20535dbedfa36a95bc99d509a6cf9782e9d385deb8fb16b7f170882ea9ec88b1

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
04/04/2024, 11:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-04-04_9a74dec1e7c1c3a007b4378dffec7483_ryuk.exe
Size 1.1MB
Sample240404-ngvfpaeb24
SHA256 20535dbedfa36a95bc99d509a6cf9782e9d385deb8fb16b7f170882ea9ec88b1
MD5 9a74dec1e7c1c3a007b4378dffec7483
SHA1 4786c303209bc4659a786228421a11b99b659f89
SHA512 5f1c56c44732f1ac4517cb6cea8cf97ef1b48bdabe0042d6872bf36126277f7ae10a2b35fd77846340e5aeaf22c47b72170a429e20e9b12ae12070da0ec2ceff
SSDEEP 24576:OSi1SoCU5qJSr1eWPSCsP0MugC6eT38NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:OS7PLjeT3gDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
5048	alg.exe
3580	DiagnosticsHub.StandardCollector.Service.exe
60	fxssvc.exe
3428	elevation_service.exe
4308	elevation_service.exe
3432	maintenanceservice.exe
1744	msdtc.exe
4972	OSE.EXE
1696	PerceptionSimulationService.exe
2564	perfhost.exe
2880	locator.exe
840	SensorDataService.exe
2480	snmptrap.exe
2532	spectrum.exe
3408	ssh-agent.exe
4424	TieringEngineService.exe
4500	AgentService.exe
736	vds.exe
876	vssvc.exe
4732	wbengine.exe
2296	WmiApSrv.exe
4000	SearchIndexer.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in System32 directory 37 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\vds.exe	2024-04-04_9a74dec1e7c1c3a007b4378dffec7483_ryuk.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\locator.exe	2024-04-04_9a74dec1e7c1c3a007b4378dffec7483_ryuk.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2024-04-04_9a74dec1e7c1c3a007b4378dffec7483_ryuk.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2024-04-04_9a74dec1e7c1c3a007b4378dffec7483_ryuk.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2024-04-04_9a74dec1e7c1c3a007b4378dffec7483_ryuk.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2024-04-04_9a74dec1e7c1c3a007b4378dffec7483_ryuk.exe
File opened for modification	C:\Windows\system32\dllhost.exe	alg.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2024-04-04_9a74dec1e7c1c3a007b4378dffec7483_ryuk.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2024-04-04_9a74dec1e7c1c3a007b4378dffec7483_ryuk.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2024-04-04_9a74dec1e7c1c3a007b4378dffec7483_ryuk.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2024-04-04_9a74dec1e7c1c3a007b4378dffec7483_ryuk.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2024-04-04_9a74dec1e7c1c3a007b4378dffec7483_ryuk.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2024-04-04_9a74dec1e7c1c3a007b4378dffec7483_ryuk.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	alg.exe
File opened for modification	C:\Windows\system32\AgentService.exe	alg.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2024-04-04_9a74dec1e7c1c3a007b4378dffec7483_ryuk.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2024-04-04_9a74dec1e7c1c3a007b4378dffec7483_ryuk.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2024-04-04_9a74dec1e7c1c3a007b4378dffec7483_ryuk.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2024-04-04_9a74dec1e7c1c3a007b4378dffec7483_ryuk.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2024-04-04_9a74dec1e7c1c3a007b4378dffec7483_ryuk.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\dac9d7088ed1090.bin	alg.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2024-04-04_9a74dec1e7c1c3a007b4378dffec7483_ryuk.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2024-04-04_9a74dec1e7c1c3a007b4378dffec7483_ryuk.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2024-04-04_9a74dec1e7c1c3a007b4378dffec7483_ryuk.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\System32\alg.exe	2024-04-04_9a74dec1e7c1c3a007b4378dffec7483_ryuk.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2024-04-04_9a74dec1e7c1c3a007b4378dffec7483_ryuk.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2024-04-04_9a74dec1e7c1c3a007b4378dffec7483_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2024-04-04_9a74dec1e7c1c3a007b4378dffec7483_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2024-04-04_9a74dec1e7c1c3a007b4378dffec7483_ryuk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2024-04-04_9a74dec1e7c1c3a007b4378dffec7483_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	2024-04-04_9a74dec1e7c1c3a007b4378dffec7483_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	2024-04-04_9a74dec1e7c1c3a007b4378dffec7483_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\106.0.5249.119\chrome_installer.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	2024-04-04_9a74dec1e7c1c3a007b4378dffec7483_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2024-04-04_9a74dec1e7c1c3a007b4378dffec7483_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2024-04-04_9a74dec1e7c1c3a007b4378dffec7483_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	2024-04-04_9a74dec1e7c1c3a007b4378dffec7483_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2024-04-04_9a74dec1e7c1c3a007b4378dffec7483_ryuk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	2024-04-04_9a74dec1e7c1c3a007b4378dffec7483_ryuk.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2024-04-04_9a74dec1e7c1c3a007b4378dffec7483_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	2024-04-04_9a74dec1e7c1c3a007b4378dffec7483_ryuk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2024-04-04_9a74dec1e7c1c3a007b4378dffec7483_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	2024-04-04_9a74dec1e7c1c3a007b4378dffec7483_ryuk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2024-04-04_9a74dec1e7c1c3a007b4378dffec7483_ryuk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2024-04-04_9a74dec1e7c1c3a007b4378dffec7483_ryuk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2024-04-04_9a74dec1e7c1c3a007b4378dffec7483_ryuk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2024-04-04_9a74dec1e7c1c3a007b4378dffec7483_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2024-04-04_9a74dec1e7c1c3a007b4378dffec7483_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdate.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2024-04-04_9a74dec1e7c1c3a007b4378dffec7483_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2024-04-04_9a74dec1e7c1c3a007b4378dffec7483_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	2024-04-04_9a74dec1e7c1c3a007b4378dffec7483_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	alg.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2024-04-04_9a74dec1e7c1c3a007b4378dffec7483_ryuk.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001a240f6c8286da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cb63536d8286da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9923 = "Windows Media playlist"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e103136d8286da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bd74df6b8286da01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007c34416c8286da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000be36226c8286da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005aae9f6d8286da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e801326d8286da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
3580	DiagnosticsHub.StandardCollector.Service.exe
3580	DiagnosticsHub.StandardCollector.Service.exe
3580	DiagnosticsHub.StandardCollector.Service.exe
3580	DiagnosticsHub.StandardCollector.Service.exe
3580	DiagnosticsHub.StandardCollector.Service.exe
3580	DiagnosticsHub.StandardCollector.Service.exe
3580	DiagnosticsHub.StandardCollector.Service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
656	Process not Found
656	Process not Found

Suspicious use of AdjustPrivilegeToken 41 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2816	2024-04-04_9a74dec1e7c1c3a007b4378dffec7483_ryuk.exe
Token: SeAuditPrivilege	60	fxssvc.exe
Token: SeRestorePrivilege	4424	TieringEngineService.exe
Token: SeManageVolumePrivilege	4424	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	4500	AgentService.exe
Token: SeBackupPrivilege	876	vssvc.exe
Token: SeRestorePrivilege	876	vssvc.exe
Token: SeAuditPrivilege	876	vssvc.exe
Token: SeBackupPrivilege	4732	wbengine.exe
Token: SeRestorePrivilege	4732	wbengine.exe
Token: SeSecurityPrivilege	4732	wbengine.exe
Token: 33	4000	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4000	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4000	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4000	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4000	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4000	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4000	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4000	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4000	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4000	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4000	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4000	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4000	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4000	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4000	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4000	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4000	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4000	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4000	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4000	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4000	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4000	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4000	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4000	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4000	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4000	SearchIndexer.exe
Token: SeDebugPrivilege	5048	alg.exe
Token: SeDebugPrivilege	5048	alg.exe
Token: SeDebugPrivilege	5048	alg.exe
Token: SeDebugPrivilege	3580	DiagnosticsHub.StandardCollector.Service.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4000 wrote to memory of 2636	4000	SearchIndexer.exe	109
PID 4000 wrote to memory of 2636	4000	SearchIndexer.exe	109
PID 4000 wrote to memory of 2104	4000	SearchIndexer.exe	110
PID 4000 wrote to memory of 2104	4000	SearchIndexer.exe	110

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2024-04-04_9a74dec1e7c1c3a007b4378dffec7483_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-04_9a74dec1e7c1c3a007b4378dffec7483_ryuk.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2816

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:5048

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3580

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:3992

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:60

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3428

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4308

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3432

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:1744

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4972

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1696

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:2564

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:2880

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:840

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:2480

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2532

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3408

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:776

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4424

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4500

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:736

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:876

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4732

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:2296

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4000
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2636
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 916 920 928 8192 924 900
  2⤵
  - Modifies data under HKEY_USERS
  PID:2104

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
Size 2.1MB
SHA256 993c882c38a30fec28dce843b801312d494560c31bbd18008ad5a38d20335aa5
MD5 f9194a97d8400556ded238592eceebb2
SHA1 7a0c0f0129521d13df3e455930cb12cb2fa5a9ad
SHA512 f0e0d4f2fc317da3814c9eeeb25e3aacc9ce3f8ee5c4b6196f0bacbd0a8c6aa8e8f25a08f73808e4b6d74f41a7a399d391ebaa16a376dde0531c52c78f19b4ff
SSDEEP 49152:WuYk3H5koUXfTqkkYLO/W2buywzMbOX+T7z5NgDUYmvFur31yAipQCtXxc0H:WPfTqi90bgU7dG1yfpVBlH
MD5 SHA1 SHA512 SSDEEP

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 781KB
SHA256 af3feeedbc3352f8046d12c1a0ab89e090f44a943694e591d6b8e8fcb0b93027
MD5 6d123db2e0258e178079bcfa376b1fe5
SHA1 01e0be754910a3f8f6bfb17a67046ad6efb3d65e
SHA512 b103cf2f7861fbfd4ef5ab2bf8b32889c8e9438cc0cc791ec20ec789563616d5d5a79f450cc1e213fa4be20af027e0c64949f29e48b000c79391ea897e1f6a15
SSDEEP 24576:GPsJcuiU8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:Gwcu5gDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 93b0b8c426cda4c2fb106cab734640d62163ea98d3127614f54b448cb2510499
MD5 15ea30c34edbfb4120e71aadf6b08f6b
SHA1 d18bd913c4b316392478193ab6b0940897fda61c
SHA512 47df33c3961e5625e3a0f80c74e73862d6af68f8e4bd035832c171592537b1efcddb3ff7cbee57bc8ee6e0f4d61916ea7df8dc54a554ecb8d4b23f61655b5252
SSDEEP 24576:l+gkEVfh4CoI8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:MgkExSSgDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 f990ad2b72b06ab06a11ab01bbc284d895932ae51c8bc486477cef1b152e47b2
MD5 1866c239913681eadb19d762d5c2fb53
SHA1 f1b8a47ef0396c52e5bd711ba71650b1ec7065c4
SHA512 079d5aeb21077b7b925addebb8707da381bd8b6469215005a0a4823137258cb5858385db046b98019fddb86fd46508925ff23472d9377f48a170c3a1578618b6
SSDEEP 24576:UBpDRmi78gkPXlyo0Gxjrh8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:wNRmi78gkPX4o0GxjtgDUYmvFur31yA6
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 dd1d46465816cded3e0bd70eb84bddba2366b8411b4cb7b120b29fcff9b1a1d4
MD5 1262d464358a30742e0a008855b42cbe
SHA1 5a9eaae558221fecfbcc74add5457f15b5ffc5c2
SHA512 866950a7892ba258750078491a9a3e675d6f2a94544955210d22e5a7e90060008a42750de156411af98ffe73d0b4af0d902a143ad3f24da6e193fcc05d81bc67
SSDEEP 24576:ELOS2oyPIXVI8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:c/ylgDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 d0cd56495537239adf1019016919ca93ad710d84e24a72b5ad8c8ca023d4e419
MD5 208d748380fe1060a53aec084ad9a744
SHA1 0906bab2f7d9fd7a5d76139f666b941995802584
SHA512 e7cb54751746546c34663c2f5e3a9e45b3984807332829dd901e675ca332d02a4b7ce5c1ea32ef775b90e3316d8dc1bce72884497a7eaad2a366f7834e51d063
SSDEEP 12288:0fyFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:0fy8NDFKYmKOF0zr31JwAlcR3QC0OXxx
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 3b2d02cb9c24e32a9d8c454b871c5f1dd89010149c8dc4703346eaf67ab4d6e9
MD5 82b909e918e2e2b6c6e4a89ae1afabe5
SHA1 f8b2974729a0a35ac37d060dba2a1f48214202a1
SHA512 f3357a143481b531901d1163ec8d2849f88aa01e5e32e25da6b38763eb2ce2f8073aee38c757dadf292d5e08879628471c19fe581fe006c73014eb9be4a5bb86
SSDEEP 24576:AJIUb8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:AJIUbgDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 477b4c97f5dd6782789045df89cfe0f4f3c2d1589218d5a114122ffc3c0b42c5
MD5 39505255db35e77a2447674563669d21
SHA1 31e08f290ccda93cb5ec8a6b5c26e1ba713dbb74
SHA512 042d70f9ffce807f32d0f9ce0d950b6e6d800965a515ec3ac83de841e4a490f22ef4fc665e2969b70efceadfb9e6943e147bde4aae8a003309b427702bba58a2
SSDEEP 98304:fQvGAdlCEL8c/yRNw5C9U7dG1yfpVBlH:YvyEYc/y3w89UoiPBx
MD5 SHA1 SHA512 SSDEEP

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 0451d088949103fd1ce5b7e074f0e0ad860a14d9d241efdd26645df131d50345
MD5 4ad23944246afd6c173ac810840caaa5
SHA1 9cdd2862559122bc57e8966cb04f595eb8472197
SHA512 24e944035736b4c2f7d8324ad199cd558f96a083262754647dbbcb1de201b2cc2f3d748ee45e926022921f980d055c4c9f5384ac57133898e7ac609953343997
SSDEEP 24576:ydewsAj58NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:ylj5gDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 3acb72a6828c8cba0a98b34839a239f55802a52eb4624766fd679baee18b31e0
MD5 a63d46ea90bb332b8efa5c75df87f84d
SHA1 9acad55ab5ce8895cfef87e8b241d77d96354e19
SHA512 49ad55290b0926a5cd9142ad3bb743d75183ae8d0adf6bef0abefd21524ff92b6d437827fd64549eb575fa0758787a3928c39fac3c3b080a3b17015b5919147b
SSDEEP 196608:eUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJH4UoiPBx:eUEtQevvqc2W1cpV2EI324
MD5 SHA1 SHA512 SSDEEP

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 17024fa1ab15a5d27e1de014947e7582c539b3d166867269fe23c50997e8c40d
MD5 a5fa46cbbd57390c0643716ad0ee1216
SHA1 46cd2e55f89f1bd41ef99fc0a82eb08e69b25595
SHA512 a2bd470a30cbf5a1017e9bc0b1b4dc48fe21e42f33163a44a0d372c2c8551a6aa69feb9be3a359a510752e542002dbf160015c56cd9ad1c23c8257510c599236
SSDEEP 49152:6CbRquA/m2yL5zifFiV+XenmE3/zZgDUYmvFur31yAipQCtXxc0H:PoqHVjnmRU7dG1yfpVBlH
MD5 SHA1 SHA512 SSDEEP

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 01af1d092a4a5c842404e3a80bdf2d1af8b2fa119463c5c45aad792f1a4ebc69
MD5 b31a9107f63bbbd0553d0b0212474e6c
SHA1 995acc811668f931cebe31fe0f484ab7a53e76ec
SHA512 3daf31a490a2cbdba454797cc9b5a4fb24857512c53a1e62c4dde95d736b318473bd09951f53d3cbcde0828107f7f89bb12752c1afd2bb720c32305eb0dc1ccb
SSDEEP 24576:mAhGLJIFoiwtA5l7S53Y8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:mAMyFoiq5ogDUYmvFur31yAipQCtXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 5586a39e50b85c17e1b3ac571d6831472b5d5ffd22945e15408352ccde1e14ea
MD5 0ec75b6cc8af43781f4232efe7aef493
SHA1 b95c696e468d862e5b9fb02179a5b38f4e3bb4fb
SHA512 1183a21d4dcc5a595091ef33c22010c65b386a4aec5fa45d098c8f5d972a2ef7bba34ec7bc51dae53a760ad59ba10d45a09c34e87219a581a9daf78a93423881
SSDEEP 24576:owuoOWl8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:owDO0gDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 579f4190c4c7fa9598d228c484ac3ad1b861b931234f2da425c234f941ce8cb1
MD5 0664405f315b66fc4969f3b7cb82ab72
SHA1 6352c410f259a42dcace07c2e490e89d2f689980
SHA512 71421e04f436ff54008cc7ef003a7ecae94df019ff63ec5296f835cffccbd3a1dc4b13ded0cb2400c2ecd16a54946f55b35efccde2ec1d02d8eb59e62e64a2e9
SSDEEP 12288:DBZ1IypFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:tZu28NDFKYmKOF0zr31JwAlcR3QC0OXn
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe
Size 4.8MB
SHA256 129ac664b7005f800e6a0df6d2a08355097e998912dea73ec1fccfa4ddb0cf84
MD5 428d4ae8f3a6ad3818a7471c740cad0c
SHA1 c4ef89a1ff90b3030f8ef7ed0e761dc35e9d06ac
SHA512 63c5485c7c503bd96a564ea26aa8cc3c5f182665c9021576759b02ebc978d17d2e774a438a081278274ef80a77a1b2454f59b47ba4bcedd56c93fdf878dc3da7
SSDEEP 98304:yrZ4K5M+XDfiIewG+x6xZ14WU7dG1yfpVBlH:WZ4K5M6qIzv+Z1pUoiPBx
MD5 SHA1 SHA512 SSDEEP

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe
Size 4.8MB
SHA256 4d2d74974562d6163ef55e18a37d11bb946a3e2a3606edde71dc48f4f8973041
MD5 8e3abf0959b3ae3e305230ef4eac50b9
SHA1 00ff881d51e063a4dd75bc17e16921130ffc3480
SHA512 6ba756127531ba76ea2fdf20af6cc173ea8723133384a33d39c57b24cd72dfe9ed71e00156cacb4a240d78931adbda4c9659e92655fb1d8e208b623ac597c9d1
SSDEEP 98304:4rZ4K5M+XDfiIewG+x6xZ14WU7dG1yfpVBlH:MZ4K5M6qIzv+Z1pUoiPBx
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe
Size 2.2MB
SHA256 0145b24a31d86c1ca72c15aede3ebe5ac3f05cb46a149493d2ae4a194dec656b
MD5 c9477666768cc27d651794be5958f629
SHA1 e4ca7960ab1964869eecfd0c4689f4c367c95342
SHA512 4de6acb03990d7f1ef50d903322f67cf70fc904765aee97f9ea43cd2ce80be87d5c1811253534c20448971860765b98343b3f350d9d6d2a09f1af54779cfcabb
SSDEEP 49152:cfzabJ8llj+SWWi2mkx+X+diYgDUYmvFur31yAipQCtXxc0H:9ui2SU7dG1yfpVBlH
MD5 SHA1 SHA512 SSDEEP

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
Size 2.1MB
SHA256 067cec802a9d85c153aed2ff97f037f592278eb2ec2e0c3f065672a5da24046b
MD5 c18e25e066f5064fee757d96539f6194
SHA1 5cca1a58c0f5a1d919a2bce0afcfb3fe0e58c84b
SHA512 9dfd228d0f5840bef35261138951ef8e44db51731533796c5e9cbcde442a2c748f73a8b41b6284377c7fbf951f31465d5112cc7a182336307817627c8c065608
SSDEEP 49152:Ma/3xXBSZ4K5MJ1LvTMxbfsYBYSgxu9+fw4TTgDUYmvFur31yAipQCtXxc0H:OZ4K5MJabfsYNFU7dG1yfpVBlH
MD5 SHA1 SHA512 SSDEEP

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe
Size 1.8MB
SHA256 cb990c1f5871e180a1b769ece84fadc715988c1f2f62b2b7a4c9fc1623ce1010
MD5 2d07db716dd544a9e60c3096353f5e27
SHA1 217968f736f68d4d4b9218e34f108279b4c69ebd
SHA512 70b7de7f86eb6ab1994899e0145076ee093b80f97f84331e64bbd6980888bc5e9d378dbf39a2ed419bd60c7ea3e96924fe5b8c8ce6b64a9899ec4bdd21070a2f
SSDEEP 49152:XgNJtUzDu/9gKPxHC41gDUYmvFur31yAipQCtXxc0H:sPx+U7dG1yfpVBlH
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 1.5MB
SHA256 34287b894cfce6940f82dd05bbd13185aac0f2ead8b9ceeeb830676db725eb22
MD5 cdcfae315a3c258d5c8497c3f2956b78
SHA1 ff9ac9c177b913e507dfdeebb7f8ad8bf86ca2b5
SHA512 3ca784c6f0212631e741d6f2f663c28475892602ade07e4ca082990e06457f006be8382e4f53b93b1f0d8e58b4fa2c84b5a21cddfdbcca87017dd6580842ff5a
SSDEEP 49152:WOBynH1wM+v6UJxLQd7BHjdfLgDUYmvFur31yAipQCtXxc0H:qn4LQd7LWU7dG1yfpVBlH
MD5 SHA1 SHA512 SSDEEP

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 73c44b6863ec81f960642ea3291d8ee3871cafdd71a81c0a4653763070304011
MD5 fba587b1f7185ca201bd71c8bf28411f
SHA1 012f1e7e765108b371124a9e1438beeaf812d60d
SHA512 d44e72af80966ff980669b992434684b0c92c2826cb427eb54866c62be180419463e3b687f3198fa61986cc9f7c17c513e59dc24d0881ec1e82768452bad19b7
SSDEEP 12288:+6FCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:+68NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 9778180be324e89e6764497bb8a27e5503b61fe7ee24906c9fe838b6255ef3bb
MD5 c3805133687a261be4defd61f3189fce
SHA1 1999793047659f57d0c686e529920adaa84858eb
SHA512 12d9f2209cda97e843cf3f7eacd4e1e046c0091d7ceabc0819e0347e63e8000cedc8db2882144f6d19cd4f56f2049ae6e653c33c35ffe871db9be4c61c719d26
SSDEEP 12288:+9FCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:+98NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 f070f5099371970b7e942d4edae5ea41696ddb463c23c048dd690e913350e434
MD5 662af4186994aacee777d20ec4e4322b
SHA1 331ff293c4c0ea017a128649c17837911c37cd7c
SHA512 69dda7e6e1585a656453f13da327f054d619b1f4f0ed773a6a6418a7917aecd0bc2720bfdcbca3a30542e9c582208f8adf88e7aecd96478cc9172b8f9d43a138
SSDEEP 12288:zDFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:zD8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 4688a80808ec32aea11852bc269541ffc1f1597f31b65c6285fadf129713dd29
MD5 1a04c3d46c3e92e8236495ee2fbbad2a
SHA1 3fe048410a41f911bbbea5d587c42102ba09ba32
SHA512 eb7db1708498c2bcb90bcbc79a4e1c998852310c371189e29de6884d27c1981db175b42af2719c081083b1e01cb21ddc5a906e5b672b6bcd838bebdffc3b3014
SSDEEP 12288:TV4FCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:e8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 7966eebac73adaeb9e655cdfc94d0d8d3e2e4276b36a78b29d0c123e911647cc
MD5 251de04eb7139423339ed12aa19a6f07
SHA1 a6a4f2a0109b1efbc9c92846f4ef157148d5019b
SHA512 97ffc65922b6f511933f2f7dd2fca757bcef37ed91bd89fd4a75700eca97f7a8cb545266e3c24c9bf11a773b6d71b6bc95d4b612191533f1cec998ee773e5d7b
SSDEEP 12288:2QFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:2Q8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 a07d32bc7c769d7137abf23850a5bbc280ef8c47e0ae7dc1dd9e7e9be3e6dad5
MD5 8b5e0be56d442b9ce5635d94a9fbb52b
SHA1 7da89adb4c0d18f513db242f7a16ab220e23e5d7
SHA512 b4158b958c87fce6a33386df1e87b9a60a8cf7e64ec1b5524d7169a9cbb1744707d0262b629b552bdc52c4c2033967e70d773ab840a66232de849f4a769f1425
SSDEEP 12288:nhFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:nh8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 4a26a71645f8fa7e882d65e62b5b58e599680872bd123a51626f40a4c24803a6
MD5 fd5566982efed06da8d41a21ea9c3128
SHA1 6aa1491c51c4547a39a8d8755784ad9058c0d6e5
SHA512 0bef2e7b9019cd9bd3ad580466da77534f0e67aeded551cd14eb14c1ddf5ec3e0f2a2f46ab290891556b8d62bd4c2d88d115bc8aadf49e64c09dc8d394fdd443
SSDEEP 12288:I1FCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:I18NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 2c2cff9fcfafcd523f052751459800b4ada6c0affb6571c9e3c310acf775ccab
MD5 f02c12fcc4600e306e0e7ca0a8d1300e
SHA1 9ea8d940abce5353658b8802519562073cedb88c
SHA512 805ca4f63cdef05683d1a6aab02defd55b391141a3e6c4306a5bf9e55afad92ccc9b5bc78f36519ef86f416c9126e64e897b3c44cfb1815825e724fb1462f3ff
SSDEEP 24576:6ZMSzFVSOd8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:6ZMSzfRgDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 e511bcfedd7f92db1976c21beea57145afc4025cfe9e1a3b710cf093a84c50e8
MD5 e5060157fac36fabbda3b4a9af5ed076
SHA1 e0d7870af656c2f454697a663a29794458ec4663
SHA512 665b33748919088e38812c20ce059e347a80b6c1eb3110aed84cdd118bee3fe5da3a07f64f92abdcd29529d71dc1b70fee8ed09ead5d7566840b457b3a8954a3
SSDEEP 12288:ImFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:Im8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 e74303d9a0dc9b9f51f391d97db6ea6d019e60cfa90a0685cbee746c77b6e485
MD5 2b51a0f6d6afdda41fa2709b6b21e68a
SHA1 b236b07bd280ff9da279677e92639f026a349bd6
SHA512 6259adf0f7b670b248df5eb9f07085d9247bc8412f0d9ca68a981289de5df3a719a07651604c94cfa8f229cf0f217f66440e11ec81db4bb82d0b80420a629814
SSDEEP 12288:xiFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:xi8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 6cc88df6fff3d20021b01386d282fdace3733ba5da557f19e9a36bafc6a00beb
MD5 1827fa0f3e44d4ccce3e6e5e5e76003c
SHA1 aa8114665737513873483f7f71996dea5fbf17ab
SHA512 06f7f00f5559d283b81bb7cd9ec4a480131b144ae0bf9357fd7264efa460360510228883c175b9ab476dc3085b46b47a7db7dd21d79502a8514ca3ad1e8ea384
SSDEEP 12288:yyPz5L8pFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:vzyp8NDFKYmKOF0zr31JwAlcR3QC0OXn
MD5 SHA1 SHA512 SSDEEP

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 c6ae6a9201a03551e565772e088d59c3eab21a9dffde18d392f4290472242d4b
MD5 413d81a69d10537183597a0bd8f40696
SHA1 134809b97534a9f2c748b97e8a46168a1cd0c773
SHA512 7b3d06741a984dfe62b796f0b9405b6538609d859e3ad6789aac335d7667ec604caea2ef5d9e336b26ffdfeb2a18747dae03091a8170b006e94d23b9c478b73b
SSDEEP 12288:vmFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:vm8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 3c8548e909c29a78eb303753a93e4a06800c47a0817b15609e87f15022058ea5
MD5 1d7cd1b72e0be2205ec4b2a665d6f861
SHA1 96c106d32d225d2da3a07db80c10c1a912fad374
SHA512 5294b82e154f0be3a80df278bbf36729b39445f926ba8e8b3b694f7978b076851ef29874d5313f2e125dcf4aeb1db6fbd5d2283598b6b1eaf116b0572ef5ae23
SSDEEP 12288:JmFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:Jm8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 7ea1f9603e834f4219808c3887c596530f874714456986df045f0a61b0dddf7b
MD5 ee0c487d3271e16634d170ab97a07f52
SHA1 13890933bcabac301777cf3ef289940769ae4827
SHA512 a44182e7ec77592f582a65560b064d1af5a55dc8e0f44604c4e5467a2910de5460d7bb894a403303178495185e1b11548a4a8dc4fd6093fd32ad33ce7c2caf55
SSDEEP 12288:KyPz5L8pFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:Xzyp8NDFKYmKOF0zr31JwAlcR3QC0OXn
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 f5f633061c57617817929f8be451e6f23a3ccedf3d682afcc746612dd9418ddf
MD5 939767345fd84725f1c0cd197f7dc893
SHA1 2eb10e4d72eb190147388ea100abc2739be48334
SHA512 c2a329d1e9d2b4bc439f1aad222cdfe57bba6a1f6c85440f155540e43fcf9bc2fbdeec4792eab499673d8a29235679db282c1fa179d696116ab94de9b4556a37
SSDEEP 24576:eTHaLl3z0zDT8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:eT6LljMgDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 e5a434fc1c5a78ea282e4db375259ef4ae9448e66bf494285ddc3ceedefb75c4
MD5 898eded2a30ee3ff3b3d113308b6dd15
SHA1 37616f9508f1cb4873f409bb396f9d5844061f42
SHA512 0135083896c740bf404532971eca782387e987f08c3aa4d6c036bc957ff8bb495596410b5233de1528034dd8fcec5f8a4e064ac3d2f8e5831bf89643b90526c6
SSDEEP 24576:p37d9CHKy7GZ38NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:57d9CHKyaRgDUYmvFur31yAipQCtXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 ce5a707bdfc7848589996f054d2a2e0e35a94dbdbe50e3c3652fb52e958b9094
MD5 1d704ce00bdaf13e29a5cceaa9d3df71
SHA1 ce9801102565c8d94cda7629ce621bffc1e3f8b2
SHA512 4363fa4decc8a127f0e4db8634dbb536804948663bac4fe3bdf9481acb083b1f70dd902f23c03acf812984100141d10594989c6a373d8b72c7bd404b25b3a0fc
SSDEEP 24576:kcP4mcvIjkGOxhKP2l71SNKbrh/8KBe8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:fP4m4IpOO67N8K8gDUYmvFur31yAipQi
MD5 SHA1 SHA512 SSDEEP

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 696KB
SHA256 dec9aec76dcf95077b8573fc5fe4c2e86a537cc6923dee6259363f8f07bae1f0
MD5 edcc3c6b0b528ab286a92f2dc3b21cc4
SHA1 a2d8e84b8110709cb41c6ce309d005b83d183fc2
SHA512 5d32d38a7281c45e506483322276427229ed60edf3276f829e1f5695d486092ab325207295949a7d8d2d6adcd50a73309dcaaf268a8580c57adf3b11fc442e91
SSDEEP 12288:/FYq0SxFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:/gSx8NDFKYmKOF0zr31JwAlcR3QC0OXn
MD5 SHA1 SHA512 SSDEEP

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 32b746307e9ddb636de388e5457a106f187218f2ac022d4c972ab53434812b3d
MD5 b932ee8ffa976eb85258f0ebf48e56e7
SHA1 8892340a54bc110661f35e6f46a3149937db2f40
SHA512 9468a657479d88d660b998fbf302365eeb4161d1ca4a1253b041725b1cf641c7762d9dda464edce3612f9ac53f1e91107d3ced5703895054882e9e128c9937af
SSDEEP 12288:3WFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:3W8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 d2f199110a755d64ab7963690ddc3e096f277edfc953f80b4b79256ec56accd7
MD5 fb482384b950e984500222c80a5dfdea
SHA1 252481e7afb34f775c9b6f0d8cfc7d0c2eeefcfd
SHA512 21ab4f202a633640826d05c7907c6c246ea29482fb6c43dbf7914ddc65891cd7477add92b86ad9f7ce05bbba1d99e9dee9ef3bb7b94f6dc466e83cf3570f6608
SSDEEP 49152:3a0h2GEkuAe73q3pp46zwwQQgDUYmvFur31yAipQCtXxc0H:3a0hNYG4Jw4U7dG1yfpVBlH
MD5 SHA1 SHA512 SSDEEP

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 659KB
SHA256 913502b3219820d75dcc523f36dbfbaef63684c9ad65af6d4622346012505795
MD5 93bde3b9c7dc4e0af8a01f38c9331872
SHA1 80ff845df07b95b36e108800ed7d20e5db66117e
SHA512 e0c0b752fdb3dd474f0a96dddb7b73234909dbb6a4ac5c85936a1ad85db223306fe22b952da12e6b41401517cf98e21b590d0d051641a725f7cda2845e7a8e88
SSDEEP 12288:IhbHjfXNFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:IhbHjPN8NDFKYmKOF0zr31JwAlcR3QCx
MD5 SHA1 SHA512 SSDEEP

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 c5907f57580710257f8189d310c313b8d2777625c255188a74ab78e83bed35de
MD5 5e20657e304ac87d8e8f68ea1778c254
SHA1 f7d5d278831a42f15bfae33e43ec6b2b0fde0f38
SHA512 f81250cef2471d367fa7d7df8767f6803a0ddf38ded402160eb8f7fc4397d62fbc29a3b8c5d70168916d45671a65b3cc3812b38cd55e17e1438ff105b982202b
SSDEEP 24576:S3YgnJcRTk4yti+R5dpR/l8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:SIgnaTk46ppR/lgDUYmvFur31yAipQCx
MD5 SHA1 SHA512 SSDEEP

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 578KB
SHA256 bb16b5ac39a479bc1ea6e9d3c066602ddfcb1fd2c6a37cc6af2cd324294a9b2b
MD5 3c981fec58e71548426d665a0fb1bbf9
SHA1 dc96874fc24395b5aaa3741ca289ecd52b6ce12f
SHA512 a1beeedb12d8b674d76f21572f14b7787d1a4fc87f1a489ada2067d12c5e854dcd42be4a85b65ad6be1d6d4cb1fd9dcb5aa9848911fca666ff23743c61127033
SSDEEP 12288:FSFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:FS8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 940KB
SHA256 2cf9ad2fb38e1b2cd700e5420edf5c0bdb6d9c22a5ea16a44e6c2e01366ca1d8
MD5 93bfac75cbd5feae9f6df9c262120ea8
SHA1 53894a563ff11181d285a2b3abd5b93d5215cb03
SHA512 35cad563863023750354371c288f375d1f7812c1306bb6a5e90a822f06b4340d3a71f58a3bb06d4c781ac724dd7f66753f453ffb9d119ae1c9b5ae12965acf4b
SSDEEP 24576:fpL3UTv8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:fpL3UbgDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 671KB
SHA256 3040a137dc1869da4b24c7559ab3221f17816be955973d74713238082746e35a
MD5 56078a6ce0673689891916be13de481d
SHA1 c4461645011d702514275da57d1a61a5adb8ac3d
SHA512 129420e75bd704be06d9c9b5b531b6a5293d4e0c0810ff9f2d82944d51c33c6ad7a96289927704ffc489daca220f145864edc7957d6b6a0e9beb66f6d75dc478
SSDEEP 12288:qpFtpO7FCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:oO78NDFKYmKOF0zr31JwAlcR3QC0OXxx
MD5 SHA1 SHA512 SSDEEP

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 d6987362de9e0a7c4166475c60ae3fe57edf3dfd5cda28a611d5729da10b37a3
MD5 c49bd716357d8a69145592c4d1448e35
SHA1 a8c43f8d4d1344222b68601449fa83a65c31fc28
SHA512 0cf001c5d05c12f5e6b8ed3a8a819c86affb6a5c504f4c615d06ae2273f48bc9e0c70e3b31c6cb83204a9d0ceb194242ed6242adce43c40c91deffa8fa28df3c
SSDEEP 24576:s7NM9YmZqmWMUkPjZM48Mv6bEhsm8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:s7cBWMpPjN8DbEhtgDUYmvFur31yAipZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 4fc74f190dbef89131df8dd482791b1ce41a6fd6b89f77a92373d96dfe3b5c44
MD5 88c8d5e186d7fe9f6c04a1d8dfedf7d3
SHA1 ff0d0e0a689395df07370f5c4d699286e4f10df5
SHA512 e7944cf9ddc1138df199b55e44f8d480b7030f83ec0fcf4a4848bfde9366159ec8019146a388e7d32ac6c681c28be65ee473fda0e8b878804ef653562715a101
SSDEEP 49152:eF2YuHNETovcvNYf8kmGgDUYmvFur31yAipQCtXxc0H:P6tCf8k+U7dG1yfpVBlH
MD5 SHA1 SHA512 SSDEEP

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 06ddf1dd51686d02adf00f054fca7ef7f42fc7c1f5871e1079438564df39da31
MD5 a343ab1e603e811467a15a824e42a0c6
SHA1 fbaba2826a45e655b0bd14438d55ab506ed924ca
SHA512 ffb197dd6c02a3b63d4718604e02b416df4305e444b6740d11a9f1acae62ae744f656b5906570c58d7ad58469fd92fa20d66379667a9659603c61fd24ac8a75b
SSDEEP 24576:pAFs06+Omlf3NXEbTo38NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:uFs060lVXuwgDUYmvFur31yAipQCtXxx
MD5 SHA1 SHA512 SSDEEP

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 885KB
SHA256 3376f0f2d0ba3b5f2a9e9488162eebc1bdd6247cf7003f4adc3e4ed9718437f9
MD5 44ae838df8ac570e7a6c6be3383641b6
SHA1 7665aef50e1eddf98b79a4a4f5662b00bb9158c9
SHA512 dc76d5b121118004e63b2afc5c7da1caefce8d049bec224a7004bf6514da587282f4e90c40ca455105cdf0ce0c1396c1f166846c9202ce354242d6b30afa6383
SSDEEP 24576:6JnJ5D3Wtw8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:6JnJ5DGtwgDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 f47e16e78d31a3d345d46c648b2e1790d0f6971934c6946de07fa89f38c2d6c7
MD5 9eafcd30e0f18b87f34b9334d1d54941
SHA1 eb4645dd86e4964e73772123fbebc6f15e1c567c
SHA512 6247d1959664a80f0b26541bb984172e3fe826cf511b18bae347fe95a7b3f39f78680a9af7b8b5db5a1e4c6fb53f7d215b281e93bd573ffe1f38051b4718458a
SSDEEP 49152:4o06DIKdwc+eQnSt65aV6gDUYmvFur31yAipQCtXxc0H:lFU7dG1yfpVBlH
MD5 SHA1 SHA512 SSDEEP

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 661KB
SHA256 61d88bb2f123574f88dd97a6a70a8b651b9d1827302a2283c73358979139b00b
MD5 8cae27c53ffff46f3f8e744c57435323
SHA1 7335a2806477058dc2dad94609d1e547f042668f
SHA512 7c933501121facba133121c76fbd2ac47c8605727bc8924139bc4b640883babc148d5f43f1a1144af1a36710d07132cb12fa6e8c299c8f690118d988e94f3690
SSDEEP 12288:oEP3RrsFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:Drs8NDFKYmKOF0zr31JwAlcR3QC0OXxx
MD5 SHA1 SHA512 SSDEEP

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 712KB
SHA256 9f5e2c8323cbf2bcea59460d4fbefd1c2dabfcc5200378d35f5565ca94885f3f
MD5 a42e0ebaecdd70f827b783ff4859d021
SHA1 ba7d399c873df50b84b6e5fb12162f98227be626
SHA512 da34b248f2b1bef57c42c5b33f4b7f4c6df18808ca1e913e367a11c4fa9cde5ce345d7e756412b53cb6b0e59242a77d0adb0a1f199cfbf5119a4783f2e832fa1
SSDEEP 12288:Cjky9FCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:CIy98NDFKYmKOF0zr31JwAlcR3QC0OXn
MD5 SHA1 SHA512 SSDEEP

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 584KB
SHA256 37466ed4ab18046974db50ad13443028ffdfd65e0f122ed61c3511564a0e4195
MD5 2568841749076729cef0ba7360057b60
SHA1 437516fa5ddcc2dd0405923fed589d7af0ad3e8d
SHA512 74f57653aad22b221db69d61ff38df9f7fae5623420a95aab20407a951907175a0711300b96a13d256b1896f56cab37c178d0573477734c374634155cf14a244
SSDEEP 12288:5FrFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:vr8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 84824afba1d5d56ba31b7c04488054b947b75209d86eaa76015e0245110bfa77
MD5 b0fcd41e2591516f9deabbaf46c8aa6d
SHA1 30d689d95078ac68bf6a880870dfe68c6adce0fc
SHA512 a8768e795c752d91bea49a635fc502b04c7c74c8da1ec75d1514dbc4aecdb63f8ccdb9c2dcac3a0b93b29aa4e6a39b5a89cc14799323ae100dcb51461a0527d1
SSDEEP 24576:jQ9MxZKdcz97w3u8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:jVKXugDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 772KB
SHA256 07b4cbe578d98ff72e6a03030f20a48209e9b5b8cfed668df259e6a816eecf0f
MD5 b508bc34d9bca6d4cf844adb4c3f55a8
SHA1 746ecb6633c6c8ebbce2ae75c88c9ff76f590d1d
SHA512 5cd8301c59e760adde04047bede0a3688b2b3811c1263dc12e1762f897fc2204cd13a42b52abfe24acfac28727d6fbe3f22fca11f48d7801b8d057555d296d71
SSDEEP 24576:tyocxAp58NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:wocxAp5gDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 1c2740b2ad116393e1fb163deafed5621edc75b203059de940186944e04c9bf5
MD5 caae7abf7e20bb772bf014942f96e6cd
SHA1 06d6c5282835392ab9f6939aaff88cff70db2ca4
SHA512 5cd97d1efe437fa694a619f90506f01fbc1220b325d57aed6b26afd151a86af2d2b4f3bf951429a667b0ff1ddebcb79bf3c19f7ac7d2afcbf532aedaa6a66cad
SSDEEP 49152:sWcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIK5gDUYmvFur31yAipQCtXxc0H:m0zuNIkU7dG1yfpVBlH
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 cc68b0fbbf5a04c4dc8497b9ce35cc65cf93e7ceea93dde9f56b09823ba95fda
MD5 d4f5cc3f97923b6daea529cc6b8f0306
SHA1 3a643d817dc7160b554037c1a7830eb3a4b93824
SHA512 352440e959d37979320b842c3e04fc06bf988564385db46ac6a5ece4263f9a13faa49d015d502967cd8dc4f7112dd28e0b2fe76855c0b62dcfc12f3bbebd0975
SSDEEP 24576:71QT7EcpfxR+N5AWAz3ooiYtjMqbs8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:GTDxR+N5YzTfjMbgDUYmvFur31yAipQi
MD5 SHA1 SHA512 SSDEEP

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 877KB
SHA256 4e852988030d5e0b920d8f410680ccf89aec61370a2ad30fde34e6c35023f353
MD5 8147205c6de27cdb4bf492ce2ccfd19d
SHA1 6e2c0b8a767954cc2258c293030a6f247ad602f2
SHA512 64d6b2946a2354212ffbbc66e2429b09e9839c3627f296e145c665011599663838d00bc04f7c59c824cb5401cba11e6a86362b01bcbf41d05292d562b92bfabd
SSDEEP 24576:MTMdOz0FFS+imSL48NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:E0K+imSL4gDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 635KB
SHA256 e0a4464ba522d22aa55db0ea58f7da040fb5665474332f9773df88a245439ac0
MD5 86fcde42c52ef597775ff4b1f3b23885
SHA1 86ecdf8cf521c9739ec76a2d4dc309c2c1bd9336
SHA512 066d517257121c1761e48928bc32a2563d5b0a5b1cdd885dd05fb03ec2f29fd01cdc1c47ccd1bac18b43377834edfd2c0039612b629c56949a4b4920f346d981
SSDEEP 12288:Y47vFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:vv8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

office2016setup.exe

Path C:\odt\office2016setup.exe
Size 5.6MB
SHA256 8f598f26fd07c11a0142bc6854dc0bafb79372f9aa3d934d178b7784c17a28a0
MD5 c044703a89e52a037c2eb6ba238f1e04
SHA1 c29c3c2919818e8f8a04c261c61ec98562002271
SHA512 29e27c48e6076c4986b93cba1a6285831368c2e691695f2f195808afdf942d7876ecd5249395a74a0e7f730e9186debcf43b7a50d4e2c04eadba6bdb780eadb0
SSDEEP 98304:S7M701RgX4iuSl1DtlEq81xZPGnzURnBh6gGL/QmvD/cTwY2h3FUU7dG1yfpVBlH:8M7pTXexZPGzURnBh6gGLF+W3OUoiPBx
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/60-38-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/60-45-0x0000000000A00000-0x0000000000A60000-memory.dmp

Download

memory/60-39-0x0000000000A00000-0x0000000000A60000-memory.dmp

Download

memory/60-50-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/60-48-0x0000000000A00000-0x0000000000A60000-memory.dmp

Download

memory/736-542-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/736-245-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/736-251-0x0000000000BA0000-0x0000000000C00000-memory.dmp

Download

memory/840-168-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/840-225-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/840-159-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/876-264-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/876-256-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/1696-185-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/1696-130-0x0000000000BD0000-0x0000000000C30000-memory.dmp

Download

memory/1696-124-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/1744-94-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/1744-93-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/1744-158-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/1744-101-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/2296-290-0x0000000000520000-0x0000000000580000-memory.dmp

Download

memory/2296-282-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/2480-242-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/2480-174-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/2480-181-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/2532-255-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/2532-194-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/2532-187-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/2564-199-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/2564-135-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/2564-143-0x0000000000690000-0x00000000006F7000-memory.dmp

Download

memory/2816-0-0x00000000004F0000-0x0000000000550000-memory.dmp

Download

memory/2816-1-0x0000000140000000-0x0000000140125000-memory.dmp

Download

memory/2816-63-0x0000000140000000-0x0000000140125000-memory.dmp

Download

memory/2816-466-0x0000000140000000-0x0000000140125000-memory.dmp

Download

memory/2816-478-0x00000000004F0000-0x0000000000550000-memory.dmp

Download

memory/2816-7-0x00000000004F0000-0x0000000000550000-memory.dmp

Download

memory/2880-156-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/2880-212-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/2880-146-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/3408-268-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/3408-202-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/3408-209-0x0000000000D90000-0x0000000000DF0000-memory.dmp

Download

memory/3428-122-0x0000000140000000-0x0000000140237000-memory.dmp

Download

memory/3428-59-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/3428-52-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/3428-53-0x0000000140000000-0x0000000140237000-memory.dmp

Download

memory/3432-77-0x0000000001A90000-0x0000000001AF0000-memory.dmp

Download

memory/3432-90-0x0000000140000000-0x00000001400CA000-memory.dmp

Download

memory/3432-78-0x0000000140000000-0x00000001400CA000-memory.dmp

Download

memory/3432-84-0x0000000001A90000-0x0000000001AF0000-memory.dmp

Download

memory/3432-87-0x0000000001A90000-0x0000000001AF0000-memory.dmp

Download

memory/3580-34-0x0000000000580000-0x00000000005E0000-memory.dmp

Download

memory/3580-92-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/3580-26-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/3580-27-0x0000000000580000-0x00000000005E0000-memory.dmp

Download

memory/4000-295-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4000-303-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/4308-66-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/4308-72-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/4308-64-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/4308-134-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/4424-214-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/4424-221-0x0000000000680000-0x00000000006E0000-memory.dmp

Download

memory/4424-281-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/4500-239-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4500-240-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4500-234-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4500-226-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4732-277-0x0000000000B60000-0x0000000000BC0000-memory.dmp

Download

memory/4732-269-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4972-106-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/4972-118-0x0000000000900000-0x0000000000960000-memory.dmp

Download

memory/4972-173-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/5048-20-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/5048-12-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/5048-13-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/5048-76-0x0000000140000000-0x00000001400AA000-memory.dmp

Download