9128451e9e9c47c610120c33171167640280e68c0e65f7eef48c885ade643c2a

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
08/06/2024, 19:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-06-08_c0ebbf24ef440fe6e0c0a1204104f83a_ryuk.exe
Size 1.9MB
Sample240608-ye8kmsfc71
SHA256 9128451e9e9c47c610120c33171167640280e68c0e65f7eef48c885ade643c2a
MD5 c0ebbf24ef440fe6e0c0a1204104f83a
SHA1 3797d5cc7e8d264142079b627ad2aa0cb60da00f
SHA512 ed6181ac947bfcd8e7ad60e050270814c565b898a2491c18e7b3b679ccb01dbf62f4aa4d59ba33670e1a922c89cc4826ef46cb129d2e7e3b0f5766449590fd80
SSDEEP 24576:278r8FfC3R32nUnCdAaKu++nOKwH/BYcCAwQEKesf/NmLeiTd:2/fQR37CGaPdCCAcKV/NmLvTd
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
5080	alg.exe
3972	DiagnosticsHub.StandardCollector.Service.exe
3356	fxssvc.exe
3608	elevation_service.exe
4104	elevation_service.exe
1088	maintenanceservice.exe
2064	OSE.EXE
3948	msdtc.exe
2380	PerceptionSimulationService.exe
3992	perfhost.exe
3292	locator.exe
4904	SensorDataService.exe
5116	snmptrap.exe
388	spectrum.exe
3612	ssh-agent.exe
3716	TieringEngineService.exe
228	AgentService.exe
704	vds.exe
4444	vssvc.exe
2372	wbengine.exe
956	WmiApSrv.exe
4420	SearchIndexer.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in System32 directory 30 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2024-06-08_c0ebbf24ef440fe6e0c0a1204104f83a_ryuk.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2024-06-08_c0ebbf24ef440fe6e0c0a1204104f83a_ryuk.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2024-06-08_c0ebbf24ef440fe6e0c0a1204104f83a_ryuk.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2024-06-08_c0ebbf24ef440fe6e0c0a1204104f83a_ryuk.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\78b76f30b4b1389a.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2024-06-08_c0ebbf24ef440fe6e0c0a1204104f83a_ryuk.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_99718\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\110.0.5481.104\chrome_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\110.0.5481.104\chrome_installer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Install\{28C8484C-303E-4CB2-A704-E3FF47E10F7C}\chrome_installer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2024-06-08_c0ebbf24ef440fe6e0c0a1204104f83a_ryuk.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000074396852dcb9da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e7c17152dcb9da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b4ba0c53dcb9da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000014239352dcb9da01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d9e87852dcb9da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000000ff4d52dcb9da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007dbced52dcb9da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004e998952dcb9da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004e998952dcb9da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000334d5c52dcb9da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
3972	DiagnosticsHub.StandardCollector.Service.exe
3972	DiagnosticsHub.StandardCollector.Service.exe
3972	DiagnosticsHub.StandardCollector.Service.exe
3972	DiagnosticsHub.StandardCollector.Service.exe
3972	DiagnosticsHub.StandardCollector.Service.exe
3972	DiagnosticsHub.StandardCollector.Service.exe
3972	DiagnosticsHub.StandardCollector.Service.exe
3608	elevation_service.exe
3608	elevation_service.exe
3608	elevation_service.exe
3608	elevation_service.exe
3608	elevation_service.exe
3608	elevation_service.exe
3608	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
672	Process not Found
672	Process not Found

Suspicious use of AdjustPrivilegeToken 40 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4996	2024-06-08_c0ebbf24ef440fe6e0c0a1204104f83a_ryuk.exe
Token: SeAuditPrivilege	3356	fxssvc.exe
Token: SeDebugPrivilege	3972	DiagnosticsHub.StandardCollector.Service.exe
Token: SeTakeOwnershipPrivilege	3608	elevation_service.exe
Token: SeRestorePrivilege	3716	TieringEngineService.exe
Token: SeManageVolumePrivilege	3716	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	228	AgentService.exe
Token: SeBackupPrivilege	4444	vssvc.exe
Token: SeRestorePrivilege	4444	vssvc.exe
Token: SeAuditPrivilege	4444	vssvc.exe
Token: SeBackupPrivilege	2372	wbengine.exe
Token: SeRestorePrivilege	2372	wbengine.exe
Token: SeSecurityPrivilege	2372	wbengine.exe
Token: 33	4420	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4420	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4420	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4420	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4420	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4420	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4420	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4420	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4420	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4420	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4420	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4420	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4420	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4420	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4420	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4420	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4420	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4420	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4420	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4420	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4420	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4420	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4420	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4420	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4420	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4420	SearchIndexer.exe
Token: SeDebugPrivilege	3608	elevation_service.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4420 wrote to memory of 5032	4420	SearchIndexer.exe	122
PID 4420 wrote to memory of 5032	4420	SearchIndexer.exe	122
PID 4420 wrote to memory of 3500	4420	SearchIndexer.exe	123
PID 4420 wrote to memory of 3500	4420	SearchIndexer.exe	123

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2024-06-08_c0ebbf24ef440fe6e0c0a1204104f83a_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-08_c0ebbf24ef440fe6e0c0a1204104f83a_ryuk.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4996

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:5080

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3972

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:4064

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3356

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3608

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4104

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1088

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2064

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:3948

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2380

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:3992

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:3292

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4904

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:5116

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:388

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3612

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:2460

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3716

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:228

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:704

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4444

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2372

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:956

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4420
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5032
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:3500

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
Size 2.1MB
SHA256 aa5e75fa53fd0e2000b6b19ae7c3cc923af49c674b26b8710fd311d16446917d
MD5 4375a085449140abbbd3cb4cbb2d05c7
SHA1 c7cb0f49d585ef259edffc6a993c7c742ca71e1f
SHA512 f7c46c982e910e59e54b0b77583817bca47d2cecf90a6d179e9a3edbfdd0686967df361527552fd247c3d6446a752d871e0d378c333347bd18118cb8ec041848
SSDEEP 49152:iuYk3H5koUzfTqkkYLO/W2buywzMbOX+T7z51CCAcKV/NmLvTd:i7fTqi90bhCCMlwLv
MD5 SHA1 SHA512 SSDEEP

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 797KB
SHA256 952691cd5ef0ee15e96a343bf22deb8966cb3d359501c7df7672e333c4253a70
MD5 b1ee413d29a1c2bc763eb2f8a49eb508
SHA1 a8dcc33f9b2fe44c56eb5b4fa69f9f42ca467c02
SHA512 617cfdb65d8435acbd48c148bac0622e6102121cf3026786e4b8791ef6b39ef37139070fa77702affb0358280093c5b668a0dd1cc919ea1f45b021a4219168df
SSDEEP 24576:riPnBsuEswH/BYcCAwQEKesf/NmLeiTd:USufCCAcKV/NmLvTd
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 dac6da767a5c45b6be059d22c1c6c09b9498b36069bfd6598958b40d3a354c6f
MD5 ca4ba05053a91397fc09d4d8d1b7be2b
SHA1 f5238180cad468537ee2d3a8f4cff60909461a54
SHA512 139d1f427cd6a7934b8b81749547cdbbb25e44459e159a590f28a7eb43ee622fb6b3129941f081fa856c9b39175f9fce31b8e29919d0a87cc7449b55ca24e80d
SSDEEP 24576:S+gkEHfh4CoQwH/BYcCAwQEKesf/NmLeiTd:XgkE/SyCCAcKV/NmLvTd
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 e5599ac9eb30582f5fcfa5ac961d21d66efb0b1afa7c6ab0224313612040f41b
MD5 6a05211ad2da0c2d8441419f9c3a4e43
SHA1 705f373b2efc556cd56fa136d4675ca3a55060aa
SHA512 c2e115a0caaf9f692795c0f7bd9c28b7c6057cf0432b4b9e93d01f0dfea7bea903eed9e451c960948857de6fc5e5cb275c37374f874b62a4a243573db044c74b
SSDEEP 24576:fBpDRmi78gkPXlyo0Gtjr5wH/BYcCAwQEKesf/NmLeiTd:JNRmi78gkPX4o0GtjVCCAcKV/NmLvTd
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 217cc372bbe5027c8d578cf257e87aec4c6c39c34ea5d869e3c7f9f07d8a9a22
MD5 a194de06ccad74291450964f9a8eb817
SHA1 ad0ec59e2ef10dc23c9c041d486bad852a148f74
SHA512 4b1f567f453f27321e5512c6c65269c5b993afc83b09c4e6e3d4b2004aa818fea73e16737f64c8293fb330db82c215ef1e17330c29bce70c75b614d029ef73f1
SSDEEP 24576:OLOS2oTPIXVQwH/BYcCAwQEKesf/NmLeiTd:u/TdCCAcKV/NmLvTd
MD5 SHA1 SHA512 SSDEEP

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 c84efb5eb00d5af83ba0c299fdc7cd57d2e0f956c58ac588a279c0a6e9102abd
MD5 e0676a7eeb87fff7e14bc0306929ba22
SHA1 84e2a07a0285fe8b5ae3816889e6a9945126dfc2
SHA512 77eaa515578850c7d7316d8d215e61c6a65fc37162ba436924b9a8015c8617f5b057b50e835dfce00c1dde7713f9e51a2be4c19c9f750fb3131dce6f0f78e572
SSDEEP 12288:DtQU5VFWwHiC4mxYr8PCAwQy3KVMsMWsYNv+0kHe/6eZ0hW4:DtSwH/BYcCAwQEKesf/NmLeiTd
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 2d9b943b9ed9435a1963f79f0ca642a6c713a9af4299827cb0684e4f04446fd5
MD5 b26f18394df7e0833a2a34521f9f4058
SHA1 2a29166d16bf716d00aed98b829d2e2c8008e230
SHA512 d4e536c3ddae2eae60f46fd9c755c8249d8c35848e81d3d8e40f16f8531fe05f2ebe2f8748c8926c77e705cde23e43c84dcb10ce731168e1fe4e5af888f33919
SSDEEP 12288:BeBNUbTVO86UBU5VFWwHiC4mxYr8PCAwQy3KVMsMWsYNv+0kHe/6eZ0hW4:BJIU7wH/BYcCAwQEKesf/NmLeiTd
MD5 SHA1 SHA512 SSDEEP

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 7e1f77b3a4e132a9c75081f35174c41bb997a5c2b47aae871f5fba1763bc1143
MD5 94c620b441781befd248920c442d0e85
SHA1 222375cad46d3321ddbfe9463fe19864c6446fda
SHA512 d24dafc3df7e5d0b506de9232adf8f7edfee9a5872d5e8543d47d44751edac1e20a99425a43e2b7a8adb6b2709b0d2295f7fb0a74db5c2a7ff142b61a73627b7
SSDEEP 49152:3QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THZ:3QvGAdlCEL8c/DRNw5C0CCMlwLv
MD5 SHA1 SHA512 SSDEEP

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 82ed25b5ac50a9182d56261679dd2a53fb94c78d7f827e679ac313f37d1a3774
MD5 a7266ad89244bd5b4e819eaddb019560
SHA1 a7c1873174df43d21dd28bd429c42a9a3a385df7
SHA512 f760e75191ad5da9f33ea0da4a78ba3f56f84f683a700d4ac20c2d82bfaea02a53bc57139fd6e4c9308ded386170b02173855bbe1a278684b9eae9905f332259
SSDEEP 12288:3AwSfxL/2Dc3RDLLmt0LDQewsAjnU5VFWwHiC4mxYr8PCAwQy3KVMsMWsYNv+0kR:Q0ewsAjhwH/BYcCAwQEKesf/NmLeiTd
MD5 SHA1 SHA512 SSDEEP

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 aba71e22e02c541aa66c7e1c9b6521f40f1275b51477b7bee7eef8c5c838b45b
MD5 79b8680f4a91f281abb214ee75835591
SHA1 49358c903bb3b6f0cb91692ce077fa4891d3b9f5
SHA512 1127ca9847f3a194d1463c6da124eecbb41696905ed72fbb5f33dc4836c51ea0b4316a63f5529e4c9d11cb39208ac9e472d1580289018d6edcca998ab5fa396c
SSDEEP 196608:1UEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHJ6:1UEtQevvqc2W1cpV2tI32J
MD5 SHA1 SHA512 SSDEEP

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 e8a32565502c098df595f808fe385283bd3fca8ea11f19bb35218a4651c3c6e2
MD5 d67dc51ac3d822f46995613642cac6cd
SHA1 87507a9d4b8d85aea5fc4b8f0ca386d67035712d
SHA512 276ee0b2c53454034ab2d3f4ca0281a1ee2450bcb2d92a64dcc2f071e0c8a076fe93c5d015057101c444f9a56e1e7cf7177b1efd5744f3de09a4eea37cca3a2e
SSDEEP 49152:GCbRquA/m2yL5zQfFiV+XenmE3/zBCCAcKV/NmLvTd:roqtVjnmACCMlwLv
MD5 SHA1 SHA512 SSDEEP

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 7e9d7cce79483829904abe26211a0c67c0f9309fbbfd7b2ab5d0f9c77e67d9f9
MD5 e81621b3ea4c5fb220ecc49f3522245b
SHA1 861471861f47adfb8b505f686496cc7c20ab169a
SHA512 049324a9dd52f2457f39786302022b62cb4a5ce91f64dd127d70bfe97c21741f821ccf93bc32b9aef01b5439f02ae289244375b1bcecfcee570e5a87e576393f
SSDEEP 24576:AAhGL3IFoiwtA5l7S53gwH/BYcCAwQEKesf/NmLeiTd:AAMUFoiq5wCCAcKV/NmLvTd
MD5 SHA1 SHA512 SSDEEP

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 be769baa06f8f56ed29d6d617b61446bb320cd8e468fd8141586b581aa4d4bb2
MD5 680a230161995cfa3120ab8eadf0417c
SHA1 5fb5447c63f19f70c6f68f5d3cfe3b573d50fcc8
SHA512 1a215494da6a61e0a284342179e4d05d232d12dcb3ea68e6dd56cf23423ab8546a441d4f083a67081a49d99d92b4ebd4d67fc2e5144716dbfaf655d48cd637a2
SSDEEP 12288:jmw5HEjsChNVBFgl0WDm+CqU5VFWwHiC4mxYr8PCAwQy3KVMsMWsYNv+0kHe/6e2:iwu4OWdwH/BYcCAwQEKesf/NmLeiTd
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 681d3c455941336eda2a271766c41cd8d4d9312590222f529295dfeba88bdf8f
MD5 af470d369e8e8e406e6498f16c267ff5
SHA1 0e63c761db7b9f2559497a429a4f1afbf97dae28
SHA512 b84001a165f63a732e63dd06d8ce5cd23807356612530bf1f945ae3ebb9ccb13bf3886cbacdc422408550142efa8ecdc8ce33c62fbf64800f30d4e954df1a000
SSDEEP 12288:/eZ1IyXU5VFWwHiC4mxYr8PCAwQy3KVMsMWsYNv+0kHe/6eZ0hW4:mZuWwH/BYcCAwQEKesf/NmLeiTd
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
Size 5.4MB
SHA256 c83f6cb4a37e5a1871dfbb295b4c9d3a7bb428ecce6ab344b3add00478d92f82
MD5 4e8b3e65abb8f7a8b106b81eaaa270d8
SHA1 b27ed06f1ec736c24b0193019ae0c06825ae0e9d
SHA512 b5c0643b59e9edba9d1d342e244730f282581b4ca4dcfede9b1a4d17f7cd016d1d8d11c6e73837fa9095a9168a2204bcab103459033d61f4e601c1b312e8977e
SSDEEP 49152:90kwIi7c4xZlm5knEtw99Kn/2vim7vgv6m+yyJ/0gbvjy7yY7BHi3u7L/gBUUWLJ:FwfhY7g/rLO7yYA3awr341g4CCMlwLv
MD5 SHA1 SHA512 SSDEEP

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe
Size 5.4MB
SHA256 33417e6fc124ccbaa57ef99a5dd6eb9d2e6d028445ef6ffbf0087a75ad286c52
MD5 64e0778485a020597f9c0468c1372458
SHA1 8a887c19fab4dc993870bc11f0fa28ed5b9a93d0
SHA512 2b84fb16248f1003ac2b84ad80a16f84ae1ac5426966b03e3ddc28bfe9245e4a66735981cbc09daedd9b997d8e42e25695f582af857b496d14a9fd009e535cad
SSDEEP 49152:A0kwIi7c4xZlm5knEtw99Kn/2vim7vgv6m+yyJ/0gbvjy7yY7BHi3u7L/gBUUWLJ:mwfhY7g/rLO7yYA3awr341g4CCMlwLv
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe
Size 2.0MB
SHA256 c1c36e54b745dff54332b5458ab85c60e7bc7c5dcd18a7830088dea18ea79eac
MD5 544c7a1b6ebc5c1d018be902af058fd2
SHA1 0ee178eeed1066127d1627694cbe2cc311473ffa
SHA512 d33bc4f6ef7d36609ea556b940152e701b8ec14c21bf449e07c9e099b0831eb3ea9197fb83080b8294f8e9041c2d27f4813f0050ff6e71c01279a13d29b2cd4e
SSDEEP 24576:5cTyYv0FteQUd5I2kjgD6iQacAdwH/BYcCAwQEKesf/NmLeiTd:5uXv0FtpU5606zOdCCAcKV/NmLvTd
MD5 SHA1 SHA512 SSDEEP

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
Size 2.2MB
SHA256 59d0585b47c3982778e6d4b6b272deb86cb350774d9081f5ca29bfecf65784b4
MD5 ec7022fa53acfdc781857c24e05442da
SHA1 2393fbd68db9a39035514e722668e8bc505702ee
SHA512 3820a9e82947157024534e1e2cb28b4fc083d8202f65e79b743a8620301a72fec42ce88983e0d853d7e8d6b477386c563f8576eb07706908b1d93fb8208a00f0
SSDEEP 49152:ty7mTd0GxN8jyyncHjXKUyn4GVcbDSKrNTxhCCAcKV/NmLvTd:YmYeycHjWjMThCCMlwLv
MD5 SHA1 SHA512 SSDEEP

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe
Size 1.8MB
SHA256 92c14d421bfe203741c1ddb124224ab08413e6ee64551616eeb6ddeb0b8926ee
MD5 8daba153e9cbc1b6d21859d6340a7561
SHA1 2c6708864f3fadc7df8f862c56a4679fe0eb117a
SHA512 f659415f73e35f34bc4b966f8853c0718308231377fb4b3793668fc48018509611134d4bff1b15dbce8bb559d9a9c1e5e6b0972df963fce3bb71b7e3e49b393d
SSDEEP 24576:L6drZn1WEci182IEUZNbJeRgUebgW816+wH/BYcCAwQEKesf/NmLeiTd:LWnDci18NNNUgbY1CCAcKV/NmLvTd
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 1.7MB
SHA256 a8568acc1b762f861ce9dde66e9b47f3a2d6e69c68c2d98014203844406cf375
MD5 e19377820399fb1f3302af03d659d7b9
SHA1 d15a1d0085cf8228322d0b21b4ff953209374b8f
SHA512 34a0793daf4e1e155e7db352642b5cb5216774c03d95cf284acbc608ca603f8a6d762ad546a5781da50d33bb3b485f1643e42c4381117075cceea4a318edc9a4
SSDEEP 24576:rk5lHW5EzMZupOG0G2reD+melRgTTv/1nyfwH/BYcCAwQEKesf/NmLeiTd:LizMZw0GhamSoWCCAcKV/NmLvTd
MD5 SHA1 SHA512 SSDEEP

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 4cd167a4c93fa339093e865cca63371601c12d2bca91f0f6e2b92b1f1a98b421
MD5 d94655ae25a4fd0c6aa9d4e85ef0326c
SHA1 64b5058bee77219098e7589dd217ec1c2948d2fe
SHA512 74b5aa01d8b79602cb92c1c9a9afc7f1684f94efd4d36cdcf53c870d15f7f226137d8886408ca9bc347fccefd437d34163017146039adaf8698f0f618ae6b21f
SSDEEP 12288:zIU5VFWwHiC4mxYr8PCAwQy3KVMsMWsYNv+0kHe/6eZ0hW4:zKwH/BYcCAwQEKesf/NmLeiTd
MD5 SHA1 SHA512 SSDEEP

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 3db578d1233d455377fe2b8a50e14ef5c14036ea28a3002f460ad7e541266627
MD5 9f01de56ea58b865ce924c89fc5b6b29
SHA1 9f3eea21968c6267bb1850de411c905a479546ba
SHA512 6357599e4f0fe94ff8eca3e644c0df7e0f7634961a30d208e048779f2f52d743830ad02e3582b4f45c24a6c3124a63acda1bbb21318683c1fe78f0b6dcb2fb5d
SSDEEP 12288:bjU5VFWwHiC4mxYr8PCAwQy3KVMsMWsYNv+0kHe/6eZ0hW4:blwH/BYcCAwQEKesf/NmLeiTd
MD5 SHA1 SHA512 SSDEEP

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 b25845cabb8706dc7ccc288960c5bc0e96ce9df9f0f72b9106ba0c4088cd5591
MD5 82038a621795c6a2558d1a3b218ba668
SHA1 2e70ca48eadc2c9be2b2d1dbdad9600269dbc016
SHA512 b91f87675e312c03cd9773a6dfcebc8b12aed7e1f6b155bad26c6c9e48f3ed80ba6759525f6fbfc6ab5ae7ef6347927031361a3ad0794d9b471d69e0b13a63ba
SSDEEP 12288:E5U5VFWwHiC4mxYr8PCAwQy3KVMsMWsYNv+0kHe/6eZ0hW4:EzwH/BYcCAwQEKesf/NmLeiTd
MD5 SHA1 SHA512 SSDEEP

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 0e5aad22719b991282b164b488e2c8585e55fe0edbdfbe7b16e690aee189e022
MD5 63955c5383d4f05a944c15c0dfa2cbc9
SHA1 aa11774a16e2ca4d97e7421e02fc169d5d1f65e5
SHA512 f02b727393e5c7ee8b2c44766ec9b6e9addff61a1b0a7dba731fb6a1cee79f731b03b883c027c153f864afed8c79ee250b878abd93a5ef739964c516e1547086
SSDEEP 12288:gVeU5VFWwHiC4mxYr8PCAwQy3KVMsMWsYNv+0kHe/6eZ0hW4:LwH/BYcCAwQEKesf/NmLeiTd
MD5 SHA1 SHA512 SSDEEP

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 1d12ce4e7b3de9a83516458f04472a5da9b80460e2389401f3381085991453a7
MD5 7da3781c0a6ad57feb5eab8dbd944824
SHA1 e1547f2f5b6e69ef118f7bd6afaf8e209252697f
SHA512 251b34ac9e0d572a1bf83218a5ddf6590888ed016b60a42ecc08366c7ab6ec471aeaef2aae491f613d87270dfe397e2e7106341885173b11c2e97fec711f3758
SSDEEP 12288:CmU5VFWwHiC4mxYr8PCAwQy3KVMsMWsYNv+0kHe/6eZ0hW4:CIwH/BYcCAwQEKesf/NmLeiTd
MD5 SHA1 SHA512 SSDEEP

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 9db6f0ff277c9d5ae6bfa722ef2c7d379bd78581252c10c834009f1be5404a34
MD5 e0365a8099d6c33c18ebbcb7c1c3b520
SHA1 43ac13bc785004e8a1e4a87dd3bbf9b244ed6019
SHA512 901d6c7a321333d26c9be1f358e41ef43cd03d8e48cdaf4201fde2f2590af05a6e472fe1b0af1f71fae05623b6565ad10e73b528a7f799ad8c1d934b1100e2aa
SSDEEP 12288:MfU5VFWwHiC4mxYr8PCAwQy3KVMsMWsYNv+0kHe/6eZ0hW4:M5wH/BYcCAwQEKesf/NmLeiTd
MD5 SHA1 SHA512 SSDEEP

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 f0f27aafe01591ff0a2625299eb4762f60be4b5af26ae313b834c5edd8294be9
MD5 b0a5b289ddb6bfee97b82152da7b0760
SHA1 b85bcf3a9f6d86dd17388e2dbf7c23577262fca2
SHA512 b7c1e38a023a68e53cd844edd026d5b8eb8c31b78a80d0ecebb793cbe0c5959b5543b4cbccc6cd28e9dc25b8af9c6f30bb176488e2806dc43f49bbe06a803f5e
SSDEEP 12288:3rU5VFWwHiC4mxYr8PCAwQy3KVMsMWsYNv+0kHe/6eZ0hW4:3twH/BYcCAwQEKesf/NmLeiTd
MD5 SHA1 SHA512 SSDEEP

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 93f45bc0b7884d521425217255d72433fb722b5a79d8707a8acabc137d9fe68a
MD5 71475db018711d9acc48157e264b0055
SHA1 a20727fe376ba0a44e2037f5026397c746ade124
SHA512 9d641267d6dad696a6ab2e617100c9f6a24e570593f4811d853865a92856962fe0e5a9afe0617acf021041422b28aa9ae23823c065bbd8ea059865708f7f846c
SSDEEP 24576:uZMRzFVSOFwH/BYcCAwQEKesf/NmLeiTd:uZMRzfpCCAcKV/NmLvTd
MD5 SHA1 SHA512 SSDEEP

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 52e4a8ce4ee74e01d395fce3dd76bccb28e3230a1b2996cfbdaa522e9cbc1c8a
MD5 b4c282d57cccd5c3fa90ad7c143b22ac
SHA1 29af68e4248b55d41e18677b434d1a4bbd618548
SHA512 c2a58ca40269c17aa7577079649f66622151d914ea349bae418d40b6a21fcf0097979c7d3cdfe5a15dc6a0a00cc67ee412ad30bdcaec62475ac2a6d311023974
SSDEEP 12288:hsU5VFWwHiC4mxYr8PCAwQy3KVMsMWsYNv+0kHe/6eZ0hW4:hGwH/BYcCAwQEKesf/NmLeiTd
MD5 SHA1 SHA512 SSDEEP

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 d4b36e053685ffec6de385f0e6a9837a4c58ac3b28719ab45a17dbf40212cf5c
MD5 755a62a16130aaae8641b9c0d494ab07
SHA1 439fe7d30c42d28a4d233fbb5ede94edc5a970c0
SHA512 bae0087864c6b653dc3f7e708c449e7d35a8411c6d65362ce3d06b43f7893d9a0ff306fb22240f08edbf3452a45737cd0cb1ef5e3ac64af0a0dd9b91d9c3257b
SSDEEP 12288:4AU5VFWwHiC4mxYr8PCAwQy3KVMsMWsYNv+0kHe/6eZ0hW4:4CwH/BYcCAwQEKesf/NmLeiTd
MD5 SHA1 SHA512 SSDEEP

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 b67263fd1dc4f69eb08b0046c6172e4eda777f8c90c9e072b9c9cb48150fb94e
MD5 9784f35efbef0ca422baa08d6b0eff4b
SHA1 e1dcd557cb547f79faa97afa44e7f979b1da8ece
SHA512 91fcab7d9fbe7b124b629d9d67d1c983d3709c1d63da6b933ba3b2d1101e1e39f9c5ec932fa4ae66319821930713ac1059f3d35a6792d73e902167fc18d5b33c
SSDEEP 12288:pyPz5L8XU5VFWwHiC4mxYr8PCAwQy3KVMsMWsYNv+0kHe/6eZ0hW4:IzyRwH/BYcCAwQEKesf/NmLeiTd
MD5 SHA1 SHA512 SSDEEP

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 6260ed3f9d81ba5d9b5f0de786434bcd015587e28886531ee79ced5a8b722472
MD5 09b0a3a81a1d106eadc5480413bd65b9
SHA1 4089f568192798673e5404cd941b0c82ecffde2f
SHA512 99d794a98397c322a3d7d9c3da2ba4dc9b51ba8b2934262b2ca2245ce92535a878659d81199e238e87645e8d62981c237ead1e7ff69141350a3a2b1ab1d7cd32
SSDEEP 12288:TsU5VFWwHiC4mxYr8PCAwQy3KVMsMWsYNv+0kHe/6eZ0hW4:TGwH/BYcCAwQEKesf/NmLeiTd
MD5 SHA1 SHA512 SSDEEP

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 84f23c4c6b7fdddc9465dc508ed5ffe2c7e59ac8926cb506cdcb60965c86b458
MD5 f1c7ddc11003ebf72c0ebac3dcaeaa08
SHA1 59a2a88fc02befb752b1fe52c2dc3e27a067e6a3
SHA512 c3dbe3548c9b3506f8c338e71f2a4288ac8f313bc85e3b3708fd225d63890cec7e46fb7499d42a6ff725546c1b7c1b87b016e2f4ad0c4bd09499128d47ec33f2
SSDEEP 12288:0sU5VFWwHiC4mxYr8PCAwQy3KVMsMWsYNv+0kHe/6eZ0hW4:0GwH/BYcCAwQEKesf/NmLeiTd
MD5 SHA1 SHA512 SSDEEP

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 c369169e2602b58472075962df334eeaf744772cb7535202da97433bf7bf9691
MD5 cea93ea6c3d40b9e074f38f5950c19ad
SHA1 bf89df1b23706d2c27cd2df1b34646e036d6efc8
SHA512 2075fd6e0b9288e6e492b173c5998b8eaa22ce7b81bb41b1d1167ca25dd76681f83831a7ff94ab0c087b2ad335cac9ac7de01ef0022ae5d9a8677c71105f518b
SSDEEP 12288:8yPz5L8XU5VFWwHiC4mxYr8PCAwQy3KVMsMWsYNv+0kHe/6eZ0hW4:lzyRwH/BYcCAwQEKesf/NmLeiTd
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 18c9b0d0ca3903de0b38a00da6eeea602e88d07f97b41f19809a56798d6f5ef0
MD5 85fd49165795fbfb12bd2e51870669b5
SHA1 55dca58c6e4a26ef393cc8bfd20adcb0a726eea6
SHA512 afa56bde8acc400a291b4147ae61de49fc260af546c163a051eee6f490798b943f01daf762309b9b68c52cdfa4986f052ec262d557fcd8b348baa55439a3a658
SSDEEP 24576:KTDaLl3z0zDDwH/BYcCAwQEKesf/NmLeiTd:KTuLljECCAcKV/NmLvTd
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 dc055299de9b326d93f3b16a57b1986b269995ee433c0cd4092041e398828613
MD5 dac00528e67ba9e0b380c7c42e3eb2c3
SHA1 28202551c25897bc4f58aeeacbd381d6e896db6b
SHA512 428c2d8d8e37e0840ddccf7854a3db62ab23ab158e62288caa267eb04745c3e808e083cc385c97cf12a35827aa9dff367b5d6136a7b8621cd85128c1b9c301f2
SSDEEP 24576:X3vd9CHKy7GZnwH/BYcCAwQEKesf/NmLeiTd:nvd9CHKyapCCAcKV/NmLvTd
MD5 SHA1 SHA512 SSDEEP

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 62eb32c0fb4a0cadcc8c7f8b0ec8ae7fb85fba1aff4a480f2ca349a5d75d39e3
MD5 173eebfda43e0b22afd20ea14e24092d
SHA1 cdc9ca472df9a8809ecb13db30bb023947140d71
SHA512 1c1cb82b638dafa26ab8f7162d88a2a11fa2d0bda91b2f011d2d9ac9098524c7f62d4ab987715d13abc6c73d42d50a753d8ebffc5f9d8e183991b700eb63b815
SSDEEP 12288:rZU5VFWwHiC4mxYr8PCAwQy3KVMsMWsYNv+0kHe/6eZ0hW4:rTwH/BYcCAwQEKesf/NmLeiTd
MD5 SHA1 SHA512 SSDEEP

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 73c189e5d022e34826abea2d774cd46df5b57df757ce1d084d08399950e24cae
MD5 2117c2821b7f6564d2820c80dc658084
SHA1 b3046ad683d155c575a6b8aeeddc78d5b43fef36
SHA512 337fe2433061277d5fb23d78476ff5c2ec52458943351910edfebaf1896a3530cfa964b876073df1cd7672a3ee9a02e075b76c959e21dafa3706437a168694de
SSDEEP 12288:p3U5VFWwHiC4mxYr8PCAwQy3KVMsMWsYNv+0kHe/6eZ0hW4:pxwH/BYcCAwQEKesf/NmLeiTd
MD5 SHA1 SHA512 SSDEEP

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 9f43fee6c10e84db621207bb59eb37ab4d9d4a0aaae83f4b24e2d0c996055da0
MD5 5ebd4e78da1636134069d2aeca792b78
SHA1 0b2cb9b0ba6a35617b2c932148044954e980391a
SHA512 82989f7c45929f708a9f69ff20f2045b6ec462f33746ed86c3273699b89ce159df1bc39d91a90d2cb8bd62d136059fec4c432485526f2c7f531db21ce77f21f8
SSDEEP 12288:AyU5VFWwHiC4mxYr8PCAwQy3KVMsMWsYNv+0kHe/6eZ0hW4:AswH/BYcCAwQEKesf/NmLeiTd
MD5 SHA1 SHA512 SSDEEP

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 ce3c05e8dd0ca178bae7c8c654a441801ebefcedb011b5f966cdb4754af35ab9
MD5 f5b1f1223bb19c284440d09f8492f10c
SHA1 297f49cad102b608c3bcfa16a6d545678d5fa375
SHA512 f9a0d1ede72f52094d2e6cadc38d9809ef2db47ba259132da5adc277622bf525553a85e5f306c91aae80a0e04b6d6b6e0ba94b96153c2c6bde2fd158756ffa46
SSDEEP 12288:isU5VFWwHiC4mxYr8PCAwQy3KVMsMWsYNv+0kHe/6eZ0hW4:iGwH/BYcCAwQEKesf/NmLeiTd
MD5 SHA1 SHA512 SSDEEP

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 701KB
SHA256 6020dc26d19ceff662f7cbea99c3245826195ba4cfb22d00be84dcb8e111144d
MD5 c9a59ef820a10a256443e02f4090697a
SHA1 a4c6e0cf95059c20276d916dde769c93ac6db58c
SHA512 6f95c540a480bbc453a67baa768d120a2b264e0e49dd3ea2c9012721175619fed16799af32e52601a7686e96d888b5f427ced4674c2705acd4fe587a1fc77ef1
SSDEEP 12288:kUFmDDLFU5VFWwHiC4mxYr8PCAwQy3KVMsMWsYNv+0kHe/6eZ0hW4:W3wH/BYcCAwQEKesf/NmLeiTd
MD5 SHA1 SHA512 SSDEEP

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 7ac2126b31ad2e3ea8b7a3d0c7bee8afe318aee9cbfab7ad641fad8cb7e755f3
MD5 dedac47adce61ed49a63692a84efcf40
SHA1 5f3abd48bc3b772ba3fe2b8c5473f613b3520df0
SHA512 b524ecc6f658bf311596ab12d631f4cb2fc2aeeeea0aa36044793d2c9bbbb70a45eb98ed2e39fdcccb55bd7230287c6c274ecd91ad784b5c6e38c37df485fbfb
SSDEEP 12288:Ic3U5VFWwHiC4mxYr8PCAwQy3KVMsMWsYNv+0kHe/6eZ0hW4:IcxwH/BYcCAwQEKesf/NmLeiTd
MD5 SHA1 SHA512 SSDEEP

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 2bf36a811defb691314a0c35092700b13c37cf6449b982ebfdce6cee74d3b382
MD5 e092ecf92aefb4b1731c72b0792134a6
SHA1 05afb5f6f46586ba6d010fb6c080b987d774c07e
SHA512 5dbba4f16f6fdfccce55ca8ddcba25d58d38cbdf6f8d53b904f0812ad2a5ae95a23605741bdfbb06ac369820f25068c5ae8aed7d8db8cb4cf165a59373a66b61
SSDEEP 49152:2a0h2GEkuAe73q3pp46zwwQexCCAcKV/NmLvTd:2a0hNYG4Jw5CCMlwLv
MD5 SHA1 SHA512 SSDEEP

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 659KB
SHA256 552d84d4b506879bbab92a6e709e6f496f4dda416067470ab823cda2b21a31f0
MD5 0177c539f7833d2f11a8927c6ff6ce10
SHA1 1f4649bd64173cfe33bac652d3a9a664998ce967
SHA512 b6b43adc581239045e6acf70871a1014f1eaf091f887a258785852634a98ee34d6e709ef963f0d09fec8e534cec1b4f411df08767333d6c22dad28261049119f
SSDEEP 12288:vhbHjfX7U5VFWwHiC4mxYr8PCAwQy3KVMsMWsYNv+0kHe/6eZ0hW4:vhbHjP9wH/BYcCAwQEKesf/NmLeiTd
MD5 SHA1 SHA512 SSDEEP

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 815a9748353ec604fcf7a238196d48c039b4ace82e49e824e55b8dd7fd2b7774
MD5 3d53eaf9f4e843136198185cdd70e75b
SHA1 2d1d8b2840aea648d22116af1e492649f141f00d
SHA512 8159560c335fe78dec2ad3d9b5591a0c0bd93ed6495665368f47e58072500127affa48a2ca6d314b1302cf8de0c06869df7d03ee1b3368bb96532ae52949e3e9
SSDEEP 24576:13YgnJcRTk4yti+R5dBR/1wH/BYcCAwQEKesf/NmLeiTd:1IgnaTk46pBR/1CCAcKV/NmLvTd
MD5 SHA1 SHA512 SSDEEP

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 578KB
SHA256 9ce52f1ce30e760996ada9321ea7e62b622e32b887fc1460bb9aadfd556ad69d
MD5 f7eb17876c851c36de4964942dd70fbf
SHA1 c0e9f8a1fc24618e242e4d46ea74fccc345e54d4
SHA512 a32da2022512222e6d17d1f7d6621d8c739ba651c2c5c6f15bb7b3bfe977daf2b4f8d351ae26c3c0d167fe25ee5f3dd3871751c5e695b25bc56c26d6e754a8aa
SSDEEP 12288:7Y3U5VFWwHiC4mxYr8PCAwQy3KVMsMWsYNv+0kHe/6eZ0hW4:7YxwH/BYcCAwQEKesf/NmLeiTd
MD5 SHA1 SHA512 SSDEEP

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 940KB
SHA256 27cfd33e2229eca2ac993de012cd20a09d26aabf24166f3a18ee07e0fb69a43e
MD5 bb3b12149bb199397649a4b578025aaf
SHA1 97e9307905439b346154275d071ec1e6e62edd08
SHA512 852a91bce6d60f6b6c6145c57a88c5d24079fc422a39ede3fbce5683b4d5d91a40cfa0f412c84332cf19980eeab000014106aaab526bc8e9ecf483b5c5bd0b6f
SSDEEP 12288:3ObfA4LWOsvAYFTV3U5VFWwHiC4mxYr8PCAwQy3KVMsMWsYNv+0kHe/6eZ0hW4:YbL3UTVxwH/BYcCAwQEKesf/NmLeiTd
MD5 SHA1 SHA512 SSDEEP

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 671KB
SHA256 a523e512df4c4665571ffb09d72e9b105ef3912c0209df10d0a7df00cb6309c7
MD5 1839eed080f8a393f4da3ac6f14bf327
SHA1 b8629f7cda21bbbc80b2e899b41c67152c12fbae
SHA512 a9826b2e9606bd4c272009a589eea3ef9a311f18f9f816f489192109023f60e5f8870afad230ce1ed9b9fd9494c95dd809b219c116aa4b57519ba599b068a6da
SSDEEP 12288:0pFtIOR3U5VFWwHiC4mxYr8PCAwQy3KVMsMWsYNv+0kHe/6eZ0hW4:vORxwH/BYcCAwQEKesf/NmLeiTd
MD5 SHA1 SHA512 SSDEEP

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 a8ee9af7659a221f24245b056455eb16edbc921a5c1101b974cb9b05d98cf738
MD5 36f81321c35528b41b33a27614ec26e8
SHA1 dba6d4edb338b6610014009125913400d134958e
SHA512 9616a98d45fa33703278f9f852e89e9c54e501337da18afeb3892f5a74a70eb549bb44764fd9d01dc324c2a8b133869868c7c21df793e347cc8e2461b7db6f51
SSDEEP 24576:67NM9YqZqmWMUkPjZM48Mv6bEhssxwH/BYcCAwQEKesf/NmLeiTd:67cBWMpPjN8DbEhbxCCAcKV/NmLvTd
MD5 SHA1 SHA512 SSDEEP

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 bbf2d31c504ad898bc4004ad9b7a58b75ba29e4a5ba35e134e2c6dd85c4c82ab
MD5 da52c2d937059c9174516b8ac131572a
SHA1 4413db07d3dd46dafa302bd6f0f14272bf3a1f13
SHA512 a6f6a0b06691b162f843352f15f8dd0ace2ed354d87b518ceef18d22689d09b6ad80dbc3990d9d1940f50fccd7d6aac74c2f9afb20c163d4804edd443d9d451e
SSDEEP 49152:IF2YuHNETovAvNYf8kmMxCCAcKV/NmLvTd:N6BCf8knCCMlwLv
MD5 SHA1 SHA512 SSDEEP

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 4fbfdf2bbf1380fe88fd4eac4dfcef2b925b885bd7c3c8aabfcf1108c28b407b
MD5 9926796c32e1af0ce1b168b8f481d0b9
SHA1 96528a5139625e990a7862f76cf89710249e121b
SHA512 1a9fb44146b2886be3feaf7e5be47f77a70883b29bae8946410e5d694c4c5e5685dee04d66c78045fae299fe659200b2cb6df55e491172620c5a8f4b2d1019e1
SSDEEP 24576:cAFs06+OmlfkNXEbTodxwH/BYcCAwQEKesf/NmLeiTd:xFs060lwXu+xCCAcKV/NmLvTd
MD5 SHA1 SHA512 SSDEEP

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 885KB
SHA256 d1d63a553d19639620256fff746342957b2626374ae87fb005329059ab9411fa
MD5 39092c4580f7542636488c7fd2c50b2d
SHA1 0e85fd50eaa2a20f4fcfee4786f5e429f0ff26f3
SHA512 394ac7ffcb3d7489406eae491cd42fd46a5ff7168dc71f167111145b7d3550b5007a455a78d61d348f86bb575dbf4692ccc7096791c7e7c5a120dd8a08154e84
SSDEEP 24576:pJnJ5D3WX+xwH/BYcCAwQEKesf/NmLeiTd:pJnJ5DGX+xCCAcKV/NmLvTd
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 14152e65ae639c5ca56c9925ee76ffbbc68397c68f84280d1727a2012bcbe58c
MD5 e1f8a2a3d46effef8923d11c35983eb0
SHA1 a22f4c8591261a5ab0865c8c09eab854cd6bcd2e
SHA512 821f0e2adf5f778c4e9f62fcf955c2386d00ab5f9629d961168b23d0a7ef8f474a2e7d0979a09d8c3a21d4435e1dd3a74737d3a281158c8bb690f1346d788322
SSDEEP 49152:0g06DIKdwc+eQnSt65aVAxCCAcKV/NmLvTd:lkCCMlwLv
MD5 SHA1 SHA512 SSDEEP

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 661KB
SHA256 13e1c2af0a262eb15e4be65932a2a9ab0bfcf29b58780b4b9f89b00cd9c5ba0e
MD5 4f2f19c0b62fe7051a14d981d3ab5777
SHA1 17ff495893e364d16c86e5526292ed81d323ab2e
SHA512 fea274ff4323263e685436f48f19ab7f51c7dcda799b599c188767b3a161895b361a08d0b83336d1e9c99020e22baeb3001a782f78b4380a8abb0b93a1312160
SSDEEP 12288:JEP3RnKU5VFWwHiC4mxYr8PCAwQy3KVMsMWsYNv+0kHe/6eZ0hW4:anEwH/BYcCAwQEKesf/NmLeiTd
MD5 SHA1 SHA512 SSDEEP

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 712KB
SHA256 3d23b39b6526952beef958f492da6865ef7b02ab959756528a2c82f454af0cf2
MD5 5cfe031442fbcbb46432fa9187ddba2d
SHA1 02383f26b5ab8bdfd2f75efd29aa6f9ed6b2c075
SHA512 e9b5c31ac667a1f18784ba780e33789dbc589d4062f0f6ce89ecaa1fe0e4a21fb18594a896fac751713a7db21d259b3353eb67213e8f97e117010cf5ad1c863a
SSDEEP 12288:jjkyr3U5VFWwHiC4mxYr8PCAwQy3KVMsMWsYNv+0kHe/6eZ0hW4:jIyrxwH/BYcCAwQEKesf/NmLeiTd
MD5 SHA1 SHA512 SSDEEP

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 584KB
SHA256 25befda5bf1b7a3f72c8f209d2b4890610662dbd926888d69250ad6933e95ff4
MD5 92bdd44f2e96be435068d6a67fe908ea
SHA1 31d5be39c2cb005a4f50c090452e1c46a8d21606
SHA512 9ddda9549eef854c8c1214cf87f80111df7255572495187d044db0906d5303fdcc2851831fb4701636a3b9b2babd5e56f7a9509f39926c14c7f348586602892e
SSDEEP 12288:/yB3U5VFWwHiC4mxYr8PCAwQy3KVMsMWsYNv+0kHe/6eZ0hW4:KBxwH/BYcCAwQEKesf/NmLeiTd
MD5 SHA1 SHA512 SSDEEP

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 271431a80eb6c72950eea64e59df1637d544bfb3b4b4c7639bd2465668e8db0e
MD5 edef50bf3f85e2ff80287b057220e4c5
SHA1 8aa44548e421ebd21dcf62c2e819850f72b17a1a
SHA512 d6d6192ed5b76bbc75efb4720453761c879b00e92bbce534dfd3320c5de1c5babe40f5126fb7726e3f10dda758742132962fde8114c1243483b281fef7daf057
SSDEEP 24576:NQ9MxZKdcz9dw3UxwH/BYcCAwQEKesf/NmLeiTd:NVKZUxCCAcKV/NmLvTd
MD5 SHA1 SHA512 SSDEEP

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 772KB
SHA256 761bdfccdab6d14797560fd54081535bcfe354d43e1c8150f2fad547802116e1
MD5 ab9c0cb3d319729c298183d8dbacbc4b
SHA1 89ff7fddebde42ddeb9a9f6ede5819f2ebf15cc5
SHA512 81852a150c163415be12115051644bf233b2f88c4a523c09c5ee1b6b3c035f1ca2226dda6f434b191f38ded9740668e263a6ac5156f26f3786ffda2e64ceceac
SSDEEP 24576:AyocDApHxwH/BYcCAwQEKesf/NmLeiTd:NocDApHxCCAcKV/NmLvTd
MD5 SHA1 SHA512 SSDEEP

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 2d11d690bf58998783efae1a86068b287d8538fd2e93c1f2cb91b9d440b1ec44
MD5 64834202987d2027f3c796c1740df90f
SHA1 68c6cd543c4a531cf94881ebfba60f7407a419e8
SHA512 d0bad2fe9d865a3600156363fd0d78b2b858fcd2c7375b354de9763ca88c0ae10d7236367408ea1725179b4eee3dc99158990a09a28162a98201f34d4a4711fb
SSDEEP 49152:6WcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKHxCCAcKV/NmLvTd:80zuNI7CCMlwLv
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 f72c7d8e07ec062be00dbd9d9aa4e7c4aeba9208a90b397caf2918b9df0e2a9b
MD5 47b3d54413df32cea6a868dde65503e9
SHA1 5d83b14fa6a9885be04a6e495b0ebaa1c6940108
SHA512 af7956cdcbf6120464e290ca65f82816b6a8e8950d5e456484c69d6bc163421b9faace4e12a481d291f658eca19921a93f98805e4612753d09997c9b63cc91dd
SSDEEP 24576:t1QT7EcpfxR+N5AWAz3ooiYujMqbEwH/BYcCAwQEKesf/NmLeiTd:YTDxR+N5YzT4jMXCCAcKV/NmLvTd
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/228-317-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/228-319-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/388-559-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/388-291-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/704-322-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/704-565-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/956-335-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/956-568-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/1088-67-0x0000000001A70000-0x0000000001AD0000-memory.dmp

Download

memory/1088-84-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/1088-70-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/1088-61-0x0000000001A70000-0x0000000001AD0000-memory.dmp

Download

memory/1088-72-0x0000000001A70000-0x0000000001AD0000-memory.dmp

Download

memory/2064-74-0x00000000004F0000-0x0000000000550000-memory.dmp

Download

memory/2064-83-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/2064-80-0x00000000004F0000-0x0000000000550000-memory.dmp

Download

memory/2372-330-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/2372-567-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/2380-325-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/2380-258-0x0000000000BC0000-0x0000000000C20000-memory.dmp

Download

memory/2380-264-0x0000000000BC0000-0x0000000000C20000-memory.dmp

Download

memory/2380-257-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/3292-281-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/3292-333-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/3356-30-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/3356-31-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/3608-42-0x0000000140000000-0x000000014024B000-memory.dmp

Download

memory/3608-246-0x0000000140000000-0x000000014024B000-memory.dmp

Download

memory/3608-40-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/3608-34-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/3612-303-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/3612-561-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/3716-314-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/3716-562-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/3948-253-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/3948-321-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/3972-26-0x0000000000580000-0x00000000005E0000-memory.dmp

Download

memory/3972-25-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/3972-17-0x0000000000580000-0x00000000005E0000-memory.dmp

Download

memory/3992-329-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/3992-271-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/3992-272-0x0000000000520000-0x0000000000587000-memory.dmp

Download

memory/4104-56-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/4104-58-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/4104-50-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/4104-247-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/4420-569-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4420-342-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4444-326-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/4444-566-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/4904-284-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4904-560-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4904-338-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4996-8-0x0000000140000000-0x00000001401F0000-memory.dmp

Download

memory/4996-9-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/4996-0-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/4996-47-0x0000000140000000-0x00000001401F0000-memory.dmp

Download

memory/5080-13-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/5080-243-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/5116-288-0x0000000140000000-0x0000000140096000-memory.dmp

Download