Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
03/06/2024, 07:47
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-06-03_d3e343ce973d1c7ec99c5c59ea5f1f52_ryuk.exe
Resource
win7-20240221-en
windows7-x64
21 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-06-03_d3e343ce973d1c7ec99c5c59ea5f1f52_ryuk.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
17 signatures
150 seconds
General
- Target 2024-06-03_d3e343ce973d1c7ec99c5c59ea5f1f52_ryuk.exe
- Size 2.7MB
- Sample240603-jmp1yahf62
- SHA256 3b0d9a46b08a1ce99dccfc84172547f1d117fe39668b4270568b0a0e5e2ae79f
- MD5 d3e343ce973d1c7ec99c5c59ea5f1f52
- SHA1 d7d262be600e38f48e149f7fbfb3eaabbbfd4fd2
- SHA512 505265cd7b4d0445155527708e380ea997cd983c7aae1aa63da5fcfea7fae44a631b32369233fd5d99ec70588305b1a591ee4cef3dd4e9d6a46d4e659b217da6
- SSDEEP 49152:G2IoCBtJnxlyU/mWhRcQYhie6/UIdjjQbctXnFDu3nAzNjteyUHBdH3yMkQ/qoL9:RrCBrtcy/lflD0nANte9BpCcqo4w
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 22 IoCs
pid Process 4560 alg.exe 628 DiagnosticsHub.StandardCollector.Service.exe 4316 fxssvc.exe 452 elevation_service.exe 4716 elevation_service.exe 4932 maintenanceservice.exe 3196 msdtc.exe 4592 OSE.EXE 2928 PerceptionSimulationService.exe 3428 perfhost.exe 4076 locator.exe 908 SensorDataService.exe 2888 snmptrap.exe 4564 spectrum.exe 2236 ssh-agent.exe 2940 TieringEngineService.exe 2500 AgentService.exe 1480 vds.exe 4912 vssvc.exe 4368 wbengine.exe 1192 WmiApSrv.exe 2604 SearchIndexer.exe - Modifies system executable filetype association 2 TTPs 8 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" 2024-06-03_d3e343ce973d1c7ec99c5c59ea5f1f52_ryuk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA} 2024-06-03_d3e343ce973d1c7ec99c5c59ea5f1f52_ryuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\ 2024-06-03_d3e343ce973d1c7ec99c5c59ea5f1f52_ryuk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR 2024-06-03_d3e343ce973d1c7ec99c5c59ea5f1f52_ryuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}" 2024-06-03_d3e343ce973d1c7ec99c5c59ea5f1f52_ryuk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA} 2024-06-03_d3e343ce973d1c7ec99c5c59ea5f1f52_ryuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\ 2024-06-03_d3e343ce973d1c7ec99c5c59ea5f1f52_ryuk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR32 2024-06-03_d3e343ce973d1c7ec99c5c59ea5f1f52_ryuk.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops file in System32 directory 37 IoCs
description ioc Process File opened for modification C:\Windows\System32\msdtc.exe 2024-06-03_d3e343ce973d1c7ec99c5c59ea5f1f52_ryuk.exe File opened for modification C:\Windows\system32\dllhost.exe 2024-06-03_d3e343ce973d1c7ec99c5c59ea5f1f52_ryuk.exe File opened for modification C:\Windows\System32\snmptrap.exe 2024-06-03_d3e343ce973d1c7ec99c5c59ea5f1f52_ryuk.exe File opened for modification C:\Windows\System32\vds.exe 2024-06-03_d3e343ce973d1c7ec99c5c59ea5f1f52_ryuk.exe File opened for modification C:\Windows\system32\msiexec.exe elevation_service.exe File opened for modification C:\Windows\system32\SgrmBroker.exe 2024-06-03_d3e343ce973d1c7ec99c5c59ea5f1f52_ryuk.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe 2024-06-03_d3e343ce973d1c7ec99c5c59ea5f1f52_ryuk.exe File opened for modification C:\Windows\system32\fxssvc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\AgentService.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\locator.exe 2024-06-03_d3e343ce973d1c7ec99c5c59ea5f1f52_ryuk.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 2024-06-03_d3e343ce973d1c7ec99c5c59ea5f1f52_ryuk.exe File opened for modification C:\Windows\System32\SensorDataService.exe 2024-06-03_d3e343ce973d1c7ec99c5c59ea5f1f52_ryuk.exe File opened for modification C:\Windows\system32\dllhost.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\msiexec.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\SgrmBroker.exe elevation_service.exe File opened for modification C:\Windows\system32\AgentService.exe elevation_service.exe File opened for modification C:\Windows\System32\alg.exe 2024-06-03_d3e343ce973d1c7ec99c5c59ea5f1f52_ryuk.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\5bc08083b4b1389a.bin DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\SysWow64\perfhost.exe 2024-06-03_d3e343ce973d1c7ec99c5c59ea5f1f52_ryuk.exe File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG msdtc.exe File opened for modification C:\Windows\system32\vssvc.exe 2024-06-03_d3e343ce973d1c7ec99c5c59ea5f1f52_ryuk.exe File opened for modification C:\Windows\system32\fxssvc.exe 2024-06-03_d3e343ce973d1c7ec99c5c59ea5f1f52_ryuk.exe File opened for modification C:\Windows\system32\SearchIndexer.exe 2024-06-03_d3e343ce973d1c7ec99c5c59ea5f1f52_ryuk.exe File opened for modification C:\Windows\system32\SgrmBroker.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\fxssvc.exe elevation_service.exe File opened for modification C:\Windows\system32\AgentService.exe 2024-06-03_d3e343ce973d1c7ec99c5c59ea5f1f52_ryuk.exe File opened for modification C:\Windows\system32\spectrum.exe 2024-06-03_d3e343ce973d1c7ec99c5c59ea5f1f52_ryuk.exe File opened for modification C:\Windows\system32\wbengine.exe 2024-06-03_d3e343ce973d1c7ec99c5c59ea5f1f52_ryuk.exe File opened for modification C:\Windows\system32\AppVClient.exe elevation_service.exe File opened for modification C:\Windows\system32\dllhost.exe elevation_service.exe File opened for modification C:\Windows\System32\SensorDataService.exe elevation_service.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe 2024-06-03_d3e343ce973d1c7ec99c5c59ea5f1f52_ryuk.exe File opened for modification C:\Windows\system32\msiexec.exe 2024-06-03_d3e343ce973d1c7ec99c5c59ea5f1f52_ryuk.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe 2024-06-03_d3e343ce973d1c7ec99c5c59ea5f1f52_ryuk.exe File opened for modification C:\Windows\system32\TieringEngineService.exe 2024-06-03_d3e343ce973d1c7ec99c5c59ea5f1f52_ryuk.exe File opened for modification C:\Windows\system32\AppVClient.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\AppVClient.exe 2024-06-03_d3e343ce973d1c7ec99c5c59ea5f1f52_ryuk.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe 2024-06-03_d3e343ce973d1c7ec99c5c59ea5f1f52_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe 2024-06-03_d3e343ce973d1c7ec99c5c59ea5f1f52_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe 2024-06-03_d3e343ce973d1c7ec99c5c59ea5f1f52_ryuk.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe 2024-06-03_d3e343ce973d1c7ec99c5c59ea5f1f52_ryuk.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe 2024-06-03_d3e343ce973d1c7ec99c5c59ea5f1f52_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe 2024-06-03_d3e343ce973d1c7ec99c5c59ea5f1f52_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe 2024-06-03_d3e343ce973d1c7ec99c5c59ea5f1f52_ryuk.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe 2024-06-03_d3e343ce973d1c7ec99c5c59ea5f1f52_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe elevation_service.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe 2024-06-03_d3e343ce973d1c7ec99c5c59ea5f1f52_ryuk.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe 2024-06-03_d3e343ce973d1c7ec99c5c59ea5f1f52_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe 2024-06-03_d3e343ce973d1c7ec99c5c59ea5f1f52_ryuk.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateSetup.exe 2024-06-03_d3e343ce973d1c7ec99c5c59ea5f1f52_ryuk.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\mip.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe 2024-06-03_d3e343ce973d1c7ec99c5c59ea5f1f52_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe 2024-06-03_d3e343ce973d1c7ec99c5c59ea5f1f52_ryuk.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe 2024-06-03_d3e343ce973d1c7ec99c5c59ea5f1f52_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe elevation_service.exe File opened for modification C:\Program Files\7-Zip\7zG.exe 2024-06-03_d3e343ce973d1c7ec99c5c59ea5f1f52_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe 2024-06-03_d3e343ce973d1c7ec99c5c59ea5f1f52_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe 2024-06-03_d3e343ce973d1c7ec99c5c59ea5f1f52_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe 2024-06-03_d3e343ce973d1c7ec99c5c59ea5f1f52_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_99718\java.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe 2024-06-03_d3e343ce973d1c7ec99c5c59ea5f1f52_ryuk.exe File opened for modification C:\Program Files\dotnet\dotnet.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe 2024-06-03_d3e343ce973d1c7ec99c5c59ea5f1f52_ryuk.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe 2024-06-03_d3e343ce973d1c7ec99c5c59ea5f1f52_ryuk.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe 2024-06-03_d3e343ce973d1c7ec99c5c59ea5f1f52_ryuk.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_99718\javaws.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe 2024-06-03_d3e343ce973d1c7ec99c5c59ea5f1f52_ryuk.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_99718\javaw.exe 2024-06-03_d3e343ce973d1c7ec99c5c59ea5f1f52_ryuk.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe 2024-06-03_d3e343ce973d1c7ec99c5c59ea5f1f52_ryuk.exe - Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\DtcInstall.log msdtc.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe elevation_service.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2024-06-03_d3e343ce973d1c7ec99c5c59ea5f1f52_ryuk.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz TieringEngineService.exe Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 TieringEngineService.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection" SearchIndexer.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000666db94b8ab5da01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000889658528ab5da01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002e135a538ab5da01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006d08f54b8ab5da01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie SearchFilterHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001fc72c538ab5da01 SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009db238538ab5da01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchFilterHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008046b24b8ab5da01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001a07144c8ab5da01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1133 = "Print" fxssvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000016a164c8ab5da01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration" SearchIndexer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration" SearchIndexer.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie SearchFilterHost.exe - Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}" 2024-06-03_d3e343ce973d1c7ec99c5c59ea5f1f52_ryuk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA} 2024-06-03_d3e343ce973d1c7ec99c5c59ea5f1f52_ryuk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers 2024-06-03_d3e343ce973d1c7ec99c5c59ea5f1f52_ryuk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\WinRAR32 2024-06-03_d3e343ce973d1c7ec99c5c59ea5f1f52_ryuk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA} 2024-06-03_d3e343ce973d1c7ec99c5c59ea5f1f52_ryuk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ 2024-06-03_d3e343ce973d1c7ec99c5c59ea5f1f52_ryuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\DropHandler\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}" 2024-06-03_d3e343ce973d1c7ec99c5c59ea5f1f52_ryuk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\DragDropHandlers\WinRAR 2024-06-03_d3e343ce973d1c7ec99c5c59ea5f1f52_ryuk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shell\open\command 2024-06-03_d3e343ce973d1c7ec99c5c59ea5f1f52_ryuk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\DefaultIcon 2024-06-03_d3e343ce973d1c7ec99c5c59ea5f1f52_ryuk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV 2024-06-03_d3e343ce973d1c7ec99c5c59ea5f1f52_ryuk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\DropHandler 2024-06-03_d3e343ce973d1c7ec99c5c59ea5f1f52_ryuk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\WinRAR 2024-06-03_d3e343ce973d1c7ec99c5c59ea5f1f52_ryuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}" 2024-06-03_d3e343ce973d1c7ec99c5c59ea5f1f52_ryuk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shell\open 2024-06-03_d3e343ce973d1c7ec99c5c59ea5f1f52_ryuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\DropHandler\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}" 2024-06-03_d3e343ce973d1c7ec99c5c59ea5f1f52_ryuk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\WinRAR 2024-06-03_d3e343ce973d1c7ec99c5c59ea5f1f52_ryuk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR 2024-06-03_d3e343ce973d1c7ec99c5c59ea5f1f52_ryuk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex 2024-06-03_d3e343ce973d1c7ec99c5c59ea5f1f52_ryuk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\ContextMenuHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA} 2024-06-03_d3e343ce973d1c7ec99c5c59ea5f1f52_ryuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\DropHandler\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" 2024-06-03_d3e343ce973d1c7ec99c5c59ea5f1f52_ryuk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\DropHandler 2024-06-03_d3e343ce973d1c7ec99c5c59ea5f1f52_ryuk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\ContextMenuHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA} 2024-06-03_d3e343ce973d1c7ec99c5c59ea5f1f52_ryuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\ 2024-06-03_d3e343ce973d1c7ec99c5c59ea5f1f52_ryuk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shell\open\command 2024-06-03_d3e343ce973d1c7ec99c5c59ea5f1f52_ryuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" 2024-06-03_d3e343ce973d1c7ec99c5c59ea5f1f52_ryuk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shell 2024-06-03_d3e343ce973d1c7ec99c5c59ea5f1f52_ryuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\WinRAR.exe\" \"%1\"" 2024-06-03_d3e343ce973d1c7ec99c5c59ea5f1f52_ryuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\WinRAR.exe,0" 2024-06-03_d3e343ce973d1c7ec99c5c59ea5f1f52_ryuk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shell\open 2024-06-03_d3e343ce973d1c7ec99c5c59ea5f1f52_ryuk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR 2024-06-03_d3e343ce973d1c7ec99c5c59ea5f1f52_ryuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\ 2024-06-03_d3e343ce973d1c7ec99c5c59ea5f1f52_ryuk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA} 2024-06-03_d3e343ce973d1c7ec99c5c59ea5f1f52_ryuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}" 2024-06-03_d3e343ce973d1c7ec99c5c59ea5f1f52_ryuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\ContextMenuHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\ 2024-06-03_d3e343ce973d1c7ec99c5c59ea5f1f52_ryuk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA} 2024-06-03_d3e343ce973d1c7ec99c5c59ea5f1f52_ryuk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\DefaultIcon 2024-06-03_d3e343ce973d1c7ec99c5c59ea5f1f52_ryuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\ = "WinRAR ZIP archive" 2024-06-03_d3e343ce973d1c7ec99c5c59ea5f1f52_ryuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\ContextMenuHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\ 2024-06-03_d3e343ce973d1c7ec99c5c59ea5f1f52_ryuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\ContextMenuHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\ 2024-06-03_d3e343ce973d1c7ec99c5c59ea5f1f52_ryuk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\WinRAR32 2024-06-03_d3e343ce973d1c7ec99c5c59ea5f1f52_ryuk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\ContextMenuHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA} 2024-06-03_d3e343ce973d1c7ec99c5c59ea5f1f52_ryuk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\shell 2024-06-03_d3e343ce973d1c7ec99c5c59ea5f1f52_ryuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\WinRAR.exe\" \"%1\"" 2024-06-03_d3e343ce973d1c7ec99c5c59ea5f1f52_ryuk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\DefaultIcon 2024-06-03_d3e343ce973d1c7ec99c5c59ea5f1f52_ryuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\ = "RAR recovery volume" 2024-06-03_d3e343ce973d1c7ec99c5c59ea5f1f52_ryuk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\ContextMenuHandlers 2024-06-03_d3e343ce973d1c7ec99c5c59ea5f1f52_ryuk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA} 2024-06-03_d3e343ce973d1c7ec99c5c59ea5f1f52_ryuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" 2024-06-03_d3e343ce973d1c7ec99c5c59ea5f1f52_ryuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\WinRAR.exe,0" 2024-06-03_d3e343ce973d1c7ec99c5c59ea5f1f52_ryuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\WinRAR.exe\" \"%1\"" 2024-06-03_d3e343ce973d1c7ec99c5c59ea5f1f52_ryuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.rev\ = "WinRAR.REV" 2024-06-03_d3e343ce973d1c7ec99c5c59ea5f1f52_ryuk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\shell\open\command 2024-06-03_d3e343ce973d1c7ec99c5c59ea5f1f52_ryuk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA} 2024-06-03_d3e343ce973d1c7ec99c5c59ea5f1f52_ryuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\ 2024-06-03_d3e343ce973d1c7ec99c5c59ea5f1f52_ryuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\ 2024-06-03_d3e343ce973d1c7ec99c5c59ea5f1f52_ryuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}" 2024-06-03_d3e343ce973d1c7ec99c5c59ea5f1f52_ryuk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\ContextMenuHandlers 2024-06-03_d3e343ce973d1c7ec99c5c59ea5f1f52_ryuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\DropHandler\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" 2024-06-03_d3e343ce973d1c7ec99c5c59ea5f1f52_ryuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\ = "WinRAR archive" 2024-06-03_d3e343ce973d1c7ec99c5c59ea5f1f52_ryuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\ 2024-06-03_d3e343ce973d1c7ec99c5c59ea5f1f52_ryuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" 2024-06-03_d3e343ce973d1c7ec99c5c59ea5f1f52_ryuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\ 2024-06-03_d3e343ce973d1c7ec99c5c59ea5f1f52_ryuk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shell 2024-06-03_d3e343ce973d1c7ec99c5c59ea5f1f52_ryuk.exe - Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 628 DiagnosticsHub.StandardCollector.Service.exe 628 DiagnosticsHub.StandardCollector.Service.exe 628 DiagnosticsHub.StandardCollector.Service.exe 628 DiagnosticsHub.StandardCollector.Service.exe 628 DiagnosticsHub.StandardCollector.Service.exe 628 DiagnosticsHub.StandardCollector.Service.exe 628 DiagnosticsHub.StandardCollector.Service.exe 452 elevation_service.exe 452 elevation_service.exe 452 elevation_service.exe 452 elevation_service.exe 452 elevation_service.exe 452 elevation_service.exe 452 elevation_service.exe - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 660 Process not Found 660 Process not Found - Suspicious use of AdjustPrivilegeToken 39 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 3524 2024-06-03_d3e343ce973d1c7ec99c5c59ea5f1f52_ryuk.exe Token: SeAuditPrivilege 4316 fxssvc.exe Token: SeRestorePrivilege 2940 TieringEngineService.exe Token: SeManageVolumePrivilege 2940 TieringEngineService.exe Token: SeAssignPrimaryTokenPrivilege 2500 AgentService.exe Token: SeBackupPrivilege 4912 vssvc.exe Token: SeRestorePrivilege 4912 vssvc.exe Token: SeAuditPrivilege 4912 vssvc.exe Token: SeBackupPrivilege 4368 wbengine.exe Token: SeRestorePrivilege 4368 wbengine.exe Token: SeSecurityPrivilege 4368 wbengine.exe Token: 33 2604 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 2604 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2604 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2604 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2604 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2604 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2604 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2604 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2604 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2604 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2604 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2604 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2604 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2604 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2604 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2604 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2604 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2604 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2604 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2604 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2604 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2604 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2604 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2604 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2604 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2604 SearchIndexer.exe Token: SeDebugPrivilege 628 DiagnosticsHub.StandardCollector.Service.exe Token: SeDebugPrivilege 452 elevation_service.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3524 2024-06-03_d3e343ce973d1c7ec99c5c59ea5f1f52_ryuk.exe 3524 2024-06-03_d3e343ce973d1c7ec99c5c59ea5f1f52_ryuk.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2604 wrote to memory of 2724 2604 SearchIndexer.exe 109 PID 2604 wrote to memory of 2724 2604 SearchIndexer.exe 109 PID 2604 wrote to memory of 3160 2604 SearchIndexer.exe 110 PID 2604 wrote to memory of 3160 2604 SearchIndexer.exe 110 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-03_d3e343ce973d1c7ec99c5c59ea5f1f52_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-03_d3e343ce973d1c7ec99c5c59ea5f1f52_ryuk.exe"1⤵
- Modifies system executable filetype association
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3524
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
PID:4560
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:628
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:2328
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4316
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:452
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
PID:4716
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:4932
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:3196
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:4592
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
PID:2928
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
PID:3428
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
PID:4076
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:908
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
PID:2888
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4564
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
PID:2236
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵PID:3816
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2940
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2500
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
PID:1480
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4912
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4368
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
PID:1192
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:2724
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 7842⤵
- Modifies data under HKEY_USERS
PID:3160
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
- Size 2.1MB
- SHA256 5d769f9e561ad1d3120bf9688daab750be68cf2ce63d7c1a17ae2ad263cb0b36
- MD5 daa4f5f2bcbb9bc5e9f2719c34838b07
- SHA1 2b8c8e172de0d0f0fe218e57936917eb5ceea677
- SHA512 b193fc6c04f456ea99f9e6dfb312b14b13a082fb5f1323bf87463b244684fba3b499422dc46194178a0d810ca38758148b6c8fd261669807f028e68d1cfebb97
- SSDEEP 49152:6uYk3H5koUUfTqkkYLO/W2buywzMbOX+T7z54kQ/qoLEw:68fTqi90bMqo4w
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 797KB
- SHA256 710835b0fd86e47a7f60a990c0098ceab183ddb4977804e7d7cd1c889ad66f4d
- MD5 f2b42a01de0ef7606d6ad1a8b8a8f912
- SHA1 ae5fb75da21daf2d51bb4f2056cad233e22708b1
- SHA512 8f7c1f31b271e1f117373d94bbaaac2ac0e5c5c827de4c22082aa3a4e16f156b1885e58995d4321f9aa102c35919fc8b5025565538d2dd917dae76df1533a378
- SSDEEP 12288:wcQiZmNJLBsunEfMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:6ionBsuE0SkQ/7Gb8NLEbeZ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7z.exe
- Size 1.1MB
- SHA256 5efb751d15a9b4fdd776871e1bab12dab48d0d4f15cda9a51962a885c89a7007
- MD5 c4ca581f26699ef1fae4e20012cd0c85
- SHA1 7563ac0f6761847c24d8f863bcf062546abec1ef
- SHA512 3b71c159f91949a89ac67eed701c6ea63dcc274cf9e31009d563f11a7eb317a9f443fac46f59b0f039cec35dfccf102d976adfea6919bcb01d19918607f70e94
- SSDEEP 12288:27a3iwbihym2g7XO3LWUDfh4CoDMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:n+gkEdfh4CogSkQ/7Gb8NLEbeZ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7zFM.exe
- Size 1.5MB
- SHA256 be5d1a709445461c5eb145bd0f81f0c62fdffa05780643636add9ee0a8c662ca
- MD5 d5d5a19e077b834b62a0a95a51e4506b
- SHA1 c8eb8869ac28f3ceb4acf54f179a32d5aeafabe7
- SHA512 4a46e0e7b0909369a1d262cc041e6ace1f179fbf038a37f54696f514263cdd7d63fdfc620c1e8a57438dcc4f775d5ccc2eb885195dc72951987b86efd6a9d14b
- SSDEEP 24576:+BpDRmi78gkPXlyo0GhjrhSkQ/7Gb8NLEbeZ:KNRmi78gkPX4o0GhjYkQ/qoLEw
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7zG.exe
- Size 1.2MB
- SHA256 3f3d88e70ff6d8eb5ecaeaa1c4fb1a0298e6bf261b31a0ee0ab354892f05cdd1
- MD5 1b201aa9dc021ea53db5139510581160
- SHA1 fa118a6df1e45ad697af1b3dce570d69b7a6037f
- SHA512 acf8f4b47a1255440ead192ce6c1742f66099b348de62a7f29bdf347ec2660ff5c3f19aecb42ac0ebeabed34df3f57e1c4729b1b7647cdf873c6b7a004244773
- SSDEEP 12288:mfC6Aj+TN5uixZN+8rKhUdTC/wE1DD0Ca5ZIXVDMTmkJR4Do07Y86gw5CtCjX+NR:6LOS2oPPIXVgSkQ/7Gb8NLEbeZ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 582KB
- SHA256 188d8feadb2c98c931e59f1fa29463a92196e0a7dfeef5466aeb5fb93645adac
- MD5 639870823efdb779424bc43b88159a01
- SHA1 71952eef2ebfd6b5d18290a9c29aea6bd97e2ad5
- SHA512 42cab223a335868b7141667dd1e0b1b239bf67a95a96aa89201ffafc4c79a2f20db3891b7957e216b832528b4909911af8e4246e354354c89e3fb76cbdc98ce3
- SSDEEP 12288:ZYhMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:ZY6SkQ/7Gb8NLEbeZ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
- Size 840KB
- SHA256 741f86fa9343c077a58efdd5775ac766ef32471963e762110699109a4df5df0f
- MD5 3afadfb8cd0b2ac9a5572fd778e19ad7
- SHA1 e4e17ac3090d031cecbadb89d6b062cc3ecee5d7
- SHA512 c8ade5e089835e20f9b8e3a0c644b95bb26c4318e108012d04f72fc14f6744ae2863012753b48433343e9a7251026d3339fdd734eda8f1d618524295827531dc
- SSDEEP 12288:neBNUbTVO86UOMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:nJIUrSkQ/7Gb8NLEbeZ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 4.6MB
- SHA256 853e03fa500218d586187d17394fc7962ee62db17bf98ca417c7b09e51a1627d
- MD5 ed4af1bd390480d2ba5c5e83a1bea8bf
- SHA1 571b93705f7682ed1f7977a8e3ea0845594bdbac
- SHA512 7f8e0fc40619550d4fab10189c6eed4e0a8f4e9c7e09c11b2b6c2d51fc0dc80ffc45660aba8a8d7caeb0c23d2f41ce4d671b0a70f46f38e0837a8e958510aab7
- SSDEEP 49152:MQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THe:MQvGAdlCEL8c/WRNw5CFqo4w
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
- Size 910KB
- SHA256 8a3ce3a14877996a40323cd6218fe0d5b73057fad6b697620ea92d3e5847f684
- MD5 fe02eb74b3d672efb81b350227202cdd
- SHA1 286a1fa747005d2880cfcc36c5214e0eaf6714ca
- SHA512 e0845def947468869dd5e38b181de7f2a8d725ab33c8f9936cbe75190f6720fdfa17d3a1933486b79cbd4d74f4aef1dfba15a0bf731e2d5dfe37a5f566030f42
- SSDEEP 12288:XAwSfxL/2Dc3mDLLmt0LDQewsAjwMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:wfewsAjZSkQ/7Gb8NLEbeZ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
- Size 24.0MB
- SHA256 1e1c08643d125c2fcdeaeb46a33a59265ec3fa9eaf135612d451b860459ba162
- MD5 020cd0ddb08336537524aa0f718714a4
- SHA1 3b8b017f5b6cd252c911e980a83edabcce972023
- SHA512 e0a5b695b90efeba79f5d9540922a739c4f74fabbfb94936f49b2d7749834d81950d82bf339be742f8060756e7ecc1a7d6a212fc3d67f4cce7b839d9b4f0087b
- SSDEEP 196608:QUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHk:QUEtQevvqc2W1cpV20I32k
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
- Size 2.7MB
- SHA256 e27ffd9975fced38fcf4131adb087bf1cbdb46b5d281fe6214b5e6a5f8f2ec13
- MD5 ee03f402b363574879c9920dca0f62a0
- SHA1 e65a182ca6f0bbaabcab17b6b57ffc21844ea37c
- SHA512 f8149ac6abc3cac45ec8c0ebfa627cf77e535e9c47706dce4f05e33ac24092a9233bc419701e20333197b8773a95986d3f5a0582f5c35d5426ee798366e0feb5
- SSDEEP 49152:+CbRquA/m2yL5zLfFiV+XenmE3/zckQ/qoLEw:zoq2Vjnmpqo4w
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
- Size 1.1MB
- SHA256 d1e496a1f41c0fe2e48f57dfc25a339384e7f6b5bfcb777604a3c84160009be7
- MD5 68f08bfe8521d59c27e4d6d21ab9c5a3
- SHA1 5a152b1f0a73cf0d679720b44fd69aa7da88ad8f
- SHA512 f6864cb10eb98e083b11f351b22291f4e16757e3674289c96c9ac0f5d447ce7539b685f4230362912a1da56a082a3113aa2cf22ac33cfcbc4e512d0ec1589314
- SSDEEP 24576:WAhGL6IFoiwtA5l7S53QSkQ/7Gb8NLEbeZ:WAM5Foiq5pkQ/qoLEw
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 805KB
- SHA256 ff9bae9c18a11294e54444f9af23d4d2155d90771b72abc9c1c9b86fcf2fb318
- MD5 0d50c0d39fa1254632400fa975e9421b
- SHA1 96469661076dca6291649baf5cc48e6da8b751d0
- SHA512 2ad0b704110e2e21a49ca7f2615c330480f8535843ab1fb5d6e0a330f983ef2937864bb91d57252852927fffff0fb3edca35bf105ede49a1f866b2d2567af8e1
- SSDEEP 12288:Hmw5HEjsChNEBFgl0WDm+CXMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:GwuROWNSkQ/7Gb8NLEbeZ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
- Size 656KB
- SHA256 40c644cc71e5541f292794217a934c8360f2fb8a19af3019b63578e9f80ea54e
- MD5 36b4e3bce00835ffb7fcd26b3d941cbc
- SHA1 6ae31beacbd7d3be195142e75239c167311c815b
- SHA512 6fe4c7fdf5bbecd7f9530deb30516d56249fe6216f3d3a01903a593426d9f4cd5e3ef96979a3b7ca3ac184f2fead1443d39da93ba5950dedf77520de9c3c6348
- SSDEEP 12288:PyZ1IyAMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:qZumSkQ/7Gb8NLEbeZ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
- Size 5.4MB
- SHA256 f6b462d1ebdb56843906f4a1f3990e331bfcd65ca7c653ce28f20e62f1f999c1
- MD5 60e63a7a7173adefc91f0f8ef64673c0
- SHA1 23c5001cc6e73f9b9ba3017cbbc4536a705f618c
- SHA512 90858b805fe51a1a2f4528600d5b396d96a3725b05cd9765fa3c34b43fba9d603a19604550cabe8d8f8a921992810c4d6cc597fa74396564cdc6a97eb6af81e0
- SSDEEP 49152:y0kwIi7c4xZlm5knEtw99Kn/2vim7vgv6m+yyJ/0gbvjK7yY7BHi3u7L/gBUUWLO:EwfhY7g/rL+7yYA3awr341gxqo4w
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe
- Size 5.4MB
- SHA256 1cb09ffc67396553ed35aafacf9d8669c132cac9ed723159d99e7480afe34fb4
- MD5 bb88c8116803715f982445d62420acc9
- SHA1 e86a2c7c211be60786f5b9b5ea6324bee9075d2c
- SHA512 e3b803cf9bad743d7e6a60de58a04a2662aae74e6fed3a7747c91b495b51339156f5af3d52949ead035980dd1c1ee54c0bf113f33bb3fd9dbe21d079069bae96
- SSDEEP 49152:l0kwIi7c4xZlm5knEtw99Kn/2vim7vgv6m+yyJ/0gbvjK7yY7BHi3u7L/gBUUWLO:twfhY7g/rL+7yYA3awr341gxqo4w
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe
- Size 2.0MB
- SHA256 7a1470137510f24b611fc09bd6e6ee4fd9d5ef7025be059a8efb362ca828c37f
- MD5 9cbef05b93d2f8159975874c8080c4c8
- SHA1 d80f791c6af82255c9ca88b23158278890c83e6a
- SHA512 d4046ce29abdb6c70bc66482952ee43a1ec45c2aea30bcbf4e28c9d22b32947271b128e0e688b6b34059d8b3f8b3bbcded561e31e9cb8edb5a01b7e916b0b600
- SSDEEP 24576:FcTyYv0FteQUk5I2kjgD6iQacANSkQ/7Gb8NLEbeZ:FuXv0Ftpp5606zOAkQ/qoLEw
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
- Size 2.2MB
- SHA256 37541ea76b36409844d334a6c7bcbb3e67c14215aacc02df153ecdff8e166223
- MD5 8035e142424a3394fc83048be6075d6d
- SHA1 b6afb02c5fb492b547f166e64fb01d8c50d5c4b6
- SHA512 68a97d54c253a0954e566c915365fb5cf7d046da8287413b166083679a6a6fa3a1ca276028fff9e2807257de0d3b64da5a15bf6504e491751d25cb53b5a12ccb
- SSDEEP 49152:Qy7mTd0GxN8jyynzHjXKUyn4GVcbDSKrNTx8kQ/qoLEw:vmYeyzHjWjMTMqo4w
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe
- Size 1.8MB
- SHA256 9b767cb8b7f71fa9e5ee5d3ae14db03446836a7a4db93d01038a4e63aacfd844
- MD5 6d803a2040eb1efc00ed2a0d30ea0ca2
- SHA1 f616e2f2d63d13daa2e37fe6bb4b75ce72db260c
- SHA512 25fc947abafe0dfe318f83debfb45eb738c0f82ddd11ed5b6c7fcc8427b8a3a53428c0c28949270d1209de627779301d4e990e1ca03fb360c7b079db22985e41
- SSDEEP 24576:k6drZn1WEci182IEUINbJeRgUebgW816eSkQ/7Gb8NLEbeZ:kWnDci18cNNUgbY4kQ/qoLEw
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
- Size 1.7MB
- SHA256 2f8d82e75bcb35e7671588fa972bca1ccdebdebfed1dc4909e4954925283bff7
- MD5 60bfa71d92caba9886be219d6e5b66ae
- SHA1 d29517adf771352a8f06039975f035b596f7cf5b
- SHA512 70f8912d1fbebcbf182cf9d758c344c77a8deadbe5b3ef677d4e799604efe036f5b3db34ad4ab31e69d12679cd2f590abff2212afa0c27f58fdbeacacfe3d76a
- SSDEEP 24576:Jk5lHW5EzMZupOM0G2reD+melRgTTv/1nyXSkQ/7Gb8NLEbeZ:FizMZO0GhamSo/kQ/qoLEw
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
- Size 581KB
- SHA256 e3aabc98f3b3497634e2700b39a40be06e9fec62d831c46aa6316d8011b26011
- MD5 cb1a115dd6670252f644b6a20f590260
- SHA1 36ca624fa9fcff175d293519fa9ac01545047d6f
- SHA512 6f9123be23de959d8221b4fb0222e48cfff47f0d1928504c23288968f46aab074519dceb443b01e74b37e18373e1d89f8271094d85a9a803bfe75b114681e372
- SSDEEP 12288:P5MTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:PiSkQ/7Gb8NLEbeZ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
- Size 581KB
- SHA256 4a9d3092b4bd6535cd5ffc9cf01e76b1a27f891b87b7716ecbbf3f22d1a09dab
- MD5 feb3bafa269025fe2ec32ff1744685a2
- SHA1 b508359d721fe43e6f88200db321633e886f316d
- SHA512 d4abee370c32f53ad21fdd17f0ed4fb38f11619379bb154602f7a3236f6ac25df9e94d9873959853ce89898d6da7bd1d372443b88753b1aa0c8988456c681406
- SSDEEP 12288:LEMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:LlSkQ/7Gb8NLEbeZ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
- Size 581KB
- SHA256 fd89bd0c512e15f2b51a6c0dfa209de7dfee916d084315592f3a0e9147402f7d
- MD5 64073caeb72821b2fc6e389591f3e3aa
- SHA1 9fc9b97647311b3871a9df60e451c078a3f71cbe
- SHA512 3061ea3194b9610d7ccc92faa3d5cc2f64b8d533134735aeb4d1f273456553cbf682bd9a90915d7aaf22bda13cf17a27c0067701f23898b94f9bc8e32bec11da
- SSDEEP 12288:RmMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:RTSkQ/7Gb8NLEbeZ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
- Size 601KB
- SHA256 4c36b47505758a270a7a172f7e80118c39cb1bf3293c90a121747e1cdb7c69b2
- MD5 56e7a2183de440c4379343664d00efc6
- SHA1 470d764c3c8baa5f2ad0f15be373146090f06e22
- SHA512 2bb4325aa64a3ad19daee88f476df69939739b3f11459e2932907f89fba6c9f08b3bdb47e110fe6dede5b8bc5735bb13a85f9ef266d858cdb3467591e3d3b79e
- SSDEEP 12288:jVTMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:eSkQ/7Gb8NLEbeZ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 581KB
- SHA256 1444a34a1d9186f515eeb707ea8dbf88088302e4a7fc3b0c25f852b504886286
- MD5 51c48170ba47efc8b2b29c6617cc7fcc
- SHA1 f7f26535ad9b67b5461bddc73ea97f67cec6b3c2
- SHA512 226616a0fe40e26285bc3f852a6c5f8c3851341eccba78c8fedb97078bfebac7167217d4d8a132a908444945f3cd172c7e22e30f1a226fb32f241cc26a5a9367
- SSDEEP 12288:cbMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:coSkQ/7Gb8NLEbeZ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 581KB
- SHA256 2130af6d51fe4d994ab23432f7def1fa64682d638c085288c70cb900c5b3065e
- MD5 4cf4a18c853bf3470a4d4b096b3e9d36
- SHA1 f76b0e99fa2772374a9ef6c765e477bb81ceee18
- SHA512 6f417a2a034b1ffec8669bb43d3833632cd39689a733d0dca1ff33c25d838681b79f12f44efbd73cdf697382f1316525308fd1acbfd6e4d27c38c035d4e66544
- SSDEEP 12288:hoMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:hhSkQ/7Gb8NLEbeZ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 581KB
- SHA256 520bc72f2ae70e7a0d4c0a8415eb6e2cf2143266a5ab0add81c457de1e39ff4c
- MD5 6f138feac2227e313252690a5723daaf
- SHA1 d31a4b0553fda89bca37fe8752335ce8102b07ca
- SHA512 96a90ac3297c45ceb3c16116f0a24fa2180019bba3d96470cadbeb867b495288c9f7180d336d3b8711e6138321ba89e89d442daca173a32876b3b8a32074ed8b
- SSDEEP 12288:csMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:c9SkQ/7Gb8NLEbeZ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Java\jdk-1.8\bin\java.exe
- Size 841KB
- SHA256 320d505baaa9e7358bf53b322bfcaa952109d36cfb2dd945618212cd44ffc826
- MD5 3d519ee8783653eb97b05f03c4a7884d
- SHA1 21d908fa49ddcf5879d603bf02f171eeb26024fd
- SHA512 574d925c570e0732a98fc42c0beb2d6aeb674f86d5c5788ed6a54975dedce7749f4485fc1ca3d6f81a3b6cc0156eb5e9b870c0da57b389b5c359ab7738df69bf
- SSDEEP 12288:/iZwbDzzFEoS2cPvykMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:aZM3zFVSOFSkQ/7Gb8NLEbeZ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 581KB
- SHA256 b269af0be0842b63aad9374b9ac8e8aa41c167072bdc30b60a8f6f792b3d3963
- MD5 64f56187db027f4b7973a42340f49a5b
- SHA1 949d8b17537ee724cc5b23ae4e41c7a3328dad59
- SHA512 5377c8eabe12a92845244268df39ceb9009baad03c621e767e8d73fe5fae2ecb88ee3b2be714f71cc84e690c5dcca16ca57ad5b2262d69e6cafd5acf35b46f44
- SSDEEP 12288:gFMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:g2SkQ/7Gb8NLEbeZ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 581KB
- SHA256 da6546c1a2f043085e56f0a1c6de58b7e7cd7e6d7a6a7096b4b0b674a2cab998
- MD5 84b3b4d6e7f54a548cc8c6d92f369dd1
- SHA1 44b964a4d686b1310b4799a721150503254094da
- SHA512 cfdecf3c7b13a87b4f897866dcac146bc2768032def6038b2d5cb75be5faacd598a45a50621286f830318975820a96ae2a099525353f51ab40c84782481b745d
- SSDEEP 12288:jxMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:jKSkQ/7Gb8NLEbeZ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
- Size 717KB
- SHA256 d4cb48f5d80bfcec466baedf47648010c1252c0594fe67315058ca5b586ccb60
- MD5 cb3ec9b221464b1897c9e2ef2cab6553
- SHA1 f8c45e33a8b68c1884d35a60ba308d521a48b7bc
- SHA512 d94c5ab965a9995449e28435ae4f69007de650d06b937d95ddebe3dc6510f6d54a149c7af4f97b445f6c99c742fd93d9721110d3c603761240a437e2b87dfb26
- SSDEEP 12288:XyPz5L8AMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:azypSkQ/7Gb8NLEbeZ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 581KB
- SHA256 ae2ce716cc67e6371723c7ad81256c2a6514e88b2ec4869ab24d2a02e302e626
- MD5 6218324c4202fddbfd6b01a60384d04f
- SHA1 f8f62f48cbcdcfe35cc701e1ed39243d36e89f92
- SHA512 28d70ca852080edeae99f259a54f7355d9dd582c8b996b7fa1a54b1acfc20371d81b12ed01f8ab5eded54bf0abc7f3442a65bba9ede69a22e1a5abc2e584f726
- SSDEEP 12288:AFMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:A2SkQ/7Gb8NLEbeZ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 581KB
- SHA256 e21ff1fa6c0af4360ddb4fa31dde2753e26a4f06f79f690c07982d100443f447
- MD5 54a656df23c5f5da1e3c7b68365fd2d5
- SHA1 d6067e8974354d8efab86f5068c9ae5ab4753f43
- SHA512 3b9c3742d85b82644c7a83eee9c92a0c56cdb2b6b2df535a72742215d433faf9eb55256a3bd0af80b148fcec05d629cc3a25b340bf3d66d6013901edcdc0ee6b
- SSDEEP 12288:yFMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:y2SkQ/7Gb8NLEbeZ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
- Size 717KB
- SHA256 4dc313e120520ee18b0df7a657279148b89b14a59cc92806327d40ef3f6954eb
- MD5 97d21236d6a8cb0caaa88884dd3fd118
- SHA1 4792299ab53fabac318d99fae70258d5cff343df
- SHA512 177219225dcd4ebb49fd6546d3437e65e93fdc01d39a6e4a507308ac9f825838044b000941e83521ef1c58e31064aaa48fb5382840251338781973caec1aeab4
- SSDEEP 12288:kyPz5L8AMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:9zypSkQ/7Gb8NLEbeZ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
- Size 841KB
- SHA256 d206ff58302586fb9d59473f9b2755bfe707d133b17ec4ca9aadb7863add57f0
- MD5 ab9430b6cc6212b4bb28f76b96c1e39a
- SHA1 e3da674ee4ff790da49149a7c5c8f503e9154e68
- SHA512 6f798e504486b0db0f492aedac1b61c5e39db160eb5424ab8c3e90d6ddc017d476c481260b45629390cdd3f8b65517073011714a11d746ec70d3857c2ea6d9ba
- SSDEEP 12288:/Cd91WYoaLHF3z0z04PDvhWMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:qT8aLl3z0zDDSkQ/7Gb8NLEbeZ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
- Size 1020KB
- SHA256 5eadddf407fa75cc7a7874a8361bb8cc031857cfe438ebaf41cb8b9f05353116
- MD5 c70f475133ba565b4dabc6e6e80c1cc6
- SHA1 a2e1c1581a724c232839c0e89533402fc9561dcd
- SHA512 87567448c0dddc2c1e19ce21ca25236a1e9d3fc00b34f0448b587a34c24ecc84ec3eafb09f6f4f13b7212b7d741fb96248715da7aeeb2536ad8c6fd21aae086a
- SSDEEP 12288:wi4e7+RdTfgwCHKy7GLbbdIvfMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:w3rd9CHKy7GZPSkQ/7Gb8NLEbeZ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 581KB
- SHA256 b6b3317953af02cd6ea135df4b6882e7e12d5b0c434e828666ba1c42e64ccc66
- MD5 14ebcacd73caed4694fd220119df0cf5
- SHA1 ac020eb992b0123f00c6d521240fc59d3a9661c6
- SHA512 2a5216c1917a032306894adeb9e0a9ec2b4e3521222cc9c67ed55a2792f9ab7834641aa579ccb9c6d23d59b8709015d9a9c4c5f2352ed8b2042e7c006115c931
- SSDEEP 12288:lGMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:lzSkQ/7Gb8NLEbeZ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Windows Media Player\wmpnetwk.exe
- Size 1.5MB
- SHA256 cddb8551e85a9fbcaa1aea16db62c7e498668c2f85d3d6a1a1f84f740a0f6178
- MD5 d45cc9e3426712523fbd2568a4cc8cdc
- SHA1 d5026bacfb0b152c0865d9766b34c2b58ca943aa
- SHA512 7e0e59147c832c2c1cd88bb2684e5711142d7a48ce57bf7a8c3d005157390f3a129c65e6736597377debbe091393610eeaba132ba57338ad1aa37aab7b4d71e1
- SSDEEP 24576:CcP4mcvIjkGOxhKP2l71nNKbrh/8KBOSkQ/7Gb8NLEbeZ:tP4m4IpOO67W8K1kQ/qoLEw
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\dotnet\dotnet.exe
- Size 701KB
- SHA256 6ede06943314379dc22440284f60eccd856a934953950cb696cead1190f240a7
- MD5 69c2b338254afee06dc4a148da4bc754
- SHA1 4fe23b6fc2c690f4d02660a6b431b9c15e62440c
- SHA512 35800622f036d4f31d18019ccdab2e54bf504573c60c2d299158be15a74351ecd6f65a8cb2a2563a2824899dcbc5a096cb45cf5d0a1fc159b2983ada63126352
- SSDEEP 12288:oUFmDDLKMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:y/SkQ/7Gb8NLEbeZ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 588KB
- SHA256 84eb5fbf20f613d3e069aab77e55ad83a17d6d7918ec45ccd457c467e3c6cf76
- MD5 ac05155d0af14f27dc56a440cc50f689
- SHA1 dc84be16f194b436c33b2dbbaedc81d0a692509b
- SHA512 2e5928d3b0645dfd609b5b2c71121d0d07e070ba4c133d5822c7e0a0fba879b52d28b2e8dcb726ee9eb809ef2b7b67eb0468774e30d2ada7dcc4ee57a64a7260
- SSDEEP 12288:IVMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:IGSkQ/7Gb8NLEbeZ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\AgentService.exe
- Size 1.7MB
- SHA256 0d38c1214cb8cb309f5aa19074b8072bcd24810dfc1e1c14e8472affa12b762b
- MD5 392340bf6c217205df4fb7ed10776f3b
- SHA1 21b9e3c43ce750296df53518aa43ec4b21985496
- SHA512 4561dbfc036a97984e1d534e93dfd97ba82692da3d76d1ca1468da7d0486e40930760ba9f8dd3c098a35b6db06cf873248c1c52c4bae8ddc722e2bd7223904a2
- SSDEEP 49152:Va0h2GEkuAe73q3pp46zwwQBkQ/qoLEw:Va0hNYG4Jwkqo4w
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
- Size 659KB
- SHA256 d66a657dae675efd26699a06c813b0c7a47802397f36e71424a72dcd0eaf577c
- MD5 311d76094db97dab7be297d5dfbd20cc
- SHA1 5dfddb0dbe6e08e9f3050d935efa6696957ad867
- SHA512 30d836f8cc472237ce16b72c51082a1657375b41a08dfe4be8184dfd632b96c9661bc46aa668b2c112839f4363233429bb19f24d643df322a2a29519634f846e
- SSDEEP 12288:chbHjfX0MTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:chbHjPVSkQ/7Gb8NLEbeZ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\FXSSVC.exe
- Size 1.2MB
- SHA256 b807e7d02d336f713b326350e1d0ea6f67582175378b25fd25479dfcea646642
- MD5 583b1f6c872629ab41a79bc841541bb1
- SHA1 30d59708338f421c9ddd07ea5732e2399bd42fe5
- SHA512 f0e935c605ce8d0f90f5232038960af0232467c4bca6fa65fd8a768ee3c1af8059270ae5b62f80773107ed0f3deb020cecb4ddf83113fceb281831a06c1e4cd3
- SSDEEP 24576:K3YgnJcRTk4yti+R5dBR/NSkQ/7Gb8NLEbeZ:KIgnaTk46pBR/AkQ/qoLEw
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\Locator.exe
- Size 578KB
- SHA256 11809e96ad085ff104d8678be66448ae3add028aa10c553c82101d724183d23a
- MD5 61c17d54169e1bb2e0d2549216b231b3
- SHA1 bc86731f9e1e6eef87a91152cc5b14d208d1577b
- SHA512 45dc4dc8830ac4173ce02e7e224465a730cae6ab33c6a6534243dc094e9f1215f4d606a4a165c389e3316825e0f6c213157e55bb9e8f237d3ee114e3ad4b17a0
- SSDEEP 12288:3BMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:3aSkQ/7Gb8NLEbeZ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 940KB
- SHA256 e7c402a844b3fa37ece6b76af96a11c9402ca29eb51480b6017a00a165da6769
- MD5 80ffd48e4311bbe40e67760cb05bb049
- SHA1 4f2094a3b5d160bd8f80fca648da7d739c8849cd
- SHA512 126750c3e275d2907c08602a1425ef7d1ef0d9fee674513cacc505c64cd40b7c3861370f4688eef426e5dd246b6169dc77228cf8c25c36dabd67f86ec7a25967
- SSDEEP 12288:JObIA4LWOsvAYFTiMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:+AL3UTnSkQ/7Gb8NLEbeZ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 671KB
- SHA256 fe5661e5d2f86bafb60daec401f66fa3499496abb699d234a4127aafeaaeeb07
- MD5 9735c7ade2902908adfeb2b4afac58cd
- SHA1 5dd86653d02e81f7576375b912f3446a447392f2
- SHA512 c58bcc943422c96b5933fc6b38d8e9cf00c5bcb2b25bc9cbf5f04497ec640bd31c3e39e7cb9525931b727c7a653b358910028f63d106aa8fa939710f82577d44
- SSDEEP 12288:upFtvOuMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:SOLSkQ/7Gb8NLEbeZ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\SearchIndexer.exe
- Size 1.4MB
- SHA256 747eca36b2df06977dfe4f124ef55b6400bb57761eb84cf557cba5218cbb647d
- MD5 80f03b00fecbd7fd4926f19311110257
- SHA1 0749dd1878aa01d33b2f783b5e8afb4e20ca6476
- SHA512 c10becf63657257497add35d2ab638f2e797760748affa38eb5e8d95a8133b943b12a62cbb68a82935b81dad7d86810be6df94d006703849242520ca9de7821f
- SSDEEP 24576:47NM9YqZqmWMUkPjZM48Mv6bEhs2SkQ/7Gb8NLEbeZ:47cBWMpPjN8DbEhYkQ/qoLEw
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.8MB
- SHA256 d7d40d8ee24b83a107e3742d38a8f12e4d6627b89f96def04da530e0f2fcda39
- MD5 4460ee3ba581ee81e4a2630af542436a
- SHA1 0ef845d53539b73dccf44c13f8d599c0df1467f5
- SHA512 9d10e3ec0b388d00c7c009adad2a9fa2b3c09cf25bed0b0e2780d8044959e3402ef3d7a3e322bae8c3b3ecb9ebe8f67990a2016b35fef810e000716afa8e2512
- SSDEEP 24576:JW6BApg2YuyuNDYTabvcdvNYf8km1USkQ/7Gb8NLEbeZ:JF2YuHNETovAvNYf8kmPkQ/qoLEw
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\Spectrum.exe
- Size 1.4MB
- SHA256 428c4a08214a1e66bb6eab2d4b96bb5e655ab845d14bad0ecf00f1ecc86f8d38
- MD5 556340f5339df9e6b012798d08e17e9b
- SHA1 6dffe5f5752c81ad6824ec7f21bdc17c09a15ce5
- SHA512 32ec10d46b06cd2dac91cd5418973f9c0074310f51a8e3693dc2ecd3afa70378c962c00f3cf81d4e2d262e5ad8d6f558c4ef4965a510635eb6b313d64014f5d0
- SSDEEP 24576:UAFs06+Omlf8NXEbToPSkQ/7Gb8NLEbeZ:ZFs060loXuhkQ/qoLEw
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\TieringEngineService.exe
- Size 885KB
- SHA256 6a6be36923f8fac924e6f51dc4bc57bbc5ca9c39e7adce826e6f6c7f29395bcd
- MD5 a16da82237513fc546b6aa666d9add84
- SHA1 7822b5054e7df32d5dd6933d83cfa30861d4dd49
- SHA512 0f284251b1ea78ecab1268bea1ccb657d79ff10af1425a4831eaa884467be474de947576dbd2ce143f82961d5f136521d3e2327ee02b3d45b2ec071d1c3df89f
- SSDEEP 12288:qCJnJ5D3VkrDzxlMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:rJnJ5D3WXISkQ/7Gb8NLEbeZ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\VSSVC.exe
- Size 2.0MB
- SHA256 c0ceee9e1c89dc9ce61b384ffedbfeca557c59919ada31075e692b15e139359d
- MD5 eca1d9d4cc81116800e6bb273365be18
- SHA1 54494f0ca697b9d2ce62b7bcd9d4b9d9893efb12
- SHA512 b1d72795f507c70a85d0286932e32a5673a36047aa12b03716cb8dbb161ef904caa9842a04c7ac7d69b781acde3cb8a2e010327e5135f44fd3251cb177e564e1
- SSDEEP 24576:XEPghm6/7IIXdwcXrif7qQncjlP65i3VuNSkQ/7Gb8NLEbeZ:Qg06DIKdwc+eQnSt65aVrkQ/qoLEw
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\alg.exe
- Size 661KB
- SHA256 dbc4fb6617c9e87e3f1a96f1223b06567b72e4e3a1dc1d13570ca1a4dbb40b52
- MD5 c1103c7af14e433fdfa1257170563a74
- SHA1 76acb3145e0f813f1b58ab28550cce5aa3004224
- SHA512 ce99f17254f8c54bf85f62b4a454edfa85aa97800ae9c1873d87a1900308f560800e6747153a25a76b743b494e8e5ea56392dbd5194df835e5d7110287701126
- SSDEEP 12288:NEP3RnXMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3Xe:un8SkQ/7Gb8NLEbeZ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\msdtc.exe
- Size 712KB
- SHA256 7974ddd70ffbb2c14ed168f6fe70dcd5fe8434ce6dd2ca11c175777472144484
- MD5 71395935d5b0074fd36a5c1625a3b4d2
- SHA1 984bbcff5034babfef8a64009cc3e5258f4403e4
- SHA512 941ccae7caac1342a8f8b77be7b17f393b72c853304fa7b37498b4c4d42da6a0b599519c2ac7bf27eec58cbdc76451ad6977d6b4d762ea536e122da0fc9ecf8b
- SSDEEP 12288:3jkyEMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:3IylSkQ/7Gb8NLEbeZ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\snmptrap.exe
- Size 584KB
- SHA256 d5c49b610aad7950da2af61e8f8ac3863c2adae637a1036b7691cae49e533d1c
- MD5 74faa7e944aa9ec3db6a943e921c60ee
- SHA1 a240e36d9583af251a11306e94b161256b2dc7b3
- SHA512 f0d81f13aedaa819d01c1d10dbebde514058aa49e4f53ca7d250fc12aa5a51021c00c5b9f73aa2b6af687271f71c5003474ff40b6fc2b01f9ac673829595f312
- SSDEEP 12288:Wy+MTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:/bSkQ/7Gb8NLEbeZ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\vds.exe
- Size 1.3MB
- SHA256 74b518851296b5d70402e41119c73df64c61dc9268bbe779fb8b90b9d6a945f3
- MD5 be05dcf4fbb7c1a777d8d2e5c3190a78
- SHA1 7eb79d6d5c7e031863914bfa32db8c43125279ca
- SHA512 4800c2ad7a23234d3b7add427af93d4fc52ba92618bd7d504d9f2a04997090da42d7a2c67ba5f7fb9d9d504a33012cbd8d78aa1454a66598b59f2bbad319182c
- SSDEEP 12288:gLQZb3C97GYnZMv5zBcKY9dMD3dMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:WQ9MxZKdcz9dw3+SkQ/7Gb8NLEbeZ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\wbem\WmiApSrv.exe
- Size 772KB
- SHA256 1bc6bd047a22098fda53b514757ea79ba3afa4e3b7d0e080de33c0a52f884090
- MD5 4c3dfbd7f784a5a65e5ea3683340f9c4
- SHA1 6f934a23b680a7fcbd2016f212039cac6a928159
- SHA512 df03ca9fc3ce731e8c668b4f0701cbc20ea28d687fe177ebde377348e84e309154e3b5b468c4a671b73ce6b6d8a6f4afbb0a0b236781692de335c30f2e9d1bd7
- SSDEEP 12288:SyoKo2JRple9pwMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:SyocDApZSkQ/7Gb8NLEbeZ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\wbengine.exe
- Size 2.1MB
- SHA256 396cbd383d45fe36eda91bf19728eaf5e945c919f787dc22e5be79769e8581d1
- MD5 d10a5a79279424ab4168a6dc3bf5e25a
- SHA1 e239145c23f5dc9405a95dd31b0157b9167af009
- SHA512 cae74526c9ffe93feeec4f1123e0e1f3240c5e5e6b13f30e486586c87cf720f380962f8e36d5c4357f26dfb4132bf42a304d2683dcad31ff2eca0d807534e08e
- SSDEEP 49152:0WcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IK8kQ/qoLEw:e0zuNI2qo4w
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\system32\AppVClient.exe
- Size 1.3MB
- SHA256 588f91ed40a3d1319f95216c62e69737b952ce5cd7f8b36a32b2979d7fd7bccd
- MD5 c314e6b1ef4f5ca652afcb4eacd4994b
- SHA1 4d81635d8fbeb9a3707b218f61456d959c2503f6
- SHA512 6a9b6c7961d730f04c4da389c2eb303457a9392af77556bcf3f9106e2ba0a5327c9230f9e5ab8df905d5d09d7e48e1100837cd350e451e28da588f5ac671ddd4
- SSDEEP 24576:M1QT7EcpfxR+N5AWAz3ooiYzjMqb8SkQ/7Gb8NLEbeZ:RTDxR+N5YzTBjMWkQ/qoLEw
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\system32\SgrmBroker.exe
- Size 877KB
- SHA256 38aba099b35009b5907cc1825fd8e1d6f802bd7a7cc051d326c0714def09558b
- MD5 b37813c05ba453331cad2e14e644fc9f
- SHA1 29573a9fbb3eff3d7b1ead93f16c769de9957cae
- SHA512 4b0e1df98b8d755d95c92317069d18b6c3ef4342d4e636b4115a95454cd1f23768c9858e321284831f59a341d93a2186fe7dc22802cc84fdfd81f8bf276a620f
- SSDEEP 12288:F/5T+RdOzMbFFTG+eEqNmSL+EMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:PTMdOz0FFS+UmSLwSkQ/7Gb8NLEbeZ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\system32\msiexec.exe
- Size 635KB
- SHA256 80e747567b7b6c1cfb156ae2c0014ff59cf367ac23d13880a48bc4f38e95655c
- MD5 979c49b054d7c3f900981572c53a75dd
- SHA1 9c6a678165ab5cf3c7b211280cfc922e59157c85
- SHA512 841bb374d0c572e313a2e3a5b1d85a4f69f72df85e757813f0efbc531af7e478a721692133a708caaecae86b454d16e49b8fc0bc21568b340bb83e8e0ea59bc5
- SSDEEP 12288:t4KiMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:pnSkQ/7Gb8NLEbeZ
- MD5 SHA1 SHA512 SSDEEP