e16af10e39a2d7b9c1d4c08a1daf569bd2d5deb2239e32f5b2db86dfccc17fb5

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
03/04/2024, 10:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-04-03_6509005b6dd4f631824ad3b63a8f2064_ryuk.exe
Size 940KB
Sample240403-l12yrscc95
SHA256 e16af10e39a2d7b9c1d4c08a1daf569bd2d5deb2239e32f5b2db86dfccc17fb5
MD5 6509005b6dd4f631824ad3b63a8f2064
SHA1 0396015e1b7e2ed6ff98ac2fe239fe3703f6fc7a
SHA512 b07c6e189f28476d0631158580f054db6e8cd45bc04e7acb984341e7d566390d767d96bcf463f7b7d1bd31376e107b305677fe49ba4c54db72e0a1f6aee342ef
SSDEEP 12288:HOb9A4LWOsvAYFTMqzX/7Rs1m5PMIq54d0FyY5H3vhj6bCzmEQ9dQ1hDT:opL3UTMq7Os5PMI9C3Z3vpcEsWnT
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
2292	alg.exe
2484	elevation_service.exe
4084	elevation_service.exe
3144	maintenanceservice.exe
5104	OSE.EXE
812	DiagnosticsHub.StandardCollector.Service.exe
3484	fxssvc.exe
1036	msdtc.exe
1892	PerceptionSimulationService.exe
4200	perfhost.exe
3244	locator.exe
932	SensorDataService.exe
3580	snmptrap.exe
468	spectrum.exe
2708	ssh-agent.exe
4020	TieringEngineService.exe
2976	AgentService.exe
1612	vds.exe
4032	vssvc.exe
3700	wbengine.exe
844	WmiApSrv.exe
4504	SearchIndexer.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in System32 directory 24 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\5ecf4c70c4fd1e7a.bin	alg.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2024-04-03_6509005b6dd4f631824ad3b63a8f2064_ryuk.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\106.0.5249.119\chrome_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe	alg.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	alg.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006d615208ae85da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9908 = "Wave Sound"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ffac9e08ae85da01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000739e2e08ae85da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000739e2e08ae85da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008f2afa07ae85da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b63b2c08ae85da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f6073c09ae85da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e3e79908ae85da01	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
2484	elevation_service.exe
2484	elevation_service.exe
2484	elevation_service.exe
2484	elevation_service.exe
2484	elevation_service.exe
2484	elevation_service.exe
2484	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
652	Process not Found
652	Process not Found

Suspicious use of AdjustPrivilegeToken 42 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2556	2024-04-03_6509005b6dd4f631824ad3b63a8f2064_ryuk.exe
Token: SeDebugPrivilege	2292	alg.exe
Token: SeDebugPrivilege	2292	alg.exe
Token: SeDebugPrivilege	2292	alg.exe
Token: SeTakeOwnershipPrivilege	2484	elevation_service.exe
Token: SeAuditPrivilege	3484	fxssvc.exe
Token: SeRestorePrivilege	4020	TieringEngineService.exe
Token: SeManageVolumePrivilege	4020	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	2976	AgentService.exe
Token: SeBackupPrivilege	4032	vssvc.exe
Token: SeRestorePrivilege	4032	vssvc.exe
Token: SeAuditPrivilege	4032	vssvc.exe
Token: SeBackupPrivilege	3700	wbengine.exe
Token: SeRestorePrivilege	3700	wbengine.exe
Token: SeSecurityPrivilege	3700	wbengine.exe
Token: 33	4504	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4504	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4504	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4504	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4504	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4504	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4504	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4504	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4504	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4504	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4504	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4504	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4504	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4504	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4504	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4504	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4504	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4504	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4504	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4504	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4504	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4504	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4504	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4504	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4504	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4504	SearchIndexer.exe
Token: SeDebugPrivilege	2484	elevation_service.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4504 wrote to memory of 5052	4504	SearchIndexer.exe	122
PID 4504 wrote to memory of 5052	4504	SearchIndexer.exe	122
PID 4504 wrote to memory of 5012	4504	SearchIndexer.exe	123
PID 4504 wrote to memory of 5012	4504	SearchIndexer.exe	123

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2024-04-03_6509005b6dd4f631824ad3b63a8f2064_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-03_6509005b6dd4f631824ad3b63a8f2064_ryuk.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:2556

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:2292

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2484

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4084

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3144

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5104

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:812

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:4864

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3484

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:1036

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1892

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:4200

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:3244

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:932

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:3580

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:468

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2708

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:4568

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4020

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2976

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:1612

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4032

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3700

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:844

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4504
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5052
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 916 920 928 8192 924 896
  2⤵
  - Modifies data under HKEY_USERS
  PID:5012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
Size 2.1MB
SHA256 1798d3c5b39bc3a8e02de0a3e7c4900818ead4fe5ead828351c5c2f74473b72d
MD5 961fc6757edd35616eaab763529a59cd
SHA1 a0a2380bd2b4d78d2d6f42fe4a5cf66dedaab186
SHA512 c21804a42351266134a9643d73cede517bc32385429d78a93fcb782e3006fad57be869fe64787f4580b6aaf272ebb9de75d6d7605bd7b4e213bc48a8a9924d73
SSDEEP 49152:7uYk3H5koUXfTqkkYLO/W2buywzMbOX+T7z5B9WPMI9C3Z/2bWnT:7PfTqi90bl9BIAJubW
MD5 SHA1 SHA512 SSDEEP

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 781KB
SHA256 66efcdedaa01c21cb0771eda6a648bea9a78be0e344564431859c9648fcd2917
MD5 6b2595e216ba2aa17b2c3d1238b4d4f9
SHA1 d37a6a022c568a59f8a1096b0fe3a18f10b83902
SHA512 184bcde516805b56e9cfdbf4fe2f281300667c22a7339621652ef949ddaeeea55c3b34c4cd53d961a6cee15c7472ee28774da6e2eef25d0c6146ab87c22f3a7f
SSDEEP 12288:DC0P9Q/JcuiQqzX/7Rs1m5PMIq54d0FyY5H3vhj6bCzmEQ9dQ1hDT:BPsJcuiQq7Os5PMI9C3Z3vpcEsWnT
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 c8db3c012295c4ef83d11bf685234d408525006c3fae1b56d61e014f727a2487
MD5 d79daf076a5ec3be2669ad07d83bcc83
SHA1 8b61df6dc3f493e64175b1f855bd70ea26df8f6c
SHA512 b52485e02efe45f964940bf75e97a09b06dacf20c5709277d2afd83d429a0b423a2e194eda7e2bdb912a8c19e41e000d327944e28b67c0370b2e2d3af2b9ba81
SSDEEP 24576:3+gkEVfh4Co8q7Os5PMI9C3Z3vpcEsWnT:OgkExSO9WPMI9C3Z/2bWnT
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 c1429c9f810cc3b5f07cab5e6ee01333fb8dd6463fa61e62dc90eceb87d853bd
MD5 21395530c4bdc8213219e8d7274571f8
SHA1 6199bc7c37c52368ba5fd69b22b8fcf9f75f9f4a
SHA512 965ba921ac5b1b169e1f6de4590c43beb1990def2ee5c35180882f49babc75da5cd893c420d404bc2d02dc30894dc83add9332a6169360054e5142e04d70592d
SSDEEP 24576:JBpDRmi78gkPXlyo0Gxjrdq7Os5PMI9C3Z3vpcEsWnT:rNRmi78gkPX4o0Gxjh9WPMI9C3Z/2bWT
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 192272a229808c047b343d237e185103c799a091ec1efe91431d6f0de499731a
MD5 e3dda2a350fce285e9b45436585843fd
SHA1 22da03f849a64288a3fa40369b1bc3c802c5c451
SHA512 db4666bb4607b4e06a41f21f9fe260365b016fdeca20902a75286584dd86d8255216f77a897bb903c67616614989bf2e59f1b9ad1999eedd61339b774ad8b067
SSDEEP 24576:SLOS2oyPIXV8q7Os5PMI9C3Z3vpcEsWnT:y/yp9WPMI9C3Z/2bWnT
MD5 SHA1 SHA512 SSDEEP

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 3f3a1e0c99f4060334717764c75af0a692d5282548e5725c3524de5eb5d6feae
MD5 c332933267ea7b8458bf310a4cb00604
SHA1 205d128c8d368c5d946843d8ee92a94cac04023e
SHA512 43c80a5a51584e62e716c5b66ebcd865b4915c14929f96e5becc474113e97f25cad5fc10b2b3d617655da5125a91a3cacd9604877f398ee2f9a3fab74f251ef0
SSDEEP 12288:WfuqzX/7Rs1m5PMIq54d0FyY5H3vhj6bCzmEQ9dQ1hDT:Wfuq7Os5PMI9C3Z3vpcEsWnT
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 02cf75c8106c4893b891375760018aa5c003a6f1a37214a823e7f5aec9c89459
MD5 4ecb553db5eb90f5a95db5845a61689f
SHA1 7240b051255511a7c440532871943c153469e413
SHA512 b7592039969cf55a44d770e94f6c2a24d6ac6f587334367059617fabd789d7eee394aa898860269e8fff7e3b09840a500a5fadfb3fd64665145c1fc592b1eaf5
SSDEEP 12288:IeBNUbTVO86U/qzX/7Rs1m5PMIq54d0FyY5H3vhj6bCzmEQ9dQ1hDT:IJIU/q7Os5PMI9C3Z3vpcEsWnT
MD5 SHA1 SHA512 SSDEEP

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 0b038cfb72418f8fd397bcb08c8c5f99af6b3ba5b5fda3121986ebeb72dd8897
MD5 0685568dcd4339a9029f22f9fe83d1fb
SHA1 c1e1689291e2ec5b58ff79c1697d8ce7e0e910a8
SHA512 bb85d19592fe564d86d2f50d11ce476bfe4473144eb4a19cc7338bedc59c671f34ba47ee15b734ea9cb51fd9f0e01cf0fb656a67840faf59d93540e0c24712f7
SSDEEP 49152:4QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THV:4QvGAdlCEL8c/yRNw5Co9BIAJubW
MD5 SHA1 SHA512 SSDEEP

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 3517c4da340ec10875713551cc2664101c8c66e623b4102ea69ac6a9a5559c5f
MD5 f833a3c47dc009dc678791b510a65d05
SHA1 0792eeacc89d0a844fab1620451a03b6cd5a191a
SHA512 6e6aebe191e1d63911f98e6caeb3fa7ef4b028409dcfbfc22d50ce810e933b3fc563ae90f559df260c67b79e65d1b5eb1b2f8995f777b15d96979132c1a697fb
SSDEEP 12288:UAwSfxL/2Dc34DLLmt0LDQewsAjlqzX/7Rs1m5PMIq54d0FyY5H3vhj6bCzmEQ9Y:pdewsAjlq7Os5PMI9C3Z3vpcEsWnT
MD5 SHA1 SHA512 SSDEEP

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 d0a7f9030c5b16759759c97fd5d202bb636f6ccd489923ac6b4678d8c6b9fd55
MD5 41156625a24481374bb5341f9ddc12ee
SHA1 c53965182acc393058067d91c7022fec19172e37
SHA512 c4d04668b9d1d5738957c0065f66a8f82ebf724c48c2748f8126b071a03cd87e19cdc72d9220c58f9de6d76853e9049fe0f96266b9de741fc0f20aac9381b42c
SSDEEP 196608:rUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHvZ:rUEtQevvqc2W1cpV2EI32v
MD5 SHA1 SHA512 SSDEEP

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 cff5b336aaf8c5e85aa93ff3cdc4c98146aa20ae4e71ce835025d4f9cf1c3394
MD5 9b91c39d8db3febe2dfbfc924e113666
SHA1 30c367e158d943f0840c07a1c38102c459582937
SHA512 fdab1a03c81edb1e6f3e4f2bf20609071390fbdc29a9406d0a8acfc23d72b298d5e335dc95efda1916dcc93952091e3c7404a5fe1ce427cd048e55b104ae1ed4
SSDEEP 49152:5CbRquA/m2yL5zifFiV+XenmE3/zF9WPMI9C3Z/2bWnT:WoqHVjnms9BIAJubW
MD5 SHA1 SHA512 SSDEEP

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 9fd3d09fcbb73f7b9f8e28fde99a1263ce35740ba6db7c4c2fd84cdab96dca1c
MD5 e4bad1baaa6e43217993d63fdbe23f26
SHA1 96a88bd51dc0e77f7aa0b2234ccdbf985f572c2a
SHA512 459885ab6be3e9722876a5bc259c561a9d5b8473da389fcdc9b8017edc15c3f78222c1097efaa29af184d542990d39b026fe4e77bf9fcb85efdf252b32175765
SSDEEP 24576:gAhGLJIFoiwtA5l7S53Mq7Os5PMI9C3Z3vpcEsWnT:gAMyFoiq5c9WPMI9C3Z/2bWnT
MD5 SHA1 SHA512 SSDEEP

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 8e0aff0c0779ecc1ff8b4812285f9f939cd2faa7908c456c72259cdd4f442bf1
MD5 02c98b940b7d4b3da636d0015329bbae
SHA1 1efd813177e213cc9073212383e69349519eadbb
SHA512 7054b6f933983f34cc02a0fda8b94a107c38bc2c77244acc8a037d52cc162f3bc61121a6b0419f8299e0497dbf7714dcbb7092d7d5f6f9eb769f8893c6443edd
SSDEEP 12288:mmw5HEjsChNVBFgl0WDm+CYqzX/7Rs1m5PMIq54d0FyY5H3vhj6bCzmEQ9dQ1hDT:/wuoOWpq7Os5PMI9C3Z3vpcEsWnT
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 259605d6ef2dcc33b778985cf41713e2061a551696b28b964d1364b35d133c21
MD5 631c73dfbcff88efa7abcfb33da99af8
SHA1 38b9f25ecf1d5ed4a0541c7cbe8f154b045cc86f
SHA512 b358125f6fa97195551e5ce6de0d5938ce983f3d55221a741c321cfeebdaf10094d480351757ff1618bf34b7f29db2fd02347c6a0a382ca0eea3b30ddc2718b2
SSDEEP 12288:YBZ1IyVqzX/7Rs1m5PMIq54d0FyY5H3vhj6bCzmEQ9dQ1hDT:GZuaq7Os5PMI9C3Z3vpcEsWnT
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe
Size 4.8MB
SHA256 395c504541e6a097e155c7d5033a5a8f1d66f405fcfd9c371c7708780e71efe2
MD5 de3871f5ea7cc70c494be7e043052cf1
SHA1 8d30d42711dc4341eb3ccb651b48da99c71f2db8
SHA512 ecd56233933a793b9401a289c810917190bc804918e308332f07c90201e771114d39bf71eb3dfd163519e30e3331c24d1381294ebc04586dc091ffdd048dd217
SSDEEP 98304:FrZ4K5M+XDfiIewG+x6xZ14H9BIAJubW:JZ4K5M6qIzv+Z1aZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe
Size 4.8MB
SHA256 0b9399bfc202d8f890f7cb4118e55a21f38fa702dbf1273a5a8932725be35474
MD5 829aab92a942cf6e7a36f97dbae387db
SHA1 45376d415b523ced09a7ebb4c93ff494ecb5ceea
SHA512 96a63c2d5bc63232abdcada6310b0f0cb5b237fb9f0c25f2267a5db75c184369c1ca7d9d4ac1b5b14f0a3f89e13cb365fced5e0e074c0a76537d7fa101049fe1
SSDEEP 98304:0rZ4K5M+XDfiIewG+x6xZ14H9BIAJubW:AZ4K5M6qIzv+Z1aZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe
Size 2.2MB
SHA256 0c4ee28c4885288ceda070e74efdc0a6c048547486d8c770f7d76a9afd640d00
MD5 a9bc276608335be83c73fb33b66c5832
SHA1 0aba72608038aaefcaf2d1de3ced7f8be28a14d3
SHA512 6e298576effb0a8b34ebbe6d484d569bda1e41c3be38f4df3acd62e00d3ad32c4e8be93c167494643f55536a45be3ffb2ce40185c2a20a75fec34cb583891f29
SSDEEP 49152:SfzabJ8llj+SWWi2mkx+X+diM9WPMI9C3Z/2bWnT:Xui2T9BIAJubW
MD5 SHA1 SHA512 SSDEEP

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
Size 2.1MB
SHA256 51097594c0f169846e405c14011214af71040829424efff93951382413d6a000
MD5 87dab1a70ded541fcd28e0f8863f60ce
SHA1 928688a09f2ba7059e719ac77a73d1b0a58c028f
SHA512 5eab5d9e98a960cdf86462735f5cdfa192cd7e84a0e55150a9ef30d96841490662956883778dfdf48ad07260b8cb56aa36e7db5431b430d20ce1a267b0844ace
SSDEEP 49152:aa/3xXBSZ4K5MJ1LvTMxbfsYBYSgxu9+fw4Tn9WPMI9C3Z/2bWnT:EZ4K5MJabfsYNA9BIAJubW
MD5 SHA1 SHA512 SSDEEP

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe
Size 1.8MB
SHA256 d4499e57921eea60fbb82dc7e02784a7de0b697afc4564f7700f0c233b88e5ad
MD5 e51455db37afc0102174afd4f0358f4d
SHA1 a538ec28fede6b14aa6fbaefbb7af8f14c59e7e1
SHA512 9ff56d4474ff746d0b2b3f1005fdd32491775dd3109fb8d16bb08a77f312d142e871393ac854b9785540f828010b76db4264beda362c498bb334be8a129aab10
SSDEEP 49152:3gNJtUzDu/9gKPxHC459WPMI9C3Z/2bWnT:MPxf9BIAJubW
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 1.5MB
SHA256 0620c3e01e7a73c6d862089f9ee92b7344d6dce7abeb18106e53505b4e8fe7fa
MD5 06588264250888202e8e9c21a87f4de6
SHA1 2ee3197d9109b1308c69b6a1b83c160e5b9cec32
SHA512 65715b57e62ec4b3aceb8ce6dfba9423a605152c4733d9ad3021247a06cf75891874a85eca0e8322171d195c2fbc0dab3f947c15489d08d338ae655a10289d40
SSDEEP 49152:bOBynH1wM+v6UJxLQd7BHjdfv9WPMI9C3Z/2bWnT:Nn4LQd7LH9BIAJubW
MD5 SHA1 SHA512 SSDEEP

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 c0fe28f9a7c312679267d04e055bd3af6cde969ae65c963dbb33051b6fa9ea04
MD5 090a0bab5c3258a617cace00aeceb0e6
SHA1 1edfb0ddb64a04b59a196124979c3d25d8cf869a
SHA512 58725e3f2b6b92840336bb5efbdb3268536528ac53338d809ae46ee4c886005b9388afffa1a4ffa62ee11a12063f54df5793715e8e31dc0963cb8bf98b52b8dd
SSDEEP 12288:aGqzX/7Rs1m5PMIq54d0FyY5H3vhj6bCzmEQ9dQ1hDT:aGq7Os5PMI9C3Z3vpcEsWnT
MD5 SHA1 SHA512 SSDEEP

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 0f2c5ac3b1122c1e78262f81a8135bc72325e1328ae56b065698b2a8b349b8df
MD5 b40eefefda7c59d9b3466d5be8990c9d
SHA1 694cbfc329301e61f29f76fb5d38587d59766012
SHA512 704b522131a45547ae63011abb42adb3019980152fbd6e2b216a200575fea927b04ff18faa5576b08bd63e200bee59f6a83561eca2fe75944e4cd5eab5c26e7d
SSDEEP 12288:IxqzX/7Rs1m5PMIq54d0FyY5H3vhj6bCzmEQ9dQ1hDT:Ixq7Os5PMI9C3Z3vpcEsWnT
MD5 SHA1 SHA512 SSDEEP

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 d11eca8169c0a2dd408454464a18f2f7d822e391d28ef21994282afd4a859746
MD5 64b4d642df99dd010a331821e43daa58
SHA1 e65b6e23a3a1d2624c1ac2dfb08edd695773c08f
SHA512 82e4fc8dff13b82285ec37ecff2bc0bcbc2cc2c2e5f56577eb26f7690c05bbd97614c1a134a200dfb37d603e6b1e3e803392747015542b34ed38d9aa08526686
SSDEEP 12288:xXqzX/7Rs1m5PMIq54d0FyY5H3vhj6bCzmEQ9dQ1hDT:xXq7Os5PMI9C3Z3vpcEsWnT
MD5 SHA1 SHA512 SSDEEP

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 b0dda545d0c32aaf2340271893084546267a453d9f102e083be9859f811c0afa
MD5 54141db191e87b660e262952ce5a1fe7
SHA1 b787ba5ad7decc7f69e7b7a703b950a5e6de4e57
SHA512 c595c614bc0e48df26bf569ed7aa3a247c7202fd8cc7de1ea012dad6533732a676d0eb7fdc6206b7ac5ea0bfad517a7d481b630a9201e2e6d2e5a55583362619
SSDEEP 12288:CVsqzX/7Rs1m5PMIq54d0FyY5H3vhj6bCzmEQ9dQ1hDT:Zq7Os5PMI9C3Z3vpcEsWnT
MD5 SHA1 SHA512 SSDEEP

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 3d96adfeb8c232f4564d706a4080471225aed76186faebdf9eada49b2ef242c6
MD5 b6d3857e560fd249548eb36f7ca8a67d
SHA1 b39b2f6f40c5901d5b2f2c81a9481247dc8215f4
SHA512 e01b51f415b015ee1eb4a1d3ba506896d3baf7ef688f3c8e3acb751932cc94de91b176a0a661a65beea6b8b6208127bec9802d5de498585f4b653461f703a435
SSDEEP 12288:I0qzX/7Rs1m5PMIq54d0FyY5H3vhj6bCzmEQ9dQ1hDT:I0q7Os5PMI9C3Z3vpcEsWnT
MD5 SHA1 SHA512 SSDEEP

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 d76170981b9b7317054038374bb1254cd5f94d3dc68e848b5ff8123a55548bc6
MD5 c3fc2d25e2d34a04d2e8236f639a01f3
SHA1 ed514d05d52692c740fecf40b68c07e7cc7b4c99
SHA512 2379acaf067a30cb7be4d7eee580dc316db2863a0224343428509a34ffcacfb2e39fab195a29b37cbea61eb489228433a2f61b4d80fc3203190780635ed9d9fa
SSDEEP 12288:CdqzX/7Rs1m5PMIq54d0FyY5H3vhj6bCzmEQ9dQ1hDT:Cdq7Os5PMI9C3Z3vpcEsWnT
MD5 SHA1 SHA512 SSDEEP

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 78e76e0572221ffc6ad93ae7ed0de93a962deac0d12bf7e1b1e14f75ae821caf
MD5 aab93867788df54f5ec39fb499388f7b
SHA1 f8113309e12d2a54a196750da87c23105c9c879f
SHA512 352e867fef985fd3015ac67dd8df80caa46865025fbba14cc4df044d6dc6ca1a83732169928126f470864e63a6b01718d0698c6e8bcc0b6166164247e0c280aa
SSDEEP 12288:U5qzX/7Rs1m5PMIq54d0FyY5H3vhj6bCzmEQ9dQ1hDT:U5q7Os5PMI9C3Z3vpcEsWnT
MD5 SHA1 SHA512 SSDEEP

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 fcc73dce7004866aec1eca9772a0e6591fce923d82355bd0a8942e9bae2bbf2f
MD5 97de041a18508947e9e85a6dc5098d69
SHA1 fecb124b892a5f65c20d4462f841ac1862eb5b9c
SHA512 dfb816b6beeff649441d00fe78413d19a1ffaf33c1d44095ff5cb47195b324ff35a1ec5421addb8a213902ccaa1c9c0a276dd093772d87cc9aa9f4b25e8a1af2
SSDEEP 12288:4iZwb6zzFEoS2cPvyRqzX/7Rs1m5PMIq54d0FyY5H3vhj6bCzmEQ9dQ1hDT:7ZMSzFVSORq7Os5PMI9C3Z3vpcEsWnT
MD5 SHA1 SHA512 SSDEEP

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 5cfc15989ba84cb5d303f665fd3d646da2ed8fc1113578dcdb377ba087e498d8
MD5 8e955b2e31721d3c38ef7b08baae6850
SHA1 51950ebba30f9e99407848b85f6753552facb191
SHA512 2798eb8ce19a24077093d21026fbe83396303487906d717866712deed218681cd80de6e038ea3cd4b2e7b55cbd9ac3cf2e6527a15c5609800fc9e0de59b8a23f
SSDEEP 12288:TKqzX/7Rs1m5PMIq54d0FyY5H3vhj6bCzmEQ9dQ1hDT:TKq7Os5PMI9C3Z3vpcEsWnT
MD5 SHA1 SHA512 SSDEEP

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 f78e60a9c5c598bb170fc210aef3e0ad284389575b3a3b2479ba629b2b32b7f0
MD5 1e6023d088b8d847c7cefc166d473a99
SHA1 59df9cd71cd1a48470e44062268f1800d6ac1371
SHA512 f9f9903012e104883dc5e8ddb8bd08f6b8b66d3267828a29f28352f4a55a4376c099bbd1d68e5b437a4443a471ed9f56ffa66f33ba54c0afc8eca539701f12d3
SSDEEP 12288:NeqzX/7Rs1m5PMIq54d0FyY5H3vhj6bCzmEQ9dQ1hDT:Neq7Os5PMI9C3Z3vpcEsWnT
MD5 SHA1 SHA512 SSDEEP

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 7ef75bffa33238cf2cf981b145e40f45021cc2c703d4165c31997b16e597a76a
MD5 4f6bd6a820416e9c99419f666541c806
SHA1 ae50e16f362e226b02eea2824dfbb54b32460198
SHA512 94a92f22733ab44f9a327ad60b1e376670c7167db3a9001cc5fe932de1887cd6da0c700ef34531a6a7e7b10a326a1cd6bff449523f1304f4e08eacdd11d6ea48
SSDEEP 12288:XKqzX/7Rs1m5PMIq54d0FyY5H3vhj6bCzmEQ9dQ1hDT:XKq7Os5PMI9C3Z3vpcEsWnT
MD5 SHA1 SHA512 SSDEEP

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 6cd5ece267a138189dc91172523def0057299f86ac620d92e2167aecc19c0249
MD5 7b42fc54a98f5b1d390f86b3ad12976a
SHA1 105b2c56e16536c046e35b66da8dfd3dd78e4d80
SHA512 608dcb1461aa49cf60e8561201f97a5d49a36ec7b30553ee0bb93df1750c429e13c191f22326d66d8bf67e099947a04966a808ef966fad1d34c388b3bd68478c
SSDEEP 12288:MKqzX/7Rs1m5PMIq54d0FyY5H3vhj6bCzmEQ9dQ1hDT:MKq7Os5PMI9C3Z3vpcEsWnT
MD5 SHA1 SHA512 SSDEEP

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 c3465462de0856f6874d9b4d1cae8ca82641f8253fc4455f5592a24885979ff0
MD5 68efb7689e39071bbfc2b0377be5dd09
SHA1 f33c8e90a9b1b9e0044b8c77f5416a15e38eb2cb
SHA512 11231629203634a74224da6e29ed8152f0484d11c04c179ac62c84de5aa6213641e76a266d41234b6ae1298075237e516bf0ba179aec967e324fa9df8806e6ec
SSDEEP 12288:VyPz5L8VqzX/7Rs1m5PMIq54d0FyY5H3vhj6bCzmEQ9dQ1hDT:8zyVq7Os5PMI9C3Z3vpcEsWnT
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 8254280f48cba0eafd1161271e8da5c722a84bd32dbc9c0b3db518caadd8a2f8
MD5 01a5e2aa2ae37f2ac5231ca7c9ae95e2
SHA1 5472296538abd3089761284162a163c2c07f89ac
SHA512 931b21229af081c6224dce90a2097013317f1825fa67f650ee1c3d0e8eb1bd0ce1c9c68a92a7d4396d66cbef55eb23792bef1b266c8fe1e32dccecc403b510ae
SSDEEP 24576:GTHaLl3z0zDnq7Os5PMI9C3Z3vpcEsWnT:GT6Llj49WPMI9C3Z/2bWnT
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 65d7f79c5167de0754aa0f6ef33b0f116cda4c8eadd62276ab1da588c5169573
MD5 2566b5ffbdf9a7318560987ff609050d
SHA1 e5d182a2dd829b2acf680a068adc53761667ef0a
SHA512 f2984ee5c9eb0a1c2d0a49401b25240b11fb38b54f5d706b3279a700b156282d5ee78728a82da94b5d7a410fa6ee2a1171bc2f9d5c42dbc67311c5cf43f6b758
SSDEEP 24576:S37d9CHKy7GZjq7Os5PMI9C3Z3vpcEsWnT:07d9CHKyaN9WPMI9C3Z/2bWnT
MD5 SHA1 SHA512 SSDEEP

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 228dc9467ed7c5ab8a7ea4613ea8c9d83332ac6b60581f0bd30c69fe43c35d5b
MD5 5f8d0301a139ab17fa7fd1bd08738550
SHA1 4654372b7e845003b7a1ab21d7cf9a63821db2e8
SHA512 420b645037394a53d13050f71d72521bf51c10ed2007d38089cd1792adeb0d6aba45837789f15bd69643e344906bf89421e28bc83104911cc82ad926ffa929e9
SSDEEP 12288:h3qzX/7Rs1m5PMIq54d0FyY5H3vhj6bCzmEQ9dQ1hDT:h3q7Os5PMI9C3Z3vpcEsWnT
MD5 SHA1 SHA512 SSDEEP

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 fc97330115217179133f2398752bba15f498ec467441f0d41893eff61afcf46c
MD5 ba8fbc9f5f1de922b574a4d9943bee84
SHA1 8897dc627af461c7febad3cf121a929ea975e213
SHA512 acf8bf8972e2bd2d9b2389bf95c252908b459c850b235677b34aaedef5e9665be75a81dcee1134c1f2ad2776c8af997b8f860a460b622da1293904dc1f284e93
SSDEEP 12288:s1qzX/7Rs1m5PMIq54d0FyY5H3vhj6bCzmEQ9dQ1hDT:s1q7Os5PMI9C3Z3vpcEsWnT
MD5 SHA1 SHA512 SSDEEP

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 2fe3eab2c85fb5b3676a1042a4fcb5be6fee885bbd5e63ff7630fc524603a42a
MD5 0cb65a02b116164d2783f50a279cb929
SHA1 84950f9f53b769d3e08a9f827e797a7d218295b0
SHA512 be410d7f4cb799ee3e9581a5fd88911c8870444ba3aaa6e0889828c91832a89e1f805c79b61290222504f7782d759eb5831c82496fa4a797e8cde603b32f8363
SSDEEP 12288:+AqzX/7Rs1m5PMIq54d0FyY5H3vhj6bCzmEQ9dQ1hDT:+Aq7Os5PMI9C3Z3vpcEsWnT
MD5 SHA1 SHA512 SSDEEP

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 0013bd08ef403962613fb5e59fcaf0c5b053d2e2f69b5f6fccbb8c9cb4fea412
MD5 948ad7d325b1b886ba6d5e9b3d8e3bec
SHA1 a60ec0ba6f0e731e9774e1fff4ed21f7136a50f0
SHA512 e56fb3a89b33dacd4ec4baac2b62db2b1c4ac28b7700863fc07add9e08af9e07ac72d653899a67103e3728cf1e2f51baa52a1e30adafb0c214f4801c4f72b2e3
SSDEEP 12288:9KqzX/7Rs1m5PMIq54d0FyY5H3vhj6bCzmEQ9dQ1hDT:9Kq7Os5PMI9C3Z3vpcEsWnT
MD5 SHA1 SHA512 SSDEEP

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 2dee2a0d4e5a1ee636c3ddffdab3d1ff5003fcd116af9310ee18aa1070f019bc
MD5 cdef39a669e1c8a24f0d1404af745f79
SHA1 7386feecb45d90a8239a10ef9a0414d05e2cddf6
SHA512 f00060e412f5286c6e4610c21909b98b7d669c27938069ea433f8063dab2bd46aa290bb0536a4c82e33fc4a0774eba65c72f50aa60b5b805826582c86542771f
SSDEEP 12288:w3qzX/7Rs1m5PMIq54d0FyY5H3vhj6bCzmEQ9dQ1hDT:w3q7Os5PMI9C3Z3vpcEsWnT
MD5 SHA1 SHA512 SSDEEP

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 e8527f55f029e3a21584b84f901017c18e27e689edbe28c4669e02dee88d9e80
MD5 77df88cbea1bcee772360aabb611bbbc
SHA1 b44e520e112df8832ddbfb04ffed8c1cf1699f8f
SHA512 77c096ce052ecb4c48948e021e5a60c570b4e6d162e77e4c300ea1907028f598637ac4439bb3a2accdb32491e26e4c6bc16812ab81d64a7f8d3dcdc062ba6d68
SSDEEP 12288:gSqzX/7Rs1m5PMIq54d0FyY5H3vhj6bCzmEQ9dQ1hDT:gSq7Os5PMI9C3Z3vpcEsWnT
MD5 SHA1 SHA512 SSDEEP

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 696KB
SHA256 8d3fdf30a7f1fc99a1ebe93e8004c3eb015ec7accbba830bf81ea52f9eb67eb1
MD5 c8dc95f774464646953e5774c514a9fa
SHA1 b80f6a8b1a84a5b98baba769a4fe9dbd797da654
SHA512 f173c324cc52b974f8cd1a003acb8a041736d982bb15df6a830bf3aec2d3ef1ae038dc43dabc04e95df7848667a2d8d26d3dd3f579a0d309e193661f4442232b
SSDEEP 12288:kFYq0StqzX/7Rs1m5PMIq54d0FyY5H3vhj6bCzmEQ9dQ1hDT:kgStq7Os5PMI9C3Z3vpcEsWnT
MD5 SHA1 SHA512 SSDEEP

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 b76a6219640b37d1194e2daab492646b963e172068dd5517ae1837d55e0d49a6
MD5 08c868e59796adc3c248a41289587d76
SHA1 a5aea93157e778375c1b911de2f99a4f20747da2
SHA512 18aa5759819f10650c9a368c79bb77fd6840ff2b838564b843ee98d6a8a2fc5fa42ac17ac0a43d0a2016152594c7c5dbaba5c30cb8e480176b4ce1385a7e0c1f
SSDEEP 12288:cMqzX/7Rs1m5PMIq54d0FyY5H3vhj6bCzmEQ9dQ1hDT:cMq7Os5PMI9C3Z3vpcEsWnT
MD5 SHA1 SHA512 SSDEEP

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 e392e863c7851aa960d98835b2c945505f1ce8c672fa2ee4a41c0f5ec96eb01f
MD5 89c932e303ecbcc3710ff657e6f728ff
SHA1 f02243322235b93f88f593a88d338f8d90af6298
SHA512 fc1e0388ae20995660c08fa3ddc74e24e98356346dcfc050bf18bc12dd49be26558fb748b07765fbcc59e204c6cbf4af0a659c36ec29459fdcb9eae29172c90c
SSDEEP 49152:Ma0h2GEkuAe73q3pp46zwwQK9WPMI9C3Z/2bWnT:Ma0hNYG4JwT9BIAJubW
MD5 SHA1 SHA512 SSDEEP

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 659KB
SHA256 cbd1545a97a647bb421c4f68e2881ec59db128cebc7f8dc4904f5397cb84a8a1
MD5 cfee33f4dd02059913609df3a4c95bdb
SHA1 560c06ae685e24b76fd05d9b4e637463655243b3
SHA512 758379ce0744c4664c0219d61b257851da7cc0890e41bcad3e7875fb8feba44c29d66b82ed476a6976387dfff57372aa4e1c364e3d0c4125033a04e05f3746aa
SSDEEP 12288:BhbHjfX/qzX/7Rs1m5PMIq54d0FyY5H3vhj6bCzmEQ9dQ1hDT:BhbHjP/q7Os5PMI9C3Z3vpcEsWnT
MD5 SHA1 SHA512 SSDEEP

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 24db35233eb622a975acd771c28a43fcd6c4bafea1a503f76e0506a12a3c29cb
MD5 504b6d44c2feb5d79d05648c3ae4d975
SHA1 3503ff7bb62fbc1a8816cc3857d4be3f90e51b2b
SHA512 1cebf96744758e5e21d14ad9a50c7ae7012683d39b96c87691cef7b4a4aa621bb27a2134a7858ce7cf8b8a1aa6235c2f49a23ed88615a723494a98ef96a85320
SSDEEP 24576:k3YgnJcRTk4yti+R5dpR/3q7Os5PMI9C3Z3vpcEsWnT:kIgnaTk46ppR/39WPMI9C3Z/2bWnT
MD5 SHA1 SHA512 SSDEEP

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 578KB
SHA256 58ead926ccb1358a066ef10bd3df6c78b99bf0352b8df6ecf89566c29b653e58
MD5 8a4267311f0820eb9c44054f5f4ad712
SHA1 181010c1fe3ea7e4a9ebc01967c603498b9d3d45
SHA512 ff20b6da12c4ee384e01145ee3945349061c6dce8b8fb7ee1378aa4a6c24435a5b8874b0fe1257a6ac1ad3e193d31210744a848ec5e92b286faa1ad041b1412d
SSDEEP 12288:MIqzX/7Rs1m5PMIq54d0FyY5H3vhj6bCzmEQ9dQ1hDT:MIq7Os5PMI9C3Z3vpcEsWnT
MD5 SHA1 SHA512 SSDEEP

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 940KB
SHA256 e84c0c6dff60af2c156c2428d9b4fe217034a3fa952b80ed6e0b542b01de2d8c
MD5 4f26f0e7d7b7a6b2fa4079f41bccf9c7
SHA1 3d265496bae009114da9b4bcce2f9baabf3be50e
SHA512 d0400e9480017d77f09b7f7ec689493f56657290305b29287bbc9753df8aa3ef9974a967c2c9ed58bce55a66620b816a3842c8ff365091b074446f77d47bd238
SSDEEP 12288:aOb9A4LWOsvAYFTVqzX/7Rs1m5PMIq54d0FyY5H3vhj6bCzmEQ9dQ1hDT:LpL3UTVq7Os5PMI9C3Z3vpcEsWnT
MD5 SHA1 SHA512 SSDEEP

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 671KB
SHA256 d8352ea2fe5e6e10fcffab8e81a9653d521905811dd691caee8e857a88838069
MD5 9de413b507b6851ec17e7552f7c6ff29
SHA1 b5a4da17774d6303efbc5786966e8edef5116c57
SHA512 1429b2d38478b2c4d3aa4978bb14994919b863b88aeed26e55b9494b5bbfc221f0ea06c936a0d2c3ec45096b06ce1a80fc013c0e0e0fec44e1d10ccd7b593efa
SSDEEP 12288:SpFtpOhqzX/7Rs1m5PMIq54d0FyY5H3vhj6bCzmEQ9dQ1hDT:AOhq7Os5PMI9C3Z3vpcEsWnT
MD5 SHA1 SHA512 SSDEEP

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 b1700d39c1ef46ed54f43e67847d603bca55b53e3ee064c9b9fa005d7bbf0e58
MD5 a9bf21aa5bbea8ea789584a306be9b90
SHA1 a61b4be98e740051deb8d23fc7b2c926b41f8ec1
SHA512 ebe15459653aa00ad094936d220d31bc8a5d5a1f60f2d11b8dd58d985e7fb79114e928518fa5d8ab84d778bfdac16b6b3210d49c6676d99fef8c3400d9aafd45
SSDEEP 24576:x7NM9YmZqmWMUkPjZM48Mv6bEhs8q7Os5PMI9C3Z3vpcEsWnT:x7cBWMpPjN8DbEhf9WPMI9C3Z/2bWnT
MD5 SHA1 SHA512 SSDEEP

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 434c927c1b35b5b33260dc1acdc8e27b5f3f40342c5eaa2633c525946d10e468
MD5 87227a8bf69df25d0fa29239984839b2
SHA1 473e0afc32f067f5c84c17a86c6ca34f9bdc38cd
SHA512 16bf7d345d8bf8d523f54b3ede59a961d1e9b4c68482c53e7a650a911d023503f28fc306ef7c7dc5d9c218c851d0b897a5edc3e2ed5d3969474d575766aae821
SSDEEP 49152:vF2YuHNETovcvNYf8kmc9WPMI9C3Z/2bWnT:26tCf8kh9BIAJubW
MD5 SHA1 SHA512 SSDEEP

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 9106da9b9fd29b5638c443f3c7960da1e7a9db2d6a60d90749917ec486b9c050
MD5 0bef6a9d27e8cf43d0d11f27b4660df3
SHA1 6df265b9da4b676e9b22112b902f3ce608ce4755
SHA512 ae9155da36f817071ce41def84da576c8914de8b0fd280313d104f59ee14bf1a2f42885ae7ee2017ebc1fe06cfadaa855e8f68877d5bbd6edf50df7b334f96cd
SSDEEP 24576:jAFs06+Omlf3NXEbTodq7Os5PMI9C3Z3vpcEsWnT:sFs060lVXuq9WPMI9C3Z/2bWnT
MD5 SHA1 SHA512 SSDEEP

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 885KB
SHA256 ec1986a97b23adc1c2dbc9ba0cc743f93dffe8cbc54a201233a5309914385e90
MD5 a878951e64d0673139ac9b8dd7a0ca79
SHA1 3a5b100e55d35e9ee81a0e04587561c9e0494a62
SHA512 3ca6d5a527ee3220605c223fb29e50de1c14604d2bf739ea0879888410b90f8144f39a0bd5a4724318b897a3e31d00c159b998feecb279c15feb1c35a3445a2b
SSDEEP 12288:/CJnJ5D3VkrlzxcqzX/7Rs1m5PMIq54d0FyY5H3vhj6bCzmEQ9dQ1hDT:6JnJ5D3Wtqq7Os5PMI9C3Z3vpcEsWnT
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 c696eddf0ee32fb1d0f4e798ed75360ae59cde9f51f134abdbaa83cb2522510a
MD5 0c799884600e580bae88a92c54dd7e40
SHA1 32d449f8dd274a96c4a81bd891ddedf5a96faceb
SHA512 b153375b575dca0321641366ace029cd5029c2dcb99e396f93de8b71d3ee0788d3b9ad776a707b881dc54888869007cd776aed6171d19d9ab2f2a314761d4606
SSDEEP 49152:9o06DIKdwc+eQnSt65aVQ9WPMI9C3Z/2bWnT:qO9BIAJubW
MD5 SHA1 SHA512 SSDEEP

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 661KB
SHA256 5978ddfe484273dae812dd5211671fe090ce2261ef8e3340e7fcd095d64d57ed
MD5 358428b0f78574460cadc0e5af21880a
SHA1 45064ffa5eae4b4ad2a0f00e09321f9c5502ad1b
SHA512 8d02e8c1a702bc2d101e46f18fa5157c6f3171aafd517ca468714034a214f872b07a6c7800b54b58265e7e1644b250f6498f97dadd154fd11ee39cda488a0288
SSDEEP 12288:uEP3Rr0qzX/7Rs1m5PMIq54d0FyY5H3vhj6bCzmEQ9dQ1hDT:Nr0q7Os5PMI9C3Z3vpcEsWnT
MD5 SHA1 SHA512 SSDEEP

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 712KB
SHA256 8c5857095a5e01311431836c94657cc6c571a29c56071e4f042329eb8302ab47
MD5 1bbf97e03fea7d55546d92f8a8cb7207
SHA1 33c16ff796c8d9f0c42c8cfd313983a346301df6
SHA512 0deedb9b50400c295662e5bac92f3e639bde9bf98e7e5a301c34704049a69f7826529f3c8a92623bda9b5147103439cc988330110a11b9e7df3ab0787567f0c1
SSDEEP 12288:3jkyPqzX/7Rs1m5PMIq54d0FyY5H3vhj6bCzmEQ9dQ1hDT:3IyPq7Os5PMI9C3Z3vpcEsWnT
MD5 SHA1 SHA512 SSDEEP

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 584KB
SHA256 bfcea98f663373644e5f86239ce1e1ed6195c4f277ea64a4c5bd942b22615ea8
MD5 14189ee43b7d068905ea7f0a13b5b46b
SHA1 dfa3ebbb85e4b13ec4ae716f5182f5da11a52d2e
SHA512 ccef5e4e5055e43644d83e76b60febc898c67edf9e906214de56c9a827e28ba2348f0c9de484c45c61a93eeba6d9d2335e0a3d6d42fd67a717618fbf02ff21b4
SSDEEP 12288:hFxqzX/7Rs1m5PMIq54d0FyY5H3vhj6bCzmEQ9dQ1hDT:nxq7Os5PMI9C3Z3vpcEsWnT
MD5 SHA1 SHA512 SSDEEP

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 791d244baf0ca7d22d483ec2d20908ace585d43895af48f4caa7cbc148721fed
MD5 a0bc5caf1c1134f1c21a806cf8c9adba
SHA1 70c0df978429ac02d07a4fa82ccff4ae0e49342c
SHA512 b13bb1a4be49079cd009348918aef17444c39fe01d277f06d7ab9f64920f92d9086de5767c315a84db15bce246ec9f24a9a9ab266f542ee2f60df1f34ae61620
SSDEEP 24576:IQ9MxZKdcz97w3kq7Os5PMI9C3Z3vpcEsWnT:IVKXk9WPMI9C3Z/2bWnT
MD5 SHA1 SHA512 SSDEEP

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 772KB
SHA256 1ce1645d9c79e795d7e7314afe2fb6f1dbeeeb11822fb372a53173fbe6ab3d05
MD5 26afea963294ca4d3bf8b743c2ee54e9
SHA1 47d01e2167c676a52a595d894cfa38dfe50132f7
SHA512 5850b9ad13cb5bb80ef83ff9212d9840700f5a725e1c4e8627044b472186132be0e2902ee1627eea085b59fe97b0b121158767465d330eca7881a32164cf5b62
SSDEEP 12288:6yoKo2HRple9pbqzX/7Rs1m5PMIq54d0FyY5H3vhj6bCzmEQ9dQ1hDT:6yocxApbq7Os5PMI9C3Z3vpcEsWnT
MD5 SHA1 SHA512 SSDEEP

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 dbafcb70feca85638e1de08a9a86e55bc667a6bd0dd413b88aaaf1e199a50f97
MD5 9bb8c300cdc5747cdeb3c7cc2e602bdd
SHA1 3cc728956a7cf47750d6139628a35332352ccd4f
SHA512 b271f4a5196ad01b7aab3a383d14428a9953198dd14e149bd462a56a8665af7a27b8428846c03d03b00b3ad0814047707a5e23860daa87e177bc354551f11cf8
SSDEEP 49152:aWcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIKb9WPMI9C3Z/2bWnT:c0zuNIH9BIAJubW
MD5 SHA1 SHA512 SSDEEP

Submit Download

office2016setup.exe

Path C:\odt\office2016setup.exe
Size 5.6MB
SHA256 0efb61d3fd0011c5401089bbc0e34433eabab7ac3086937b4d00bde337fe2776
MD5 b4307575e32e7be3b86f52d95bccadc7
SHA1 329d59710f1e21e6e230971bed248c48835c179f
SHA512 3bf50a3ce151637f8b60a867215f5e0fa14abe34b2d458d7e6a2fc21150adb7711543e868a27d86f0ae7e1afd944b0a13b7da9a05ca54b955d7745c00f481d14
SSDEEP 98304:L7M701RgX4iuSl1DtlEq81xZPGnzURnBh6gGL/QmvD/cTwY2h3FJ9BIAJubW:/M7pTXexZPGzURnBh6gGLF+W3lZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/468-365-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/468-427-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/468-356-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/812-255-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/812-247-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/812-248-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/812-315-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/812-254-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/932-335-0x0000000000520000-0x0000000000580000-memory.dmp

Download

memory/932-396-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/932-328-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/932-406-0x0000000000520000-0x0000000000580000-memory.dmp

Download

memory/1036-284-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/1036-273-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/1036-342-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/1036-349-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/1612-415-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/1612-423-0x0000000000B00000-0x0000000000B60000-memory.dmp

Download

memory/1892-300-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/1892-363-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/1892-355-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/1892-289-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/2292-16-0x0000000000600000-0x0000000000660000-memory.dmp

Download

memory/2292-17-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/2292-24-0x0000000000600000-0x0000000000660000-memory.dmp

Download

memory/2292-23-0x0000000000600000-0x0000000000660000-memory.dmp

Download

memory/2292-234-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/2484-29-0x0000000140000000-0x0000000140237000-memory.dmp

Download

memory/2484-30-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/2484-37-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/2484-238-0x0000000140000000-0x0000000140237000-memory.dmp

Download

memory/2556-8-0x00000000021E0000-0x0000000002240000-memory.dmp

Download

memory/2556-12-0x00000000021E0000-0x0000000002240000-memory.dmp

Download

memory/2556-14-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/2556-7-0x00000000021E0000-0x0000000002240000-memory.dmp

Download

memory/2556-0-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/2556-1-0x00000000021E0000-0x0000000002240000-memory.dmp

Download

memory/2708-440-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/2708-380-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/2708-372-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/2976-399-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/2976-412-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/2976-408-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/2976-411-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/3144-63-0x00000000022D0000-0x0000000002330000-memory.dmp

Download

memory/3144-53-0x00000000022D0000-0x0000000002330000-memory.dmp

Download

memory/3144-54-0x0000000140000000-0x00000001400CA000-memory.dmp

Download

memory/3144-68-0x0000000140000000-0x00000001400CA000-memory.dmp

Download

memory/3144-60-0x00000000022D0000-0x0000000002330000-memory.dmp

Download

memory/3244-318-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/3244-383-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/3244-325-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/3484-267-0x0000000000E70000-0x0000000000ED0000-memory.dmp

Download

memory/3484-278-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/3484-280-0x0000000000E70000-0x0000000000ED0000-memory.dmp

Download

memory/3484-260-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/3484-259-0x0000000000E70000-0x0000000000ED0000-memory.dmp

Download

memory/3580-345-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/3580-414-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/3580-352-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3700-443-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/3700-449-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/4020-453-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/4020-385-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/4020-392-0x0000000000680000-0x00000000006E0000-memory.dmp

Download

memory/4032-428-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/4032-437-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/4084-42-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/4084-41-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/4084-49-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/4084-239-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/4200-313-0x0000000000760000-0x00000000007C7000-memory.dmp

Download

memory/4200-304-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/4200-370-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/5104-76-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/5104-242-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/5104-70-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/5104-67-0x00000000007B0000-0x0000000000810000-memory.dmp

Download