4388345e796355cb5d16c8c431c247a1279a14721aebc8cd584df697fe232237

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 17:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-06-03_c8480b69ab0b2c2be00bb9dc6d70db94_ryuk.exe
Size 1.1MB
Sample240603-vlaqeadb2v
SHA256 4388345e796355cb5d16c8c431c247a1279a14721aebc8cd584df697fe232237
MD5 c8480b69ab0b2c2be00bb9dc6d70db94
SHA1 74e375de082f8d94c4c6205109671ea3572dc3b6
SHA512 120802d424e72b4f50c2a3d03a3bf847b75c8ee0688bfa1541fe0158a948c7a0686c263855a787a9b267de73f6405e6eca7ea19f156f93a02eea75fdc74c0155
SSDEEP 24576:mSi1SoCU5qJSr1eWPSCsP0MugC6eTWMdIuwe3zfIe7xmvH/:2S7PLjeTWMdFrIe78vH/
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
116	alg.exe
3640	DiagnosticsHub.StandardCollector.Service.exe
3456	fxssvc.exe
3348	elevation_service.exe
4576	elevation_service.exe
3980	maintenanceservice.exe
1388	msdtc.exe
2628	OSE.EXE
4468	PerceptionSimulationService.exe
1808	perfhost.exe
1952	locator.exe
4376	SensorDataService.exe
4716	snmptrap.exe
4416	spectrum.exe
4560	ssh-agent.exe
640	TieringEngineService.exe
1344	AgentService.exe
220	vds.exe
4944	vssvc.exe
1224	wbengine.exe
3436	WmiApSrv.exe
1372	SearchIndexer.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in System32 directory 37 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\msdtc.exe	2024-06-03_c8480b69ab0b2c2be00bb9dc6d70db94_ryuk.exe
File opened for modification	C:\Windows\system32\locator.exe	2024-06-03_c8480b69ab0b2c2be00bb9dc6d70db94_ryuk.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2024-06-03_c8480b69ab0b2c2be00bb9dc6d70db94_ryuk.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2024-06-03_c8480b69ab0b2c2be00bb9dc6d70db94_ryuk.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2024-06-03_c8480b69ab0b2c2be00bb9dc6d70db94_ryuk.exe
File opened for modification	C:\Windows\System32\alg.exe	2024-06-03_c8480b69ab0b2c2be00bb9dc6d70db94_ryuk.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2024-06-03_c8480b69ab0b2c2be00bb9dc6d70db94_ryuk.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\6ee6d6aee703f493.bin	alg.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2024-06-03_c8480b69ab0b2c2be00bb9dc6d70db94_ryuk.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2024-06-03_c8480b69ab0b2c2be00bb9dc6d70db94_ryuk.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2024-06-03_c8480b69ab0b2c2be00bb9dc6d70db94_ryuk.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2024-06-03_c8480b69ab0b2c2be00bb9dc6d70db94_ryuk.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2024-06-03_c8480b69ab0b2c2be00bb9dc6d70db94_ryuk.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2024-06-03_c8480b69ab0b2c2be00bb9dc6d70db94_ryuk.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2024-06-03_c8480b69ab0b2c2be00bb9dc6d70db94_ryuk.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2024-06-03_c8480b69ab0b2c2be00bb9dc6d70db94_ryuk.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2024-06-03_c8480b69ab0b2c2be00bb9dc6d70db94_ryuk.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2024-06-03_c8480b69ab0b2c2be00bb9dc6d70db94_ryuk.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2024-06-03_c8480b69ab0b2c2be00bb9dc6d70db94_ryuk.exe
File opened for modification	C:\Windows\System32\vds.exe	2024-06-03_c8480b69ab0b2c2be00bb9dc6d70db94_ryuk.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2024-06-03_c8480b69ab0b2c2be00bb9dc6d70db94_ryuk.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2024-06-03_c8480b69ab0b2c2be00bb9dc6d70db94_ryuk.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	alg.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\system32\AgentService.exe	alg.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2024-06-03_c8480b69ab0b2c2be00bb9dc6d70db94_ryuk.exe
File opened for modification	C:\Windows\system32\dllhost.exe	alg.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2024-06-03_c8480b69ab0b2c2be00bb9dc6d70db94_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	2024-06-03_c8480b69ab0b2c2be00bb9dc6d70db94_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2024-06-03_c8480b69ab0b2c2be00bb9dc6d70db94_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2024-06-03_c8480b69ab0b2c2be00bb9dc6d70db94_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2024-06-03_c8480b69ab0b2c2be00bb9dc6d70db94_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	2024-06-03_c8480b69ab0b2c2be00bb9dc6d70db94_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2024-06-03_c8480b69ab0b2c2be00bb9dc6d70db94_ryuk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2024-06-03_c8480b69ab0b2c2be00bb9dc6d70db94_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2024-06-03_c8480b69ab0b2c2be00bb9dc6d70db94_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	2024-06-03_c8480b69ab0b2c2be00bb9dc6d70db94_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2024-06-03_c8480b69ab0b2c2be00bb9dc6d70db94_ryuk.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	2024-06-03_c8480b69ab0b2c2be00bb9dc6d70db94_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\110.0.5481.104\chrome_installer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	2024-06-03_c8480b69ab0b2c2be00bb9dc6d70db94_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	DiagnosticsHub.StandardCollector.Service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	2024-06-03_c8480b69ab0b2c2be00bb9dc6d70db94_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2024-06-03_c8480b69ab0b2c2be00bb9dc6d70db94_ryuk.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe	2024-06-03_c8480b69ab0b2c2be00bb9dc6d70db94_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	2024-06-03_c8480b69ab0b2c2be00bb9dc6d70db94_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2024-06-03_c8480b69ab0b2c2be00bb9dc6d70db94_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2024-06-03_c8480b69ab0b2c2be00bb9dc6d70db94_ryuk.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	2024-06-03_c8480b69ab0b2c2be00bb9dc6d70db94_ryuk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2024-06-03_c8480b69ab0b2c2be00bb9dc6d70db94_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2024-06-03_c8480b69ab0b2c2be00bb9dc6d70db94_ryuk.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2024-06-03_c8480b69ab0b2c2be00bb9dc6d70db94_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	2024-06-03_c8480b69ab0b2c2be00bb9dc6d70db94_ryuk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2024-06-03_c8480b69ab0b2c2be00bb9dc6d70db94_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_110750\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	2024-06-03_c8480b69ab0b2c2be00bb9dc6d70db94_ryuk.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	alg.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2024-06-03_c8480b69ab0b2c2be00bb9dc6d70db94_ryuk.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e8191215d8b5da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007b922413d8b5da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000002690115d8b5da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000f310313d8b5da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a7d34914d8b5da01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000002690115d8b5da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
3640	DiagnosticsHub.StandardCollector.Service.exe
3640	DiagnosticsHub.StandardCollector.Service.exe
3640	DiagnosticsHub.StandardCollector.Service.exe
3640	DiagnosticsHub.StandardCollector.Service.exe
3640	DiagnosticsHub.StandardCollector.Service.exe
3640	DiagnosticsHub.StandardCollector.Service.exe
3640	DiagnosticsHub.StandardCollector.Service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
656	Process not Found
656	Process not Found

Suspicious use of AdjustPrivilegeToken 41 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2996	2024-06-03_c8480b69ab0b2c2be00bb9dc6d70db94_ryuk.exe
Token: SeAuditPrivilege	3456	fxssvc.exe
Token: SeRestorePrivilege	640	TieringEngineService.exe
Token: SeManageVolumePrivilege	640	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	1344	AgentService.exe
Token: SeBackupPrivilege	4944	vssvc.exe
Token: SeRestorePrivilege	4944	vssvc.exe
Token: SeAuditPrivilege	4944	vssvc.exe
Token: SeBackupPrivilege	1224	wbengine.exe
Token: SeRestorePrivilege	1224	wbengine.exe
Token: SeSecurityPrivilege	1224	wbengine.exe
Token: 33	1372	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1372	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1372	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1372	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1372	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1372	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1372	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1372	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1372	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1372	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1372	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1372	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1372	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1372	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1372	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1372	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1372	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1372	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1372	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1372	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1372	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1372	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1372	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1372	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1372	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1372	SearchIndexer.exe
Token: SeDebugPrivilege	116	alg.exe
Token: SeDebugPrivilege	116	alg.exe
Token: SeDebugPrivilege	116	alg.exe
Token: SeDebugPrivilege	3640	DiagnosticsHub.StandardCollector.Service.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1372 wrote to memory of 4780	1372	SearchIndexer.exe	108
PID 1372 wrote to memory of 4780	1372	SearchIndexer.exe	108
PID 1372 wrote to memory of 3620	1372	SearchIndexer.exe	109
PID 1372 wrote to memory of 3620	1372	SearchIndexer.exe	109

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2024-06-03_c8480b69ab0b2c2be00bb9dc6d70db94_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-03_c8480b69ab0b2c2be00bb9dc6d70db94_ryuk.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2996

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:116

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3640

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:3636

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3456

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3348

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4576

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:3980

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:1388

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2628

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4468

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:1808

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:1952

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4376

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:4716

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4416

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4560

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:4492

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:640

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1344

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:220

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4944

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1224

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:3436

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1372
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4780
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
  2⤵
  - Modifies data under HKEY_USERS
  PID:3620

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
Size 2.1MB
SHA256 5886429b5b68ac8fb66c8046eaed27d5b6bdbbf74ecfefe385fe5448affda229
MD5 a35494622135ea653caaa52e35862aaa
SHA1 3b0174ae26454feb9027a50d15e2d2a1e4c5edd2
SHA512 12eb8fcdc565d762dadb1318f7439468c68f9d5ddb82aef4ecfc4f7d57cf598abdf6c682d7183b50bb9f33fb1727873b526bd4769a3f546b50f31c43de6c8ee7
SSDEEP 49152:FuYk3H5koUXfTqkkYLO/W2buywzMbOX+T7z5JMdFrIe78vH/:FPfTqi90b+TjYvH
MD5 SHA1 SHA512 SSDEEP

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 797KB
SHA256 905a11f8213bc504259f52c54ad2d8eccef944b551625e53b221e1ab3dfa4c6a
MD5 dd99aa42d213b23e7a255b3d6cccddf9
SHA1 5503e1f32010fa71739bf2067eb47cae55d1cb3b
SHA512 a61f6660f0b330dec9d5525a1452018efc4338d271f34fd636d07baa4b722e1b15ba4b6db64fd9f55a13a6327d6dc55c84ac58d9099e3df4d0f3cf91bcf6a2f4
SSDEEP 12288:TcQiQmNJLBsunEl+Xq1gYgR+8DAoczI2ZfnwlQTePINayz+ByIne7xmmZjIUTSlb:bidnBsuEeMdIuwe3zfIe7xmvH/
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 2324c9101faafa42f51ed33628e595021bfea712f1f9f55cfcb7de22316c875b
MD5 b8bde524b776d2d2a5f6cc64abae40f6
SHA1 3c69d7c07f7d7a35f89a0d6fa6ac463619cc9e31
SHA512 b39557678973d0bb743e3237f3c2f4154b311fe373a0de2b2c995f07a584b9b07d95a0a9cfceb72cffe1df5e0944720330b9529f2e70c58fe31f8de7de8ff082
SSDEEP 12288:w7a3iwbihym2g7XO3LWUHfh4CoZ+Xq1gYgR+8DAoczI2ZfnwlQTePINayz+ByInp:d+gkEVfh4CoaMdIuwe3zfIe7xmvH/
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 29d59136c0180dc49a5d0ab96c648459d60898307a3e59675f2863cda1fb0eaa
MD5 bcfdc906d608baaf5d19db61601252bb
SHA1 02e670b504d9041fe40bec94ceeeaeea5a473d31
SHA512 4adce5c0aa5d38c518fec39b8186abcb324224afa1ef968c4f45c64c354318d16b4b9725628835967f2ececa8cd79dfe75213a8d9d5a14541aa3da7d25d0b595
SSDEEP 24576:kBpDRmi78gkPXlyo0Gxjr1MdIuwe3zfIe7xmvH/:gNRmi78gkPX4o0GxjpMdFrIe78vH/
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 278c658a7f9d3fc776f54202f2260335a18f934e932a487ec2ee109464a55acf
MD5 e5ca6003456abf83b4ee22e5d5677b12
SHA1 f768be47dc35f574aa56e813f14823445398c2c0
SHA512 ed2d329ca7af221fa05a2f97fac5f9bfe801207d02640c99af7cd94bb0ccb37c091f4748218e0fffb100f78cb421cc48cf5a78f82a479461a8e3a422e7a49621
SSDEEP 12288:vfC6Aj+TN5uixZN+8rKhUdTC/wE1MD0Ca5ZIXVZ+Xq1gYgR+8DAoczI2ZfnwlQTa:HLOS2oyPIXVaMdIuwe3zfIe7xmvH/
MD5 SHA1 SHA512 SSDEEP

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 249e5718517ba9a8c0dc5179a4b635a7ec51fe3e5ac4d16234ed63d2683bbd1f
MD5 b18b4f3df36cb93acea23967565b2136
SHA1 d021a437e7502201a6f48059e25f48c7881eeb97
SHA512 aa303d4acff16d710fd3cc79f102f24d7fb87f8126fafbe280e2bacf286c7c2849da0b91c844d6dadc33d2593a37f952aa06199c26385766fb479f8411647a52
SSDEEP 12288:ufT+Xq1gYgR+8DAoczI2ZfnwlQTePINayz+ByIne7xmmZjIUTSl+0/1:ufMMdIuwe3zfIe7xmvH/
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 fb4738e6d13eca9b2d5eb8e70702acaa515022dcb0d15e40a7af97045080dbff
MD5 9ecf4c97e907e0bbdf2052a13d0abc7a
SHA1 c27416e69fa75f30cab9311b75ca719ceee89f4a
SHA512 b41fbe84b7251d01f1f9f71275987fb5b7221a4f404af25610b0ec1d630719fd6eece0f719a3a08936634552001691021e24e7315878ef847a68bf77f259a5d2
SSDEEP 12288:XeBNUbTVO86U2+Xq1gYgR+8DAoczI2ZfnwlQTePINayz+ByIne7xmmZjIUTSl+0t:XJIU/MdIuwe3zfIe7xmvH/
MD5 SHA1 SHA512 SSDEEP

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 28ecff656b2d09243efec8cd86ab390a69909ca3d071215952a97a1101c83384
MD5 86f7df4711a058ce1083ca1d92cd6524
SHA1 821d76e3809a69363edc8f5761edf1969b4213e7
SHA512 964d9142cd3c4ce42335e206b5f6252ceaabc1ee20cd139d5bcd7f8fb94d49a890c3c40c5ee1bcfaa577c233ef8c0e518edac7afdff5cbce7a78922bf2e1c614
SSDEEP 49152:xQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THt:xQvGAdlCEL8c/yRNw5ClTjYvH
MD5 SHA1 SHA512 SSDEEP

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 c39413d33c003921c624e711f7fc6594c1db12b363a3280a7fdf724959824eaa
MD5 f61398b4599c117a04861023817b8403
SHA1 48723f636147e12b4ceefa9614bec9f9ce7c9402
SHA512 d06cfa42e7afcd4ee388a35e9fd7e6a9edcd064d040d66725ea029de3882a4c5b2d8dd8300d4b8ee0bb24c316991225bbc82694110741a95107bab9a089a72ad
SSDEEP 12288:bAwSfxL/2Dc34DLLmt0LDQewsAjc+Xq1gYgR+8DAoczI2ZfnwlQTePINayz+ByIp:EdewsAjdMdIuwe3zfIe7xmvH/
MD5 SHA1 SHA512 SSDEEP

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 dd03ab52b39ad9526f721ca0dce12c103f07970fd5f9cb90965b69c021600719
MD5 841ac7e45d7ad1b6c55a816d9fb172b9
SHA1 ea9b1e23682079229b62dc13174714aa5b12af49
SHA512 ba729efe17c49f1aafc172471dcc8ce20a1f51147d6a45c4e152f2b29d47fac6cfe1f7b29be20a6759d444e89ccc56f0a3c65dc2c9c9b375981ce8f139c50d65
SSDEEP 196608:ZUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHGv:ZUEtQevvqc2W1cpV2EI32W
MD5 SHA1 SHA512 SSDEEP

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 ecd2d990791e1836646273430f361d56d0264f404b2ee01f2358d8c479a1bde4
MD5 624690b9d29f920894faf32915a07638
SHA1 359f19f187b3577640a522a4ddd1644e85474b57
SHA512 bd9544ee33c8019848fdd008ca50935cb878963cd87fb0995fa2a1daccd24651934a88560e873d41b0432a79b8c5f55f80031ccd9ef36bd8527576265f95ea78
SSDEEP 49152:RCbRquA/m2yL5zTfFiV+XenmE3/z9MdFrIe78vH/:eoquVjnm5TjYvH
MD5 SHA1 SHA512 SSDEEP

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 35437c8cbef35d07588594aff8a73a4ff954c016947d86b5f48308580890d884
MD5 7abcfe58488d9b825eddf8bc03c17a15
SHA1 e4b03c9e54d9e8971c5ce41b27f4ab4a5c3911e7
SHA512 5df70c570ea6de9bea852c659c7c282ec235264fe6c673731b23bc02a1b093f4b097172025d8984377bfe1fc0424a1c8e164b3d3b1de551db1071f27639b69f1
SSDEEP 24576:8AhGLJIFoiwtA5l7S53KMdIuwe3zfIe7xmvH/:8AMyFoiq56MdFrIe78vH/
MD5 SHA1 SHA512 SSDEEP

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 c6b330c48a18d35f8f855212fbdf3bd099c2dc0e586ccfd76302d0b984463ac9
MD5 62c39de7de8ef4672442261fc1664627
SHA1 40f63a90f5271163f7d46808446b84b60d2bb10c
SHA512 3830dfc3e71f7f242a76dc98f83a2c31616e9c5b78a1e2740d7e7dd1ce4dd22269179ea34aab8ba741fde74c58c24b5fe72216935cc97db0250b5e450d9b8f6f
SSDEEP 12288:8mw5HEjsChNVBFgl0WDm+Cd+Xq1gYgR+8DAoczI2ZfnwlQTePINayz+ByIne7xml:5wuoOWRMdIuwe3zfIe7xmvH/
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 a1cf47b7e990a85d9fee12dcc7ffd677431893df328311b0f3ead1afebe84b2d
MD5 9471461453cd9530c2fce034b23a5d1e
SHA1 6553a85326393b5ff0a40182e750dc591df00efe
SHA512 943a3423b020e210779c88957065c53c9c3426bf4e4910c40661e365ade2ab5bc1ac1bcb20bed751e153400ab3474780985fbb897690324e62a4122985d3b2c5
SSDEEP 12288:5BZ1IyM+Xq1gYgR+8DAoczI2ZfnwlQTePINayz+ByIne7xmmZjIUTSl+0/1:XZuoMdIuwe3zfIe7xmvH/
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
Size 5.4MB
SHA256 22291b1da7c88e636a487b7704ce96326967ff6f3ff22f0865032c0237b777f0
MD5 4a74ae9189ac8d449c514953d200f063
SHA1 2765e67f54306925275d9f60bd0ca8115c7de9a0
SHA512 f2a8f6156bb4dfe0f93da72f1254db31ed42f5f9d22bd424ede3812bd046a9e1a9595ddbb2b1e802718b0fe115c2ae581c64051de74d45b645fe9410f168ccdc
SSDEEP 49152:10kwIi7c4xZlm5knEtw99Kn/2vim7vgv6m+yyJ/0gbvjR7yY7BHi3u7L/gBUUWLd:dwfhY7g/rLd7yYA3awr341gRTjYvH
MD5 SHA1 SHA512 SSDEEP

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe
Size 5.4MB
SHA256 312bf1a9238e4bb615490107ec63f56cdd65e116912f5cc819b02f4b668e8a5d
MD5 ceaf320a6a14dca5a3084769687a0f25
SHA1 e041cb4f6dee2a603e98ca38e7a5f88c45cde42a
SHA512 9ca830e5860c5c29ce7d919522f4e7c9760d9d9a53bf6759fbc2fc16547ef44d1ebad6fb45ec65430d7c463cb33c35dca12837185cc0df19495b04deb179d533
SSDEEP 49152:80kwIi7c4xZlm5knEtw99Kn/2vim7vgv6m+yyJ/0gbvjR7yY7BHi3u7L/gBUUWLd:awfhY7g/rLd7yYA3awr341gRTjYvH
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe
Size 2.0MB
SHA256 d9c7f5ff546e28c99356e77890963fd95e0a013209124cf9938cd4a30195234f
MD5 cd125eeee2bc34fac6e160ef3da539af
SHA1 2af49fb34616b0152fc5764d30384e935496c66f
SHA512 39ecef8e5452acd6a1d545dcd6976661a08e17e7be6271fb666f94b8c212f2e94ae3c95fc60b5c93ba7d8767ed8e0cc3e43a1451b5461750f1c1f8afcf7dfa7a
SSDEEP 24576:XcTyYv0FteQU+5I2kjgD6iQacARMdIuwe3zfIe7xmvH/:XuXv0Ftpn5606zORMdFrIe78vH/
MD5 SHA1 SHA512 SSDEEP

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
Size 2.2MB
SHA256 1e2e8b1bd98baa9ea8fb25e39084158c018f6cbb8579bf81972e6b083f0d7b65
MD5 23972638c5977094b9255df221311c54
SHA1 f8dcc979b7d87e4a0f9a3a67e94479c492a088e9
SHA512 04c80ae7682f3f3134184fdd7da6645b51538d92451e2d329e8065f9db8068802367254414cc2e777cb37ca4d6e3c832c4bcd78d557e147ea179ea73c0e16101
SSDEEP 49152:By7mTd0GxN8jyynxHjXKUyn4GVcbDSKrNTxdMdFrIe78vH/:cmYeyxHjWjMT+TjYvH
MD5 SHA1 SHA512 SSDEEP

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe
Size 1.8MB
SHA256 ffd8b7c5cfbf96a4571eb837e750b690d25af47eac9bb7dadc38a2546438e9dc
MD5 22065e74a9ec313fdf4e56594ea78778
SHA1 fa9930ac51526cb12a4839c25fe418ac30ef4c1e
SHA512 e6890263f38a61f78c6c54185a2bacc4f300722921d31648ce96cc08ca763bd3f70f4e105d70bf378a2f0d77934dc48411488c305b4da4e84c9660ea1aa0d6ec
SSDEEP 24576:I6drZn1WEci182IEUeNbJeRgUebgW816QMdIuwe3zfIe7xmvH/:IWnDci18yNNUgbYJMdFrIe78vH/
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 1.7MB
SHA256 efec3e61ff4bb45de9c4de4ee0b8a1f2908af47fbaad1f7ec14e1c91892d57e5
MD5 7ba3e5ef38a249315a3717660794018e
SHA1 ff7c3ebfbb2e220a8cb14441f5f61dd199f4f27a
SHA512 23664958387c497b96b1007bde0ee82704f9e763840b3319f555a03dce5b9e157b4b324d413d712c9e6f3ced114c487d20620d3b3a87eaefbb92116b9312dc15
SSDEEP 24576:Yk5lHW5EzMZupO80G2reD+melRgTTv/1nyLMdIuwe3zfIe7xmvH/:+izMZm0GhamSooMdFrIe78vH/
MD5 SHA1 SHA512 SSDEEP

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 7b7144192bab196642426d2b83052f16d63b8701302b0567bf6a29d764c33f88
MD5 3ff22a234e5929c4878b34de14c42710
SHA1 ef18b6e9872e7d6bd8803ed24e804827271f22d3
SHA512 ae2ccfb9cc81c8f52d3ed06b69f0d9c43b667974a8fdd6942473f3448a369fdbcea8fa1247a6e78927860e9aa1d1d07e90016ee64b4799c4153e8a9fa2bd96e9
SSDEEP 12288:eL+Xq1gYgR+8DAoczI2ZfnwlQTePINayz+ByIne7xmmZjIUTSl+0/1:eEMdIuwe3zfIe7xmvH/
MD5 SHA1 SHA512 SSDEEP

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 c03720dbdb8374c422688247026faaf08a36ee529787f73caf1461c500df2b79
MD5 209dcf9887119b6abcc912449f7ecb0b
SHA1 78392495096b0377d0e47491ee8eb05baf292837
SHA512 016c2ac2b652da49694b261300fa6ff35b25532e7bf0ae552a23079f899f76bac84f9b42503e971df94e7440a35ed72b2fc0de052264990745ee8187e317fced
SSDEEP 12288:Og+Xq1gYgR+8DAoczI2ZfnwlQTePINayz+ByIne7xmmZjIUTSl+0/1:OZMdIuwe3zfIe7xmvH/
MD5 SHA1 SHA512 SSDEEP

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 630235d0786c046fe52af89887e2d75ef7c1fba62176290d9f94e41655d7c12e
MD5 4ebc731a50148b738e9d67c9c31821bc
SHA1 c9d4e0d8bab6f55723e4897fb1144670bc957a0b
SHA512 391cc7ef84e8d35da1ff08968d85dadfa9e88215576de7c5c181fc25462894d23b0080e10ea76696bf203f3ff62f40e91697f07fb324fcdb9027f3a8a2635499
SSDEEP 12288:Lu+Xq1gYgR+8DAoczI2ZfnwlQTePINayz+ByIne7xmmZjIUTSl+0/1:LXMdIuwe3zfIe7xmvH/
MD5 SHA1 SHA512 SSDEEP

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 aa00bd3ebab825144ea4ec26b38f51b97d6866554954728eb0fb9494fe22c448
MD5 4a469d1151e01d802a68f43a08643782
SHA1 19d4a50c47e4add8a51850c5d76bd0978c7f2b76
SHA512 5259b7733e068650e7fda6b78369f1d7b78dd644ba354af158a3b7cee6f67456feedbb22e91716a5ad56c7260b76be3940f87856fd865700bf5dab6b3d933d3b
SSDEEP 12288:/VJ+Xq1gYgR+8DAoczI2ZfnwlQTePINayz+ByIne7xmmZjIUTSl+0/1:sMdIuwe3zfIe7xmvH/
MD5 SHA1 SHA512 SSDEEP

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 2a8ff566f58780e656864a3fbee89e731d93e2352424fdcf99f4db870afa6c94
MD5 778cb1359c69b9eb2f36598ffa81c1c7
SHA1 e7543c48228c1238c021d3e5ed7dbd0628f0fd81
SHA512 e0ad13d589e3551a9f9e4aa5d675a1600e5358fdccd382fb461b810e5d320f8d3c87ba21094ecc647d786cfba35bdbd26db5e7e17fff114af950a8142160059a
SSDEEP 12288:gR+Xq1gYgR+8DAoczI2ZfnwlQTePINayz+ByIne7xmmZjIUTSl+0/1:gyMdIuwe3zfIe7xmvH/
MD5 SHA1 SHA512 SSDEEP

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 5beb64a30516f3497e539475fe29d3ed457bb6a22bcbcaf09cdc6a465abd6319
MD5 1a938b74aee1fd8ce797fb6df835a482
SHA1 e214743fdecb83e43a5d2c861b00da990a1c4ee6
SHA512 d7635a67ba9901ffb699396cf48af49250294d270d803095e74ae45e59e8a88ebc66a9c5f516b44b7fcb149b7d6eac8655c00df92faedaef5ffd6bad8cbda64e
SSDEEP 12288:TU+Xq1gYgR+8DAoczI2ZfnwlQTePINayz+ByIne7xmmZjIUTSl+0/1:T1MdIuwe3zfIe7xmvH/
MD5 SHA1 SHA512 SSDEEP

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 1b298a86389bf93d4ce27c2823a2305bbdfb7724e705d677283b18f7b9aa25c2
MD5 4142039f6ef8a4be73cc1550d8e0e2d5
SHA1 b4a7cdf3b408a6a4d476ce6db6365932f5092778
SHA512 e7352c829fb5587c467e93184a5793c6d68786d474a6211b6fa335d53f4f9ee47405e5ab41c047e2f3451a1c2de0d2906e1850839fa008940cce3fe8a2b20710
SSDEEP 12288:5o+Xq1gYgR+8DAoczI2ZfnwlQTePINayz+ByIne7xmmZjIUTSl+0/1:5BMdIuwe3zfIe7xmvH/
MD5 SHA1 SHA512 SSDEEP

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 95de42ae8d6029aedb40c2d5f2f8679b92dbf198659f84d378c859cce8a99bda
MD5 04f9bb6d383ebd146dce9a67486feea9
SHA1 4ed33b32974e692504ee25068ad74f366bd10311
SHA512 f70c38ea20f09964f2ffd6436f4749fd16762f46530df5f4f0450adace2065e2a0c1c6446ce072588a204f0a0e2de38fbdbf264b2709611ebf122a0c44840ada
SSDEEP 12288:GiZwb6zzFEoS2cPvyA+Xq1gYgR+8DAoczI2ZfnwlQTePINayz+ByIne7xmmZjIUM:JZMSzFVSO5MdIuwe3zfIe7xmvH/
MD5 SHA1 SHA512 SSDEEP

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 922da9f10d6229e237764df0184497086c6aa1de597a9932f690e29a4844c389
MD5 d8c8c2266e25d1e04c195a0319327df7
SHA1 251337aabf6edd03da63c130ef2a4d32dbaa3f96
SHA512 05256c729a3d2ca4cdd7f10f9431f96626a2c9dda3eb37f4813be659c7af312ec55a6111375d824c023f46ff70057347518878ad850006f13af6aca143ca5883
SSDEEP 12288:j3+Xq1gYgR+8DAoczI2ZfnwlQTePINayz+ByIne7xmmZjIUTSl+0/1:j4MdIuwe3zfIe7xmvH/
MD5 SHA1 SHA512 SSDEEP

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 9a6e79ad6696faae265af1a928f12c9ca934e191cbbb4e56db99e1209a682416
MD5 9f2eea3e69e0085a0f63a69775763cb0
SHA1 f7aafc933da18b922c67261caa1957fd57137a93
SHA512 eb6ccf1bdfe8f43b37ec8f8e21bacd6d6a0355d8cedd020efafa902c9d439a1472d808fd235b434eed48bbab133322578efed2966d5d2960ee8bc45a18391b66
SSDEEP 12288:uD+Xq1gYgR+8DAoczI2ZfnwlQTePINayz+ByIne7xmmZjIUTSl+0/1:ucMdIuwe3zfIe7xmvH/
MD5 SHA1 SHA512 SSDEEP

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 00df38a8595ed422492ab5a76ff25e1842321ab97bdf0c3a6e9c00c603d024ae
MD5 6c00e876383b9274bd87e835f3ccbe24
SHA1 1ececae939d9e3efc587ca5a7c51100eeb1f486f
SHA512 921cebc002418c2b23362af904d84965cd1f106e8a8d391188bc0d00b482fa8d2b2a072245fb98f0308e7e46170c8202ec26e4966a30d0cfe62dd9394d008e16
SSDEEP 12288:/yPz5L8M+Xq1gYgR+8DAoczI2ZfnwlQTePINayz+ByIne7xmmZjIUTSl+0/1:yzytMdIuwe3zfIe7xmvH/
MD5 SHA1 SHA512 SSDEEP

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 7bc47cae653cae07c4f3085c8523bb863fa9cc61066d2a5f1e9a2e7af4934959
MD5 d376eccc89aeacf14c4e5c5e7f667f8e
SHA1 4c41298a23561bebf43f4776d418cc90b084b956
SHA512 7e22461202d07bc7e5d917e8edb43e75fcc98f02e263d64b1b7beb2eb0f038e24da5f05ee566ef47f4d92775d1c79bc3aed9e0d688d2b200c710ef4b1d22f364
SSDEEP 12288:T3+Xq1gYgR+8DAoczI2ZfnwlQTePINayz+ByIne7xmmZjIUTSl+0/1:T4MdIuwe3zfIe7xmvH/
MD5 SHA1 SHA512 SSDEEP

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 d05ae8204eef41e2b57b32dc399d578dff4dab2423571693246f9b07a9f07773
MD5 ea0865c67c2de3a17627c37076debba0
SHA1 44e8278818492e0a72431f0a73961bf6d36dd1bc
SHA512 d49dae958b9dd98ead462d3afdc44a9f7c13d8dcc895047bc0ef10b6168c787bed47a14bfc18956c3247b378ebda8389bb2902cf3abaa1b04c0732e09e3eca19
SSDEEP 12288:t3+Xq1gYgR+8DAoczI2ZfnwlQTePINayz+ByIne7xmmZjIUTSl+0/1:t4MdIuwe3zfIe7xmvH/
MD5 SHA1 SHA512 SSDEEP

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 380fdfc214a4d2e315ee7461eef4949949270f35ec22efe2b389d47a254cbc08
MD5 3b928f01a66e36227f06474fe45097ee
SHA1 0aafebc044be46ca9c44ad7a41c53f1b98177946
SHA512 08d77c80c74780e8701dd0c1f8603b9e21aa3129003f691bd0259894982cfeabfe49628e44c1a4452f38ed8c09693f5e42e82203343f57c024cb8d677fb422c9
SSDEEP 12288:JyPz5L8M+Xq1gYgR+8DAoczI2ZfnwlQTePINayz+ByIne7xmmZjIUTSl+0/1:ozytMdIuwe3zfIe7xmvH/
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 3a331d849ee9648b3608cbcf9beb36082efd9b3fb0c17933df9ca04ba390faf2
MD5 b4a72484fff937d7a2f24087b8acabf2
SHA1 0efa07e4ad420700bcac5dbb65b80a01d175f994
SHA512 76fd3b1aa3e944d84c447ccc6536744fb0560af5305d18e47403d980f8ca1ab2bb8db7e124e03b32abd9d08e49976c0ab1d734c137b6cb545fc3977a0c9be675
SSDEEP 12288:/Cd9eWYoaLHF3z0z04PDvh++Xq1gYgR+8DAoczI2ZfnwlQTePINayz+ByIne7xml:qTHaLl3z0zDHMdIuwe3zfIe7xmvH/
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 9625e38d00f30e8695e748cc74af4d60a39608f8b57c64207dc52f7596d47851
MD5 1fbe841fc0abe0b0ac7e9d20e01d41b8
SHA1 8f8b2d8dbdd7d351c89c64df5a36c47b14a498a5
SHA512 dc1ed08081a0d3382fb0caafc9941b9365a370a927ebcf9ba9d5a400bb26b0f0f1aeda2c6d7d1a03a644f09913393546e0ce832203744671d630ee33d8ceb6e1
SSDEEP 12288:ri4e7+RdTfgwCHKy7GLbbdIvl+Xq1gYgR+8DAoczI2ZfnwlQTePINayz+ByIne7o:r37d9CHKy7GZTMdIuwe3zfIe7xmvH/
MD5 SHA1 SHA512 SSDEEP

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 1b90b4340b2300927f0e9724c02db3f5b49e114badb20cad96c98a8eba45d70e
MD5 8c1394bb29ca597d7070f5e704ead8a1
SHA1 f63997c6fc44757603cc06c39ecbeb9f7de2b8c3
SHA512 7cecee68115abaa30a2b1325715b668a08609fd24ce1798346d7b6cbbd15c856a21861386b8d11ae76fc77a548a78e3a9cfa8b6fabdc163402399de484efc45a
SSDEEP 12288:CO+Xq1gYgR+8DAoczI2ZfnwlQTePINayz+ByIne7xmmZjIUTSl+0/1:C3MdIuwe3zfIe7xmvH/
MD5 SHA1 SHA512 SSDEEP

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 e2185eec3a95ff55342a121588dc8c29a930413d8b8b1fe4d5667e61d38fc977
MD5 9cef522218e90bb529d87a7444fbbad4
SHA1 59c02166c9001527e45f6e6e1afe506c7efefd7a
SHA512 f4554740faf198cb774820377779afa355c5141e6f493f8b7bff450f224f4fd6a0e1ff4e4dc02808f038a5057ba6a55fa3e196305e1b68a8a1cbc22d2b11cbf0
SSDEEP 24576:6cP4mcvIjkGOxhKP2l71SNKbrh/8KBAMdIuwe3zfIe7xmvH/:lP4m4IpOO67N8KmMdFrIe78vH/
MD5 SHA1 SHA512 SSDEEP

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 701KB
SHA256 1ee151bc75c8afb9ce1952abf3836750642c816c74d123fb012299c3a87f5dcf
MD5 ca3e0a6dc8ae2945fb879593ee6ba596
SHA1 d11c9ff158b1b2e67697a7cc2263a09735a543db
SHA512 131b196720d3e32736e84cf60adbf86239464a65fc699188fd196842767b6763d63e94b50d212d4f955c2ab1cb2eef404c5ef8465ca911c81cf8c14ea7d91381
SSDEEP 12288:IUFmDDLi+Xq1gYgR+8DAoczI2ZfnwlQTePINayz+ByIne7xmmZjIUTSl+0/1:SDMdIuwe3zfIe7xmvH/
MD5 SHA1 SHA512 SSDEEP

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 1fd5915541898a169f90732a50907935c636205f185831600162a39d5e731e6d
MD5 329d6354bf7b14d0472973e00b5478bb
SHA1 f635df561c199acda3cf3b95c97cbc00d58d449b
SHA512 456a797325e64f5165eb48cc229b6280512bd7c6d3bd57f9e182610673fc20b8910800c31221e1c8cb183b747b2aa9f1b5f2434ce44d42519fcd92714c9d08c3
SSDEEP 12288:Kn+Xq1gYgR+8DAoczI2ZfnwlQTePINayz+ByIne7xmmZjIUTSl+0/1:KIMdIuwe3zfIe7xmvH/
MD5 SHA1 SHA512 SSDEEP

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 57af7fd7c03d934d45baa98660bb0dad76732aef4b4c2faebc2594d06ae94d9b
MD5 27cbae24d1cef750a750e40199622b1f
SHA1 26df8e773e8a866115ada64073d860c22afd64bd
SHA512 0bd984aab7d255b7e4b4d34e1b855a7d71aeca111dc61b7255e46e145e10c08cd9649402cbc9a7164c08e0708de0178c9590ad806546aac67deee74d6c26d069
SSDEEP 49152:sa0h2GEkuAe73q3pp46zwwQyMdFrIe78vH/:sa0hNYG4JwGTjYvH
MD5 SHA1 SHA512 SSDEEP

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 659KB
SHA256 a2d675e7b29e120598b45d2074cf831f60c31b2b82e1c251ab5035e78324b51b
MD5 dcff358607b1269deb2a5fd1cc03893c
SHA1 c3f51304b728884ed6f74861496db19dd7eaf285
SHA512 b187eebadb0456160a48b8149e10badbdda4f39d6ff206254c39749890b3c0cd93cb351a0bf88d9fb46bd8ea364617815ee5d2928b9b389f0de7bdabd781c0d1
SSDEEP 12288:ehbHjfXw+Xq1gYgR+8DAoczI2ZfnwlQTePINayz+ByIne7xmmZjIUTSl+0/1:ehbHjPJMdIuwe3zfIe7xmvH/
MD5 SHA1 SHA512 SSDEEP

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 1fdb3d221e40eaac790e3693363d2293e415d6e8797acf2e21112162a9d88bc3
MD5 0c2daf4cd9da7839838513301e13c961
SHA1 9fc686cf8faffe181d6abb9e7ed6690421b5b7e9
SHA512 25194ca7ef71210c2f352a60331332056de05dd7a3191864325d704df20ae0d63928a1f5469c85fb40f2f1e5a52d92bd05870916b2604c320961aaeda9a008d4
SSDEEP 24576:n3YgnJcRTk4yti+R5dpR/RMdIuwe3zfIe7xmvH/:nIgnaTk46ppR/RMdFrIe78vH/
MD5 SHA1 SHA512 SSDEEP

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 578KB
SHA256 15b24f7bba0d7a3fa099d44245d05d2a8c6f3c2a91ce63c888b7a86005acc20b
MD5 f4f2f0dcb1a73a9cbdc97c6580b12ef9
SHA1 9dee98349f81d6ec514cb0be0d9f8101b42255e0
SHA512 936cdfcd3324c1e13d1ededa7e01f7e8e44145a17bf5ef6065478e7da0cf8f76f6a7819355b050327db9c24c7f389d2831a562bb5559e3b503f4880fe7202d1e
SSDEEP 12288:2z+Xq1gYgR+8DAoczI2ZfnwlQTePINayz+ByIne7xmmZjIUTSl+0/1:2sMdIuwe3zfIe7xmvH/
MD5 SHA1 SHA512 SSDEEP

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 940KB
SHA256 d7945abbee9d32bcfc2bbd5deef5b3cf74d363c899756c117e22f1ea5f7a7830
MD5 ca0672357950d9a0592ff8e10351e964
SHA1 b74f19cf468dbcc698ce47a9b056498d0fcb56f2
SHA512 b5a3122579fce97ca6f858317eb4eb2acebb822311508d9a14951ef080f2e8b5ac1691bdb581d3afd17e5911dfaee9c854ccd76ca950871a6fd39f51fa4fdaad
SSDEEP 12288:EOb9A4LWOsvAYFT6+Xq1gYgR+8DAoczI2ZfnwlQTePINayz+ByIne7xmmZjIUTSN:ppL3UTbMdIuwe3zfIe7xmvH/
MD5 SHA1 SHA512 SSDEEP

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 671KB
SHA256 487c0cf24f311c9beb6d8b57f44495da5dbe02e8f7be5784c995691194bdd4e7
MD5 f1295abaeb99e35046289425e020ca10
SHA1 e368348cca308af6c78ee6214286a1053302856f
SHA512 8645694e7e848532d5e91c5c6fc45ffa5b370e7c3b4416040905b8bf99f0d0d3b08bbd61e6c00b79fcf97ef3d2d13abc759c53f482007d1b3f8cec12f3792b7c
SSDEEP 12288:jpFtpOW+Xq1gYgR+8DAoczI2ZfnwlQTePINayz+ByIne7xmmZjIUTSl+0/1:/OfMdIuwe3zfIe7xmvH/
MD5 SHA1 SHA512 SSDEEP

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 0e38b60aa8ae9802c8caac875288d92329ea89549945b06bbd28017072a932cc
MD5 5075a7f152ee76f33832e234085a1dd7
SHA1 ddd6269cf4009a721db920363c49f3c03a6b4889
SHA512 7f052282961c59a733afe4bc13440a5a332e33ed0e3f46bf840c3197579027566e37056c292545b86cba5bd61a34f32747b0b266a138979a671e93752d6c6094
SSDEEP 24576:X7NM9YmZqmWMUkPjZM48Mv6bEhs4MdIuwe3zfIe7xmvH/:X7cBWMpPjN8DbEhpMdFrIe78vH/
MD5 SHA1 SHA512 SSDEEP

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 72102421f622ffa93496c61b1a62e97ddaebe7f29767edc2209215ece843d073
MD5 baeaa69f731445531667d21100b42d7e
SHA1 f54b1add104ea3340b2f8671222b754b5a2c7392
SHA512 4c784827f0822300bc630d1eea5cb3f8ec6b5508d2e1326e20af0183228dcf8876fffa77649cdb5761d0ab17806ff5419c0cf30c57fb027d71ddebdfe1f1d363
SSDEEP 24576:fW6BApg2YuyuNDYTabvcRvNYf8km1+MdIuwe3zfIe7xmvH/:fF2YuHNETovcvNYf8kmYMdFrIe78vH/
MD5 SHA1 SHA512 SSDEEP

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 53b073e75277708a5bf1af90bf721bd5af4edd917a3bb13aeb8a1b00a2437b96
MD5 bf8ffceb99fe2599bfb0cac49ab456fd
SHA1 07b3f338e3526c5a95edd9017738cc3a0d22c225
SHA512 919c7e2acc74b7ce64d5efe8e571626990df522007b63b44832292b979051bb76fbe5eda30321c8374eeea6450c868d64a79dd87504d03dc02e4d5a4165c99c0
SSDEEP 24576:2AFs06+Omlf3NXEbToTMdIuwe3zfIe7xmvH/:fFs060lVXuSMdFrIe78vH/
MD5 SHA1 SHA512 SSDEEP

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 885KB
SHA256 75053297d4c67773e596931d8b0568c080218be60c5aa5935e8df99f022dc4f6
MD5 edc1412e855b7e590cbd9e9a289013f5
SHA1 4fe1c78dbe6d59c044da13d0994fd06bafc76d60
SHA512 1e101fc98f61367eac47e78e0d3402f10ebdc3456aca6381ed8a9717eeefd3e344f3141fb2e227ade7da6be70272079ad48479f4794035ccde0224907fffac8f
SSDEEP 12288:VCJnJ5D3VkrlzxX+Xq1gYgR+8DAoczI2ZfnwlQTePINayz+ByIne7xmmZjIUTSlb:MJnJ5D3WtSMdIuwe3zfIe7xmvH/
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 e84086e4ea6675ca7e55c065274df67cc9b71c49a553632358366846f7c8e2ec
MD5 cc8ddc36654e88f1c0c14ce16443aa72
SHA1 134c064aa815e6fa26114715a91b56f2dedc1d53
SHA512 b1cffe06b586329a68e37341d86c4f75e95f3ddcbc4cf91e4c1ae39d004203b6f9eefad62b2e94a3875482fc0c25aa1c60b952ceb4bda380a3653dd102f57c1e
SSDEEP 49152:Yo06DIKdwc+eQnSt65aVEMdFrIe78vH/:F9TjYvH
MD5 SHA1 SHA512 SSDEEP

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 661KB
SHA256 97b91d6107fa22f51e90f584f26bbfd5fc030c61d37f39543f44320a436d9511
MD5 f2c5543a2a928e00e732262ef8642210
SHA1 69af91b880c0c1e9ec074702ab45014b83010866
SHA512 5c331ef833a60ec58b6873d3e6bc2c9a90ba4cfe997753f4f24ab69f4f3a86ec2f66d500c9d8de0a9ef351c7bf5bf6a0cc1bc2df30b52e33f6d71b7d0ba4d5fc
SSDEEP 12288:OEP3Rrd+Xq1gYgR+8DAoczI2ZfnwlQTePINayz+ByIne7xmmZjIUTSl+0/1:tr2MdIuwe3zfIe7xmvH/
MD5 SHA1 SHA512 SSDEEP

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 712KB
SHA256 8ab7cefdce39fa9bde8afdbd5012a849efaa012edae9fca722845589b30b0111
MD5 d4a563d3eab6e08f16b715feaa1d22a5
SHA1 210cf8ce7bc2ac7aa91a8fb4fc3fcc186186efca
SHA512 cddf8840181e7a507b13b0612a31ad6612ca10f061b43e706bea6df780d863d90004879cd9780a5579adeb0593e7218501859b07e56ce93ff1f0197e954020ea
SSDEEP 12288:4jkyg+Xq1gYgR+8DAoczI2ZfnwlQTePINayz+ByIne7xmmZjIUTSl+0/1:4IyZMdIuwe3zfIe7xmvH/
MD5 SHA1 SHA512 SSDEEP

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 584KB
SHA256 1f5193edc4439c06e1693cadfbfde31b1601b309b10660f8bc9eabbbb2e78b2b
MD5 0571806ebb1b874eaefab57f6670b6c5
SHA1 af4684c24dba196632451c1b3a032a8236a231ad
SHA512 9ad1c30c3d97971a358cb0b295f6f5b1226e311feca7ddf0ed5310137252c20aac6036386bdcdb9f37dfb8328885ca8874893ae77fe83984cd459415adf601c3
SSDEEP 12288:iFG+Xq1gYgR+8DAoczI2ZfnwlQTePINayz+ByIne7xmmZjIUTSl+0/1:QvMdIuwe3zfIe7xmvH/
MD5 SHA1 SHA512 SSDEEP

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 330b9f53681fbf2446f1d39bc411b75a3f42909e52e2760f231b94cdfb9db80e
MD5 de94bb347799b289fedfeea5b4eaee8e
SHA1 19aa6e5fac3c121310d9d1fdbb395051c38a78d2
SHA512 79fe794d97be10484233edae55471f0d6c8d442ceb8aea2af21a79856bb8f5b83aef72d0a365ff18b2a239afaf8198616a79e3de8a72980fd64470a3fef41aef
SSDEEP 24576:2Q9MxZKdcz97w3wMdIuwe3zfIe7xmvH/:2VKXwMdFrIe78vH/
MD5 SHA1 SHA512 SSDEEP

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 772KB
SHA256 106b309fecc8906b527f22e86a70a5df3a454a424b113825e0d1f4281ad775af
MD5 8d2e946778b0b4ca779e7d2ad7b0d9e6
SHA1 f29cf149ed30535a64840bd1f7650c17f398e314
SHA512 948299dc59c3da0a0510c74acb04ee085bcda6a2b8b0ae3f1db2d3aca5ccff90439cdbf8a551ec78a4e4aad441a13d8e558834559a7f4a0d3b6c4980cdfcf10f
SSDEEP 12288:OyoKo2HRple9pc+Xq1gYgR+8DAoczI2ZfnwlQTePINayz+ByIne7xmmZjIUTSl++:OyocxApdMdIuwe3zfIe7xmvH/
MD5 SHA1 SHA512 SSDEEP

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 5270c6c6530ba3075cf7c7cf09abd232bae4ad1cf8eec47dc701a3389f50a40c
MD5 f50483e587bcf5e3cfe599737b0e7852
SHA1 9d3ba97ed21a9a04484734259c7e96c922728679
SHA512 abd62015e58ede5a95e706f4711483e24d5cc282be964161d3be1d0636b1f2e7a07158415493f8cbd418fccf34880f305a8291e1a914896d20b08364f5cde678
SSDEEP 49152:vWcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIKdMdFrIe78vH/:X0zuNICTjYvH
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 e215ba468519f6e3325b338044dce470247275ba8a9cebe1a95bf7d7b9e1d719
MD5 b6a180f01996304d0252602e3704152d
SHA1 39ff262d0cf3fddb163857d4f70202f531af4abf
SHA512 3bdab365ab15973cfec038b7e6ce3c35f0a783e924dc095fb76fc13301eb0b80d2453c2aa1343b496b81afefa6e75f102dfc6450cce8908574a553fddec4bd2a
SSDEEP 24576:S1QT7EcpfxR+N5AWAz3ooiYtjMqb2MdIuwe3zfIe7xmvH/:PTDxR+N5YzTfjM/MdFrIe78vH/
MD5 SHA1 SHA512 SSDEEP

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 877KB
SHA256 4fa3a5f452f8af13ce2eb89a2298ae3d2246096ec5af5a5cc133c54a24173a8c
MD5 d21d082c7a5813d34823d1a7e83c0a25
SHA1 e04c4cb5914dac35049a9aa6d94c4fc6358a6601
SHA512 85596fde17e9731b2ff873396110fe1d8cc9a85674e658ec6a2ba806fed038040c2830ffa1d226f7d6c0cee02782b5841735692a6b8b09b68afb35fa53b8d016
SSDEEP 24576:dTMdOz0FFS+imSLqMdIuwe3zfIe7xmvH/:n0K+imSLqMdFrIe78vH/
MD5 SHA1 SHA512 SSDEEP

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 635KB
SHA256 941deea018b4c6c9b4803e859fa552ed048061f932daafe810ee3a441a474284
MD5 987557de3ee4467362a478a1b7df100e
SHA1 870f063565958f867f3e81284b383730c3715805
SHA512 fec359a072e7f53446070ed94bbddc116b3623905acee3ba2271ab9b9a6476fc2a8fdb152700b85180fe0c6de24f598d2404a62ec84126f05f0c45036b30c5cc
SSDEEP 12288:t476+Xq1gYgR+8DAoczI2ZfnwlQTePINayz+ByIne7xmmZjIUTSl+0/1:4bMdIuwe3zfIe7xmvH/
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/116-22-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/116-12-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/116-13-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/116-588-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/220-263-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/640-262-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/1224-265-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/1344-193-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/1372-267-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/1372-593-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/1388-247-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/1388-84-0x0000000000D80000-0x0000000000DE0000-memory.dmp

Download

memory/1808-256-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/1952-257-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/2628-248-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/2996-461-0x0000000140000000-0x0000000140125000-memory.dmp

Download

memory/2996-462-0x00000000020A0000-0x0000000002100000-memory.dmp

Download

memory/2996-0-0x0000000140000000-0x0000000140125000-memory.dmp

Download

memory/2996-1-0x00000000020A0000-0x0000000002100000-memory.dmp

Download

memory/2996-7-0x00000000020A0000-0x0000000002100000-memory.dmp

Download

memory/3348-46-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/3348-589-0x0000000140000000-0x000000014024B000-memory.dmp

Download

memory/3348-250-0x0000000140000000-0x000000014024B000-memory.dmp

Download

memory/3348-52-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/3436-266-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/3436-592-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/3456-42-0x0000000000460000-0x00000000004C0000-memory.dmp

Download

memory/3456-82-0x0000000000460000-0x00000000004C0000-memory.dmp

Download

memory/3456-81-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/3456-36-0x0000000000460000-0x00000000004C0000-memory.dmp

Download

memory/3640-246-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/3640-32-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/3640-26-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/3980-72-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/3980-76-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/3980-78-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/3980-66-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/4376-258-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4376-517-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4416-260-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4468-255-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/4560-261-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/4576-254-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/4576-62-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/4576-590-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/4576-56-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/4716-259-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/4944-264-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/4944-591-0x0000000140000000-0x00000001401FC000-memory.dmp

Download