f619d0b3ea2f5cb79cb312cb03e0c7596ed8c46342e0600ca06be27c79903f84

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 07:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-06-03_bf194039ff2e6ae14f3af0a524d9b54f_ryuk.exe
Size 1.1MB
Sample240603-jktaksgd2y
SHA256 f619d0b3ea2f5cb79cb312cb03e0c7596ed8c46342e0600ca06be27c79903f84
MD5 bf194039ff2e6ae14f3af0a524d9b54f
SHA1 8b318747a496ec5ccbe2d83f5beb39b8c9b79135
SHA512 5007bd41e83ac834fafa151dd753cc93ae589d75bf03c83794d51dee0278fc26521941ecdb91faf16704b6df1935a1b7e03feeee373d2c2c96212bed79842fab
SSDEEP 24576:GLhGkEi8j/eWRwc/J213mDnfuBFDXPkO1SkQ/7Gb8NLEbeZ:+hGV/eWRwc/o13mDGBFDSkQ/qoLEw
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
4032	alg.exe
4716	DiagnosticsHub.StandardCollector.Service.exe
4024	fxssvc.exe
5104	elevation_service.exe
1776	elevation_service.exe
2192	maintenanceservice.exe
3832	OSE.EXE
3496	msdtc.exe
1524	PerceptionSimulationService.exe
1636	perfhost.exe
4156	locator.exe
4332	SensorDataService.exe
1084	snmptrap.exe
3128	spectrum.exe
4120	ssh-agent.exe
1064	TieringEngineService.exe
2552	AgentService.exe
4976	vds.exe
5096	vssvc.exe
1044	wbengine.exe
2288	WmiApSrv.exe
540	SearchIndexer.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in System32 directory 30 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2024-06-03_bf194039ff2e6ae14f3af0a524d9b54f_ryuk.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2024-06-03_bf194039ff2e6ae14f3af0a524d9b54f_ryuk.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2024-06-03_bf194039ff2e6ae14f3af0a524d9b54f_ryuk.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2024-06-03_bf194039ff2e6ae14f3af0a524d9b54f_ryuk.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2024-06-03_bf194039ff2e6ae14f3af0a524d9b54f_ryuk.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\dd30c53cc3136770.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe	2024-06-03_bf194039ff2e6ae14f3af0a524d9b54f_ryuk.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateSetup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\minidump-analyzer.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2024-06-03_bf194039ff2e6ae14f3af0a524d9b54f_ryuk.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9926 = "M3U file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b97c450b8ab5da01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000075a16b0b8ab5da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000119fa90b8ab5da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9908 = "Wave Sound"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000058b1bc0b8ab5da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008448af0a8ab5da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000940bd30a8ab5da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000eb06300b8ab5da01	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
4716	DiagnosticsHub.StandardCollector.Service.exe
4716	DiagnosticsHub.StandardCollector.Service.exe
4716	DiagnosticsHub.StandardCollector.Service.exe
4716	DiagnosticsHub.StandardCollector.Service.exe
4716	DiagnosticsHub.StandardCollector.Service.exe
4716	DiagnosticsHub.StandardCollector.Service.exe
5104	elevation_service.exe
5104	elevation_service.exe
5104	elevation_service.exe
5104	elevation_service.exe
5104	elevation_service.exe
5104	elevation_service.exe
5104	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
656	Process not Found
656	Process not Found

Suspicious use of AdjustPrivilegeToken 40 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3480	2024-06-03_bf194039ff2e6ae14f3af0a524d9b54f_ryuk.exe
Token: SeAuditPrivilege	4024	fxssvc.exe
Token: SeDebugPrivilege	4716	DiagnosticsHub.StandardCollector.Service.exe
Token: SeTakeOwnershipPrivilege	5104	elevation_service.exe
Token: SeRestorePrivilege	1064	TieringEngineService.exe
Token: SeManageVolumePrivilege	1064	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	2552	AgentService.exe
Token: SeBackupPrivilege	5096	vssvc.exe
Token: SeRestorePrivilege	5096	vssvc.exe
Token: SeAuditPrivilege	5096	vssvc.exe
Token: SeBackupPrivilege	1044	wbengine.exe
Token: SeRestorePrivilege	1044	wbengine.exe
Token: SeSecurityPrivilege	1044	wbengine.exe
Token: 33	540	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	540	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	540	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	540	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	540	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	540	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	540	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	540	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	540	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	540	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	540	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	540	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	540	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	540	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	540	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	540	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	540	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	540	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	540	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	540	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	540	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	540	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	540	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	540	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	540	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	540	SearchIndexer.exe
Token: SeDebugPrivilege	5104	elevation_service.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 540 wrote to memory of 4380	540	SearchIndexer.exe	124
PID 540 wrote to memory of 4380	540	SearchIndexer.exe	124
PID 540 wrote to memory of 3380	540	SearchIndexer.exe	125
PID 540 wrote to memory of 3380	540	SearchIndexer.exe	125

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2024-06-03_bf194039ff2e6ae14f3af0a524d9b54f_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-03_bf194039ff2e6ae14f3af0a524d9b54f_ryuk.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3480

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:4032

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4716

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:4732

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4024

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5104

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1776

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2192

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3832

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:3496

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1524

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:1636

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4156

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4332

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:1084

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3128

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4120

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:4896

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1064

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2552

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:4976

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5096

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1044

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:2288

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:540
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4380
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 804 808 816 8192 812 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:3380

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
Size 2.1MB
SHA256 54ed89fb5d84ecf33b2042888ddf4dfe32b460a4bedb18d86bfec63201d82fce
MD5 38384cdd3a30ad71f105f055a51b297b
SHA1 7a1ea0b12b1af3b441471efc756a00d25cf13f13
SHA512 efc98a1866107cf772546248b4c25ad51655f4d526e826e620d51f1dfa11f7a4cfae1e7b141be4e2979c0511f4870bf6735090fd8a40db8eb431d01eeaad1ae5
SSDEEP 49152:suYk3H5koUUfTqkkYLO/W2buywzMbOX+T7z5/kQ/qoLEw:s8fTqi90bHqo4w
MD5 SHA1 SHA512 SSDEEP

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 797KB
SHA256 6d4e65f36363f93d431e8e26f76ee12eec2865504ebe6c229ea63bc5ec091790
MD5 db95c833af87290db13be773b93e2110
SHA1 b4df3e6f78ffca2c5ade6187f8b94cc402de79a2
SHA512 b221f505c0945fb01877e4e434e05330f36c1e79902a143e537acfd8b4caf10d0443d0ae947305d5bc89028d46fcd64b6a8f34ed33655e25feb449062b7395b4
SSDEEP 12288:jcQiZmNJLBsunEWMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:rionBsuEDSkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 9100ddd8714d210fff52ee75a067bc5c9399b4fa0e591e97162a2bef0bd30eef
MD5 3710b350254b1cc67d8f3c45a1e929bb
SHA1 a51853915e52d7abfb8c02ca4da3c656ea3c4e8f
SHA512 d74d2c5e2b277a6d065528f71fa36de9026995afc57097959ba655ebf568f2e5731cbec2921ee74cecfeaa5523cf684662314d84ce232ca25a13daae8e295d5a
SSDEEP 12288:Z7a3iwbihym2g7XO3LWUDfh4CoCMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:s+gkEdfh4CoHSkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 91e86ac6c5475b1edeab69b27aa9635be4043a92169c722ae0f2f0a25433ae85
MD5 4f8e8ce22134a377ccf96ec8e49453d1
SHA1 4906dea331e6184c8709047369989f035ec9b15e
SHA512 32058f29b2aa630a44ec9f01ca693ce4046a7123d578711bd36c27974d62e4eec3f222b3fd32c8fc8ade744324fea4f5ec2be79c927411f70cd6cbe2bab46849
SSDEEP 24576:yBpDRmi78gkPXlyo0GhjrCSkQ/7Gb8NLEbeZ:GNRmi78gkPX4o0GhjHkQ/qoLEw
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 072e7456ff6bb82ed853815ce02110179d68dfaf8d930d703875f7a6f0408522
MD5 db0975e849836bb327d33cf1c19050eb
SHA1 7fbbd0141540e3d1bb4470198b20591e33fb1e32
SHA512 4f4350ca26641641b5c99d819e8c856c0f42b39650e30cbaa64bd7abf84bf16b0926f148b822d9fb01fc2fd64692b231c52b4c133f26be9a4cf9c2ff5cc02c24
SSDEEP 12288:FfC6Aj+TN5uixZN+8rKhUdTC/wE1DD0Ca5ZIXVCMTmkJR4Do07Y86gw5CtCjX+NR:dLOS2oPPIXVHSkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 8de86743eaa3cf2b2f6d56fa53399cf266c5696a3e8fa816c94ab28fa4f99862
MD5 6ee557f32a845faf44cbfeda9dc066d4
SHA1 70e607bcccafb91e19a289b23ca8e382b8dd8a32
SHA512 acbf2763b354a4f01195a84bdfa4fe2ed00daf41b436e9faf2f385a48f6185a353b73c0f545bbc77f3f8739541a4b48534a6355fa55510223570366108082a87
SSDEEP 12288:hYkMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:hYFSkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 574cb275481c51203a566cc97a53b35fda4cfe5b0af4dc90e96c13a51a5b182e
MD5 8147153f1280e8f1c467ea2c6e31c9ba
SHA1 a1caa58e60c3e1e99ee16c5aa82e5e520697c8e9
SHA512 8276fa611dc44b83759fc0b20b9f533886526da44c26798c6ca939b36e1c58cdd15f32df6356afdcfa84c4439f3654fdd0b730c85f81d66d6eaec5942c8f7e1e
SSDEEP 12288:ceBNUbTVO86UDMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:cJIUgSkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 37a1a1189738f510567305bbd33c1095322530ad113d8f5182c745ea168cf200
MD5 31574ec816c1642500319818e60d5fd8
SHA1 01dfe5a4654241c1d259252cf07a2d2613996e75
SHA512 ab45c0518a6ca2ce85e8531c86dd7e49d06baf8c93528937a30871d09ac0ff43a872b0a7abcdd9b5928a1893cf0b25ce5202dcc86955ce18ad8cc4b435bc1052
SSDEEP 49152:jQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3TH5:jQvGAdlCEL8c/WRNw5C6qo4w
MD5 SHA1 SHA512 SSDEEP

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 2eca6ee3d383cc5e96043f48644e920c90eb56e2c8f474a9ee32ba6114fe091d
MD5 a42ec29ee6cf57f95046d2eeca161f0f
SHA1 0cdd95b336caf8cd69f946b31530abd2a14d94c9
SHA512 2397749564a477f37507a0582108658060d92ea14b648f03da5232c1e143afe78051746bf5a0120c44456190d41a2f79cbee05a02646476409f10b64ae31fa00
SSDEEP 12288:0AwSfxL/2Dc3mDLLmt0LDQewsAjxMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:JfewsAjKSkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 2bbd7de56b9bb37687daa3c422f16865544109922c62caeea44b530f63a84964
MD5 b798991c110b86ba76ab58af58a1e9d7
SHA1 9fc71511efb0ccb88bc26d742281e18e4e5d62d7
SHA512 f9f0e4cf9924cc5b3c1e7361254c6e23266208542bf56304a1f372f7d2bb22287f51eb8225c4c243bb2fd0b7d3a6105de25f9507f1e308e867003670a1250cec
SSDEEP 196608:wUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJH3:wUEtQevvqc2W1cpV20I323
MD5 SHA1 SHA512 SSDEEP

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 8bc197f0fef865dee698d888961bc443102ddf22cc4a9cbc8c26d3b69ba49b48
MD5 70cff408cf722fc3357f9b4078255adf
SHA1 89e83cc8fa16a82f2e9bd9077d2c24003142a261
SHA512 f7d547031b7b4e32aea07619c2ac3555603ab1cada2ce308ed6b55efa1b1b8ce433f455af451296b71ffae4416818531b007e39377d42d29f255f7b458a493c9
SSDEEP 49152:dCbRquA/m2yL5zLfFiV+XenmE3/zjkQ/qoLEw:aoq2Vjnmmqo4w
MD5 SHA1 SHA512 SSDEEP

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 3e0a1f626cc7f9b91acdd8c9d22560222908f9744674463b2cf05e1bd1443a87
MD5 8127e4fe54c08b2bd23e7d1af40366fb
SHA1 6b2248abf69828b26498c1b2ccd7ff83e3e8cb8f
SHA512 61190ba07e74a81f5853891adb6a96f8ee2386ee2aafed48839a0ddc68b4376ea533e1749af27f8fbfe5687b21dd85a1e4c76ea381c35c071be1e36a990cc06f
SSDEEP 24576:jAhGL6IFoiwtA5l7S53XSkQ/7Gb8NLEbeZ:jAM5Foiq5SkQ/qoLEw
MD5 SHA1 SHA512 SSDEEP

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 b2dcc03ecf5b30d2a11729d4f0bc804ba28f37a73897786897c6a5a4ea774b7a
MD5 1afe77562ce58c796842f1391a0fc1d5
SHA1 eb9b9987a2dbfddb4d7a89c2505f33969e022951
SHA512 45804d233b121c64d101d0a273665a5c2e62afb9e532fc7a37ac181c6022be8f1187debf749c58abc3aa47ab7eed369c2d4d2c872df9c8861989b2ce734d23eb
SSDEEP 12288:wmw5HEjsChNEBFgl0WDm+C+MTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:twuROWmSkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 a47126774f4dd09d022f935bc74d2d33c9ceda897cfbbbd6ed7a3cf0181e5e1f
MD5 f88ebad4e232d25ea3be019f4378e845
SHA1 40803ccf20f287d1a1ab1e7e423574ed7149d560
SHA512 d5bec85517afb264c74ef812b9e5758c9c89786bfb9c390b1f324823e50546798011833ddfcf915e5a26a7a8b84e0ade14af1bda545d03c135ec8842b8778229
SSDEEP 12288:5yZ1IyhMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:wZupSkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
Size 5.4MB
SHA256 6fb2ba52cbcc7dfd89e4e2abd5b44dcf2a9cdd11e273e3a8b69ea87a2635600e
MD5 7acfa954e511158b41acba4e1555fc25
SHA1 0856a0f5d08b74876d9c78e8330128b793c91eff
SHA512 64c9dbb39eb585d24eb77162a28644d3a63b102e66bdfedfdc2a38a2b5688b3677bbc50e745bf65d500b0095683f8c4ff0a315286f95e1b5d451cbe6bbc338c6
SSDEEP 49152:b0kwIi7c4xZlm5knEtw99Kn/2vim7vgv6m+yyJ/0gbvjK7yY7BHi3u7L/gBUUWLJ:HwfhY7g/rL+7yYA3awr341g+qo4w
MD5 SHA1 SHA512 SSDEEP

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe
Size 5.4MB
SHA256 940d4d08a618ebb355eaf6b05e809570b163dd404b7e4d0749a19a5330d03725
MD5 67f691d8f8eb60aa9959ab83d4015dd6
SHA1 4f77814d7fd53112302cd3aab523375263c04a8c
SHA512 94424926c58b0769305bb2788cd336d61a1d32fa8a0941e476c065b7a8c99838e8bd02d74a6ff798e4810dbc6bf21f990a680c30d8e928a74a33eae26908bc0e
SSDEEP 49152:l0kwIi7c4xZlm5knEtw99Kn/2vim7vgv6m+yyJ/0gbvjK7yY7BHi3u7L/gBUUWLJ:twfhY7g/rL+7yYA3awr341g+qo4w
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe
Size 2.0MB
SHA256 fda4765ff1aaf0d9d703c071320bb862e8064f50ff36c66a717b258a9eec5405
MD5 c281dc3ceaa2cb00ffc1ea4409242422
SHA1 80adf8ce3d6792c0cc629dd6316427134ecf9d21
SHA512 8789b817060a1641940e8c511f19c2334836ad055005224aab42c4cf5af07c2209a4bf54df0c8709732bb84da9356ac902b3b52ddb730730696f6335b2cb7327
SSDEEP 24576:2cTyYv0FteQUk5I2kjgD6iQacAmSkQ/7Gb8NLEbeZ:2uXv0Ftpp5606zO/kQ/qoLEw
MD5 SHA1 SHA512 SSDEEP

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
Size 2.2MB
SHA256 8b7d0f251887a4cc355cd25282a24da62e7992b63500e1bf1648d7c0c7604846
MD5 62096d13c05ab906118d240ffa5e604c
SHA1 f1b134ad0ee40f749434db5d9b305ab68363b4b6
SHA512 53e132148e4237b9f26b396ce01aca2161f344c4a543a967c82dad1b6fdd77b70765955521a670099f3483e682bddddcb3e6012b1ea28e23fa3210c5d956169d
SSDEEP 49152:Yy7mTd0GxN8jyynzHjXKUyn4GVcbDSKrNTxLkQ/qoLEw:HmYeyzHjWjMTHqo4w
MD5 SHA1 SHA512 SSDEEP

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe
Size 1.8MB
SHA256 7da6ad6af9e8aa58e0ce095cb9353f94f24a3aab86c0ad2ae045c1930494c8b2
MD5 b5324c0119a377edfbed38468f296077
SHA1 411f6dce6f9ab0c69a9be7b0137df8c7949b26ab
SHA512 8ebc676c353639a494730d463222a0784819a010e683e2be808b35475995248779ad44ddfa2b068c262bd2e3a55068c93289a9b164892f4e81f607ec19ae7e23
SSDEEP 24576:46drZn1WEci182IEUINbJeRgUebgW816RSkQ/7Gb8NLEbeZ:4WnDci18cNNUgbYnkQ/qoLEw
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 1.7MB
SHA256 d75720dbb18948dab3209c88e93542f9b210a4aa4cd5e3817e54274b9216a4cc
MD5 6624cb201c5eadeb34119f1eae14e0d6
SHA1 508d8ec7f0d4f1acb178f8eaa1e394ef4acd1e21
SHA512 739ef7a1eafda8bc12e2336b85dcc60414a16e382a322f8de16fe03958d36e282033bda08b5e65de519ba0f8713ea4f0b7db48fcfa7e349e422d478ed7fc6eee
SSDEEP 24576:Pk5lHW5EzMZupOM0G2reD+melRgTTv/1nyESkQ/7Gb8NLEbeZ:PizMZO0GhamSoskQ/qoLEw
MD5 SHA1 SHA512 SSDEEP

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 aff27c9d9944bbaf3cb18b8b953bfabcdf10096ed5a31db763ab16d64e767c9c
MD5 50199e615ed66007bcafdab6fc734928
SHA1 3708ade15f3db04d6c03f3e8b73730e9da731b61
SHA512 1fa0d337af13ba142ec0a0d6e08544bf549da40cfd9d8acc58504f0f093dd33105b1bc770670a69412ed71094e58840fc88c0c133a407d94e5a8cb8ed1034596
SSDEEP 12288:rMMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:rdSkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 49e92d3340018c41fcf6eed9cddea32f78738c1027fd31392f3846ea4acc500b
MD5 726fd165ff86051a848de13caff6539a
SHA1 f00b46b4db22a8ae3e8c47291a67b00f3aacfe0f
SHA512 cdd788d3ec7e783fb1a61182181ed4438e0c4bbe8d2d08152f5160eac1c7b125d7edb3d5b63e2f96a968098f5aa6e7728cdc773ca17076f33f1528c73ad3cdbb
SSDEEP 12288:QtMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:QOSkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 21cffc774589789b0c18af033292c45a64b6c7b99d707088f7018752781b30d2
MD5 1040ca2e77f1bf7c6df1a5bfc4b85f91
SHA1 49bd4acaef0e763330e97fa8ea17b9a44dc65ae0
SHA512 181777c95f4e9a8a2d8e93ee0744c7bd84fe03c436d9eb7b4a093a3a75214acab3a1f25bfde268ed3a9996cb82b4831cba3efac9a747e930d459ff975a22b602
SSDEEP 12288:ZrMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:Z4SkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 a284c41399e7025c7e5b607c1b712513931a3779660126acecd9d78ca74ff7e1
MD5 badf7cb581887ff3e12ac83a9a8e559e
SHA1 65302e3f5c6ddae78cb792eb60d29e2e08123208
SHA512 cb67c7c21573cf262c5c290f35ecc5d31cffc042ce67e86f7855c51a0018171f2baf814137b426b397e2cb5216f73715a01f12cd04e1a74f3fe0acb00b10f8ff
SSDEEP 12288:WVyMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:SSkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 4350107d55eceb907a0212d368f28110136ead2160f57ceca098f3f48d65a873
MD5 5dc6ab168384049bd4474412df9836b1
SHA1 ec5e91667401c21760ea33cdc6a91fa895ce8b1e
SHA512 5988659160af61fc0aff53ba0839b126ae73b72d429243078ebb906a4a9d7067ad2262a48400e4560f3a1b991dd6a7b636622acf03b006dd97ec42356405a319
SSDEEP 12288:4KMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:4/SkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 afe5c4783041d5cd58b8bb2a2a0e6f1c9e061f3ca0a799e7e33fc012d9ef6185
MD5 9031df21b86658d63814782cd043576a
SHA1 5283702a3e4d981b7fd5cf970d7613fb7f66b19f
SHA512 8e475d04cfc5620de85d457880936e0fed994efefb00a586578cda0d3c1ba854e38d34377a83a27b5ced4a71d789707eeb53e6336886ad0fad361e0abd32e695
SSDEEP 12288:kZMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:kCSkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 2c784e5b683699be3c145f8a8ec01d1c7b85f6417c73a05296235d1c86a888ab
MD5 c3d1b26c731ce422092702cfad54df16
SHA1 fadda5e1e7e52c09dc8e7baac08eae6fbc0a4d4e
SHA512 2811f01fb3b3f888842e89a168f48af51c7ce67e23693c6a5013c57424cd525cc94763a17284623b0a613504582bb60f14b9dd1e1a69e69c971715db01de3f46
SSDEEP 12288:vFMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:v2SkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 900b504acb1bbed1acd5ecb30b6d240bd6a922f43b2021455c6c0d6d80045770
MD5 ef1faacd5f3014332424105fcaf12b95
SHA1 3f0d9e3d3a1eb7d6a557b1a469e779b6c68c4019
SHA512 c2121b30c9f09daaa419affcca595f15f8fc3bdf34452782f9d109b3928e78898c9aa4bc9a54e21108d3197fa9d57ff64ecce94138e7d8c6b3cab21328c5448f
SSDEEP 12288:ziZwbDzzFEoS2cPvyNMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:eZM3zFVSOuSkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 dc5ab36d9d7466b9dbc83070f5aed55da1075a9dd8d4426a924e52c55413788c
MD5 b08ea1629e20aab0f8ad9bb188f1bb63
SHA1 27cb1c7c995357bc2cbd9a827a40dbe2c3ece3f9
SHA512 c907a4fa3e80d2f8a9612ff957b6a947d726227c91ac52af9be4ac99a3398f19d73732908a26f635450e424973268ee1b1f629b2ddd0fe0a61ac677c564237c1
SSDEEP 12288:ZwMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:ZZSkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 e9b493bf7ee24e73570332892f4cac7c902e202e329570471030fd1b61e80e15
MD5 6fc5eec39f048995aa2bbfb477a0c370
SHA1 d8d2684ccabfb432ede326c429f8fbad26d6486f
SHA512 b0094707502f47891454089e24912e4dbc69b460df29b6915387d4417c309d310969be10790269d3fc70dac394c4b806a44b21d1cdcbec456c41fbdc87763c75
SSDEEP 12288:sUMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:s1SkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 3220f051c3a28667944a4aa60e1ef85c4304523c4a85efe92f70715a0cdcb78e
MD5 cd579ea5a427dea1e6d4585924757ce1
SHA1 1ff1c1ee928e92a5e06bca2218c4613a1ae13cd4
SHA512 b700997b74540635d2428a9eb8ba59b3e763f538fadbcffdbe8c4038338af50b8d55efac2a9167aaa10ec38c7c47b9f951b87415e6f54f92cfa69d2ca3bea7d0
SSDEEP 12288:FyPz5L8hMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:Mzy6SkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 5b9fbf141c2c9708d05270da47db630a340506ac812c8f258632393aa1b7095e
MD5 ac248a04fb5dd86932c02a3cb57ca9d7
SHA1 63b262d116208c961764e4e7c3dda2bb651d713a
SHA512 6674d7c65d6cb83664f0be8d78ceb1efb04b2d96b6a559cdb3632319b89f4fab47713a01f7330f62fcb7a6b2a6794339a525e2c2fd1e08a10c1e5c8e106312e3
SSDEEP 12288:8wMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:8ZSkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 8d57e6613a042f3caa53c57252e84b7fbf26c41f6030ac01d743bc2f5c94f7ed
MD5 cb2b3b744fb4976bc4b723cf9e6fafb2
SHA1 904a9d21722224c330568356fd197e7e3838b2f0
SHA512 890db99480090ae78a8db05b2d228c75a9a4be5f87b0b72e7b62bdbfc76423155dceae83a761f68302d4e146d4a3f2a2f16eda7ad15c9f442592dc99df8e00c9
SSDEEP 12288:awMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:aZSkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 83caab616613e000b12a66d904db78cc92a973fad17d48d834fb82b2aafad35c
MD5 b0f92652957710cf2bec4663017c0391
SHA1 f08519d019ad29c763ffa6fa6e1d17a43feae497
SHA512 7129fabc90709721d7de476bd3465b3afaafceb4c9439fd2a65c41027050c91c3a298086b4e902502c88d00ed258bd77b671aafa7ad9edc9831c1424a47d6db5
SSDEEP 12288:0yPz5L8hMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:tzy6SkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 c0b48786e2bdcbaa8505b8b198f5a7c929b4506ab929dadf4a92cf6b55a2b1dc
MD5 18cdc010c6d0a32786553d5a907b4860
SHA1 738ad06b988d9ebc783da79143aaed52b37d9f1f
SHA512 772fd154c44f5b89c0070d072f1ad4148e340b4ea682604481ba37ec5335881bb32c0964af57d2cbeb4b3e8d65bfe7c8d494ac4749a3950004547746483322f4
SSDEEP 12288:xCd91WYoaLHF3z0z04PDvh7MTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:MT8aLl3z0zDISkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 9ad2eeefdb916b0f46429ffbc38e08f7cf29921ee90ccc47c7766ef0d1412df5
MD5 7caaccbfa14df6836c9144653f795cd0
SHA1 5908241867cf6f53ade1a8ac01607abdf1b45128
SHA512 9513c70b88fc045fc8bb29309cb4824b870b0e51566f6c18b68338ee8f2561717fae8388fb5ab573f780b6f3ca6ff89e4509695d5f671622f5e76bf440b98f51
SSDEEP 12288:si4e7+RdTfgwCHKy7GLbbdIvWMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:s3rd9CHKy7GZsSkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 2d912ec3ade6d478e0005f81a87d41902d0cbef8b5732716e7597e55e37622b6
MD5 a7a38cd2f2792a1e074ccdf45ec24336
SHA1 813e43019014fac002b9e74b28086b34b2bc6add
SHA512 875598a43737fac9b3accb939f9b1ac9fa0f78d053d5b8520fc89bdfc28f23df4cb9bf97009caa3a24aca7a55fd53f1c4f7ec3d4a27cf955748dbf6dc3ac0c43
SSDEEP 12288:BLMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:BYSkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 b16d8422617f6a02ce392bce1f96c2ea3d758ed8d25ab4952413fb66e395e247
MD5 54e312b8e0f892df01d6ad88f77af4fc
SHA1 a7d16f2312535d48bd6d5a4595e060d3b65967e5
SHA512 61aea80162927bbe6ee8170bd4c624fb2e5a36a10da96466b0c2cde0fbc45ce37c2a58f94240b8cd964e5a14ece79dfcbeedf8629cca48b4df4a7f721829a528
SSDEEP 12288:QBMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:QaSkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 bd11615ce11824f2d71e58a6091db427373ac1359fe0deaaed3a81f0120ff7b6
MD5 5de87b9ec0df8b7275b3ef4287472349
SHA1 a7ad4ab5079b9c4b431349582699568c043de3ce
SHA512 4b89ddf9c69104defc4042ba612aab9c351fcc3d8f080b8f2fbbe9ef58badaac7a378e523883cdfcbc4bf6483fb08034e5db1a736628bc081029535e1750c203
SSDEEP 12288:tWMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:tDSkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 7a2b4ad96910f3f118b15e2e08e5586aefda49010a9e8f23559ef5e17205f554
MD5 5db63fa3f8a811c87cb74e9655f380e1
SHA1 edddc8e3afef0b4a35b0ce0a4d0f33bd46a80f2c
SHA512 dd774526bb1d9f253632892ebc9ff207c22cc6ba532bb955d266eff9a2d931bed874910c98eaae19125ed39609ebb3dd7b77644c87c9ce59112b4e925e1827b0
SSDEEP 12288:5wMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:5ZSkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 7fb72750f98a5ee457aec02850b872bcb1653b3047d5575b1e8c3814ceb311f1
MD5 9fcd44fcd03bc66df3c5f08258c44880
SHA1 ee2af5d95d35e9d54485470641435acbebf7047d
SHA512 41fa2e3eea5e043e53284102294e71b78df60ad9c6e019fc524f5ad323a5bf7ce272914905ff7470c8fa605eb69f32b20a27c7db876874222efd818a7825ade3
SSDEEP 12288:lLMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:lYSkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 701KB
SHA256 d92480b7e8d3d5dafbf1672b4ade60cfa7cc1ac05156de38458265ea63c648c7
MD5 3c0c60708db1e0450819f76ddd811b73
SHA1 1ac52765b70d0a43d65b16fb1e883735f5676bf6
SHA512 284558845791a3f7ece6050784e624dd28de0d33dbe183b56aec169ef77d4b5ab24734e62a1424ebfdd8213b3499980f06f3a4fa0b949b90f809c85d2b8dbc5b
SSDEEP 12288:SUFmDDLXMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:A8SkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 dca3cf727fea40464bf6b5d4ca8f0bc92142ae5bada836c8432a2cd48422465e
MD5 aee773ef85b5dbbeed8258e234ae9e6a
SHA1 f76d280a9e0ce9086fca2674ba1da29a3bde44af
SHA512 6f64a105c9cbb7ca6ef9e906870289f7ca2c7c0a4addd803067676238bf0d461f4d671865e3e961ca1e5293fa25c764c06fd3643a8210e6e52f7c4f1a691bbd3
SSDEEP 12288:hfMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:h0SkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 0b123d5f5130536eb8656a90665a96173b3c13a628027c612e42fec3e81b2bfd
MD5 62a5ec68995fb69816a72d84b92c8f5a
SHA1 8108ad64793c4166565a085f8b943d830bdc52a1
SHA512 5181b2218de091749cb8abb2eeabe2e487af4f02799ae20d89d3e85249bd8bb5d6e3c6d90f9de050c914f9173a94e00f9a20e2dfbae2551556b41bb4e37dca79
SSDEEP 49152:La0h2GEkuAe73q3pp46zwwQDkQ/qoLEw:La0hNYG4JwCqo4w
MD5 SHA1 SHA512 SSDEEP

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 659KB
SHA256 3438de032058d5af7dc91c19b91a4cb736886cc8dd25d65ec90490d7390acba8
MD5 8ccf2a6d182fef5bcc41f284ead44e9f
SHA1 1527c6d2939fbcccd2c6598307d0ffdd35ca8abc
SHA512 a69bb0382b6a2bc9efcc6940a8e4cdf50294fee35733b40305a6ff779c899779ef8c5018b4b9c3ce6ef02a5450ef4ec4037f6507483cf8bc6329861500aa8c6b
SSDEEP 12288:zhbHjfX1MTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:zhbHjPmSkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 243242fe3500dc41d07a83a05542099278945a670780a3e5691b92922205a0f8
MD5 c2603581d0d9f465e2ebc968c3d362dc
SHA1 028c6ea950cb9ee5c481c1bb8ae5ad52d970f0ea
SHA512 fde8c483ec7e84fd4f9291c249f801edc34e1afcb3b612b2bde8e92db369972613ce2e22edc0020bf700a0b9d965c583e21734bd8418d9ca70e0273025a6a4bf
SSDEEP 24576:/3YgnJcRTk4yti+R5dBR/eSkQ/7Gb8NLEbeZ:/IgnaTk46pBR/nkQ/qoLEw
MD5 SHA1 SHA512 SSDEEP

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 578KB
SHA256 571e31c0d8d2eedd56020fe687a35d8a6f15629e1463f488d72bccc0494243ab
MD5 f917438724d422033ee59cd31cff35b0
SHA1 5e45c71255b4857631ac6941c2c5c805cf2606df
SHA512 5fc990e0fa59ac80f687b20eb58e79020c6255d3f9324e081de0f2d8f9139fcb09b817830360025cdcd7376ca6ac9344964a38f4ad26743453e0c845f71633c5
SSDEEP 12288:7zMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:7QSkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 940KB
SHA256 bae77135a8675adf3b338749303e87cbd91cfe67f92f2bf1727bdc7662944339
MD5 e8bc08457589ef0f9f4adbc3987cb139
SHA1 eaf1303a9089f9ee039e14f0a1d55b176f121008
SHA512 a18ab383f1b5288ad4d24acf3430d7d5504c0772d50589221c316264caf0d0bfda3ce697185252f7bcb2d5ad1934360c22ac16763bbe9a26ce1c114d67e1fb53
SSDEEP 12288:aObIA4LWOsvAYFTEMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:LAL3UTlSkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 671KB
SHA256 20c6889661123e85a933661ca9116f2e23aaf5a92d72636262bea5c7789613bf
MD5 03fc2a3a73696d4bfb1fccf58a48ddcc
SHA1 6647f05c5987b3ad6d88fe195088f1f4d3b2393b
SHA512 e7fcc0041ca20005c8eaf38d143b4399087583469ddee6bec6e48165524c233d728d3638adcf2f122fc2e29327d8b453f0dc093d9880f3ce0e0ccb1920534f91
SSDEEP 12288:hpFtvOYMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:3ORSkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 5c0bf04de84594af4e2342eace6b8886aa4fa44e1b9eb2b0aff98446a241a562
MD5 65a31b0d62ac8a2459846e1f1dcbee26
SHA1 79919cf3516ab6355021ef32a2bc633029a713cf
SHA512 e5678a66812f94ab9025dac6980d8ffc2661a5599f7594738c24b8c4a9f92d3e55d1313692d3dfde0fddae04c7af7b7652d18e30b0aa752c0f895435f49b8321
SSDEEP 24576:07NM9YqZqmWMUkPjZM48Mv6bEhskSkQ/7Gb8NLEbeZ:07cBWMpPjN8DbEh6kQ/qoLEw
MD5 SHA1 SHA512 SSDEEP

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 00c9c86bbcb1eab7add1d7b7e566fbd65458f8056819a9c45da78f3ab775c4b2
MD5 8bf0386ad008008cffda5c895e1d802b
SHA1 4bad18f3add063badcb06b6b9422997a7d0ba4cd
SHA512 25085784b3a1d4a9b62f48c1310186ee7efe2db64c27a66baad86be96829ab2cd9d352d9e4beac4d1c30a2d37a163317e7061e6b70181c2e40ca9591e33c9503
SSDEEP 24576:yW6BApg2YuyuNDYTabvcdvNYf8km1eSkQ/7Gb8NLEbeZ:yF2YuHNETovAvNYf8km9kQ/qoLEw
MD5 SHA1 SHA512 SSDEEP

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 a45fe9d2530bc0e371ad2c439ee99c23b9f1f527153d9458984b7bd23f36cd90
MD5 3e77bb58cc7444f6a54c4382b05f9dda
SHA1 a7ad9cfdbbf752f98c55257247607c2b662d23e2
SHA512 ef1e0739c4e89289d96d1be6980d4ab6294034695c8b856ece0be10a24b0528f4930d25b35547b109231268ec8226fd313dfdc1b55442cf04bb0212d7f793481
SSDEEP 24576:SAFs06+Omlf8NXEbTodSkQ/7Gb8NLEbeZ:LFs060loXujkQ/qoLEw
MD5 SHA1 SHA512 SSDEEP

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 885KB
SHA256 baa034f3a84b9c95813fd9f431d4f367b069889c109cf271c0d9a2c6169c5564
MD5 00b8a055ccfc7de0a51f485115708021
SHA1 dc6575c0e72a88fa1f44bd06b0281a0e8a234942
SHA512 6107d064ec70649a7a9d34bbed57043f8c92f2bf17eb2dae205085b6337370e1cd3357295b04b270a0170140a84277c7d51eb98b37714bc4eb5d2d78315eea65
SSDEEP 12288:5CJnJ5D3VkrDzxvMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:QJnJ5D3WXqSkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 98077bd088e6c7ad669fff3d794dc6b76ca4cdbf6824f1147221886db83cb9e1
MD5 b53629610cf75883a42b0b959cf0a044
SHA1 01d77a685b2780d0832795e60d322c028e250c51
SHA512 f9250c5d19f1633f92fe337c87923f25b2b4752b8ceed1bf0db20d823abe5b59adc5fffa3132edb6c2efef291fb5ec80244c4044a018867cdd92619eeeed778f
SSDEEP 24576:IEPghm6/7IIXdwcXrif7qQncjlP65i3VuHSkQ/7Gb8NLEbeZ:ng06DIKdwc+eQnSt65aVBkQ/qoLEw
MD5 SHA1 SHA512 SSDEEP

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 661KB
SHA256 e874116c6a9a5c2479e7c3de7d79cc50d3243b6edb12fc301059056c99b5d32b
MD5 f82c86ea450421c6eb2e02719492a3fe
SHA1 f32641b30736a5d0aad5db7b1ff6e23ae234442d
SHA512 67710d827098f4b4665f4f8c6fc792756d0a1d6aedb2a814676781d0081610a2fbb6452e594bf657a96bc4ba681e7006a3e93916880bcf7190b697828f518258
SSDEEP 12288:nEP3RniMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:snnSkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 712KB
SHA256 b83eec0dac82d3fc845e80d8140ed4cc38d3ef417edf542d8b36bfacf46acc94
MD5 dd8260a7a89d7218ec71c72f2e1a9882
SHA1 2c2c308f3c75a4e90f693ac1fd22da227c38defd
SHA512 d8568ddb9efbf9f7c00c56bb520fd5802bb7f25f5f874e603c2edf65515b2c4dbdaeabe6a803cd232fe9a7ae60865db0338accded59b73155145e5023f63db6e
SSDEEP 12288:6jky6MTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:6IyvSkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 584KB
SHA256 bdf290f9173add28d536c77fa64f4590288086e73c6f012c225ede249cd58afa
MD5 1b7cd076466718e56914b049527d5949
SHA1 326ff0108c06c068926517aaac9b0dce25a556cb
SHA512 6425b8dbf82979cac89a99f2a9c6352615d28983fffe777141b9d6fab4408c328f4f971b3e27abf4b294007f2a78054f02080605a0a358d34cd8d31fc7925d51
SSDEEP 12288:cyoMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:JhSkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 c7ff2133a4213a1da33c3c7081b2db99c10dbc1159cc181b9ee2b26045d691fd
MD5 52e9b120b8df8029ea60b7e1abbb32b5
SHA1 63cb24922c09460bd7b18f8a14a8cf4af6462c06
SHA512 543c8892635d46d53bcd934214167cbcd0b2f9c796affcd29917256851f363f53ab7ec18b0e30b191ef57710f27dea8582670606aaf475019c6ba170479e2a41
SSDEEP 12288:zLQZb3C97GYnZMv5zBcKY9dMD33MTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:vQ9MxZKdcz9dw3cSkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 772KB
SHA256 d429360ee3e6a7e1b2e292a9a92cfc2812c7bf714646c1e42014484bf4691480
MD5 ef6bb4a4cff784a4e85738aacce4c8b7
SHA1 4169bb01ae03063b3f1b95a192f3faf8e71d9176
SHA512 6601d5200be1eef5765e3400fe9d31855a0841bc4b2a4ef44eda6cba3fc482b5de685768da61e29f81840aa4ab47616bd518ed5aaa3675a3af6fa448bc756a22
SSDEEP 12288:8yoKo2JRple9pOMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:8yocDAprSkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 26e1435c044f8e708fb46561d078b1884c61bca6d08ca3743a8f977494b05758
MD5 6c12cf63dbc4634c8b905ef4ebc3da64
SHA1 a7c5373db0398d51b86fc5700139f92d88c1f4d4
SHA512 0268484762afe5acfb6f291d720d6b24ece07ce10a3380e0d1a8fb5923931864368a1335743a8f05dc25d56e271cfb93d7a6689c29cfb8aba295af5920da1e88
SSDEEP 49152:wWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKWkQ/qoLEw:i0zuNIYqo4w
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 64e8666dbea2124333bf4239b733f40135726abdd424ae4d3100bba3e08850a0
MD5 5ff8ebcd765b842901172571e6295641
SHA1 c92b91e4a04e4f03bc891f39c76bf94651056666
SHA512 1dac4c6bfcd0cf6e80c3b47905c1145bf19b36ba33f07e90fb73042324473919177864eda3ec9d8f29251bd5945c5175cf512996345050f3bc61f0411549288e
SSDEEP 24576:Y1QT7EcpfxR+N5AWAz3ooiYzjMqbnSkQ/7Gb8NLEbeZ:lTDxR+N5YzTBjMRkQ/qoLEw
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/540-339-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/540-540-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/1044-537-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/1044-331-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/1064-315-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/1064-532-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/1084-446-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/1084-289-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/1524-266-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/1524-326-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/1524-264-0x0000000000600000-0x0000000000660000-memory.dmp

Download

memory/1524-258-0x0000000000600000-0x0000000000660000-memory.dmp

Download

memory/1636-272-0x0000000000520000-0x0000000000586000-memory.dmp

Download

memory/1636-271-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/1636-330-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/1776-57-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/1776-44-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/1776-247-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/1776-50-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/2192-81-0x00000000016A0000-0x0000000001700000-memory.dmp

Download

memory/2192-60-0x00000000016A0000-0x0000000001700000-memory.dmp

Download

memory/2192-66-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/2192-67-0x00000000016A0000-0x0000000001700000-memory.dmp

Download

memory/2192-83-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/2288-334-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/2288-538-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/2552-320-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/2552-318-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/3128-527-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/3128-292-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/3480-56-0x0000000140000000-0x0000000140141000-memory.dmp

Download

memory/3480-1-0x00000000020C0000-0x0000000002120000-memory.dmp

Download

memory/3480-0-0x0000000140000000-0x0000000140141000-memory.dmp

Download

memory/3480-7-0x00000000020C0000-0x0000000002120000-memory.dmp

Download

memory/3480-45-0x00000000020C0000-0x0000000002120000-memory.dmp

Download

memory/3496-254-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/3496-322-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/3832-78-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/3832-80-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/3832-72-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/3832-248-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/4024-37-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4024-29-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4032-14-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/4032-242-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/4120-304-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/4120-531-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/4156-282-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/4332-285-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4332-338-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4332-528-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4716-243-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/4716-16-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/4716-24-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/4716-25-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/4976-323-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4976-535-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/5096-536-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/5096-327-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/5104-40-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/5104-32-0x0000000140000000-0x000000014024B000-memory.dmp

Download

memory/5104-33-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/5104-246-0x0000000140000000-0x000000014024B000-memory.dmp

Download