4f3ad0a7de4e503ebfd956879e12506aee6a3c533ef779611c15f137d17f3559

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
27/05/2024, 13:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-05-27_532bd9d786017993969d7f356a426f68_ryuk.exe
Size 2.2MB
Sample240527-q2vcjaee2t
SHA256 4f3ad0a7de4e503ebfd956879e12506aee6a3c533ef779611c15f137d17f3559
MD5 532bd9d786017993969d7f356a426f68
SHA1 0b9fabf58844c97fcce1acec3e3b8562232028d3
SHA512 ade23ae6d49062bc328e532a3629fda891727c0478e4d262ee6a5cdd7c74b793030668749ee568151837c275e46df54e3f8eacd61439a54becb0be3755589421
SSDEEP 24576:dOObVw4TaN1wdkukCba4oXtgLhU3wEdmh5813r2p2gV8ng2P2OaXbQYxj:dOOh3aN4kuLbegmtGk3aCg2PraXbQ
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
5060	alg.exe
2156	DiagnosticsHub.StandardCollector.Service.exe
1304	fxssvc.exe
1988	elevation_service.exe
4836	elevation_service.exe
1252	maintenanceservice.exe
4424	OSE.EXE
3604	msdtc.exe
3892	PerceptionSimulationService.exe
2044	perfhost.exe
1252	locator.exe
3528	SensorDataService.exe
1812	snmptrap.exe
224	spectrum.exe
1956	ssh-agent.exe
1964	TieringEngineService.exe
3460	AgentService.exe
4376	vds.exe
868	vssvc.exe
2868	wbengine.exe
1680	WmiApSrv.exe
5092	SearchIndexer.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in System32 directory 30 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2024-05-27_532bd9d786017993969d7f356a426f68_ryuk.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\44a687d04a48edc7.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2024-05-27_532bd9d786017993969d7f356a426f68_ryuk.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2024-05-27_532bd9d786017993969d7f356a426f68_ryuk.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2024-05-27_532bd9d786017993969d7f356a426f68_ryuk.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2024-05-27_532bd9d786017993969d7f356a426f68_ryuk.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2024-05-27_532bd9d786017993969d7f356a426f68_ryuk.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000037f1f86a3cb0da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000082fb1f6a3cb0da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ae5b416a3cb0da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d830976a3cb0da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000004aa4f6a3cb0da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d5a2ea6a3cb0da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f1d3376a3cb0da01	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
2156	DiagnosticsHub.StandardCollector.Service.exe
2156	DiagnosticsHub.StandardCollector.Service.exe
2156	DiagnosticsHub.StandardCollector.Service.exe
2156	DiagnosticsHub.StandardCollector.Service.exe
2156	DiagnosticsHub.StandardCollector.Service.exe
2156	DiagnosticsHub.StandardCollector.Service.exe
2156	DiagnosticsHub.StandardCollector.Service.exe
1988	elevation_service.exe
1988	elevation_service.exe
1988	elevation_service.exe
1988	elevation_service.exe
1988	elevation_service.exe
1988	elevation_service.exe
1988	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
660	Process not Found
660	Process not Found

Suspicious use of AdjustPrivilegeToken 40 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1208	2024-05-27_532bd9d786017993969d7f356a426f68_ryuk.exe
Token: SeAuditPrivilege	1304	fxssvc.exe
Token: SeDebugPrivilege	2156	DiagnosticsHub.StandardCollector.Service.exe
Token: SeTakeOwnershipPrivilege	1988	elevation_service.exe
Token: SeRestorePrivilege	1964	TieringEngineService.exe
Token: SeManageVolumePrivilege	1964	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	3460	AgentService.exe
Token: SeBackupPrivilege	868	vssvc.exe
Token: SeRestorePrivilege	868	vssvc.exe
Token: SeAuditPrivilege	868	vssvc.exe
Token: SeBackupPrivilege	2868	wbengine.exe
Token: SeRestorePrivilege	2868	wbengine.exe
Token: SeSecurityPrivilege	2868	wbengine.exe
Token: 33	5092	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5092	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5092	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5092	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5092	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5092	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5092	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5092	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5092	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5092	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5092	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5092	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5092	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5092	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5092	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5092	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5092	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5092	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5092	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5092	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5092	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5092	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5092	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5092	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5092	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5092	SearchIndexer.exe
Token: SeDebugPrivilege	1988	elevation_service.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 5092 wrote to memory of 3504	5092	SearchIndexer.exe	125
PID 5092 wrote to memory of 3504	5092	SearchIndexer.exe	125
PID 5092 wrote to memory of 1508	5092	SearchIndexer.exe	126
PID 5092 wrote to memory of 1508	5092	SearchIndexer.exe	126

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2024-05-27_532bd9d786017993969d7f356a426f68_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-27_532bd9d786017993969d7f356a426f68_ryuk.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1208

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:5060

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2156

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:864

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1304

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1988

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4836

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:1252

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4424

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:3604

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3892

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:2044

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:1252

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3528

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:1812

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:224

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1956

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:2448

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1964

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3460

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:4376

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:868

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2868

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:1680

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5092
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3504
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:1508

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
Size 2.1MB
SHA256 ce99591255a57d08404376184659bed772e109bd0cbea9cbd494d87416d570a9
MD5 ce5629a0e5e9eb5b9645e9915221d1ec
SHA1 55fdbdaa80337386205dad3a95ef30ac6e381aed
SHA512 d3912d3efe470593d941d4bd62772083df3e75b7e1077a1891fbd31c19b3d74e98708d10fd5003231df683a7626fab87e0b5eb1739535a38cd98e98b967b6223
SSDEEP 49152:wuYk3H5koUXfTqkkYLO/W2buywzMbOX+T7z5W3aCg2PraXbQ:wPfTqi90bIZgC6
MD5 SHA1 SHA512 SSDEEP

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 797KB
SHA256 a1b95f4689c642c9d096bc5ffc145ff450b4d45054a0ca860d13dd02dc8e811d
MD5 cc9413be1ff068da73dc4f5b8335d974
SHA1 b4b9b1f7815040fcca34b3a8c65cc2bfaeb8efc4
SHA512 e7ec9d135a1728ee504683bb8803c8b170b8f3ac3632b159f842341b0dc37bb2c8591b6868a0b8d3ba963ca15fec95e71169a6bbefc98ff1f8381003241e6495
SSDEEP 12288:rcQiQmNJLBsunEVOe7qA2p2huV8ngoPy22OaXbQY/JaYfjYvT:TidnBsuEV3r2p2gV8ng2P2OaXbQYxj
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 6c4cf656ff320459f2168051626f8f0327979836c0ebd7db1ca6e69799c7fee4
MD5 095134ae307b38f90b416031e3a00a9e
SHA1 a809e2a2ebd4fe43f870ca85df8ea1b35e134c0c
SHA512 90339ed088c66b71b82a8788a1e2f6ec2e180e39f63af0581d769902e939d932475b05e05fa324a93f0686256e2d6ddac98d808d947219ba744d8e12217b1552
SSDEEP 24576:i+gkEVfh4CoJ3r2p2gV8ng2P2OaXbQYxj:ngkExSr3aCg2PraXbQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 5422d28335a058fe93530c415c2eacda3a2fb72ab1699c70b18f9f5c910fe2de
MD5 7f7b15eb4ec284086316b1e99b850464
SHA1 5277704c4912d7455075296070ff9372d4264690
SHA512 2896a4a1ca4edd737feda5d40ee838e449a3b5b038a7c2f25d72cd764d89a4f1d3558da4757316b138f73e84a351abfec872839f5f190733aa71c8f3fefbeab1
SSDEEP 24576:aBpDRmi78gkPXlyo0Gxjr43r2p2gV8ng2P2OaXbQYxj:+NRmi78gkPX4o0GxjU3aCg2PraXbQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 063ac3e945c8b45d45b66fc325dc54ba5ab74e838df576f4d237e76da236bedb
MD5 3528118a7341c9bece105a1b0a9815db
SHA1 703ecb1393c202c22f3abd77f37c0004056fed03
SHA512 29a455f740fdedb505b59216a15ffcb84e5e1461d8394ca2a2f150d7301769c729292c5f241351bd5c1429e13654f20e46ea46d5a0b2de2e71628577f9b07418
SSDEEP 24576:QLOS2oyPIXVJ3r2p2gV8ng2P2OaXbQYxj:I/yM3aCg2PraXbQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 eca0d0843fcbd959111874f62bf2c3ba480c6d7e7a9bebfd59964e3804b1d4d0
MD5 280be489ee8421d1392345d85c883d3c
SHA1 2db395dd5f1d7161a36d5934559e2af6c0b77690
SHA512 08541ef1065745b2c40c21ffe5464af405e90e09d1bd4bea4036f807ba93c6b7fcf560c74a7ae65b7c68bc3d3b307784cfb6963bf0dda1d157d7e30712c0c3af
SSDEEP 12288:JfLOe7qA2p2huV8ngoPy22OaXbQY/JaYfjYvT:JfL3r2p2gV8ng2P2OaXbQYxj
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 9d410ed1622dddb9ef2087580f8f46629f275f7afc869e1ee76ed2e52d32b33f
MD5 2150224dcb96dce3ef82ce1735bffd75
SHA1 9b517b5cde34b600f2832f185276300b4a2d572a
SHA512 89977a75c74a9dbc2e9ea4d4e798b232afc0646dc555ee42881d671bc5a0973fbb17643a7c4f4748e6c559798f5709284dd9858c06d2cde2dbfe25b3ce0e77d9
SSDEEP 12288:9eBNUbTVO86UCOe7qA2p2huV8ngoPy22OaXbQY/JaYfjYvT:9JIUC3r2p2gV8ng2P2OaXbQYxj
MD5 SHA1 SHA512 SSDEEP

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 2dec654dcbd92672b1f1587244164a8d4ce3e5905bed51254b4bb116d7de0cd6
MD5 3c78fa8f7cd0fa7a94a1bab2855b4fb8
SHA1 c84624af990fb7f93e924b8e80b17abd5bc5e9e0
SHA512 bc98b9b787b1f3b6fd5cf9251c2203024ffdb76df1843a4709b99ca81affb6068b9be58eb86977e2b7d0d6d97cb10685721bfa759c91d336c09a2a63ffc2fe5b
SSDEEP 49152:KQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3TH+:KQvGAdlCEL8c/yRNw5CVZgC6
MD5 SHA1 SHA512 SSDEEP

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 d4629c027fd2164fdf1f9c6fc963e3629f8f29c4fc6f3e9696360eac815d0749
MD5 a6b427d7b85eef2655578d9212afabd0
SHA1 3aafb00a2bb66e7e3879b463c76e7d0a07b06ca1
SHA512 bdb306dd12fc070f773f48ea70900941ba913010c46aaccc66f1ff4e535f4fa9368d3fc89dcf2ff87bf5e41f76808c22bc70065054c70686f7b367aed7f3b5eb
SSDEEP 12288:lAwSfxL/2Dc34DLLmt0LDQewsAjwOe7qA2p2huV8ngoPy22OaXbQY/JaYfjYvT:GdewsAjw3r2p2gV8ng2P2OaXbQYxj
MD5 SHA1 SHA512 SSDEEP

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 fa593caa3466572b908be3898658838c471acc5dac100b4818ee89bd7020ebc3
MD5 dc0711c6d1dc9eb3de76ac076e96776b
SHA1 2b11682d251bbbb9a8a249dc1979c5a136a98cc7
SHA512 79d66cbbffe22afef2f40e0c4d272fd371c63fdacab2c1bee7dfd3c94f9d25ab3707d44794130b5749412eda196ae2ed3ad5792e5085c469f4144a9424e8afc1
SSDEEP 196608:zUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHXH:zUEtQevvqc2W1cpV2EI32XH
MD5 SHA1 SHA512 SSDEEP

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 d48cd5699019f5583e8352db302ef2f614fbe3becac38f0dd2835a8ff110aadc
MD5 42c3ddb265c2d1ae79aa584a9ce4500b
SHA1 3045be6bd4b23996aa39ca1827d158133dddd8f5
SHA512 8a4e46e3b7adac57d9d858aaf0acfe9068a1088d67b9065f9b2c408f9c7fc5888dc49c801903a05682d2b636b448858aeff939cfd714f1eb928489ba78c1a29e
SSDEEP 49152:KCbRquA/m2yL5zLfFiV+XenmE3/zQ3aCg2PraXbQ:/oq2VjnmxZgC6
MD5 SHA1 SHA512 SSDEEP

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 74fb45fc36666909e4bf2ef83346b4a14c1f0847b0a5bf29a2b5e12f7846dc74
MD5 5f339a9761bb53f39c814dee69f911d9
SHA1 a4ac0042f7d7c24776971d3a5c7c6786b748e5eb
SHA512 858187e4590fb3c17884aabf453b1e4734913d59fc03547f09edeabe25b84ef3241d29fd210caacd718a54d344b8b7773f48ecfbd6b3351c97ca28ef032cba0a
SSDEEP 24576:aAhGLJIFoiwtA5l7S5353r2p2gV8ng2P2OaXbQYxj:aAMyFoiq5p3aCg2PraXbQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 922e9c25cda9c4d109b1266d01890c49729d8a48d35f125cfb8530d11dba5b68
MD5 d0108d976fbfa9569071318c55749a89
SHA1 b175e67fe916194440f13230ac287b0f24d59beb
SHA512 574915d0ae7d5cc62b7e99a902753c2729d78300def3632fb7a98f779b8720dcacfca5c9d7759cbe794e6385d35fbb9b65f8be50c36458e98c37846fb5be5329
SSDEEP 12288:7mw5HEjsChNVBFgl0WDm+CdOe7qA2p2huV8ngoPy22OaXbQY/JaYfjYvT:awuoOWM3r2p2gV8ng2P2OaXbQYxj
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 17a1de2bd784668c7794c38a09b4cff99afc8503a689d4d1fdfcc8909c32e89b
MD5 6ee382dd34014eef31083bfc0a9a4ad7
SHA1 8a67bcf5ca96d517866527078d3a837f46082501
SHA512 74e5e64053547701bdaf9c012bf8d1cae754582d1d2219210f4c2f4a6bc3b2065f4fc46ab924f55ed208fce2a9e04bffdd9144550dd409af88004236c841da9d
SSDEEP 12288:lBZ1IyAOe7qA2p2huV8ngoPy22OaXbQY/JaYfjYvT:TZuP3r2p2gV8ng2P2OaXbQYxj
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
Size 5.4MB
SHA256 1a897eafa552185bfad5f036647616fff612de9e2faec9564dc8e4f5c1375f0b
MD5 aa7297983e3e96f4143731e58b9cbd3e
SHA1 63abe0244838a488f9653321eab3702eeea1f7c4
SHA512 131fe53a0d20acd625e8a0218e30456a54ffb18ad5d6de8ced5ce666d0ad86b7983f99067dbefd73317858518385d8871c05d268d73445c2fc11b68d8b4f52b2
SSDEEP 49152:O0kwIi7c4xZlm5knEtw99Kn/2vim7vgv6m+yyJ/0gbvjR7yY7BHi3u7L/gBUUWLO:4wfhY7g/rLd7yYA3awr341gJZgC6
MD5 SHA1 SHA512 SSDEEP

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe
Size 5.4MB
SHA256 f3bf091e43733b9d7d76258086ae9f2dd182cbd7b3a043f1213199c3139de60a
MD5 1b026fdb0726138bb31899b01eacf9e6
SHA1 e55afd83371d5d7b123c97dbe078b43ee35190a9
SHA512 e5d25bb83e5ccaaa7d166dbb1d4b223cc60d2cf1543b428fb3eaaf7a782312f8d97915c6b61f76ba4580692ad8944b0dc45b4b591cf376db9f7725fb0332b0de
SSDEEP 49152:R0kwIi7c4xZlm5knEtw99Kn/2vim7vgv6m+yyJ/0gbvjR7yY7BHi3u7L/gBUUWLO:hwfhY7g/rLd7yYA3awr341gJZgC6
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe
Size 2.0MB
SHA256 1b8c64f0a1d426c65945a1e393cbb0f700f39b4e567ea8546503f3a280e5d058
MD5 909d06d1eec9676e18cfffc2792ae23f
SHA1 1d4432e02d73535e9ee1f9fede615996d9528aa4
SHA512 518f2b4c80dfcb0405bedd0cc39eeb4c809aced90971813ba9be8c0fedcd9d177cdb20ffeea66365f92b9046698fa1244b60c75038aeaea717a250626eebd3ca
SSDEEP 24576:/cTyYv0FteQU+5I2kjgD6iQacAM3r2p2gV8ng2P2OaXbQYxj:/uXv0Ftpn5606zOM3aCg2PraXbQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
Size 2.2MB
SHA256 01ea01dd1c5c0a33e8b1b938bfce0037f03c7f443243b6a015c12ed9f0c3d6fa
MD5 4b875de34a20ec4f9889de7177b43309
SHA1 fd96094ee81bb6a90aac1466cf7c3d629886eabb
SHA512 5feb3032b6bcc378326d99e303fe687ffbbbbd842ce987ba636d15f073e5bfdca04ba783e480294fc062a35fabae1f6e308de974f449013b17c5af1b8d5494dc
SSDEEP 49152:uy7mTd0GxN8jyynxHjXKUyn4GVcbDSKrNTxi3aCg2PraXbQ:lmYeyxHjWjMTIZgC6
MD5 SHA1 SHA512 SSDEEP

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe
Size 1.8MB
SHA256 3a251091f4d8886315ddecd74e0b982e34d2bd8da04357b52c7ff7c6d6faa5b7
MD5 2d75fd743364a73f6119ec54cf1e8b15
SHA1 77d533866d839c4d6af857c3c1944074c127759b
SHA512 04dca55dc567c0a3014da39e4c75044a792df11f828a9afd45e43aec52310b99c7282e38966021e2572dd7a8752c3ecb39d68bfe060a66311cd240979a613b0b
SSDEEP 24576:Z6drZn1WEci182IEUeNbJeRgUebgW816n3r2p2gV8ng2P2OaXbQYxj:ZWnDci18yNNUgbY03aCg2PraXbQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 1.7MB
SHA256 184e691baf38312fd429a4126f23969ba56ac30f1838e2a3386340053c3b3c99
MD5 8ca8a387c94b5f16aa351a1a9cc875bf
SHA1 9a93ab4c10c155599b3a5dbeaa83ccba29c7cd65
SHA512 c037d5e4190ad75fb3b4c19292a907547f982c8c0df8e184470da1b259919b6f1227a42d813c098983375d5028460e28e6973eacd2f66e5d3a3640ca54ef74d3
SSDEEP 24576:4k5lHW5EzMZupO80G2reD+melRgTTv/1nyW3r2p2gV8ng2P2OaXbQYxj:eizMZm0GhamSoP3aCg2PraXbQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 f4643b323e13942a8ac487a0dbbebcf1e570b9ca1d7a2fd39f5baff4df9d470c
MD5 6bc1561fcea628709c7145f5e433a820
SHA1 0fd79d09c292e6ad2124b67acfe37080f0022a5f
SHA512 2348ee64deac55adf5cef8a70f2160a2be4e7d3245194c685d357890bc3f7e442c3cd135ab43a750918d0b10a22722f0e64fba72b2fb9775cc30c9b7c81b3337
SSDEEP 12288:XzOe7qA2p2huV8ngoPy22OaXbQY/JaYfjYvT:Xz3r2p2gV8ng2P2OaXbQYxj
MD5 SHA1 SHA512 SSDEEP

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 18d4b5a31412885a8fdb820729e9a9a8dcaa4eaf275dc8d83b8c47721ea28542
MD5 c900ac13235cbafc4e198dd8b972d282
SHA1 e0d4b42161d80631e27313e02266c25b98e4e11c
SHA512 db91caa540031327f8bb7ad0244b900ddaae2c9aee7770a886c631ac58edb0ca8672b28447965f23e415ca6b7b8e72347a42442d82fd25d4da7766d378612094
SSDEEP 12288:mEOe7qA2p2huV8ngoPy22OaXbQY/JaYfjYvT:mE3r2p2gV8ng2P2OaXbQYxj
MD5 SHA1 SHA512 SSDEEP

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 7922779474707270a5e73a33e9a6ee3b26373657895343865f78036a51d47921
MD5 14fe9a76c30a5e6f067a31f0a44ecc61
SHA1 fdea19e4f37dee3a341b079270994aa8b3cc58f2
SHA512 f24803b1c21f1288ff65ee3ee7b041e86f77bfd2da57d168dd11c6c09e3caf0876a72d56e4a073b27ac68d6c108e3dc3c245dff265ab64172b79d742cfcf22dd
SSDEEP 12288:LKOe7qA2p2huV8ngoPy22OaXbQY/JaYfjYvT:LK3r2p2gV8ng2P2OaXbQYxj
MD5 SHA1 SHA512 SSDEEP

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 682037e28bc61508d9d58a92d5aad2decdfc2ed8e72a8f73b87d36c2aa42d73d
MD5 fab0f3e5e2a4ffecb6668662251ec38b
SHA1 e15b5a41a4f345fca24e006beb042da90bd5776c
SHA512 837c081424c712595295e833f8cf9da2329066e05337e5cb955b7136b2ec36e2f593ac2d7142d20aca1ace2aea34d43cf25948d31cf78bde7d72dd363f64f3c9
SSDEEP 12288:/VZOe7qA2p2huV8ngoPy22OaXbQY/JaYfjYvT:r3r2p2gV8ng2P2OaXbQYxj
MD5 SHA1 SHA512 SSDEEP

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 86b6b1bb6fe7a9958c709895f3f859addeba64b545dfc84dbd80ff8f91183dcd
MD5 3df2158be3369c9e6eee64da102ac840
SHA1 ed07f15438f4c4a6161c376406b3c5dbfd0529a9
SHA512 a46c18ff30ea18b847d883964e827bdadd951c2a43d95893943a351cf3b4a4ad9ae46bf768b870b2e806e4f19cf31ea3afd9fd3d6484364c15358469c8d2ba26
SSDEEP 12288:mROe7qA2p2huV8ngoPy22OaXbQY/JaYfjYvT:mR3r2p2gV8ng2P2OaXbQYxj
MD5 SHA1 SHA512 SSDEEP

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 51b8d9ab295239048ee69c46eee4822d56d343fdcadf600a03ea5880891ff352
MD5 98b1c6dad55c1cb6d4134e2e0f841a0b
SHA1 e9ccfd5eea8eb6e6f7e1633b4ea916779e30025d
SHA512 1c11440c31fa2c5edb99db34aceb21200b58cb017e2ea21be4595260dd91f72892b33d19a25fd33ec54f3d1b3cf4678df8e6b1a81d755720b633e372cf5a1935
SSDEEP 12288:74Oe7qA2p2huV8ngoPy22OaXbQY/JaYfjYvT:743r2p2gV8ng2P2OaXbQYxj
MD5 SHA1 SHA512 SSDEEP

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 91ce38425633e4200eb3e675b7ffcb6ebb1e4c039c1c818a7c738999ea3070d0
MD5 893ec54089ab37089481486477db8668
SHA1 a012704b8a51a5eb3601e89097ec83fe9b42dd6b
SHA512 ac222a79f0123fd0e15246f89d9fed57d2aac335f0f23b4fba533e4c599de6d4fef26a7458dfe6ac90b2a9cee607be91e97083dff0632972d34f8591e9b0082e
SSDEEP 12288:68Oe7qA2p2huV8ngoPy22OaXbQY/JaYfjYvT:683r2p2gV8ng2P2OaXbQYxj
MD5 SHA1 SHA512 SSDEEP

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 7154e3f48db7cba200fe45a0757e9010da2801d5c98cb449a79b7f344e58d66f
MD5 93c3fce503b65341603780e5db3d33ee
SHA1 a789277e3edba43fb2d0b27643498b3ab68e3f8b
SHA512 6d03258e6fa37e99c1b6e5e255c744213d4b2a59fbaf2c4b5af68ac4c318dea84c8311670afb900486a7829d4dfe7df42aa6dfd3e860614f23e7a994cffee103
SSDEEP 12288:riZwb6zzFEoS2cPvykOe7qA2p2huV8ngoPy22OaXbQY/JaYfjYvT:WZMSzFVSOk3r2p2gV8ng2P2OaXbQYxj
MD5 SHA1 SHA512 SSDEEP

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 477876b55d0e9f8e40793ecaeebb3612c1693c70186fb519680e386168d9c121
MD5 1b5d7da7ab8767c53a6a48d734e93902
SHA1 61f122bb4a86e4f77193753418e1c106fe358511
SHA512 d325eaab811eaf7e196f11c5132e2f777f9e305d797287270582e85ed1761dae82a9cfe3206ad39cfd636d1714e0f8cfbf5d1839b892bcc3e88a5c3356f2fa8e
SSDEEP 12288:pfOe7qA2p2huV8ngoPy22OaXbQY/JaYfjYvT:pf3r2p2gV8ng2P2OaXbQYxj
MD5 SHA1 SHA512 SSDEEP

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 937f369ba61138cf0828d3413d1a619710580971371978eb332a983dd80b2c25
MD5 5e61c8e163ffbe061fc1b18b0d406ede
SHA1 e1895a49538fb1f20d1b8579f8746be792488412
SHA512 f8194cacf7550540d731f721df13eba9617112e7a660074b81b99ac0d5a69cab1553f5570499186ab9b622f64f1dd4389ea8611b9c91d4b356ccbe0fecd32a15
SSDEEP 12288:sbOe7qA2p2huV8ngoPy22OaXbQY/JaYfjYvT:sb3r2p2gV8ng2P2OaXbQYxj
MD5 SHA1 SHA512 SSDEEP

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 2756dd708f926f38394b82af7ea88611713e9ffe833cdbf3e317a823c40fa67d
MD5 b7438635df295cd3828b1c5e34014889
SHA1 b0ccf0e0036a0b08f55d3c7677d66946bcc66280
SHA512 d209bdc1979257faa50e4b16123cc446bba6f87b3b56ab4125939f3a4b5d395d07fbee7d27db2f08d0fd9013b66d251af968f855c89b057f30a5861fa69584f7
SSDEEP 12288:mfOe7qA2p2huV8ngoPy22OaXbQY/JaYfjYvT:mf3r2p2gV8ng2P2OaXbQYxj
MD5 SHA1 SHA512 SSDEEP

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 a4b4509679ba1c60cc360c4c97099f3b5cde5fa4ff09223bbe658597414daea2
MD5 3ec63323b6fc38382e794a91d6b122dd
SHA1 54b84c56727573a8cf90fb7a3b8d6733e1cad8c1
SHA512 7f344798f0a26bc85a493706ec0b1e2a239873d822eb58672cc5763207778d5d9c0137d9bb3e226d0dd46a55885ef7f9605c445b219a99ed92b0c8c54981bba3
SSDEEP 12288:GfOe7qA2p2huV8ngoPy22OaXbQY/JaYfjYvT:Gf3r2p2gV8ng2P2OaXbQYxj
MD5 SHA1 SHA512 SSDEEP

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 2eabe2d73abab728f10f1b4e00177957de5ebcd3066c938738bd8944ec0dd2e6
MD5 7c362c866b3818e1a8568cdcc7452e67
SHA1 5a34f51358c2760e00340a44a21867136f03de60
SHA512 4ad3e7605848c4d78230f85e58a81457878dc6004da9855fc953d3db5bb7dfd9b0adbee37337f8e57de3f14cffb0d326995eebbe204afa84cf585189c6cc67b1
SSDEEP 12288:GyPz5L8AOe7qA2p2huV8ngoPy22OaXbQY/JaYfjYvT:7zyA3r2p2gV8ng2P2OaXbQYxj
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 a21b7a6e562ae51df0c62ea410ccd22f851cade9a6b5d9c9cea56905594ccf32
MD5 f36ff5b83e7821621d2648e96d922032
SHA1 0c75ffd211cc42bc6c330e2321869593e909be7f
SHA512 c65098519b1a63044bb86ac71ee7dad2c02bdf3c9b0b9b2da901fefd1abaad86a95bbe54b8d7403f093f08d12baea4650f0dbf0d414012a366162778ebfed2cf
SSDEEP 24576:tTHaLl3z0zD63r2p2gV8ng2P2OaXbQYxj:tT6Llj93aCg2PraXbQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 8b6753bc743e622cbe40b16e31365339509ea497e0cb83b3351b5a3ea7c332e8
MD5 683ea40e94075801596f0c2e6c54fdc0
SHA1 506fa8499f024fd5fc27f7b034db4da95ed545c8
SHA512 cf344b85abdb78a3991930a1cb432fc7996462c5c44688a475b79633219b94e2356022f689ed6a2087d54c6d47573e86ebf42bd881c11d2234051e861ea5a24d
SSDEEP 24576:X37d9CHKy7GZu3r2p2gV8ng2P2OaXbQYxj:n7d9CHKyaI3aCg2PraXbQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 6cfd043bd313b893d3784a7821456d247d81762bd3582563a7ff5e214b8fd8fa
MD5 5dae878f69b7f231df9d555db8705ac6
SHA1 002fcaba2b1d0911f5c3e3d548f044e4154c061c
SHA512 066095db5fe0ef7c8d169b24201a4099c6bfea871381f603f99bc92a935717dbbf5e1602ef40f3a3dcaeaffa8337883231646c799d4b32fcdfc9aad28958234e
SSDEEP 12288:TqOe7qA2p2huV8ngoPy22OaXbQY/JaYfjYvT:Tq3r2p2gV8ng2P2OaXbQYxj
MD5 SHA1 SHA512 SSDEEP

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 52de083278ffacca8eb07d367d185e3d859bbeaee8f4d399665ae5a528112d39
MD5 85b0b3a58035c661049e109a62cb2e7b
SHA1 75984e9e2c16a8d652b9250caae467f183c9d01c
SHA512 af0b0162b57dc4af354149521c4fd3de6c7e186c0188b643f72ba8348850fb623af1ea9d50b80aa41c9d918d785484fb19e9ed4173aa2f8467d5e20ce2762632
SSDEEP 12288:3gOe7qA2p2huV8ngoPy22OaXbQY/JaYfjYvT:3g3r2p2gV8ng2P2OaXbQYxj
MD5 SHA1 SHA512 SSDEEP

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 36ff344e6442125a2121d1ff6b7a1f73e3b469524e8b6cfc3a2d5877c6ab7ed3
MD5 254c02cba60127b9873c2a53cdd52331
SHA1 e1b21a16b2ce4ce3fde639b5599cc37f5a26a91f
SHA512 a180d02ef38929b75e0249c78bd57b62f0391f36fe2a031493be79f94ce5951398f9af4f94b35dd69ed73df2ff3eb2886c46e47430a17a0ca5e1039fbd3b622b
SSDEEP 12288:NVOe7qA2p2huV8ngoPy22OaXbQY/JaYfjYvT:NV3r2p2gV8ng2P2OaXbQYxj
MD5 SHA1 SHA512 SSDEEP

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 4dbe84c9193d29c9846a3233cecc7b37a0b2e164d05ad2207d6c0e87f8199072
MD5 7cddb799f38c3be7a7b708a94ff5c4f5
SHA1 7bfe2a29a8d16a191c257fda2fdd8542ea4c8f7f
SHA512 c0d4e01167dbdce0c537e34879d06428fd52577e4334cb16bcbbc7ca903b6fdd95b89fe58a3be9502315ba347bd65ec4a3055e932655a3bcf201fc5fa6515054
SSDEEP 12288:tfOe7qA2p2huV8ngoPy22OaXbQY/JaYfjYvT:tf3r2p2gV8ng2P2OaXbQYxj
MD5 SHA1 SHA512 SSDEEP

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 701KB
SHA256 0aedc75c1d3a73432991c3afba56d7fc1b99920aef2c1053ddd71f534d974801
MD5 782902188940f623ac9883f19abd4640
SHA1 a9990ccdb66e262b8aea75c812c4ec1d2a5d5498
SHA512 3c6311a9b85e4e46e2342d4f123ebad2e13f8ed83ae6732ea4dacf4825bc2e75a11e3889e2ea95f461618863e1aa7e84f440fded417ac9ebae774c5b9a1672ac
SSDEEP 12288:BUFmDDLeOe7qA2p2huV8ngoPy22OaXbQY/JaYfjYvT:Fe3r2p2gV8ng2P2OaXbQYxj
MD5 SHA1 SHA512 SSDEEP

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 065ebc1f6701b093d3160717b9fa7852cb6f7928d4802ea19862638c2e62520a
MD5 4a20418fc96477c1e7850c3fa152a3f2
SHA1 ac7f2e0a9cb83e7e08b377afcfcbab9fe5d540ea
SHA512 1815981ff44a451d2f9f8390f31952564cd28ca7493c871cd0173189fcb7c57b52e6cbac748c142ec5cd9fb7ed4d6b4e9b52129a0a4eadb834439b8257ca3e3b
SSDEEP 12288:ySOe7qA2p2huV8ngoPy22OaXbQY/JaYfjYvT:yS3r2p2gV8ng2P2OaXbQYxj
MD5 SHA1 SHA512 SSDEEP

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 b911d0f9bea846aec6323162aa14806f082a0eb6997230d619a1d62b44965e97
MD5 1279341f4b767afbfa945b8cee470585
SHA1 8577ff13b30a0129c1e39ce5f8e5330f5231553c
SHA512 b866d8e6f4d8660f354c73a587dfb99bdb6eb5801ad5cbc676536527719e2b2269896d0d35dc3fbe8c6945a7de8f9db5713aaf4d6111b1a6aff62e95c2910111
SSDEEP 49152:/a0h2GEkuAe73q3pp46zwwQU3aCg2PraXbQ:/a0hNYG4JwBZgC6
MD5 SHA1 SHA512 SSDEEP

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 659KB
SHA256 5716aa0816b20021830e93408e75a9478b84041f595ed526add181fc319a4e99
MD5 9d7575b880266be8f3b8e29cedf54cf9
SHA1 f23a3affc4c30edc2aa7b97d905f3b532f849319
SHA512 28352d49d2740d04ca9082249553b07520557740f17916b4bd9f09dc112ae9882e1413a3b4e359df9f69bf2c2938013ec1e8d6f19c80c6f9d6111cee719571b1
SSDEEP 12288:GhbHjfXWOe7qA2p2huV8ngoPy22OaXbQY/JaYfjYvT:GhbHjPW3r2p2gV8ng2P2OaXbQYxj
MD5 SHA1 SHA512 SSDEEP

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 2db4aa355d2a8a19c5a338af2df2d8fa3abfa4360daf617093d4a2583a985696
MD5 87b69f3f1fd9b18ca1b59502cbd5e11f
SHA1 14a04d8da74aaa58902442ebef87158a66a22ee7
SHA512 2d30bdd28b033c4f9bd9f8c9eec4ddfda8fbedf2d8923fe2ec951e29a4c0b328dd2932c927daf3dbabcb5a38c2df1ffcb316de21ce7cafd11ee8470dfadeaab2
SSDEEP 24576:m3YgnJcRTk4yti+R5dBR/u3r2p2gV8ng2P2OaXbQYxj:mIgnaTk46pBR/u3aCg2PraXbQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 578KB
SHA256 0832694310bf9df5033dc08025de0e896515cdcc70c3e964805f1c9d9d17481f
MD5 7e95fca2c72ca68c3e88e592e5160ab1
SHA1 1db044184898c3dd61797c56467ce8cd8f7151b2
SHA512 a3c6677c3770c2918ca26988fb716fe1112813c7fa2192831ed17dc0275365d55598f3deb8f8f31ac67fbdd7c628f421695ed3efa7aab4ba263bd8388245ee04
SSDEEP 12288:dWOe7qA2p2huV8ngoPy22OaXbQY/JaYfjYvT:dW3r2p2gV8ng2P2OaXbQYxj
MD5 SHA1 SHA512 SSDEEP

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 940KB
SHA256 555224280feaf4ed8688eb24a97858cd8356dbbbf763e6dcf2bb079b4cee475c
MD5 87b01c641a060a40bed7df29547fa267
SHA1 c3acea2cfcef7c9e322e7fbc309f0fdbdc2a006c
SHA512 cf8e6164ddb687f520dd172e4c3a31859647ce1dcf6652b4793d5949f842e0012c2f38fcac3f89cb544e913578909d2efa3af73e5564442136edc5841bee18e4
SSDEEP 12288:sOb9A4LWOsvAYFT/Oe7qA2p2huV8ngoPy22OaXbQY/JaYfjYvT:RpL3UT/3r2p2gV8ng2P2OaXbQYxj
MD5 SHA1 SHA512 SSDEEP

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 671KB
SHA256 a1cb4da5b8b3ed71e87d9e9d65eb7fee3c09adb22d4bc5af04a7a8c9f71a30fd
MD5 bbdddea91938caacc1f13555627598b4
SHA1 008bfcec7359be891003a3be81f848ee63d33025
SHA512 659d441130b584fdae670b8c8e7d6dfdfcb2604112c8eb83dad818a8f98234c6a1eed70181067ef6a4166c1be3b2df9c99ca62e3b46fa5890139a60d87937701
SSDEEP 12288:IpFtpOjOe7qA2p2huV8ngoPy22OaXbQY/JaYfjYvT:aOj3r2p2gV8ng2P2OaXbQYxj
MD5 SHA1 SHA512 SSDEEP

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 fff1aa6ea72cea29b11a6bf709e244ad0883374764ae6290ab3a5116d8666383
MD5 ea493b3c41500b2b6b203c405e6be0c8
SHA1 00cee5b7c1de851b6c61abd942466f8dc16f42bc
SHA512 ee61c0f4c9f7791dcde0e736ed4375a0d8ca07d4e303559273aa0ba5b4b67dae47f188135de7fa79ffe58195464ed57df9493de960426c4a1031aefc533812e9
SSDEEP 24576:c7NM9YqZqmWMUkPjZM48Mv6bEhsC3r2p2gV8ng2P2OaXbQYxj:c7cBWMpPjN8DbEh93aCg2PraXbQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 924b6f3bae27df8c4ca28e9ca867aa0af441bee76aaca85fd0dffb44363dc124
MD5 8abdc834a0a3085e4cb11b579d44042b
SHA1 1a2b2eb2802bdbdc60f8169d2602b00c907d5893
SHA512 b27bd9d7dab2029874b3e2db865a650fc4a22a7d5a7d1ef5cfb5ae8b6c36dc5dd51f604d921d4ae2300ea091a077a0f0035770e3d119b9c377d61375736eccb6
SSDEEP 24576:/W6BApg2YuyuNDYTabvcdvNYf8km1g3r2p2gV8ng2P2OaXbQYxj:/F2YuHNETovAvNYf8kmi3aCg2PraXbQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 976a02be86c64ecb66c2e573f1c28742fdb16f26ea3de6556c7455ce8f75c301
MD5 c39f0f3deb979b0a98bc3ccc8627006a
SHA1 e79c731feff960023ccc3bce8118bd17027c3143
SHA512 250f7b0117d9abaf3dd00f8451b841d4c93aef6b38a70fbbc61a10e03fdab1ae697f0a77cb1efaca2d6929d24c889ad3351d626bbfde8b507c455e9684fa45dd
SSDEEP 24576:QAFs06+Omlf3NXEbTon3r2p2gV8ng2P2OaXbQYxj:lFs060lVXu03aCg2PraXbQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 885KB
SHA256 8d0657d695fafc9fb2e4da56f2fcf030b73b2d2f475fe60d20a640d87e45a05a
MD5 6859081cf1307290202b7d91e373d28a
SHA1 f61a01f7c3ee20b1430e5542fc8d840d3dd925d4
SHA512 af621ecc901943bc4e68afd8bbf2446f7d4077dc3920a371ce24376c5469ce64da344a1d593a7f66f516574219ee8b648a09af0005be62b72b968547e38ecfe7
SSDEEP 12288:/CJnJ5D3VkrDzxiOe7qA2p2huV8ngoPy22OaXbQY/JaYfjYvT:6JnJ5D3WX03r2p2gV8ng2P2OaXbQYxj
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 f7b81361b5e1c6198498fca7b17d764c0155ff9b02baf3c639940cd96b353b72
MD5 1109e28e9e58ac5995e53d62839aceb2
SHA1 f5f0df8fea580bed40c77289ede4511c8f4d6c88
SHA512 5072914f74305a85a619ada95ea7d3f424304e3c197962eb3ec21c1d86a5587041603da258288de9e4a81e808d297d28ad6512552102ac356a9eb5eabbeac9ab
SSDEEP 49152:1g06DIKdwc+eQnSt65aVe3aCg2PraXbQ:OGZgC6
MD5 SHA1 SHA512 SSDEEP

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 661KB
SHA256 7c96cc1e3d580d2e83267626c7bf833e05cc7016e28800f86e84360736a34ae9
MD5 f25f06c8bcdcf3cdf7e43a33fff8ebd4
SHA1 0f9aa578e568d292956851811b31aec3695c5bf5
SHA512 cdc5ffba9c01e0a0220f14f26829a6215205fb9541cf16517dfa9f2f0e7d5dd4b04a72023ddd4f3129c622a202ceb875102d0ec7577ace31e56b03268947b1ae
SSDEEP 12288:hEP3RnrOe7qA2p2huV8ngoPy22OaXbQY/JaYfjYvT:Snr3r2p2gV8ng2P2OaXbQYxj
MD5 SHA1 SHA512 SSDEEP

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 712KB
SHA256 91a1b6a47259a22f9254cdee943d1fda1f968289c1f6dffb74fdaae8dc7ea7a0
MD5 a6807e427f921917c7d9e7000628a5eb
SHA1 5ae534e097bfc4537a1ca8a08fa99be04ed18d3f
SHA512 ae1b388c16cd127c02e210ef40dd472ad23bfef8b166afbd401b2e52c1398a7856a3d87e41aa2db96c048f2e87ff0f4479009be0bf59483cf1c5c0f13b0a2b71
SSDEEP 12288:XjkytOe7qA2p2huV8ngoPy22OaXbQY/JaYfjYvT:XIyt3r2p2gV8ng2P2OaXbQYxj
MD5 SHA1 SHA512 SSDEEP

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 584KB
SHA256 7de77e0173ece4f1582a414bc28f388ff37e2d1d8379e238279d6e48a03c5e33
MD5 a23f2d389d2f35c49d68e86feb9d440e
SHA1 18988d2cde1bbec060ccf990b9b74ceeaae72f08
SHA512 7dc68f654cf58d8c73ab9e9834019cf8b0ff45ec57f3e16cc2d0cbc4a3e99110942ce745c8ed9f0d04464215d0e21f934c4554a02aa70c333b8cf567f45365de
SSDEEP 12288:yyzOe7qA2p2huV8ngoPy22OaXbQY/JaYfjYvT:7z3r2p2gV8ng2P2OaXbQYxj
MD5 SHA1 SHA512 SSDEEP

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 a09b718b0bd91717925914ebe36ac6cdceb532d129602b7033c33790f1fbc1e8
MD5 c983cf4b59a9eb574549f30c5d0e96da
SHA1 217dc21ec9910d822d8b25cd21ef19a3b10aeddd
SHA512 f195ca330b013ab98db6b0635e139da527b384c608ea4143c3b05c669ba8c87eeb441a83bf334fb4314e69e8569f8b9af54c65431d36848dc4b62af95d28adac
SSDEEP 24576:TQ9MxZKdcz9dw3K3r2p2gV8ng2P2OaXbQYxj:TVKZK3aCg2PraXbQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 772KB
SHA256 1f535a4f8811df978beef32e3da45df3fc8cc37c2c9fa5ff069433e324d67bd8
MD5 188114cee2b107b4adcb70692a8d6576
SHA1 0ea65b183cae06ff498553ef6d40235f23709eb6
SHA512 2b9e4b1dca1e152e302ebc9562e849e4934bb47f6a4ca1e77e264c5219618be4c9987fea4272ccd04baa4a8fe0c49ea42146fc27c5c163223a55eedd33cec2f5
SSDEEP 12288:cyoKo2JRple9pxOe7qA2p2huV8ngoPy22OaXbQY/JaYfjYvT:cyocDApx3r2p2gV8ng2P2OaXbQYxj
MD5 SHA1 SHA512 SSDEEP

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 68821b1d076edb4bd8781457dde9f8747b38b7755f76c067832ebc6bd1374d57
MD5 bef8af2ed603c2d8425e83f6ae9fffc4
SHA1 04c49f01b7b0865df7450cbcbae8cdd450cfeadb
SHA512 bc5d43a2e2cbb7a5464604d737a58f19c9af7e3ef687b770031d9c0379df4606c24ea49b973f84f108d89d81b811e834041496e455b4176b3d82ac10f88bb897
SSDEEP 49152:eWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKx3aCg2PraXbQ:40zuNI/ZgC6
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 e3d6f4fcc44e56ca093b8df8e8f22e0a65f56fbf20ae1bbda4c9a0b8b725f942
MD5 abde2f8d9c4a82251edc2ed2bc913688
SHA1 fcd781a6cb728e852dbb17e159aa3a9fd6dadf7d
SHA512 7fe360a5e9f7e85a24d0af6df127e9ea138a63611c87f351a07179ae5b1b76bc87a89cc41a155eef7c5715916858a654d5e5a2891bba5d71778600712b94f581
SSDEEP 24576:u1QT7EcpfxR+N5AWAz3ooiYtjMqbr3r2p2gV8ng2P2OaXbQYxj:jTDxR+N5YzTfjMQ3aCg2PraXbQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/224-298-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/224-462-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/868-469-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/868-325-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/1208-0-0x00000000020B0000-0x0000000002110000-memory.dmp

Download

memory/1208-6-0x00000000020B0000-0x0000000002110000-memory.dmp

Download

memory/1208-8-0x0000000140000000-0x0000000140248000-memory.dmp

Download

memory/1208-48-0x0000000140000000-0x0000000140248000-memory.dmp

Download

memory/1252-82-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/1252-65-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/1252-71-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/1252-69-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/1252-281-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/1252-59-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/1304-29-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/1304-41-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/1680-333-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/1680-471-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/1812-287-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/1812-461-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/1956-463-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/1956-302-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/1964-313-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/1964-465-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/1988-32-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/1988-38-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/1988-245-0x0000000140000000-0x000000014024B000-memory.dmp

Download

memory/1988-40-0x0000000140000000-0x000000014024B000-memory.dmp

Download

memory/2044-270-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/2044-328-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/2044-271-0x0000000000800000-0x0000000000866000-memory.dmp

Download

memory/2156-26-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2156-16-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2156-25-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/2868-329-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/2868-470-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/3460-316-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/3460-318-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/3528-336-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3528-283-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3528-464-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3604-252-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/3604-320-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/3892-324-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/3892-263-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/3892-257-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/3892-256-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/4376-468-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4376-321-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4424-87-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/4424-80-0x0000000000420000-0x0000000000480000-memory.dmp

Download

memory/4424-74-0x0000000000420000-0x0000000000480000-memory.dmp

Download

memory/4836-68-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/4836-51-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/4836-57-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/4836-246-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/5060-12-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/5060-242-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/5092-337-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/5092-473-0x0000000140000000-0x0000000140179000-memory.dmp

Download