
SHA1 c00a429615ef4ec4c9db4dd6ba3fa60af295d571
SHA512 086840e77f121a80c2cbe24243164a8c26b70a96b1e41b5cd0a448deaabaf4af138ed8a7ca25ac0560bf1bf6b4b4dba239802a79ea8f5e770ca2ca8b584ae216
SSDEEP 12288:diZwbwzzFEoS2cPvyZcZRXPiqwIkFPqQKj8DkBIHCP2sEMLRv1vIVq+:gZMYzFVSO8XN4qLqEIH7sTrvIr
MD5 SHA1 SHA512 SSDEEP

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 2e51bbae2b759f5f582a377736752ab7030267993e6867c7666ee87a4d121362
MD5 9007a950856fd52e37f160f8f22f6b1e
SHA1 fb1204023b0e6ce421d95869c89485d61c4091f4
SHA512 44bfe763198c175b162b511858fc8d819e48169f9edba00d30c4949cd2a812b8ffb86a3e648ae2881f7869b6b7cd1ff6f3820506f75c0df6ce4b478d404f93df
SSDEEP 12288:U0cZRXPiqwIkFPqQKj8DkBIHCP2sEMLRv1vIVq+:UfXN4qLqEIH7sTrvIr
MD5 SHA1 SHA512 SSDEEP

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 3992e7dd32d9b08282a1b32e9b7c0ccba52f44034a9dbe9929dd72ca639aa5b5
MD5 da94e758940ea23f5b87f4d4adc30956
SHA1 7b0b98486e9e8c4729b11651de11620296257620
SHA512 811ca53a5b65b0a8df3d726adcaf4893ac5535b27bc94c0972325039d373f510fc93e3e05adcc45e15b6fe475babeba23ccf4cb65ad55268f8d628afed9d3c64
SSDEEP 12288:CocZRXPiqwIkFPqQKj8DkBIHCP2sEMLRv1vIVq+:CbXN4qLqEIH7sTrvIr
MD5 SHA1 SHA512 SSDEEP

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 e794451f806502b556ff0747007e5496be8cc3af12a0133f0b316701107481b7
MD5 a118ee082c59079bc4c7d9ea8b13b7e0
SHA1 47b6a7e9a8a815eecdcde91f121c817808253213
SHA512 3882ae8e51f0b555a70c325996d9ec5ccffa0d1147db6cf4b7e9a6f4dcf623feef3fb5de3f242c729f79443fa21936bcd227b5febd0edee1571b2b5fa256f58f
SSDEEP 12288:dyPz5L8NcZRXPiqwIkFPqQKj8DkBIHCP2sEMLRv1vIVq+:Uzy4XN4qLqEIH7sTrvIr
MD5 SHA1 SHA512 SSDEEP

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 264e530718292073bd841385477e724f3e5ad480d3d9772672b7d17f0b59a46a
MD5 cbceed0a7768126e45a0990b2e6ee2ec
SHA1 e03830ba96e56f6a95c7be42de3e756827afa16a
SHA512 8f386833cb221139811039bb9be27e03b8fe0013b8c446009e74a4a0b761523de5193bea5e058bffde6e31600ccc62b06ec16d9c0501b6169e3e0bc1f0e561b5
SSDEEP 12288:W0cZRXPiqwIkFPqQKj8DkBIHCP2sEMLRv1vIVq+:WfXN4qLqEIH7sTrvIr
MD5 SHA1 SHA512 SSDEEP

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 ccf2fb219a4158c885373b8eb7662fb68ecb7d160c8a163abce169509a5e9456
MD5 296edaee96fa8639a61e2b42a11136d4
SHA1 6666b767a2b25790a54682c9833e4174a4c2d4ce
SHA512 a716a614173e4cc61d6a7c76e939a8f949a00d7bf888f4de88747e41d8fcccd964f11d5115e3c64f414facef47288491da90fd70dba38c000f19e94bbee23bb7
SSDEEP 12288:u0cZRXPiqwIkFPqQKj8DkBIHCP2sEMLRv1vIVq+:ufXN4qLqEIH7sTrvIr
MD5 SHA1 SHA512 SSDEEP

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 a687aae7b8c73557c87f0164252f29cf2300f1a40ed0682c765244ac2780af79
MD5 8c1be228c988fdda3bb5e0175d142440
SHA1 805afdbf22a3fff7b314d7afaa263233cc65ee9c
SHA512 9965fba0225d1732ce19ace66098dd789e63dc403f67b83fdcdc1e23577214ea9fbef6bc1be53a915a4358359fbb15a3089bb35145e9482092937d1830f143b4
SSDEEP 12288:1yPz5L8NcZRXPiqwIkFPqQKj8DkBIHCP2sEMLRv1vIVq+:czy4XN4qLqEIH7sTrvIr
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 e29d595d06c0d589d5a3dc7536aa0a7c6bc6d1df9a8fd8b5ad2f5a94e1fb4483
MD5 5fa26cb25b1931d513ae38bb5c12ee99
SHA1 7fbeedd5c67d846f14345850646778bd2b8e28a1
SHA512 399dc10058dd9d4e4442539d44aa47858b0239c561fb7e1c271a51ae6a43d824440281356ca9459649bab9e45482b698b6d7fd385e6ba47f1f24f787abd6027e
SSDEEP 12288:HCd9QWYoaLHF3z0z04PDvhrcZRXPiqwIkFPqQKj8DkBIHCP2sEMLRv1vIVq+:iTJaLl3z0zDSXN4qLqEIH7sTrvIr
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 8d2c11df2eacebe6d686bbb9c1d26407ee6012b864803e3ffd25fd4adee4c558
MD5 b40b2949066a3919e18a5d37b842c04b
SHA1 207a4d9dedfa94d72332cb982ad6198cca5cb38f
SHA512 8f025b3152904f0aad85c76ce134ce5e748ab49d79a9396c1e355ded2e2c7283d22945bca6b0ef2120db6d8f96d8c3769a7f4b0d15f477668196bbcdca37c59d
SSDEEP 12288:Pi4e7MRdTfgwCHKy7GLbbdIvmcZRXPiqwIkFPqQKj8DkBIHCP2sEMLRv1vIVq+:P3Vd9CHKy7GZGXN4qLqEIH7sTrvIr
MD5 SHA1 SHA512 SSDEEP

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 3068e707a8e5eb545ab76bd352b00b49d11dde3cc246f8c17e5c713e1f5049be
MD5 621dacddeeee8385e5c24e93e5c7a766
SHA1 d558a0533947a5a7e98e9dbeaa0bca21e49b77d9
SHA512 3dd2080d07cfdc57cc52e88d420ef62ee7a39698e42ba2a13960ebc837f77bc2f13f73b21db810e163036309448bd739137902ccc36db69d97947bffe9929d18
SSDEEP 24576:HcP4mcvIjkGOxhKP2l71SNKbrh/8KBHXN4qLqEIH7sTrvIr:8P4m4IpOO67N8Kdd5/IbsT0
MD5 SHA1 SHA512 SSDEEP

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 54d28c8e8ab0b213427077cd3b2e21952f7a049256ec30c00d9cd1bebff91bb1
MD5 5cc02c4c57a7c2ebb09dfebbb615ae3e
SHA1 a79efbc95db728b0f6ca614464c681cbac977648
SHA512 c630239720da6aafe3a46d303b0612518512550af2e1d38d58ef7002af80cfc39eecb95f8e039f8a611e551d027c0883a86d4d93ca6ef458664e69b0d98e60bb
SSDEEP 12288:MFiq0S1cZRXPiqwIkFPqQKj8DkBIHCP2sEMLRv1vIVq+:MaSwXN4qLqEIH7sTrvIr
MD5 SHA1 SHA512 SSDEEP

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 4d916ed821dbd109033fa96912cd60faa8234770e0333ae54538d564b0e831bd
MD5 0513cb982ab1a92ac4e98756d042e6e5
SHA1 e7b0b9dbe9559fc149df3880a2c43f16dd3ba70d
SHA512 62c9114a0b1f5b3f5fdbbc6f9c3dc52085db55dd9ebc8e2f26a393000b7b5649b513d6acc754000a1b7fe35dd964a4811b0a998220eb935a7bdc80bea5bae126
SSDEEP 12288:2kcZRXPiqwIkFPqQKj8DkBIHCP2sEMLRv1vIVq+:2vXN4qLqEIH7sTrvIr
MD5 SHA1 SHA512 SSDEEP

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 b69b9c05c11d8f947f5af8a39e3be7b9b0dc127d5aff37f1124131a818b82055
MD5 3aa898d849b626519525b55011b18402
SHA1 94ede488fd498a3a3666044261fafe95100c3fd0
SHA512 b242c2c53dc2ef059cb87fd65a63a42badecae307fce769eb5b6b017361e1f21f8b015264d2a00a10ff7b53e2806fb9449da5f675dca00d3827cbd56c3389d67
SSDEEP 49152:4a0h2GEkuAe73q3pp46zwwQBd5/IbsT0:4a0hNYG4Jww0bs
MD5 SHA1 SHA512 SSDEEP

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 9952aa2c31f08f16cb1843436c37386dccdc0dd4aabf6ad0a893bfadc58e4a8e
MD5 4dea68fa19634ad30e224bede0f3ef72
SHA1 aaf7dc94766bbf65feca5f07327b2d0254537b81
SHA512 0a056b5fe85fdeb5f7711119ee6e01df4d48345ac1465ece6993930417ba7d23f2158baa38f0bcc3cce6007d85fe5263605f72105dfc5b68c45b8f76a1e0ee60
SSDEEP 12288:RhbHjfXJcZRXPiqwIkFPqQKj8DkBIHCP2sEMLRv1vIVq+:RhbHjPMXN4qLqEIH7sTrvIr
MD5 SHA1 SHA512 SSDEEP

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 6d929e56ef9c11014872469bde57e826726e606537c44e0396aaabbe8cf18920
MD5 7e6f88ca8ac7fe0a9418318d13852658
SHA1 7662f6ace9a4f90eca7dd9789d29318abab2d9e1
SHA512 3c5a0900e7b92d5125478e7795c6382e3b54b37c4164e4959f86de157d609d11616cbfcd83e3a5456e1f19eae413ec4ef0d29219f94de11e9fbd041e4bed95e4
SSDEEP 24576:r3YgnJcRTk4yti+R5dpR/UXN4qLqEIH7sTrvIr:rIgnaTk46ppR/Ud5/IbsT0
MD5 SHA1 SHA512 SSDEEP

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 ab943601730b4f5850367452955156b33e04072f41076ff831964252441dc18b
MD5 3f5aafe6c361b48c8dedeb460ac1c1bb
SHA1 0bc75c6415590fe2943f503747e39e5d8a749803
SHA512 209db80d913962985574e754e250e07e1b0f6608c38393705062a64e3fd02082ee715e6b606d67c809d2beac61b4cc94f0da4a9ba77520303772dbff499648af
SSDEEP 12288:bYcZRXPiqwIkFPqQKj8DkBIHCP2sEMLRv1vIVq+:brXN4qLqEIH7sTrvIr
MD5 SHA1 SHA512 SSDEEP

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.5MB
SHA256 604b6a91ba7053168985d90488efb7195d390f9e313adc9a964d509d392b596f
MD5 c8bd8cb89629da278aff0081440dc50b
SHA1 4471f4b6bb52bce30be5bb1cacbd092dba821e90
SHA512 575590013d725ee19f40e1e6de746e5087daf0c80c4fad775e1e492f6fdd1a8dcf774e0dafb2590abf421fc5030fe2983799a2e7e03a0f4994bfe8c8ab2c6cb6
SSDEEP 12288:aObXA4LWOsvAYFTfcZRXPiqwIkFPqQKj8DkBIHCP2sEMLRv1vIVq+:LzL3UTOXN4qLqEIH7sTrvIr
MD5 SHA1 SHA512 SSDEEP

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 1b9ac01f8edefe9fba67b4e404049ae1a5655a666425d9a012e55977d0d15762
MD5 9f3af73df750ccfbd3165b717b101f3b
SHA1 2b855548c3f9892544db985750ce870d964ed292
SHA512 1c0a2f2e1623c5d8a09ba3faa66dbc695e616c8e2dbfa10b424ed231941e34a001bbbc498c69ea09a7fe31de07d48867f9f7a35e5b3c6aa8aea93ebefc091382
SSDEEP 12288:ppFtTOzcZRXPiqwIkFPqQKj8DkBIHCP2sEMLRv1vIVq+:TOqXN4qLqEIH7sTrvIr
MD5 SHA1 SHA512 SSDEEP

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 2df5735df9c9defa11fd5bdd16faf2093f506f1bdbfb80cf1879e68d63770a2b
MD5 1a2de7f6e62ae9512bbde437fed793f2
SHA1 7cb304eef37839906c11b9034098e9e632dd11da
SHA512 46860a9726267f1f376ed7a603a0e4503b4b6799c9dabeb9313c9fda28ce71be94af7cd25a8def23a4183411a0e49aee46b28e8dec1a4f413dd5f6b46a9cedaa
SSDEEP 24576:Z7NM9YmZqmWMUkPjZM48Mv6bEhsfXN4qLqEIH7sTrvIr:Z7cBWMpPjN8DbEhsd5/IbsT0
MD5 SHA1 SHA512 SSDEEP

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 d3356226cadba29806e6495fe647a720c0b8a38fa6a1b7225a6c19028a67ff34
MD5 f00042dfe1c3185b36ca158fec7b9e8a
SHA1 aebf2f9df4527911304d5d0ae40b4c7d26877e10
SHA512 0897c563c11f60f50534b4bf8b9e93be390d8f5087da23b02fa5ccb578dc9b0058dac4e468c06b098cff817497dd7af3e3b260bd1e4681c62bd3cb46a2aeba69
SSDEEP 24576:9W6BApg2YuyuNDYTabvcRvNYf8km1VXN4qLqEIH7sTrvIr:9F2YuHNETovcvNYf8km/d5/IbsT0
MD5 SHA1 SHA512 SSDEEP

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 268592bd68af61055e7aa8a3cc8dbb4549ec98c10b94dda95366cd0d46d214b8
MD5 73b6fb5108172b87ab648fe796dc57e0
SHA1 5426684f343df44eb9af269bab9fd9692623d1d3
SHA512 1caea00e90d974d55d749e1e3eb8f8cd8bc5a5326a55c09ed0964f5049dfb3ca96027d0f94ba7878204fba44f645d456dec93ad131229af8fe9a37d8da537802
SSDEEP 24576:kAFs06+Omlf3NXEbToGXN4qLqEIH7sTrvIr:pFs060lVXuhd5/IbsT0
MD5 SHA1 SHA512 SSDEEP

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 2ccdb8ded860d56ba6a351892a88dbac41699de925b054e465887128632fce09
MD5 b96709805c7d6dd3938b48694e50147d
SHA1 d0bba96575b7443a0bd3198bdbf88f8e0005fd33
SHA512 99c8f2855986cc25541c880cb510d301d8ff593b9796ed27174d69a73289781eeb728dee245e20b278e96025ff8b3121dfbc013ca8382bdfac90ebb9a86466b3
SSDEEP 12288:jCJnJ5D3VkrjzxUcZRXPiqwIkFPqQKj8DkBIHCP2sEMLRv1vIVq+:+JnJ5D3W3hXN4qLqEIH7sTrvIr
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 c7de7b988479a3d09d96c492a44e7a008afd3593c9a67d00279b1c1a1fc3c1d3
MD5 cf1401a62263899694f9a7994146fde7
SHA1 a893343428669bf8f97730096ef2ab31beacb111
SHA512 add405f5e6ad8bf8e5b07056c9fe4408c7a5ff81e07ae495de52cd45ab65effed1aca54732cc5d7334de8e4d8cf943ab09576e0f0a23345b21a7a42d51d2e4aa
SSDEEP 24576:ZEPohm6/7IIXdwcXrif7qQncjlP65i3VuUXN4qLqEIH7sTrvIr:eo06DIKdwc+eQnSt65aVDd5/IbsT0
MD5 SHA1 SHA512 SSDEEP

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 5c9c57c56f6ee1d29a37bc16a22c8a2e3b59761e2dceef76beb0b9a7b2cd0102
MD5 cb134d5f27bf6374bd31532ad4390fdf
SHA1 0bfa26caf840145f2ebad38635226648927d384b
SHA512 ebc6defab454c383433a607956f6b5889d7c73ac95ba199c6873256a18bb4a8ac720f5d1d817e9fff056c18d8e36dd414a372caf9ac727c47f19580574cfd73e
SSDEEP 12288:pEP3RFOcZRXPiqwIkFPqQKj8DkBIHCP2sEMLRv1vIVq+:6FtXN4qLqEIH7sTrvIr
MD5 SHA1 SHA512 SSDEEP

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.3MB
SHA256 cdcecc2b22dfefa1a05b52d66e51e2cde3478366a4dee28fca0107e1a05ab2db
MD5 fad1c3859c22e627e8dbcf6dd34c9323
SHA1 1e4dd6ef63deff3fdfb7cada03785bcd8ad02b9e
SHA512 02587e4437ec761a40c1d8edf38fb19300a36b5e3635c618c556bbf8e62a3b1b1747b1aad1a2dc5d6c4832cdf03f4b70dfeba8e96e74654c9378415d2c797755
SSDEEP 12288:tjky5cZRXPiqwIkFPqQKj8DkBIHCP2sEMLRv1vIVq+:tIycXN4qLqEIH7sTrvIr
MD5 SHA1 SHA512 SSDEEP

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 b6e4f1b6e954b251fd1e904cad81d0e0049453cd261f8ba9842292314cd9fbf5
MD5 572d0847aaf6775ae8a9ed562cc7b984
SHA1 32198115b1a39373b894b2a3c32cff68895caa72
SHA512 5db21e0ae1a054c38b7774ad31dce771b804fdc485fe376e34b76c5b4acce806ffc7c974612c7603e58c448d41cc0b14e1c94301a6e21d8e073c2994603b20e4
SSDEEP 12288:PnjcZRXPiqwIkFPqQKj8DkBIHCP2sEMLRv1vIVq+:P6XN4qLqEIH7sTrvIr
MD5 SHA1 SHA512 SSDEEP

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 0c6280acfaaf85baec15a52fcb41431a7cfe7ded95c4bd2a1c276848b877fb4d
MD5 0213ee82e4485c36606ddca90ba42463
SHA1 6558ffcab719f5aed4b61924f10d48659264e160
SHA512 e85e338b23ded1b26033149659cc1ae57a7a460b8ecbf86e3353763c5311bf67f6d113497b9615f9d9e6f0731e7bf757dfa5f093a856fec10bc2e3977dea9298
SSDEEP 12288:ZLQZb3C97GYnZMv5zBcKY97MD3ccZRXPiqwIkFPqQKj8DkBIHCP2sEMLRv1vIVq+:xQ9MxZKdcz97w33XN4qLqEIH7sTrvIr
MD5 SHA1 SHA512 SSDEEP

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 07168d2b4478f007193f6bc27d7b9fb564572d33df4a9c658b30332be7c02e0d
MD5 490b248b5bc9bdc978069af7673f7d97
SHA1 22776eb53d533083131a867b60e4d0f1d7288e16
SHA512 c7cb682cd1ad1f850bb800baa823450755d7cbfc4e7796319b6067cc2ae35dc2d2fbd78b31ad23960c0ce2cd3bb1fb1df85a3c85e46b6668da115198f4f7b681
SSDEEP 12288:DyoKo2dRple9pdcZRXPiqwIkFPqQKj8DkBIHCP2sEMLRv1vIVq+:Dyoc/ApoXN4qLqEIH7sTrvIr
MD5 SHA1 SHA512 SSDEEP

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 06e79f78ca25ea86b33896178f79f0bda05f39e0ca728a81209410a725d1ad98
MD5 f5884035c69f39f3b78050b4843b1855
SHA1 06154db7cac98e0e47075108e2d4b15916fff6f1
SHA512 7c7f03882fb2d2b372649b904eabec0a1987a238deeaa2be715c22cf79984073f89746636744158622ead6f322450336823d4150158d7774168b085374a7390d
SSDEEP 49152:xWcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIKod5/IbsT0:p0zuNIk0bs
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 4044465e24264bbceda51b916fd7a892c89f8bc54e60a7aa18e11d1dd3942685
MD5 5f00db5314daa57e88b787637173ac8b
SHA1 dd151bdc030578cc3d59cfbfcaeb1cc35e2f486c
SHA512 1fb0fa324eefddbbc28dfe87942a2bd69b31fe57bd4105298e21cad1b6e73e90e67401e4ccd0dd39687de159bfaa570730f6c12303c9b05c1a8c315cdafe42f0
SSDEEP 24576:G1QT7EcpfxR+N5AWAz3ooiYtjMqbtXN4qLqEIH7sTrvIr:LTDxR+N5YzTfjMKd5/IbsT0
MD5 SHA1 SHA512 SSDEEP

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.5MB
SHA256 90f21000d5183db991d4d7fa706d3d531c0dd09abcc177e27392a846f33618f0
MD5 ea90dbfd34c7703400c3a1aa693efc8f
SHA1 aaf55801b32007dde2493f4d31ad066f21693e3e
SHA512 f4b130fe5231b4abb05663e8bbf0f3b29aef03c1b716236ec9ffd016ee001e95b397c224c186303edcc4095424c3e2add9627a1c0b1724ced19ca6cba71f74d5
SSDEEP 24576:bTMdOz0FFS+4mSLZXN4qLqEIH7sTrvIr:J0K+4mSLZd5/IbsT0
MD5 SHA1 SHA512 SSDEEP

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.2MB
SHA256 06045d26f80cd73877f7f60b8d0f41a1163c3891f0d168d5294c8386f9659235
MD5 7b58d6713d4b0cb32b68aec28b027c7d
SHA1 7a99c9780f0ceecebe327cf3c45674306bb9d04e
SHA512 3f3cb28acfbb426ba7d4001ec0f652b4cf3dee16c4d31aa61f49b2bac55bed4a15f2c5b10781af3c75148a526200bbacd0ac4fdd7b59b8796d0e7e5c93b42c56
SSDEEP 12288:J4dfcZRXPiqwIkFPqQKj8DkBIHCP2sEMLRv1vIVq+:COXN4qLqEIH7sTrvIr
MD5 SHA1 SHA512 SSDEEP

Submit Download

office2016setup.exe

Path C:\odt\office2016setup.exe
Size 5.6MB
SHA256 6ee44504315f374e635f27151d9954429b909229d019d0d651c9e81595ca3e8e
MD5 e7d35b79a4c7c9d61cc114fc15bd8e6b
SHA1 959bb600baa3a02f5a462fa31dcd052e5fc4ef99
SHA512 02265f684518175336714ebe549a9cc41e1fa8279b6f9c2ac295afaad5727ce9cad9b67d1bf8ae722dd7d4909874e66b1548e61f74368731f00a1d3bdccce06a
SSDEEP 98304:47M701RgX4iuSl1DtlEq81xZPGnzURnBh6gGL/QmvD/cTwY2h3F00bs:yM7pTXexZPGzURnBh6gGLF+W3a
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/552-220-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/552-160-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/552-150-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/776-265-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/776-274-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/868-260-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/868-251-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/912-66-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/912-64-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/912-71-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/912-134-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/920-222-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/920-235-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/920-234-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/920-230-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/1004-174-0x0000000140000000-0x0000000140170000-memory.dmp

Download

memory/1004-117-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/1004-109-0x0000000140000000-0x0000000140170000-memory.dmp

Download

memory/1396-208-0x0000000140000000-0x0000000140182000-memory.dmp

Download

memory/1396-217-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1396-276-0x0000000140000000-0x0000000140182000-memory.dmp

Download

memory/1640-178-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/1640-250-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/1640-188-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/1676-26-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/1676-33-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/1676-92-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/1676-27-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/2328-37-0x0000000000D90000-0x0000000000DF0000-memory.dmp

Download

memory/2328-44-0x0000000000D90000-0x0000000000DF0000-memory.dmp

Download

memory/2328-47-0x0000000000D90000-0x0000000000DF0000-memory.dmp

Download

memory/2328-52-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/2328-38-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/2344-167-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/2344-237-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/2344-175-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/2772-123-0x0000000140000000-0x000000014014B000-memory.dmp

Download

memory/2772-129-0x0000000000BC0000-0x0000000000C20000-memory.dmp

Download

memory/2772-191-0x0000000000BC0000-0x0000000000C20000-memory.dmp

Download

memory/2772-186-0x0000000140000000-0x000000014014B000-memory.dmp

Download

memory/3180-278-0x0000000140000000-0x0000000140166000-memory.dmp

Download

memory/3180-285-0x0000000000650000-0x00000000006B0000-memory.dmp

Download

memory/3236-136-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/3236-201-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/3968-93-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/3968-95-0x0000000140000000-0x0000000140159000-memory.dmp

Download

memory/3968-100-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/3968-158-0x0000000140000000-0x0000000140159000-memory.dmp

Download

memory/3968-164-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/3988-19-0x0000000000520000-0x0000000000580000-memory.dmp

Download

memory/3988-12-0x0000000000520000-0x0000000000580000-memory.dmp

Download

memory/3988-20-0x0000000000520000-0x0000000000580000-memory.dmp

Download

memory/3988-13-0x0000000140000000-0x000000014014A000-memory.dmp

Download

memory/3988-75-0x0000000140000000-0x000000014014A000-memory.dmp

Download

memory/4068-194-0x0000000140000000-0x00000001401A3000-memory.dmp

Download

memory/4068-263-0x0000000140000000-0x00000001401A3000-memory.dmp

Download

memory/4068-203-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/4080-78-0x0000000140000000-0x000000014016B000-memory.dmp

Download

memory/4080-83-0x0000000002260000-0x00000000022C0000-memory.dmp

Download

memory/4080-76-0x0000000002260000-0x00000000022C0000-memory.dmp

Download

memory/4080-90-0x0000000140000000-0x000000014016B000-memory.dmp

Download

memory/4080-87-0x0000000002260000-0x00000000022C0000-memory.dmp

Download

memory/4080-84-0x0000000002260000-0x00000000022C0000-memory.dmp

Download

memory/4280-247-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/4280-240-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4480-0-0x0000000002060000-0x00000000020C0000-memory.dmp

Download

memory/4480-410-0x0000000140000000-0x0000000140125000-memory.dmp

Download

memory/4480-2-0x0000000140000000-0x0000000140125000-memory.dmp

Download

memory/4480-63-0x0000000140000000-0x0000000140125000-memory.dmp

Download

memory/4480-7-0x0000000002060000-0x00000000020C0000-memory.dmp

Download

memory/4564-299-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/4564-291-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4568-51-0x0000000140000000-0x0000000140237000-memory.dmp

Download

memory/4568-50-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/4568-59-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/4568-121-0x0000000140000000-0x0000000140237000-memory.dmp

Download

memory/4868-146-0x0000000000520000-0x0000000000580000-memory.dmp

Download

memory/4868-207-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4868-214-0x0000000000520000-0x0000000000580000-memory.dmp

Download

memory/4868-139-0x0000000140000000-0x0000000140135000-memory.dmp

Download