49098647e067de809424c6e98eadc700bbfa8e979aee1cd0f9fb96f8287f63f9

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
08/06/2024, 16:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-06-08_3a0bb8f8ce5c2a6b2b461b70ba9d902f_ryuk.exe
Size 1.1MB
Sample240608-vg68tade6v
SHA256 49098647e067de809424c6e98eadc700bbfa8e979aee1cd0f9fb96f8287f63f9
MD5 3a0bb8f8ce5c2a6b2b461b70ba9d902f
SHA1 f054f3c0862125b24c929dc22dc750b080c86bd1
SHA512 800201d72d5429268124f430baa7c4d34bccfbb0bc18ef34f5b7a5feb2afd7a97ebe251cc417e936212a4bcf57996dee4a8e3d706dfb1799b1c5e35e971b9e69
SSDEEP 24576:JSi1SoCU5qJSr1eWPSCsP0MugC6eT7sRjhm0Ijr/eax8JXO02q3A:ZS7PLjeT7EjhMjSax84
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
4236	alg.exe
3016	DiagnosticsHub.StandardCollector.Service.exe
1376	fxssvc.exe
3952	elevation_service.exe
440	elevation_service.exe
64	maintenanceservice.exe
3216	msdtc.exe
3120	OSE.EXE
4936	PerceptionSimulationService.exe
4816	perfhost.exe
1768	locator.exe
3508	SensorDataService.exe
2668	snmptrap.exe
4624	spectrum.exe
2184	ssh-agent.exe
4564	TieringEngineService.exe
768	AgentService.exe
556	vds.exe
2360	vssvc.exe
4560	wbengine.exe
1744	WmiApSrv.exe
3304	SearchIndexer.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in System32 directory 37 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\fxssvc.exe	alg.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2024-06-08_3a0bb8f8ce5c2a6b2b461b70ba9d902f_ryuk.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2024-06-08_3a0bb8f8ce5c2a6b2b461b70ba9d902f_ryuk.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2024-06-08_3a0bb8f8ce5c2a6b2b461b70ba9d902f_ryuk.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2024-06-08_3a0bb8f8ce5c2a6b2b461b70ba9d902f_ryuk.exe
File opened for modification	C:\Windows\system32\AgentService.exe	alg.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2024-06-08_3a0bb8f8ce5c2a6b2b461b70ba9d902f_ryuk.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2024-06-08_3a0bb8f8ce5c2a6b2b461b70ba9d902f_ryuk.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2024-06-08_3a0bb8f8ce5c2a6b2b461b70ba9d902f_ryuk.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2024-06-08_3a0bb8f8ce5c2a6b2b461b70ba9d902f_ryuk.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2024-06-08_3a0bb8f8ce5c2a6b2b461b70ba9d902f_ryuk.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\3f91868ec8648821.bin	alg.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2024-06-08_3a0bb8f8ce5c2a6b2b461b70ba9d902f_ryuk.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2024-06-08_3a0bb8f8ce5c2a6b2b461b70ba9d902f_ryuk.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2024-06-08_3a0bb8f8ce5c2a6b2b461b70ba9d902f_ryuk.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2024-06-08_3a0bb8f8ce5c2a6b2b461b70ba9d902f_ryuk.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2024-06-08_3a0bb8f8ce5c2a6b2b461b70ba9d902f_ryuk.exe
File opened for modification	C:\Windows\system32\locator.exe	2024-06-08_3a0bb8f8ce5c2a6b2b461b70ba9d902f_ryuk.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2024-06-08_3a0bb8f8ce5c2a6b2b461b70ba9d902f_ryuk.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2024-06-08_3a0bb8f8ce5c2a6b2b461b70ba9d902f_ryuk.exe
File opened for modification	C:\Windows\system32\dllhost.exe	alg.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\alg.exe	2024-06-08_3a0bb8f8ce5c2a6b2b461b70ba9d902f_ryuk.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2024-06-08_3a0bb8f8ce5c2a6b2b461b70ba9d902f_ryuk.exe
File opened for modification	C:\Windows\System32\vds.exe	2024-06-08_3a0bb8f8ce5c2a6b2b461b70ba9d902f_ryuk.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2024-06-08_3a0bb8f8ce5c2a6b2b461b70ba9d902f_ryuk.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2024-06-08_3a0bb8f8ce5c2a6b2b461b70ba9d902f_ryuk.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	alg.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2024-06-08_3a0bb8f8ce5c2a6b2b461b70ba9d902f_ryuk.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe	2024-06-08_3a0bb8f8ce5c2a6b2b461b70ba9d902f_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2024-06-08_3a0bb8f8ce5c2a6b2b461b70ba9d902f_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2024-06-08_3a0bb8f8ce5c2a6b2b461b70ba9d902f_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2024-06-08_3a0bb8f8ce5c2a6b2b461b70ba9d902f_ryuk.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	2024-06-08_3a0bb8f8ce5c2a6b2b461b70ba9d902f_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2024-06-08_3a0bb8f8ce5c2a6b2b461b70ba9d902f_ryuk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2024-06-08_3a0bb8f8ce5c2a6b2b461b70ba9d902f_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2024-06-08_3a0bb8f8ce5c2a6b2b461b70ba9d902f_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2024-06-08_3a0bb8f8ce5c2a6b2b461b70ba9d902f_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2024-06-08_3a0bb8f8ce5c2a6b2b461b70ba9d902f_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2024-06-08_3a0bb8f8ce5c2a6b2b461b70ba9d902f_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2024-06-08_3a0bb8f8ce5c2a6b2b461b70ba9d902f_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateBroker.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\110.0.5481.104\chrome_installer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	2024-06-08_3a0bb8f8ce5c2a6b2b461b70ba9d902f_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2024-06-08_3a0bb8f8ce5c2a6b2b461b70ba9d902f_ryuk.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2024-06-08_3a0bb8f8ce5c2a6b2b461b70ba9d902f_ryuk.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007a38dd26c5b9da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9908 = "Wave Sound"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007f2dd527c5b9da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c7204627c5b9da01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d84f3928c5b9da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bcf93e27c5b9da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007d07ce27c5b9da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000068b8e26c5b9da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000084e36927c5b9da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c4456c27c5b9da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9926 = "M3U file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
3016	DiagnosticsHub.StandardCollector.Service.exe
3016	DiagnosticsHub.StandardCollector.Service.exe
3016	DiagnosticsHub.StandardCollector.Service.exe
3016	DiagnosticsHub.StandardCollector.Service.exe
3016	DiagnosticsHub.StandardCollector.Service.exe
3016	DiagnosticsHub.StandardCollector.Service.exe
3016	DiagnosticsHub.StandardCollector.Service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
656	Process not Found
656	Process not Found

Suspicious use of AdjustPrivilegeToken 41 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3156	2024-06-08_3a0bb8f8ce5c2a6b2b461b70ba9d902f_ryuk.exe
Token: SeAuditPrivilege	1376	fxssvc.exe
Token: SeRestorePrivilege	4564	TieringEngineService.exe
Token: SeManageVolumePrivilege	4564	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	768	AgentService.exe
Token: SeBackupPrivilege	2360	vssvc.exe
Token: SeRestorePrivilege	2360	vssvc.exe
Token: SeAuditPrivilege	2360	vssvc.exe
Token: SeBackupPrivilege	4560	wbengine.exe
Token: SeRestorePrivilege	4560	wbengine.exe
Token: SeSecurityPrivilege	4560	wbengine.exe
Token: 33	3304	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3304	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3304	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3304	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3304	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3304	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3304	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3304	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3304	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3304	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3304	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3304	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3304	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3304	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3304	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3304	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3304	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3304	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3304	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3304	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3304	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3304	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3304	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3304	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3304	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3304	SearchIndexer.exe
Token: SeDebugPrivilege	4236	alg.exe
Token: SeDebugPrivilege	4236	alg.exe
Token: SeDebugPrivilege	4236	alg.exe
Token: SeDebugPrivilege	3016	DiagnosticsHub.StandardCollector.Service.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3304 wrote to memory of 2400	3304	SearchIndexer.exe	111
PID 3304 wrote to memory of 2400	3304	SearchIndexer.exe	111
PID 3304 wrote to memory of 4720	3304	SearchIndexer.exe	112
PID 3304 wrote to memory of 4720	3304	SearchIndexer.exe	112

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2024-06-08_3a0bb8f8ce5c2a6b2b461b70ba9d902f_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-08_3a0bb8f8ce5c2a6b2b461b70ba9d902f_ryuk.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3156

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4236

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3016

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:4388

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1376

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3952

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:440

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:64

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:3216

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3120

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4936

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:4816

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:1768

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3508

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:2668

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4624

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2184

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:2904

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4564

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:768

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:556

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2360

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4560

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:1744

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3304
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2400
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
  2⤵
  - Modifies data under HKEY_USERS
  PID:4720

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
Size 2.1MB
SHA256 f7246a39c292222358b7cb421a32d8531e060407e009c156d87197adaaadb77f
MD5 e31f917b98e6e03bbf86a55e91af7b56
SHA1 9fa320b05d897cfdeaabe90c1250ff7149f1ad46
SHA512 7521b6462ac9cb332e9ccc4fee18b511f75799b667f71a4b35536e7318776799ac8197107357835da0cd28c9f9c16704c6c34baa7987637ccd27ef535c8d73fe
SSDEEP 49152:MuYk3H5koUXfTqkkYLO/W2buywzMbOX+T7z5bEjhMjSax84:MPfTqi90bHQWdO
MD5 SHA1 SHA512 SSDEEP

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 3c10b2a03f6e08763439e9846195ed17ea2fc9493cf363b8d503753c9c175cc5
MD5 bde383f94b15c25976b80f585cd6caf0
SHA1 3b38b10409eabf0e421bf8a65e9cb6ef5a91b87b
SHA512 25e3a13ef2dda8c60d37137b5974fd6fde524e46e8b6287cc66948bc09d86c21a47dc80bcae25ce8e870c20591d9f4d146005307995aebd727da4577021bce7f
SSDEEP 12288:6cQi2mNJLBsunElwYeskMjFvm0qKWjr/pMoVx8JX8it802q3LZj+:EiTnBsuEEsRjhm0Ijr/eax8JXO02q3A
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 e29ec105cd3e87781bec3055bd343b54fdb750377f99054ad69b3f8f994ee41f
MD5 99c6f441c983ec32483434ffdde14934
SHA1 a0de03d4018c2d61bba748694a5abe1cd70cef75
SHA512 3a97cf675599310557966622074f5606dee4893cc047a4edf8f4b15ab6fba5337804f73eabb2348016a557281da057a2200cec687cc544a270cdd94575d9db8e
SSDEEP 24576:F+gkEHfh4Co4sRjhm0Ijr/eax8JXO02q3A:sgkE/SSEjhMjSax84
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 acf083215e9d436605a158cec75df267268e4144f980f816639f3a4b1826ed2e
MD5 36184745547388e2c33e58a35f6ef16e
SHA1 6e04045b6dce1a4ced2e07289dba00809d2481e4
SHA512 ce676dbef66d38b169483f2774ba0bc203d8b32b5a0baa15a0b56d68fe01837cf88953535e2c1d161d7eb1b32268ffa22d579e87231eb7e5ab8c12e79ec796b2
SSDEEP 24576:xBpDRmi78gkPXlyo0GxjrfsRjhm0Ijr/eax8JXO02q3A:jNRmi78gkPX4o0Gxj7EjhMjSax84
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 5925ecb692c4c05a07ddf6150283e2ba0867f7bba3d58b366fd7de53fbe53605
MD5 5cd398d6bad6fbe2a1c27f4443b4055f
SHA1 0b7496ff73f5b5a35acf5db4f709440ee7bfd449
SHA512 0867585075ca1f7d1a5afa26920319fd6acbf65b8c610320d6c889bf32225a4c3321a65173da8ff7020d7311e1e42d56eb0308f1a3f58ba91bf8f6754b1d2dd1
SSDEEP 24576:LLOS2oyPIXV4sRjhm0Ijr/eax8JXO02q3A:1/yjEjhMjSax84
MD5 SHA1 SHA512 SSDEEP

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 6fbb8e086c4b94ab7224bd91c2dceb09f28e4904f9d74679d3b6e89788c4a6d9
MD5 45950bea7d36068b8163336b6169f9dd
SHA1 fa0bbabb69cb29a5fe6b047d674b7f8d0d67365c
SHA512 6e55a244d598645465cc2d337eb62442223f848d586cf9bf355183c68d9cec0c7dc3f80ff78d7fb6e0750f1d9df81a842d1656e77bf69962f1a7cca888502a6e
SSDEEP 12288:7tHwYeskMjFvm0qKWjr/pMoVx8JX8it802q3LZj+:7tysRjhm0Ijr/eax8JXO02q3A
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 7a3ae3c9b82f584dbc69e1b64f74eba379e968955b748b85ad02b781cc24e5c4
MD5 682cb80e12fb9f7d5126cfa5ae46feae
SHA1 4b11fdc2c07207188784f6b0d76bdb5942dce336
SHA512 5979d5ef1498a80d22219f6cd5f03e2b729b52961bff08f01fd74b418115662295b33ea3a85a6b4c510370d4f27a9dfca0c6ebeb3c4c5aa476076fc44d34f830
SSDEEP 12288:feBNUbTVO86U0wYeskMjFvm0qKWjr/pMoVx8JX8it802q3LZj+:fJIU5sRjhm0Ijr/eax8JXO02q3A
MD5 SHA1 SHA512 SSDEEP

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 daa9eeab2fd19d8b156d794595acc3ef7f260ad9283c3eaca70a65bd7a73fe65
MD5 70d05bd6e157cccf9ec2ffc46f5c9e10
SHA1 46011b7c9d479fcbde052600796ed7fd5b5423ca
SHA512 2ab77fa38b74a627edd0cedd0a99b50146ea69283b314c1feecfadc021974e5974e64aa98b02031dc25ce936bc748811ab32958824af6232b074c5b276a29bc3
SSDEEP 49152:iQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THr:iQvGAdlCEL8c/yRNw5CsQWdO
MD5 SHA1 SHA512 SSDEEP

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 90ef20f8ffcfaf709b798e4831ae113ce1d8b1f2031a9e2dc70bbd237a9e0432
MD5 8caf2a73dae7cfc5b3d7319e3216b2a7
SHA1 f279e4f7d3eba4b1904124b9c6822798021322f1
SHA512 9a334af15f224f9037fc9eadd929f0c9ac5d29379fe1ebc7255f3a036bd9242662f0e017e416cee4059d3ae9c51862b5d2a9ebdac75bbd964a68332701d50912
SSDEEP 12288:ZAwSfxL/2Dc3SDLLmt0LDQewsAjuwYeskMjFvm0qKWjr/pMoVx8JX8it802q3LZ6:K7ewsAjHsRjhm0Ijr/eax8JXO02q3A
MD5 SHA1 SHA512 SSDEEP

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 7d3efca772d934faf5242bbedef63c3f753fe89c0fba9496e7316bf5ba2f5a30
MD5 c0d023b99b689eaafb7a01c66d96a274
SHA1 089ba849a2476a6b58ad01e1ce4aad99ce18596e
SHA512 c57ce52b437c6326a4d89e7e4f2ada97f7cd70e9a76014033a4a545b63f9906eca5deb2ef06c94bb352cc549c47830428863b6266c4cf09ff43e8713c7f861e5
SSDEEP 196608:NUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHPQW:NUEtQevvqc2W1cpV2EI324
MD5 SHA1 SHA512 SSDEEP

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 e391fee577c933b564ae6e2b8d285c7fc6e90fe21bda42135ef1ebea85022e8e
MD5 22c7176bcbc3c30502bdb39c098af1c8
SHA1 4980fb218eb9ab4892b2d5c18beb53430521e01e
SHA512 771e50c9461dcd569a404c05846e99196f259dd7aceaa5df703e57405d9ee855ec459691168aa9f8d41cbc184ec2307bfd8be6c998ddc7d2730a52dff7f8fc75
SSDEEP 49152:1CbRquA/m2yL5zTfFiV+XenmE3/znEjhMjSax84:ioquVjnmIQWdO
MD5 SHA1 SHA512 SSDEEP

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 21afc9f21a87b417cde98bdb21a4cbdd9855e962247af097f407cacb4f1d7c04
MD5 d32ff31b866cc785e9a9e15392eb1c14
SHA1 8cb690d52399172f6870f155b04a6f24d52a1daf
SHA512 b8bca8dc8108ee56ccd6ee6429f2524a70324da335a8fb26f4eeb3d5f0cb57c0a3455d1ba774a5fc1d702eb6b691914e2ab56e9cdbbea1bc72fc4bc17dbdbab7
SSDEEP 24576:/AhGLJIFoiwtA5l7S53osRjhm0Ijr/eax8JXO02q3A:/AMyFoiq5YEjhMjSax84
MD5 SHA1 SHA512 SSDEEP

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 d582804b179de7a5c4c66164d9b447a63f1b4c8a58f25637cae592c38376acfb
MD5 7662a130199bbf1eed231d100ac44d5c
SHA1 395b8f846a1dad2a7cd978961b198e7246741e3d
SHA512 b08a0014eb472d0a510d4584ca95dc912fc86f7bdea2b6f5269d862f073f18c1ff7b92a2bf215607ca1aba8d65b6698d182c4d29d6779b2d95e38308af0cbf2c
SSDEEP 12288:Vmw5HEjsChNzBFgl0WDm+C9wYeskMjFvm0qKWjr/pMoVx8JX8it802q3LZj+:QwuSOWjsRjhm0Ijr/eax8JXO02q3A
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 e7848d5166a6fca3e02b5144ddb470c8ef6691ca4b22cba85db972dd14fcd0b7
MD5 c9a4df1a919a59103b54fd6655412bf6
SHA1 4d9074c1cf35b4e4f69cdb1c7602879ae7647218
SHA512 71fc4d6cc8e6600c866c507b33f0d79320ce370fad925fed333a77886bf1b6266a2634146cafb416f1209aaf68676eff108cbd6ba2eea012016ae45523d64237
SSDEEP 12288:IjZ1IyewYeskMjFvm0qKWjr/pMoVx8JX8it802q3LZj+:0ZumsRjhm0Ijr/eax8JXO02q3A
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
Size 5.4MB
SHA256 af8288ce79821e01dbb95fbfc40e3bb74a0a194b53806fe9483c775630da2ae5
MD5 86322bb4c2395f644f975f9ac5af6ddb
SHA1 43a1e15c0573d26b0c2efada5302126c794582b6
SHA512 233d0e3f831b40bc8da7f21d0b3afcd92ab6f0a6ab74afb0d80cd54badbac6584600321b5ddb2829be5f18e17c6f34f09d8ad4836fda529eb8d43540796004fa
SSDEEP 49152:50kwIi7c4xZlm5knEtw99Kn/2vim7vgv6m+yyJ/0gbvjR7yY7BHi3u7L/gBUUWLb:JwfhY7g/rLd7yYA3awr341ggQWdO
MD5 SHA1 SHA512 SSDEEP

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe
Size 5.4MB
SHA256 18d75df58a56d4e3c6dd69e77cdc8729a1cc7443a7da260df5ed83c720767f5e
MD5 b2da8f0785b6cf8117e3f7f4e28f4100
SHA1 31cb74596b50aa705a96b3649dd31114b9b0806e
SHA512 b378b6d863a2a533effb53ec67f2f30599e89c9beebbf39ea3d6aaa3885d6b394c97707cdd9e2c1d7326d442da9945ae5bcb06961697f1269e7f4221e34706ee
SSDEEP 49152:a0kwIi7c4xZlm5knEtw99Kn/2vim7vgv6m+yyJ/0gbvjR7yY7BHi3u7L/gBUUWLb:swfhY7g/rLd7yYA3awr341ggQWdO
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe
Size 2.0MB
SHA256 591d6556bd2e7fd3faa5cce348d94da444be345c6a1d5e53d883d3543793b29c
MD5 828c7703614c39119328f8a963dbb818
SHA1 37d329ae457008985cec25abfd5374cc2fd5a1c3
SHA512 1bbe76e5921ec4fdab8c91f184cae70e7d86fbf586049dc716da62b0ae6e21c34a9cd32126b886d5ac3c46e3a8f0e7671a9c153a1fc2e919907522d12fbe119c
SSDEEP 24576:xcTyYv0FteQU+5I2kjgD6iQacAjsRjhm0Ijr/eax8JXO02q3A:xuXv0Ftpn5606zOjEjhMjSax84
MD5 SHA1 SHA512 SSDEEP

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
Size 2.2MB
SHA256 578492977dcdcadace7406c477b2d7180590bc4c8f8aaae8e670bf04ccae69e8
MD5 9077cc7a64e862914b81356207136185
SHA1 7ee250a1c8492c8f88a65d01882855fd1c855363
SHA512 8a6350cc94094b8f804e2346e0962505b53ff9977576ce30a0ac37726232cb1c26653ec02ea9d1baf494a164a3fa3da2630de2c8af524c46b59263c6f36a4565
SSDEEP 49152:dy7mTd0GxN8jyynxHjXKUyn4GVcbDSKrNTxHEjhMjSax84:ImYeyxHjWjMTHQWdO
MD5 SHA1 SHA512 SSDEEP

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe
Size 1.8MB
SHA256 a00743b6c63e7a6f70ffc97e32e966485d67c5dbe1e4677e0ac43be184925966
MD5 6e0b5c9654378e5a91df68103ded0c15
SHA1 ca2888f68896d2e284e21cb5fe637ff2d298be94
SHA512 e49898a83d19d6b082fb5e9abf6f4db0f0a96f928e24f33c2a2e43686115b25853051120e3a36ebde33de249a290b75c3572e095900c07fd9f414f9017658d7e
SSDEEP 24576:06drZn1WEci182IEUeNbJeRgUebgW816usRjhm0Ijr/eax8JXO02q3A:0WnDci18yNNUgbYbEjhMjSax84
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 1.7MB
SHA256 66b43b5a33e76f95d08f2183900853087482207b9d9c8d8fef7003c5246c6057
MD5 e565fed944e44092da1d364a7a34a75a
SHA1 99e4319340cb5602940cba56d8d5b6a8c67a4fc3
SHA512 f436951e86959a5a4a0f4c36dee5fa8c73532d9bb3b11ee95a8299fa24fabff90c0f03a46e2f20f26dec5326f6fc25a6b97f55e3b31dc9cb3281d5841d053291
SSDEEP 24576:sk5lHW5EzMZupO80G2reD+melRgTTv/1nyNsRjhm0Ijr/eax8JXO02q3A:SizMZm0GhamSomEjhMjSax84
MD5 SHA1 SHA512 SSDEEP

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 e156bfceb3758de811df2702a68612d6eeeae19d718740867aeb88db1cd3713e
MD5 8b5dc8a10351a535f87f1ac963d0cdc0
SHA1 cf46872e881e80894a0791edefdd5c87320d12f3
SHA512 c7f1839b84761c1f77e8a68856a01f3a6d16053bbacaa84d3a3609f4c613e1db6ee53c0330d3a46bf53e8e465c0202fdbd4d570ad867129d9bf03f03bd64aa2f
SSDEEP 12288:rfwYeskMjFvm0qKWjr/pMoVx8JX8it802q3LZj+:rqsRjhm0Ijr/eax8JXO02q3A
MD5 SHA1 SHA512 SSDEEP

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 c150213d226d0ed2d5fedb09457d3a7c625ac870eb76b2e47f77d6219a6fdc95
MD5 490033a2e537a7b2041eb9c3034ae66a
SHA1 eb9ea6c8eb2b8721d87446e867dad5dda5727fe8
SHA512 8568571be2836e7779e583aec75b33778aab93c91ce7e081273b651f433990c0b11594c6abf458654ce9f3a1abda079381c173401925d5d49031cb15bc577b1e
SSDEEP 12288:ZywYeskMjFvm0qKWjr/pMoVx8JX8it802q3LZj+:ZrsRjhm0Ijr/eax8JXO02q3A
MD5 SHA1 SHA512 SSDEEP

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 130bd3f093ebdadc5a8e6a0fb032448482377308237175b928284f5c17c05202
MD5 f1e21a775b6dbd7737f1a8d94f2503b4
SHA1 6d7efe941695402f4e5e2a309b9e5a21080eaee9
SHA512 5faacc6a12a514fa1577a6d2898600b86d6028503b43a3bfd8f0dbb8688b9d310748dcfed5e4731811bc52b4a166b4254dfe7d9f26af226ccb4bbd1ec6f35c64
SSDEEP 12288:9swYeskMjFvm0qKWjr/pMoVx8JX8it802q3LZj+:9RsRjhm0Ijr/eax8JXO02q3A
MD5 SHA1 SHA512 SSDEEP

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 62aa80640a6ba0c5dc4362bc8939bcb0d1c185561ed2a232ad8f1ff7e7e2225f
MD5 21522b08d21dff467fcff077e90a29ab
SHA1 d78d28c7612194128640bb647848d3f750dcd725
SHA512 997b9092fac0d1784600b16b5efbae98fffedd970982dd66147e56c05d793fc5c2834ef75e0d029de4b55d490be6f603e36eb35e1f2e4237d8ed2144abe0a60e
SSDEEP 12288:2V5wYeskMjFvm0qKWjr/pMoVx8JX8it802q3LZj+:vsRjhm0Ijr/eax8JXO02q3A
MD5 SHA1 SHA512 SSDEEP

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 d50fcc8ae9340b1f5a7cdc4648f0cd8aa6972b333c0d6e12129a8fbfff979990
MD5 3d4468839ebe89855bb779dfda1161f0
SHA1 0335efdd4285575ea2ae09f9a1f8d860ca8918ec
SHA512 686e751f305fce91fcd973d84eeb85216896dd4df81d4139db77f0d6a576d5e1e781dc67c1c37b21bd9a7a6ef7c9e5e232d3b756bda33d5b5419eda0c8a7d314
SSDEEP 12288:whwYeskMjFvm0qKWjr/pMoVx8JX8it802q3LZj+:wQsRjhm0Ijr/eax8JXO02q3A
MD5 SHA1 SHA512 SSDEEP

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 1c6e2bf17e8f91e4d696a8d98a36011da6755846349fdda5c2f3a02d6fd332ef
MD5 fa2bb623de27f76265df04c6fb22bd16
SHA1 3edc27cf5f7852ac92fa74ce5a901a84bb7e0efb
SHA512 0718f7949817e953d2fb469203733f03be27472b25e196fbfbbab109dd013b631045da1d4076e4888aac95b10ead59a4152d1a1d3e88e9d2296bb4bead29d1d8
SSDEEP 12288:zmwYeskMjFvm0qKWjr/pMoVx8JX8it802q3LZj+:zfsRjhm0Ijr/eax8JXO02q3A
MD5 SHA1 SHA512 SSDEEP

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 f94849a61395051a9f9e11a233a983a31fd4cecfc40c6067e5c7b4908a4ad35a
MD5 cf8d9552466614f24036d1c5c9a4cbae
SHA1 a94facffe6e356e588baf5866e85604be5fdf189
SHA512 f2ad6cddb6d7d67115f352c26347d7903e7fbe2f8241cd6b513c0cf7ca8a6969b6a56ce17fef3f8eff4883257414c69f1a144633f6dc11e0e1a23b18877e3f0a
SSDEEP 12288:h6wYeskMjFvm0qKWjr/pMoVx8JX8it802q3LZj+:hTsRjhm0Ijr/eax8JXO02q3A
MD5 SHA1 SHA512 SSDEEP

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 22400a8b9a417525ec4140f8e9481230042a721382e08532095620101ad98660
MD5 43943d5f0dccc8c6a8ecf3221cb01a11
SHA1 db0da16e412625245fafc344d577bb83b4e1045b
SHA512 8dfa550b910cf67280c0f1c086d7aad01ce1d7acf3e5166b3b98adc73d97b5772e1da3075d30a3195dab6771db3b999aede3b0a25717ac3e372f496d508596e4
SSDEEP 24576:DZMEzFVSOLsRjhm0Ijr/eax8JXO02q3A:DZMEzfvEjhMjSax84
MD5 SHA1 SHA512 SSDEEP

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 5d590ded4b51efe6f58ec18e12e5eedab0daf97dbe42e8a490c30e0b4a213a6c
MD5 cfa196d903b8f3233efb4e18ef7609e2
SHA1 b2e578a2ef26cffed58539ec0fe5d587355eb525
SHA512 7c0202b5c58e8ee494e4d93f37a5ba0b6b426d3072c20c3bfe4e8076e7f677431bd6b2337c041b3dff0a2b3b6d126f85123eae18524b5130f5cf40ba68a9bd9c
SSDEEP 12288:dLwYeskMjFvm0qKWjr/pMoVx8JX8it802q3LZj+:d2sRjhm0Ijr/eax8JXO02q3A
MD5 SHA1 SHA512 SSDEEP

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 f98b47be36c920ce65c3fdb1ecf8686d69aaa04ce5290ebc70a307eb96d0fc61
MD5 5f1a5a6154dfd5b44cfd42df062f69dc
SHA1 37fc2389c5afd6728f33345640e1d43e8cd3a964
SHA512 015328b89a7eab3de9bbfe01c554819aaa0d779effcc86ea64b4cefd6ef8d6b8cea13baed56a3cad52955f3eebb2f5b91123b444a0be5d6843fc68bc79903852
SSDEEP 12288:p3wYeskMjFvm0qKWjr/pMoVx8JX8it802q3LZj+:pCsRjhm0Ijr/eax8JXO02q3A
MD5 SHA1 SHA512 SSDEEP

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 0e30d1d76df20ee9ec6f50352879c6891af0319032cf7cd4e071991ac64559b9
MD5 7d2d0095fd8a06eea26f226e6a4fc519
SHA1 7a0a4a5d775a18248fda7b511939ea7484fd12bd
SHA512 716e62bd1e8a57567839ac7b94eb6edd17a117d744059d5a8036ac364fbf43d0a847271fe31fe9dbd0e06a73ce39b70f9f05b5442876a1c4f73e6c03d1311369
SSDEEP 12288:IyPz5L8ewYeskMjFvm0qKWjr/pMoVx8JX8it802q3LZj+:JzyXsRjhm0Ijr/eax8JXO02q3A
MD5 SHA1 SHA512 SSDEEP

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 c4c8d87bc05c1e6545acb512700128be59bdf97968fbc4dfa94f99dcc3845226
MD5 bee1ca8ae4c3061114244339a61ab662
SHA1 98ceea0cf645862f1747ef7b09e04dd9ef51dc89
SHA512 732b010ddd44fbb8d8a81018d1e1ebf18db854d7eaefcbc1b6876315ec1d9ecbbdec80250992703ce3151787e191641e41d89f6960534022c27ce42c33d02cdb
SSDEEP 12288:9LwYeskMjFvm0qKWjr/pMoVx8JX8it802q3LZj+:92sRjhm0Ijr/eax8JXO02q3A
MD5 SHA1 SHA512 SSDEEP

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 ce78e6d40d0ddb4725ecaed5e576f74579d93abff6f6ea7aec7acb391ed1d03a
MD5 f1f866953de2ecaef3582a2f2e8f4cb9
SHA1 4a41b1921994745abc710075fec2b46c93b5816d
SHA512 61eeca2deb5dfd0b9bbe9ca3721d4db777cb856dfb98880da977619185e0a0d22a90e5767a8ff4bcdd243e62d01c9ba526364cc60336f14d9eea8542008cc9f7
SSDEEP 12288:3LwYeskMjFvm0qKWjr/pMoVx8JX8it802q3LZj+:32sRjhm0Ijr/eax8JXO02q3A
MD5 SHA1 SHA512 SSDEEP

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 851c2dd9ba1f9f4af1ed3853f05bc961d3c8ff3a363b4c7e3b5f1917c1b0452f
MD5 caede03af4f4500100a734018da0b439
SHA1 dc7e23c8ad3af33103d5b033b697170a59914144
SHA512 f705a94d43e2f2ffdc20894f78d919a8899934c9e1f8303741310a8b0f266739f33183ddec6061779d29eb0bf65ea52ce729eafac6697286f2e398d78dcf9d2a
SSDEEP 12288:IyPz5L8ewYeskMjFvm0qKWjr/pMoVx8JX8it802q3LZj+:JzyXsRjhm0Ijr/eax8JXO02q3A
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.7MB
SHA256 0411b7e6965466bcfa90775774b8b496b53e2c9560533c689b6b9386b4b8bf4b
MD5 73c5f40644a162c9fea9b4a5292835ca
SHA1 c4ce2a96f85d9dab799f68c4a727da939b79b086
SHA512 e1f1ea56ad3be432671f0d32d0396fcf64c596701a0ea13a9a14c9e50c7694de9de721792c9ab14b306cd5d1d41e3a66181aed086e8f875db11e73382280c76b
SSDEEP 24576:wTdaLl3z0zDBsRjhm0Ijr/eax8JXO02q3A:wTwLljcEjhMjSax84
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.9MB
SHA256 464ae86b68e55c62d5a0d3cc1649766d7d38a025974f41e78a2cd7e3fd5e8844
MD5 a8409f203d54b54e890c1ac2fbceaf5e
SHA1 97848f2235515065800515cdf91c3d8d21b06a37
SHA512 aeb2236d2783f9d2a64a3217849cf917232435d2b17a0c5e7e3faadbeb52d0e4c98a85814bbf11fde6fd6fe67e328f8a08b8596f84099fe39bb29e187d719d21
SSDEEP 24576:H35d9CHKy7GZVsRjhm0Ijr/eax8JXO02q3A:X5d9CHKyavEjhMjSax84
MD5 SHA1 SHA512 SSDEEP

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 1a10a7c34a33429d77e4b56ed76bbcd8c4862a404ddbe772b2473510cf8ba426
MD5 a4db328e5e9cbea1877b1e8b2f44840f
SHA1 f61b1f6715814bed8137115c7e2e61c6fe0dde39
SHA512 6a0797758841d137481d99e06026bea56a1839d08f3b06558247f0fdc18ce567ae3bd59fdecbff27b80b5e686bb00a5a2a0be2ce2ef075890425fd7c5d120c5d
SSDEEP 12288:LMwYeskMjFvm0qKWjr/pMoVx8JX8it802q3LZj+:LxsRjhm0Ijr/eax8JXO02q3A
MD5 SHA1 SHA512 SSDEEP

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 bf2dd3548b2ca973381fd822399681ad40359c337401ac4e5c59ce4273ad1f06
MD5 2eb8259666596c169b51c0107c632d6f
SHA1 d22bd3fea9952c9c36002626a56bc7054ddae435
SHA512 53f0f8b930e069f0de8a92e0c875bd8cfa2930735146c25edabeaee5e60e8e255bd8406ae44a0d1c850502e1fd4e88239e4a01f325f4f85ecccb3405081898e2
SSDEEP 24576:ycP4mcvIjkGOxhKP2l71SNKbrh/8KBesRjhm0Ijr/eax8JXO02q3A:9P4m4IpOO67N8KsEjhMjSax84
MD5 SHA1 SHA512 SSDEEP

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 ad24e2a9037c52f184831099661d5ff205086c7f4a5a25def989b895b300edd8
MD5 51159facd536e2beff7fb5c32140fe5f
SHA1 57d4ad5a1215757ce2be0ae1f586126fde32ffde
SHA512 6779d4459d2da5079e94e5bc1994da6e9998f20ae36b599cafc7a159c22a1e6c2deeb276e62c1aa16d688c58e598734773e9db530c2a60aa635b3ce242ca8651
SSDEEP 12288:5UFmDDLQwYeskMjFvm0qKWjr/pMoVx8JX8it802q3LZj+:NFsRjhm0Ijr/eax8JXO02q3A
MD5 SHA1 SHA512 SSDEEP

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 3d56b171e24edfa32667695f2662e129d3326c2969522b79ceb307571cf7ad37
MD5 c708af0fc98e7c33837eb28d7506bd77
SHA1 203f2c42ce36894f096cd8ec17fba716037cbb0b
SHA512 19c8380e0b93fc3f7bdbe96a7ea80b27b0135b0dfa82b5b77b410ae2bca752415bbc10beaa3c9e6b8db2e34ada110111b56cc82dd4f07d67a6f2b7d068312057
SSDEEP 12288:F7wYeskMjFvm0qKWjr/pMoVx8JX8it802q3LZj+:FGsRjhm0Ijr/eax8JXO02q3A
MD5 SHA1 SHA512 SSDEEP

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 25985b7e5b0bff4aa32079fbe2eb78c52ae23457bc2886c83c708cd243109724
MD5 cb14689ec87dcaef3750b7f8504f6fd8
SHA1 431c3e156a3e6d450cef09eb6d0b1be6204cdeb0
SHA512 6fbfd47fc7d760ce7e826d085374a99de627e095630f73c52ca5fc8898661a568d3a1b133a9b76990fc146b9a3acd820356c196d9a02a333865ca809a6150277
SSDEEP 49152:La0h2GEkuAe73q3pp46zwwQQEjhMjSax84:La0hNYG4JwPQWdO
MD5 SHA1 SHA512 SSDEEP

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.5MB
SHA256 0091ab08d6dcb80d0875bd95966fd8e03a52065e24e19c44f02f8c724c6bdb58
MD5 b3cfbd29a4af5d2fd70a726e99d8a391
SHA1 86df2f59305cf050322211d25b3ebc379dd5849e
SHA512 7be63f91e8366b44dad57d03ef9ed545407ff6ca4e88f3371ea770ad8b513bf521a26a97b555f805b36598ab76505f87f9f04d271288d7143435a27990e23b19
SSDEEP 12288:ZhbHjfXCwYeskMjFvm0qKWjr/pMoVx8JX8it802q3LZj+:ZhbHjPbsRjhm0Ijr/eax8JXO02q3A
MD5 SHA1 SHA512 SSDEEP

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 cd498664aa4b924ac2d237440720f8f5bfa90d2b9d0929f3b302204d0133b368
MD5 137def683add779edf81a1b92cddd1bf
SHA1 b1faa0d0154623681733c41ee88475faa6f96a41
SHA512 9816531c2804a563d3e7b2657baa3976667eca0c1387b4c6799440929497896a49aff5ea512651c5259f44e8eb0af1f4440ea4c89506f956cef5c0ec3f54cba3
SSDEEP 24576:e3YgnJcRTk4yti+R5dpR/jsRjhm0Ijr/eax8JXO02q3A:eIgnaTk46ppR/jEjhMjSax84
MD5 SHA1 SHA512 SSDEEP

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.4MB
SHA256 96adac5e4f664675458dfa331cc83aa331055e6183b46fafc6a41dbccc12b67d
MD5 bb6d4d1d094cf00e34f67567ca326a5b
SHA1 171b33cc92f64756bae39cab0962d7ab38034ec5
SHA512 a4f868007c3e77a2fd7f1b34c85e6df665f530cef2271a28931de7cbb631a4f652f8f0f8c06c87feb3b0212ba351643901968f2727162ae9a2bc392c82d965ad
SSDEEP 12288:wnwYeskMjFvm0qKWjr/pMoVx8JX8it802q3LZj+0:wSsRjhm0Ijr/eax8JXO02q3A0
MD5 SHA1 SHA512 SSDEEP

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 a4a31897e45303af5dab1de1eda0bf23238bab9c45055d8bdad703ae289a906c
MD5 cc3afedf0d2081903c3c1aaf0c7bed31
SHA1 1124870d306d3c55f2132317e5782bdb3b5813f0
SHA512 fd1efac573ab15439c51ee0d0698a28d709405e3fc6e2ca38a282a7cbf079cc36ad428b85c84e14f2b40623a91d2351150196431b94fc8fcde00cdf9067d3bcb
SSDEEP 12288:jObrA4LWOsvAYFTIwYeskMjFvm0qKWjr/pMoVx8JX8it802q3LZj+:MfL3UTdsRjhm0Ijr/eax8JXO02q3A
MD5 SHA1 SHA512 SSDEEP

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 ff7fe0f1904ce94482a63d48a77aefc07813add1be5b38aa104440f74dd9c663
MD5 bb6ccaf8a1762d2aebac1db825d3a8ef
SHA1 61aaa1ef9e56305c52c4f76610e85071d53ce5a9
SHA512 af6966efbaf18a8cbd9e828ed68af2b3f08df0cf1fb5819b90bed6745c5eb1c53f508aa39f0e751bc1c1812bf6c3b47ace11fbee56054fe70330f8bd9cc9a1a4
SSDEEP 12288:QpFtfOUwYeskMjFvm0qKWjr/pMoVx8JX8it802q3LZj+:wOZsRjhm0Ijr/eax8JXO02q3A
MD5 SHA1 SHA512 SSDEEP

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 6a71dcd8aef8e927a51e77b774a34c844511c96c92349ae5d93aecba7b6375ef
MD5 ede58d51b3246b36bec5dae7b43d973f
SHA1 9a304c59ccd96a16dc5a60de3a29b0456d62cde4
SHA512 a97f26eb4ada9606ccd7c67a7401a8d7d283c8db02722afb3092891d7f7124d80cbec44ba264c7f871f9835ae98f1ba18f1d8ccb480f18f147c7485b2781c353
SSDEEP 24576:W7NM9YmZqmWMUkPjZM48Mv6bEhs2sRjhm0Ijr/eax8JXO02q3A:W7cBWMpPjN8DbEh7EjhMjSax84
MD5 SHA1 SHA512 SSDEEP

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 8c81ac9e7ade328512d68cf5776b556c8b99b428d6255d275aa7bd60521c38a6
MD5 a625de2325e3fa73c68c90d75094af6d
SHA1 a124011ef074fb98d4b6b7d941bc815e8288c01c
SHA512 c6afcfd09f7efff05edfba2383f50ce08c9c01a6a61b89fc13e9fd050a1030cc48ccb04cc8dbe67d0c2d98039968434bb7891bd7be4ac72ced9c338b3fe63c5f
SSDEEP 24576:pW6BApg2YuyuNDYTabvcRvNYf8km1ksRjhm0Ijr/eax8JXO02q3A:pF2YuHNETovcvNYf8kmWEjhMjSax84
MD5 SHA1 SHA512 SSDEEP

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 c2a99424a60d8dbd26388e0212764502c1db8f28b3dede80e9a5372b1071fa34
MD5 980c96612c6b4a51a347f15de71f6dc6
SHA1 c12e1a8f52c74014216f8f97cb00d2dbc7a34b0b
SHA512 dd1484560c5f9bc5c15ee99fcfb4e8b7c7474c9e3e72341a601a6016f543ece1f40dd7637fe0b8a9c1861d53ca720e59f29489114a3267a878f606a3f2531f87
SSDEEP 24576:hAFs06+Omlf3NXEbToVsRjhm0Ijr/eax8JXO02q3A:2Fs060lVXuwEjhMjSax84
MD5 SHA1 SHA512 SSDEEP

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.7MB
SHA256 753534ba09545dc0043222e729f471d4b9e21fae484b358cf676d9b440037c26
MD5 d14bfb981670b49ac6d85226b9bf1738
SHA1 7db05392e9973a967346f56ae48885f55ba5c286
SHA512 31928ad7924db5df83a116c8841c78c8d54c674d8b3f6ba2251185acbe5a0540ed039cb72b69da7bb4ba0aecabb9d1baf56e9458997a34e2385e3c59339bc44c
SSDEEP 24576:AJnJ5D3WLwsRjhm0Ijr/eax8JXO02q3A:AJnJ5DGLwEjhMjSax84
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 41cbfcbc5face3089b14adc779b2d095bfe723bbba6872df5ee7f01651a13a4b
MD5 1ec7117011addfd430658aed57fa0a76
SHA1 a0f87d96a4ebfb5f11026858539fa534cfb4c336
SHA512 9dfbb87f5444fcb4f37cbe841e9eec67fddf9ac10f8567c36262e22e412d7fa6963a75cb3f4d2c368a28577d55d5b3161d8fb77f8297ebf46bc6360ef045f2f1
SSDEEP 24576:fEPohm6/7IIXdwcXrif7qQncjlP65i3VujsRjhm0Ijr/eax8JXO02q3A:Yo06DIKdwc+eQnSt65aVqEjhMjSax84
MD5 SHA1 SHA512 SSDEEP

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.5MB
SHA256 3de38d9903961d5e310c36c939d485b5a99f7aaea051cb66a7c1dcac65b0ac68
MD5 1f7d2ad68f0f48814881de138c06e6bb
SHA1 6e847c6335ccf0f636bf6da4a66ccf49912ebd24
SHA512 a6d8bb43c5360e98c2e04283d19c48e71bbda4047a6682493dafb7785b64af134a0cf26033a88e30da5334ca20ad079e6fcbfe8034d373cf29ab5b37bf4fdda4
SSDEEP 12288:3EP3RB9wYeskMjFvm0qKWjr/pMoVx8JX8it802q3LZj+:8B8sRjhm0Ijr/eax8JXO02q3A
MD5 SHA1 SHA512 SSDEEP

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.6MB
SHA256 f954375353d596d194cfd2d77ffc666ba1639c3a507a6b358c99d7574f632a75
MD5 a0aa9f4375cbd77a24c725e011232655
SHA1 f3a341faed114110ffa0d541d6b69a1467d73d46
SHA512 653e346a0a97ffbbad51c2a990dd213619c2659543d2d12ee840ef2001e6c2725763897e2e843e29caa07b5ebb24ed702c2d694d5db3395d594f9721edc91c84
SSDEEP 12288:ojkyywYeskMjFvm0qKWjr/pMoVx8JX8it802q3LZj+:oIyrsRjhm0Ijr/eax8JXO02q3A
MD5 SHA1 SHA512 SSDEEP

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.4MB
SHA256 18c514f09ea51ccbd3b8c820c11ed59d4df0acf769509402c49791740f1731b3
MD5 ccc830b89c997cff17805a86cb0b62a9
SHA1 d518cf003e6df703f6de9ab3232f84410a90a1bf
SHA512 e2adcd05bf2fba50494898df15e651a840eb2be297854b31ab9c4376b34d65e82c4967075337ffe2d6114f63161674214a4471ef311aef809928074959062be5
SSDEEP 12288:+rEwYeskMjFvm0qKWjr/pMoVx8JX8it802q3LZj+:ipsRjhm0Ijr/eax8JXO02q3A
MD5 SHA1 SHA512 SSDEEP

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 1ee8f936cbc9c5322bfc13c13335d2dedc694af7a55976624719fb948fa95404
MD5 a9f38d9fb2ec38cf5e06045546f2c23b
SHA1 74ba04571bde826c032c4fb5444527178ee37ded
SHA512 48671e7ad56bde0fb57a74d33eeddf541ae62de11b51ac56dd45770d986aa4e7ef06fc2f4c2fad4d192cf6ff760fc9b5b2a49b47344a46086c652c0ed3a974cc
SSDEEP 24576:CQ9MxZKdcz97w3OsRjhm0Ijr/eax8JXO02q3A:CVKXOEjhMjSax84
MD5 SHA1 SHA512 SSDEEP

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.6MB
SHA256 02c0834a2b2caecfaa24327fe45d7fdcfedaad560ad846d1e3fb7c01d5a06d9e
MD5 2027518d073dff657cc3b9d305a59e52
SHA1 8301550b4c6722a205ce04e7d3b29339912fa9a0
SHA512 e60cba39352ede8fe27e34050f7885a1e4546447e65f4d6435d5c69cc6edbe84478139e345fbe376c3620e31e7efccb19aeadd6b79b0135d0b29e374884c78dc
SSDEEP 12288:MyoKo2hRple9puwYeskMjFvm0qKWjr/pMoVx8JX8it802q3LZj+:MyocbApHsRjhm0Ijr/eax8JXO02q3A
MD5 SHA1 SHA512 SSDEEP

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 622dd591d5575c1640050e5a17954f35a1ec036414004015206bb0778d6c382f
MD5 ed53ca8e10d277e4295000faca45b601
SHA1 94a4ab8e85a141edbdf8235e2b7e5a4fc9ea1b26
SHA512 a79b3794a34a3e6c2c5c4e577a1b654c96293c0610ada2ddd06c49a6c03bb45321cfd491e01c5dfdf2b0394d43ac79246502fe56f361f6c716b3921dc87e46c9
SSDEEP 49152:sWcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIKHEjhMjSax84:m0zuNIzQWdO
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 f0e2bf35b166bb76b67c761df1680d3b935e7b31881f4c53cd048e73ea299dd1
MD5 ed861e861dabbba64f143acb793e5f5d
SHA1 3be577314ee99e9057d23781ff2863519f41c371
SHA512 772d1c973ccc59f15d49a9be4a6a31b656dfbec484438d37ac885a1ccbd673b890edc44194a1b80137eb15f12ab0be06f777e1b34239cc0b9203892b7fac1475
SSDEEP 24576:h1QT7EcpfxR+N5AWAz3ooiYtjMqb8sRjhm0Ijr/eax8JXO02q3A:kTDxR+N5YzTfjM5EjhMjSax84
MD5 SHA1 SHA512 SSDEEP

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.7MB
SHA256 7d5b76977f53bedb08a37f33faad223f5ec5ce8311d44677b6f266604024181e
MD5 b2a536b0d90ff39c38f87fab8500179f
SHA1 3a6404e87d5b86f78b2d2dc3fe492ae777f5cdad
SHA512 f4acf693d90ff5a2ecece36c04aa989090f0c02f17a9ea4ec3312b38b35837eec1f877c0c7998b0355aa3255397becf24345ec887d31863222323239f1027287
SSDEEP 24576:iTMdOz0FFS+kmSLIsRjhm0Ijr/eax8JXO02q3A:u0K+kmSLIEjhMjSax84
MD5 SHA1 SHA512 SSDEEP

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.5MB
SHA256 0f8fb25bc01d776384631b249114b64c54985fed75e9f693957a7529d637ea20
MD5 61d13eb22301a0bb32a0bfb6a5cd942f
SHA1 f7bf521e86d3682e78fd5e4fd006b08198306f8b
SHA512 64ea2ac1fd37d4e9e68e79fb84539ac9f903ad7f57f7471274390d12327eeb5a72c490972e382cb36b808358b101470951606a90c14b1c3d7bb6dea17ed88f54
SSDEEP 12288:r4pIwYeskMjFvm0qKWjr/pMoVx8JX8it802q3LZj+:sdsRjhm0Ijr/eax8JXO02q3A
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/64-86-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/64-83-0x0000000002230000-0x0000000002290000-memory.dmp

Download

memory/64-80-0x0000000002230000-0x0000000002290000-memory.dmp

Download

memory/64-74-0x0000000002230000-0x0000000002290000-memory.dmp

Download

memory/64-73-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/440-62-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/440-70-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/440-68-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/440-178-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/556-216-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/556-603-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/768-213-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/768-201-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/1376-58-0x0000000000530000-0x0000000000590000-memory.dmp

Download

memory/1376-44-0x0000000000530000-0x0000000000590000-memory.dmp

Download

memory/1376-38-0x0000000000530000-0x0000000000590000-memory.dmp

Download

memory/1376-60-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/1376-37-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/1744-608-0x0000000140000000-0x00000001401A6000-memory.dmp

Download

memory/1744-252-0x0000000140000000-0x00000001401A6000-memory.dmp

Download

memory/1768-131-0x0000000140000000-0x0000000140175000-memory.dmp

Download

memory/1768-251-0x0000000140000000-0x0000000140175000-memory.dmp

Download

memory/2184-187-0x0000000140000000-0x00000001401E2000-memory.dmp

Download

memory/2184-601-0x0000000140000000-0x00000001401E2000-memory.dmp

Download

memory/2360-228-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/2360-606-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/2668-514-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/2668-162-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/3016-25-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/3016-33-0x0000000140000000-0x0000000140189000-memory.dmp

Download

memory/3016-34-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/3016-127-0x0000000140000000-0x0000000140189000-memory.dmp

Download

memory/3120-215-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/3120-108-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/3156-96-0x0000000140000000-0x0000000140125000-memory.dmp

Download

memory/3156-1-0x0000000001FE0000-0x0000000002040000-memory.dmp

Download

memory/3156-384-0x0000000140000000-0x0000000140125000-memory.dmp

Download

memory/3156-7-0x0000000001FE0000-0x0000000002040000-memory.dmp

Download

memory/3156-0-0x0000000140000000-0x0000000140125000-memory.dmp

Download

memory/3156-385-0x0000000001FE0000-0x0000000002040000-memory.dmp

Download

memory/3216-97-0x0000000140000000-0x0000000140199000-memory.dmp

Download

memory/3216-88-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/3304-609-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/3304-265-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/3508-142-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3508-551-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3508-264-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3952-56-0x0000000140000000-0x000000014024B000-memory.dmp

Download

memory/3952-54-0x0000000000D90000-0x0000000000DF0000-memory.dmp

Download

memory/3952-165-0x0000000140000000-0x000000014024B000-memory.dmp

Download

memory/3952-48-0x0000000000D90000-0x0000000000DF0000-memory.dmp

Download

memory/4236-101-0x0000000140000000-0x000000014018A000-memory.dmp

Download

memory/4236-21-0x0000000140000000-0x000000014018A000-memory.dmp

Download

memory/4236-12-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/4236-19-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/4560-240-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4560-607-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4564-198-0x0000000140000000-0x00000001401C2000-memory.dmp

Download

memory/4564-602-0x0000000140000000-0x00000001401C2000-memory.dmp

Download

memory/4624-600-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4624-166-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4816-239-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/4816-128-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/4936-227-0x0000000140000000-0x000000014018B000-memory.dmp

Download

memory/4936-124-0x0000000140000000-0x000000014018B000-memory.dmp

Download