3e12bb63131add21f663217b67c05a7d53b41babdd00fae7ab4e8fe3f0a320a7

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
03/04/2024, 09:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-04-03_5ba9af93d5d130f64ac17473f8c5a20a_ryuk.exe
Size 2.1MB
Sample240403-l1la1scc87
SHA256 3e12bb63131add21f663217b67c05a7d53b41babdd00fae7ab4e8fe3f0a320a7
MD5 5ba9af93d5d130f64ac17473f8c5a20a
SHA1 0d55dca12618c19be9ab629133de44f48865b32d
SHA512 caedd2c7e3b181d517b8ee7f5721c1e3557f547ded0687f190e7f03fbe84ea596a20bd7af4c214fb8dfedaa7eabcca53aff1e77168727cb6ec8f4b18a2c229c2
SSDEEP 49152:zsOwbb13ntb+g2nxDv1PZ1LTbXvHs3M9sR:zI13tb+Z3js3/
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
3012	alg.exe
2036	elevation_service.exe
1188	elevation_service.exe
2192	maintenanceservice.exe
1560	OSE.EXE
4660	DiagnosticsHub.StandardCollector.Service.exe
2872	fxssvc.exe
1140	msdtc.exe
3276	PerceptionSimulationService.exe
4892	perfhost.exe
3108	locator.exe
5056	SensorDataService.exe
4072	snmptrap.exe
2444	spectrum.exe
4188	ssh-agent.exe
4024	TieringEngineService.exe
1380	AgentService.exe
4520	vds.exe
1292	vssvc.exe
4428	wbengine.exe
4908	WmiApSrv.exe
784	SearchIndexer.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in System32 directory 24 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\8ab5d4ee46f975ab.bin	alg.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2024-04-03_5ba9af93d5d130f64ac17473f8c5a20a_ryuk.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateSetup.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Install\{6A1BB60F-884E-44C2-837C-FAE44753B873}\chrome_installer.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdate.exe	alg.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_79656\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	alg.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cc0d1de4ad85da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e74bdae3ad85da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000062e615e4ad85da01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008acc9de4ad85da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ab3424e4ad85da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b68413e4ad85da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000453c89e3ad85da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
2036	elevation_service.exe
2036	elevation_service.exe
2036	elevation_service.exe
2036	elevation_service.exe
2036	elevation_service.exe
2036	elevation_service.exe
2036	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
660	Process not Found
660	Process not Found

Suspicious use of AdjustPrivilegeToken 42 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2760	2024-04-03_5ba9af93d5d130f64ac17473f8c5a20a_ryuk.exe
Token: SeDebugPrivilege	3012	alg.exe
Token: SeDebugPrivilege	3012	alg.exe
Token: SeDebugPrivilege	3012	alg.exe
Token: SeTakeOwnershipPrivilege	2036	elevation_service.exe
Token: SeAuditPrivilege	2872	fxssvc.exe
Token: SeRestorePrivilege	4024	TieringEngineService.exe
Token: SeManageVolumePrivilege	4024	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	1380	AgentService.exe
Token: SeBackupPrivilege	1292	vssvc.exe
Token: SeRestorePrivilege	1292	vssvc.exe
Token: SeAuditPrivilege	1292	vssvc.exe
Token: SeBackupPrivilege	4428	wbengine.exe
Token: SeRestorePrivilege	4428	wbengine.exe
Token: SeSecurityPrivilege	4428	wbengine.exe
Token: 33	784	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	784	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	784	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	784	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	784	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	784	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	784	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	784	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	784	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	784	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	784	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	784	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	784	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	784	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	784	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	784	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	784	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	784	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	784	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	784	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	784	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	784	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	784	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	784	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	784	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	784	SearchIndexer.exe
Token: SeDebugPrivilege	2036	elevation_service.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 784 wrote to memory of 1892	784	SearchIndexer.exe	121
PID 784 wrote to memory of 1892	784	SearchIndexer.exe	121
PID 784 wrote to memory of 4712	784	SearchIndexer.exe	122
PID 784 wrote to memory of 4712	784	SearchIndexer.exe	122

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2024-04-03_5ba9af93d5d130f64ac17473f8c5a20a_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-03_5ba9af93d5d130f64ac17473f8c5a20a_ryuk.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:2760

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:3012

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2036

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1188

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2192

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1560

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:4660

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:3432

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2872

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:1140

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3276

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:4892

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:3108

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:5056

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:4072

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2444

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4188

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:4876

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4024

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1380

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:4520

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1292

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4428

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:4908

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:784
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1892
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
  2⤵
  - Modifies data under HKEY_USERS
  PID:4712

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
Size 2.1MB
SHA256 ea2e39b4251a08c46ed4a7b3e187eabd321081a3e359b176a4a81d2ac076c42f
MD5 4accd4548abe7c7253ff3c4cc13c9d2f
SHA1 8f6a30ebb495d28e8aadaf29d4db1feb618d5a32
SHA512 a671bd335b3b1ab6aab6de289d3efb0da3e256a76bb1350b799bd99d107c5ed2c18e42049c7d5431aceda787f9df40d13236dafe4c5fb449558bbf9febee2207
SSDEEP 49152:FuYk3H5koUXfTqkkYLO/W2buywzMbOX+T7z5GvHs3M9sR:FPfTqi90bks3/
MD5 SHA1 SHA512 SSDEEP

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 781KB
SHA256 91d918d861099f6701203656e2e251d7e57de9d3a6dc708a5aeb6bc429b2298f
MD5 bb8fd859e6d1646ced9b79d8c7d9f8be
SHA1 9c1fac700831fa7b8fcfdef7979457717d3ae3df
SHA512 4b7e6a58ad347ba73be377a112196c4a9e3bccd799aac712ebf50f3f17f029ed8c946763589fe0c61a8a4ed67728e515f778c6a72ceb10b2477931f2c0f69a27
SSDEEP 12288:oC0P9Q/Jcuiri1sXYuHa53u4wU0VZAsztwy9IU6FpbOI+Xss:cPsJcuirksIuHa53YUS9wLDFRW
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 7faa06a2b2435f4575e23150abd84355ed4b607f871adfc81b238347077737a3
MD5 40eb298f909c3d8991cf100c2b2858ae
SHA1 df9de12d42405f49761686ea2ec270a86ea24377
SHA512 e0b7d9860ba5c57681da227308d6c25ac1d954c2aa4ebfa0122908dd5ab74a13a878ca963d3ff31e15bb057c930f74653aab2953235b18d655077f657e6c4af1
SSDEEP 12288:i7a3iwbihym2g7XO3LWUHfh4Covi1sXYuHa53u4wU0VZAsztwy9IU6FpbOI+Xs/:r+gkEVfh4CovksIuHa53YUS9wLDFRW
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 52421a2f575849393c924d68c2360c0d346599515498d78397c02db760a3c498
MD5 00e5cdb3cd13c56195ce57e816a70397
SHA1 62ba8f3dc33e188811a73394921965df09d61db3
SHA512 464c886a6da4ddafb188a41ff9c639b83fecd21a01af1c1e9913fb646dc57d8fb8d94e5ecae633909c6288e35f6043662d5a5a42861697440e96afc71383f22a
SSDEEP 24576:2BpDRmi78gkPXlyo0Gxjr6ksIuHa53YUS9wLDFRW:yNRmi78gkPX4o0GxjmvHs3M9sR
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 5b3d1b1de654d2be4ecd0e41f273f546039cd19087764e9638839f8f7acbe1ba
MD5 03378994e942647d5056fb59a1ce77db
SHA1 f7ec0c48ad9672e6c1f51196b591f22487b09127
SHA512 df79cc95853cdaa95bf5c165c5f012ef2706c1dbd2700e99bfc5e9a24ade1b5d611b7ac34753d90b45cf769c8e53eadd8e6250c59c2eb2b98d1f7c5dd7dda9fa
SSDEEP 12288:YfC6Aj+TN5uixZN+8rKhUdTC/wE1MD0Ca5ZIXVvi1sXYuHa53u4wU0VZAsztwy9L:ELOS2oyPIXVvksIuHa53YUS9wLDFRW
MD5 SHA1 SHA512 SSDEEP

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 af8b472089c8b1f53c452aa483e7a20335b279e16dbf8faabc8d7ab501c79e3b
MD5 e77957c6612b491896b8878a9432b000
SHA1 e2c8e441dae20aa3955eb5677804831667eb5edf
SHA512 9abf4f005feff801f9a2f86db22e36ad0d1729ca6899c02e0af10ced9e0af2b2c19c1ebec4f3a18c9cbd9a6723602c2a8645f26814272c23352decfe3a0cff83
SSDEEP 12288:2fhi1sXYuHa53u4wU0VZAsztwy9IU6FpbOI+XsW:2fhksIuHa53YUS9wLDFRW
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 57c3fab817bb2007c82d41f6f870a3a32741bfc54907b65a1e5e04e7fa4cdc4d
MD5 61d4702be4a2c1778453241e7b087418
SHA1 3f9589311e66cee1a70f42df9a4dd97e18c9a839
SHA512 fe010826748f18aa9874df512c285296115fada1eaf5ca8eeea47e2c32839ad05b3293c5d1c59e11330e263c496ad6e7af4ae5c4c6a32c6e2afebc685bc0efab
SSDEEP 12288:NeBNUbTVO86U8i1sXYuHa53u4wU0VZAsztwy9IU6FpbOI+Xs+:NJIU8ksIuHa53YUS9wLDFRW
MD5 SHA1 SHA512 SSDEEP

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 f9b60cde900845e136d351495df29353372e3e63ef5e7c0ef41b0d71952eb2a5
MD5 8970d40788a7cb9a2fbccbb4922d52ff
SHA1 74ad0908616eaa8b2819449344710be019cdc4c3
SHA512 8014d47a1972930f96ea9cbebd5b473a81e322bc8d4efb0442928c024e956ef3443d3a5c4afa31e03f7c52aa8c76fb7b4e0b7ce2b3dc77f17d54e498f9107508
SSDEEP 49152:BQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THn:BQvGAdlCEL8c/yRNw5Cjs3/
MD5 SHA1 SHA512 SSDEEP

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 fb3fd4b2d723420087de9974eb42094c7428bd569ef314d082ff94c24c4a0974
MD5 82263404f3a7ece6f93431a65fbed2b6
SHA1 f689f03b9b19808ddb3d9f9a828bc6b8497660f7
SHA512 6dcfce9ddc58a6ce28c66e0f55b3d323ed2cde894afa73d973c8b9d146584082c180c484b8b14c4b5c9ecfbf4f7d43ff1702b333d6d9eea1e693dc6c6a547bd0
SSDEEP 12288:CAwSfxL/2Dc34DLLmt0LDQewsAjCi1sXYuHa53u4wU0VZAsztwy9IU6FpbOI+XsS:HdewsAjCksIuHa53YUS9wLDFRW
MD5 SHA1 SHA512 SSDEEP

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 96db19c2f7b755bbb82434c97f81a205b0e01210e63aed761eeed98735d34c8b
MD5 bd1b8f9bfd2ecf401c4aeb594dc3e01f
SHA1 5f34913efd54561b4e572dec11e9a3e48fb91b7f
SHA512 53affcaeebff023d36e21dda5632a91efff32fe4050fc9558ec04f469ef19cde6dfb86d16ddd862adf963e1860999b9afe21cb0cddf26c4c2e37b7a9256a1680
SSDEEP 196608:6UEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHM6/:6UEtQevvqc2W1cpV2EI32M
MD5 SHA1 SHA512 SSDEEP

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 707c84b7851cdf576563812001eb126549a965298931b5a8ff8015c9d6c123b9
MD5 0c0370164cc3d51f7e2533bc65b27812
SHA1 0cc5c05cd2b302b9b566491c0b2aabd378dfb26d
SHA512 eba63e9377850a0348debe14b3e315b58e7735883f152340e965276343a0ad04832eea45e49c53b1e9221f21ff41ae5e6e882b86c718ab8f7b8a86d3bbbb872b
SSDEEP 49152:sCbRquA/m2yL5zifFiV+XenmE3/zivHs3M9sR:FoqHVjnm3s3/
MD5 SHA1 SHA512 SSDEEP

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 06909c89575979e974e37133c1ddf4586e966f23f1c2b3129c9ee3deaeb78283
MD5 fe7175d737728657be06ad7010ace69e
SHA1 f8de9a17ea0581dfe0307d4137086ed7f03a1c7f
SHA512 5e10842f7e3cb5517d15c25c16694b10d69b288ffe045934204304cce2852a2aaf746057a148baab999ab4a8187d1808a8f15a39fc6a26c38bde7fa96537c360
SSDEEP 24576:AAhGLJIFoiwtA5l7S53/ksIuHa53YUS9wLDFRW:AAMyFoiq5PvHs3M9sR
MD5 SHA1 SHA512 SSDEEP

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 a15a8b6faee102d822c3939c1c54b54b5c611d07ac95d513653b8750295bfc7c
MD5 444e3f744795d7849fcf7d843aea0003
SHA1 f11b6f3f57c538249eb2370bbb4c2d9eb1a89856
SHA512 090c05055ceed44ae6a0a12442ac40245e5045c03241a6faef9a1c4e16b89f55ab22ccff26683172d22add0b991da42f9ec448d750c4d9ed94e2d78942cfcbaa
SSDEEP 12288:Amw5HEjsChNVBFgl0WDm+Czi1sXYuHa53u4wU0VZAsztwy9IU6FpbOI+Xs2:dwuoOWuksIuHa53YUS9wLDFRW
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 97d54780f9bcf29431fc99458b3684c8ed3de61ec7d589f87855994a69339ae3
MD5 09c765feaae3ec32955a6a13757b8742
SHA1 c221ef7070fc3b88c16c60d2fa9b6bf890cfac47
SHA512 f7c4d3cacf3cd1cfc472a22496ecba5141ee4fbc17756aec66455214cf80ff48e9c9658530c8328aa91928482fe1e51bc6d397ca53fc7dd73b7955868a0aa872
SSDEEP 12288:cBZ1Iyyi1sXYuHa53u4wU0VZAsztwy9IU6FpbOI+XsV:qZuFksIuHa53YUS9wLDFRW
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe
Size 4.8MB
SHA256 9b79354e02a054c95e514d86ea38509301a31d10f5cf186d46b57edbba5d20af
MD5 ebb0659b24679868bb270fa8e934d91f
SHA1 37ae9401aee04597b06ee8ae332b50afa138a977
SHA512 3c0c2048df0b7aa1c97494938978dc1a12e37dfffdf1f0f2fe2f77e9f12534fa74f6367caec844aa780ebb4d0960efaf4680cfd669328a14561f7eada30b36b7
SSDEEP 49152:Oj8f3jtqiCLg9LK2hIOR+k9jdAsizqxSiZ4K5MZqkL92c6nkdmbDfiIerM1R6ZPO:JrZ4K5M+XDfiIewG+x6xZ14Ws3/
MD5 SHA1 SHA512 SSDEEP

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe
Size 4.8MB
SHA256 b506ce998e76c1dee6a323b274020f8a2d753c32e477b7523d3019d14bf641c3
MD5 07b82730871d9e2d710dfa01bbcdf7ec
SHA1 a936f8fe64b8ea9208a55996cd2108b4b7c07f41
SHA512 71f5c8a1ef0f9bd8032a9f326aa64927a261703d17753aa00604f92138dfc14c1ba69b9d203b3e4458cdde7ca712cd002e8aa246a1249e9c8f09a8a0f5c54341
SSDEEP 49152:1j8f3jtqiCLg9LK2hIOR+k9jdAsizqxSiZ4K5MZqkL92c6nkdmbDfiIerM1R6ZPO:OrZ4K5M+XDfiIewG+x6xZ14Ws3/
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe
Size 2.2MB
SHA256 4e48bd574e13a6d118d839355a294db6118b6de59f1fc8dd43cc8deffa990053
MD5 feee22c172dd5a90db92011cf368be48
SHA1 a0f1eac38c322bf566533ad4921de05670097a13
SHA512 f4673644f75f981862645388e67e94cd87eebc57836e096754416b48fd63e6c93acd4e9e6e144e7ab044ad6c4be17724bc9d18122ceb680015925726ebd0f9fe
SSDEEP 49152:RfzabJ8llj+SWWi2mkx+X+di/vHs3M9sR:qui2ys3/
MD5 SHA1 SHA512 SSDEEP

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
Size 2.1MB
SHA256 6c77f93fe680525f2b8944b3469ea9adce10604a515e4683373bd33ec2874343
MD5 17e58603576e2a19b15e6b98f5c56cc3
SHA1 df4e7005b0d517e00a482d97a5cf2d53ce874d10
SHA512 133026af3536467398bade5fe648a663be58ba9ee5a9fb4d22fd7fdabd3d60c25b7ecf5a1cbcbe70dab062d8ba0f9ff79ea9afb00f7572ce2b0642cf6d1707fb
SSDEEP 49152:ka/3xXBSZ4K5MJ1LvTMxbfsYBYSgxu9+fw4TEvHs3M9sR:GZ4K5MJabfsYNbs3/
MD5 SHA1 SHA512 SSDEEP

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe
Size 1.8MB
SHA256 2ccb9e8cb3d198d9f5111f4b3a1f153953d3b307025e73e379bb4fe28e941d88
MD5 210b05add60f2f6fb87fccd48838e156
SHA1 d744821bd1fd195e519018176cdf9278a7da0e76
SHA512 46bfb08e8732ab6ffc5ef92fc23d363520cef6240cbadbb8b24b4950946646369038306b9c6fb2d27303ea3c95489810b042b2566a0a9d4b3ddb6938377e075a
SSDEEP 24576:igNJw85yUKzDu/9gKPlfLO8C49BgK4ksIuHa53YUS9wLDFRW:igNJtUzDu/9gKPxHC4+vHs3M9sR
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 1.5MB
SHA256 068e234c41258ba3696fa0eca7a26082d7695da66c4fee8394882feafbcc8ef7
MD5 5278d863b4eb6ba89cf66fae37267072
SHA1 d8750b359a90a238dea90b4f14f24f20bca5d40c
SHA512 92340895d3789b9ce14b60e6504d495bd73d986765cbbc367e800f348921bf99cbe4e753b444a5eab34b81f2fc5e9b77eb79f67ffc8a011dd804ab2183011642
SSDEEP 49152:DOBynH1wM+v6UJxLQd7BHjdfsvHs3M9sR:Vn4LQd7LWs3/
MD5 SHA1 SHA512 SSDEEP

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 373d5441a63018e9bd5dd13338b6b88c44cba175defc97713ad70d09ec9da914
MD5 e3e49d518f8bb55bb1e56118ea46b113
SHA1 1dc7a24f372e356e21cb03a7551ead9bfa0cb613
SHA512 880a103d02d3485834c51420aecb2c1f23d0a42c516dc752ef4e73909a4427daf5ea41141cb2e6b7102a0faca5b70e41233e32f950ce6514d56a5922c867b28e
SSDEEP 12288:J5i1sXYuHa53u4wU0VZAsztwy9IU6FpbOI+Xsi:J5ksIuHa53YUS9wLDFRW
MD5 SHA1 SHA512 SSDEEP

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 24dbc812869053e02241390fb4fdd76d4b4c2afd325f5c2e5289cb0e622ec165
MD5 aaf46fe35a0aed3d7a150d7d144d9f4e
SHA1 46b233dbb447619e60a0f6b84b992d7ab6db2e2c
SHA512 4ba662d5f9a5ed5c39471bea145ff70527958cd5dbe0724f7eecd97923dc85a7cd7108f7f831cadb6e782b4f16a9780e553129d11796f675dba9a1d453a31ed3
SSDEEP 12288:F2i1sXYuHa53u4wU0VZAsztwy9IU6FpbOI+Xsu:F2ksIuHa53YUS9wLDFRW
MD5 SHA1 SHA512 SSDEEP

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 604008b39125d99159420b8cea945d82a8dd8d5299314f191237f94ded5e47d0
MD5 a295683efa5401106974f02b41d43758
SHA1 c05b98934f8abc7f034e89329b7d2cd44369f658
SHA512 618de71af773791a94b848cd1b60ab3f4d3752b0ec049d4c2132e32570351ed647cc75d5dfa3d003261c6ce654f3ea8ae1fd4a7ecf21734ffc929794e6592140
SSDEEP 12288:O0i1sXYuHa53u4wU0VZAsztwy9IU6FpbOI+Xsu:O0ksIuHa53YUS9wLDFRW
MD5 SHA1 SHA512 SSDEEP

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 3833ce9337af088eac02355847fd94c0a9a3e5e7943100fbf7fd8687add0d986
MD5 7274427f257072662999590a2aeb8064
SHA1 a346358b6afac8fee9b084674c6ac51a7edd4004
SHA512 14a79c26b85e2570fadf5a6101bdcf262e91c75e923f800ec3c18ed66ac23497dbf0a9c0e4985d7d620695d228cbfc1dd264837856acbcd256222f6dca2917cd
SSDEEP 12288:dVfi1sXYuHa53u4wU0VZAsztwy9IU6FpbOI+XsV:3ksIuHa53YUS9wLDFRW
MD5 SHA1 SHA512 SSDEEP

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 e843e70eb257c207dd4a1b4fcebdcbcb4467dec96c1a0d2317fa8e4ce32bcdc7
MD5 5591202917f9155ec02d3d6276edb1e3
SHA1 fd883c72d98f8db36c96f93b6da97364530154b3
SHA512 d54e7d4aa1c58f8f537b3655f5eec1cfec10e96ac93ab5e29d3549c27ee1b81c6c3b2eb87d9a15cf02c76cc78f6d7d419f7941afecf3c2fae7ef663dcc18e4b8
SSDEEP 12288:OHi1sXYuHa53u4wU0VZAsztwy9IU6FpbOI+Xsd:OHksIuHa53YUS9wLDFRW
MD5 SHA1 SHA512 SSDEEP

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 792723358cceee732fdf920e924fb188334291d494925312b596346c929d757a
MD5 7728e6b3f257eb0105838e367168b832
SHA1 1b8544789dd362801d701e4280e58f6ab226cb09
SHA512 9a0505271414963dc0ea56796c1f552461b7001b72e3039e0ec2da150f0d8791c5127e2078ca16aa3cbabb1f1c8a81bccefddb8a011018f4b6bedbf20a519b28
SSDEEP 12288:y6i1sXYuHa53u4wU0VZAsztwy9IU6FpbOI+Xsd:y6ksIuHa53YUS9wLDFRW
MD5 SHA1 SHA512 SSDEEP

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 6fc75322c298a0241c0b842dc1adbc6f226b69527e5e2916f5b65afc72de160c
MD5 bf604bbd1b976905d2e84b9a8df0f383
SHA1 72e364c6511e65509be34076e99704e70972023d
SHA512 0f2e7e112741050bb480b46e37e154a01aebea122c80dce9a55c6494db3ad7471fe701e9208dc9293900608eccc9cdca02f2d6b3698ded3ae43f38ec8caae8ae
SSDEEP 12288:d+i1sXYuHa53u4wU0VZAsztwy9IU6FpbOI+Xsl:d+ksIuHa53YUS9wLDFRW
MD5 SHA1 SHA512 SSDEEP

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 e112976ef67a89b481ba60880a7380695b2586785443855145a3e037107f4bff
MD5 85bd9bf4bcb6dd4ed3c411d9798b8794
SHA1 065b6287ac6afb0a9e31f224b80cd58da57fa250
SHA512 8aad6256bd8643e582c3b134f47aa35f27962e7fc5f04d0ce391d5727d0176ef5d7c61eaa1b9ee6302ea3c53cc91214add9bf462982c6a96006d5cabc76bc113
SSDEEP 12288:NiZwb6zzFEoS2cPvyWi1sXYuHa53u4wU0VZAsztwy9IU6FpbOI+Xsz:QZMSzFVSOWksIuHa53YUS9wLDFRW
MD5 SHA1 SHA512 SSDEEP

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 0eb7083e06c848eb0f0a82bea3d81a0c948743464bd00215acf248614d2051b3
MD5 5909b80921c93a8b746b446fb32421c2
SHA1 7bc9d1b3b600f497d59a9c7ab2183dfad728772b
SHA512 d5c2d8a5eca1a2dcac79ad853f5ea8c8d29c03990e1b72d513fbc5b482e88a12df8d09c306fe90c44404494cd5768ab6bac8147a92ceaac113ed479e328054ea
SSDEEP 12288:x1i1sXYuHa53u4wU0VZAsztwy9IU6FpbOI+Xs2:x1ksIuHa53YUS9wLDFRW
MD5 SHA1 SHA512 SSDEEP

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 7ebd2c4c86b3b6decaac126b947a6f2ba3c6209a45528ae6cc5c0c862ffb9e91
MD5 1a193f4109aec13f4fb4986ee57d7ca4
SHA1 030c0a59d398242708b4e18b671b8ca8ebff91f4
SHA512 5128303bc8b8d616f7d389f2125fa4e373d3854498bf25d7123fcb49209bdf5c7b658967b8d734b8a665eadde641954e04afaf298997b27b8c2b436c2ac1ed86
SSDEEP 12288:CRi1sXYuHa53u4wU0VZAsztwy9IU6FpbOI+Xs2:CRksIuHa53YUS9wLDFRW
MD5 SHA1 SHA512 SSDEEP

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 cf0f8e22eaa199bd269724bfaa758f6b444d047b64af367c20088b1cf28188c4
MD5 6a1f08e24a42d656773b15790c2ad6a6
SHA1 084d9bc2ff781caa11c415c28dbeeab7f68437f8
SHA512 04d7ec9caf14207015db7c00b37c79ca09e61d73a197cb028ae712202c0b2d0f5e6749c266358f9a8f98c3cf04657a661d01bef464db4c6415f734f5e5e9766e
SSDEEP 12288:syPz5L8yi1sXYuHa53u4wU0VZAsztwy9IU6FpbOI+Xsc:1zyyksIuHa53YUS9wLDFRW
MD5 SHA1 SHA512 SSDEEP

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 be6c1eeba403f9884bbf8e00aec440ea1860e1e122f5ca7ad709a7782b9d931e
MD5 def32baddfc4100faae88a8a02e177b6
SHA1 5b7ed672251057dc4cd901f45ea3ccbaac72edc3
SHA512 5c9ebf32cebdc2c7041a186d200eba3d22425e83060840953c6a41280eda5e93d6ec9dc72d4c337d08284dd031b6f9743d7b1a957da6d27997d2ef772aa07cf9
SSDEEP 12288:u1i1sXYuHa53u4wU0VZAsztwy9IU6FpbOI+Xs2:u1ksIuHa53YUS9wLDFRW
MD5 SHA1 SHA512 SSDEEP

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 05be0f902aab1870ad53c33a19bafa35d19aba549cb55f8b4763d8190592c129
MD5 864030e29024e9fec76e995dbf05d8cb
SHA1 b5e27d7a78d423decded72cb534a2a6200820dab
SHA512 5fbebd8bda2cb103804f368845fa870b3a3f7ea0a297437832c5f97d636615226019ed93d5d67bb63d3c150188d5daf221f188999cb97babd9300ce4f7d4db98
SSDEEP 12288:h1i1sXYuHa53u4wU0VZAsztwy9IU6FpbOI+Xs2:h1ksIuHa53YUS9wLDFRW
MD5 SHA1 SHA512 SSDEEP

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 799c0a99858c5a3e0b056fa7e8b98412780f5867d90cb97cc4c7e51c4d0737b1
MD5 909e86ffdd5dbff03d48b15f187d6b80
SHA1 73e13c334439857017e1638f634959e63b9a3c95
SHA512 136fbd8ea35201a0e882277cb3dc1e599fbcae1bba67f25621ed2afba87d9b2547b262c2807907f21b421587f447db3343983f7d3b6266d3342d69ac4f9c669a
SSDEEP 12288:hyPz5L8yi1sXYuHa53u4wU0VZAsztwy9IU6FpbOI+Xsm:wzyyksIuHa53YUS9wLDFRW
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 3696f94fdf1b39b00231fff63f2850532c764a0be9a407336783a193e6b3ee32
MD5 bdd672d1bb87fd73267d8f0e9d2e4889
SHA1 49e15ea1e7fa054463fb63534550e23f5f1b99da
SHA512 d73a84ae11b8e5ea8c13e9840e4e70ae7d54ca4bc27ec99056d212cd3e4846c734ca4ffdc80ab21a6aa516bdc1cc1892a7492234a8ede6ebd61d837b3c6a38d3
SSDEEP 12288:XCd9eWYoaLHF3z0z04PDvhEi1sXYuHa53u4wU0VZAsztwy9IU6FpbOI+Xsu:STHaLl3z0zDEksIuHa53YUS9wLDFRW
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 2ef43bdf2b57f1f2481bd1206373d254e6c277bce7cf39d816b894a599e04d1f
MD5 d6e21eabedbe63dfedd357a8111c141c
SHA1 cf2cc825dd170ffd163caf6b0c9ac3fd7b52ee8b
SHA512 f27c38d24dc2f3fe93ce64af472302d9d31c436ebd748410b5d285d9307012c2ef6eb20ec1d226f568fde9dda0219bf4f348183224e374842c87c1288220d187
SSDEEP 12288:Gi4e7+RdTfgwCHKy7GLbbdIvbi1sXYuHa53u4wU0VZAsztwy9IU6FpbOI+Xs8:G37d9CHKy7GZ4ksIuHa53YUS9wLDFRW
MD5 SHA1 SHA512 SSDEEP

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 61bb0564b55a1267406ca31555ec89b5f06838b9f96ac7956399c3461f815639
MD5 72ec931cf096c5a4dcf5d8085b492a88
SHA1 bff0e19ef45bad0d8057200dd9ade8bb42d2b489
SHA512 49fcf66f04225a414aba6928ed248e57e41ae56b8760a26896f165c022cd7061cb3cf0d4de9988cea6171c3bece3657d1c079524af1166c03a7ff75e81c016f1
SSDEEP 12288:IUi1sXYuHa53u4wU0VZAsztwy9IU6FpbOI+XsM:IUksIuHa53YUS9wLDFRW
MD5 SHA1 SHA512 SSDEEP

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 afb40613406f7f3923b5df2f30b062b26ffbc17ae2b90250dfd33e8027c7ae88
MD5 08b2a0f139a05eaefe620fab0f93e2c4
SHA1 ebe2a6a8550e1ace1136fd7b06f6037c3307caa6
SHA512 1d5ab70f167bcf8a2a8030ea7a79d6af1d2b894238d186b207fe17f501cd0fd7e9f34a4c00d24423405870154184ce9a0a23b490c02f2548e030511980abb092
SSDEEP 12288:FSi1sXYuHa53u4wU0VZAsztwy9IU6FpbOI+Xsb:FSksIuHa53YUS9wLDFRW
MD5 SHA1 SHA512 SSDEEP

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 7b0b900f842e67bcd6c43a63a4ef926b6a9548f2b68c3087fe9f5a46a4023df8
MD5 471d2caa17665ea84f3792009f0691f3
SHA1 2ea15bad6cfa295af7ef09e258f9d4303c2d3c8c
SHA512 bb601f43adbf83d6302e4916ad7ac01f620e7940efea18bf228e1c6833325eb037d96d22ff8e496b6f3bd53536b729ee9b2e065f3ceb5bbab29739c67e7a6d52
SSDEEP 12288:Hbi1sXYuHa53u4wU0VZAsztwy9IU6FpbOI+Xs3:HbksIuHa53YUS9wLDFRW
MD5 SHA1 SHA512 SSDEEP

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 94e6b5609b4b282e1a788f8a11d0af237e21f6c64b715dfdbc72985ceead2a8d
MD5 f27f3ac208f6f65af89d9b143c796399
SHA1 8d902d275550711b0bbbe65bf42948f021171baf
SHA512 92a28fa7d98ee1940df547e97fa62d58171a1a3ac8d4252c5a773f49bd830b7a7c4d0e71017b7b6b9f14a7b6afca1543053b501b493f864cdb0a941a4da8094c
SSDEEP 12288:F1i1sXYuHa53u4wU0VZAsztwy9IU6FpbOI+Xs3:F1ksIuHa53YUS9wLDFRW
MD5 SHA1 SHA512 SSDEEP

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 88e563d518e45e39c91599f2e2afce2abe17f8ea58657995106d7a2d8eb291ab
MD5 f017ad49c7884fcefab0cd863a4361fe
SHA1 089d7b7ab86b29d805da50bd9180ee0fc970a5be
SHA512 edc865c835acb08a2ed2606cf17cd627bcd9e235fc04b5ba9e3a7c5193fd5894e8ab01de2f4da472bdcb8df20dd93d8ce990b641d1fc8b01930eb29c29e5d0fb
SSDEEP 12288:jUi1sXYuHa53u4wU0VZAsztwy9IU6FpbOI+XsD:jUksIuHa53YUS9wLDFRW
MD5 SHA1 SHA512 SSDEEP

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 4408e8d82f56b22e42cdf7de6b9b08f3b055ba21c3fd5e5b6bd36b7baaf6b502
MD5 a13455a5366811d0cefab4f660ef3d72
SHA1 00f575b4eb5cfc840e08dd861cf3c330689a8114
SHA512 cc67f75733423cf4dd8a926735a9063e4194cd461c1215512d35b518e4bfc19af936aa49d5bb5b993ec33b6b8d22a901aa9ba0d3037d9fb0b4fb9dee95a1cf79
SSDEEP 12288:p9i1sXYuHa53u4wU0VZAsztwy9IU6FpbOI+Xs3:p9ksIuHa53YUS9wLDFRW
MD5 SHA1 SHA512 SSDEEP

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 696KB
SHA256 0f43e607a933b474769a593e7fee4459bded8bc38e1e0d364dcc143e9bcc7c46
MD5 50861f47e7be2a9b91d2f4004d2f2e1e
SHA1 9f50eac395887452857ae685267e0ea467e639eb
SHA512 34e14a9a6b2f4e0c83f25d339db6b73c711ffa7f7e1a3cb108d2ce4e07b44e02460e5aca0337dbe619879e80b311d95405468b9288f44b4d500a49ff461add3a
SSDEEP 12288:NFYq0SKi1sXYuHa53u4wU0VZAsztwy9IU6FpbOI+Xs7:NgSKksIuHa53YUS9wLDFRW
MD5 SHA1 SHA512 SSDEEP

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 eb3065958f88b61b1ecea66f970f0d310c1026afea723d9b323b5ce619df39c4
MD5 525a7a4eb2fd59d511f64433a768d0fe
SHA1 62a52ba899bf04e8fb5d746a6e8ebea6d1e9498d
SHA512 1744c801634abf66dcca48f1ce5eb36f15d93bcb61054ec380f9a69dd9f32913cab9e8738a2964c314e2939aee4b54c4014674e0ca57aef241fd49a5202152ce
SSDEEP 12288:P1i1sXYuHa53u4wU0VZAsztwy9IU6FpbOI+XsO:P1ksIuHa53YUS9wLDFRW
MD5 SHA1 SHA512 SSDEEP

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 a37e35de6a69bbd301db7d82e401762fd87d3ad561b0208f105e7675b928afc6
MD5 f78089a7279dc3fba059ebe245c76d31
SHA1 ec927374d614f331c6b988cfe9a5b52ee5902497
SHA512 80917774e6d11527e7f4a8ee68aa3e5effd579f0e3b7f26bd1f79c87ccb066e840c1fb98d186adceb22db8edbda35f16ace27e9bcd79205013af515fce3edccc
SSDEEP 49152:pa0h2GEkuAe73q3pp46zwwQPvHs3M9sR:pa0hNYG4Jwws3/
MD5 SHA1 SHA512 SSDEEP

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 659KB
SHA256 0644e41456fa7dd44998b4ef61dee66f12419974b268d74cbc03ec40198cc116
MD5 8922eed7fd248653d1eb538806492e19
SHA1 21bf2a78de966b7a6b3cbb2fb8695441d2671137
SHA512 8ab1c50237e5eef5c8e9bb18cdfb6d3fcf7abc79605c590769f9d1b9d87e3cb24eb4a5777c07904848e20eca9b901d2795dcce17a8e241bd03b357c8459c1461
SSDEEP 12288:ohbHjfXKi1sXYuHa53u4wU0VZAsztwy9IU6FpbOI+Xsd:ohbHjPKksIuHa53YUS9wLDFRW
MD5 SHA1 SHA512 SSDEEP

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 9cf9be08ed032ee9364ff9434994ce6bf8dd7949a699dde57f0d5f9bd8402828
MD5 c53be60428de9f75617dbeadd97eaf01
SHA1 e55288632f7630265ebb7ffb4d999631b34c460a
SHA512 60610c817b6f135cd4bf4c92c8db24959cc7879a59a35fa6b2f44ba016bf67826d3c5e55a60b279b263e9c9d0000b4a9ebd90a1c68dac680653b15aa59df1d01
SSDEEP 24576:K3YgnJcRTk4yti+R5dpR/iksIuHa53YUS9wLDFRW:KIgnaTk46ppR/ivHs3M9sR
MD5 SHA1 SHA512 SSDEEP

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 578KB
SHA256 675d0f36dd4cdd6b8c30733efce9dc1d6bb8b757f290f530515fd2a651bfaa8e
MD5 9bf7430fd8e57237a72baa6c0353ddb3
SHA1 86babb2e06e05229f673268424c3f2911d8e5e12
SHA512 336d2fa87efe29e30c53a0984c227fa4d73c5e3fb80afa0390c2c098de0357c1073d5438fbd81a9758c3fd23235586337842830f6ca5761f25551e626168bd85
SSDEEP 12288:Spi1sXYuHa53u4wU0VZAsztwy9IU6FpbOI+Xs/:SpksIuHa53YUS9wLDFRW
MD5 SHA1 SHA512 SSDEEP

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 940KB
SHA256 406ba77bebfdad2b13be0ec82209fb6b0d3afa9b1d4c48417b713def3c410f54
MD5 314610200d95805ecfb9013cce31cbc6
SHA1 c154b65e1cd310190ce74340cfda06600bc91ab6
SHA512 7babf2947017ebc94ded6dc4b40cf05a00ad75b1b21dd5969b928c83edeee6344d7d25c24ba1a69fee60356645c9b9d21592fcbaa76357ade23eddadf48fd4d2
SSDEEP 12288:cOb9A4LWOsvAYFT0i1sXYuHa53u4wU0VZAsztwy9IU6FpbOI+XsA:BpL3UT0ksIuHa53YUS9wLDFRW
MD5 SHA1 SHA512 SSDEEP

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 671KB
SHA256 7efd14df469345905334c45dc6045e4ad59611e1b5b2f821d96122a4181ec630
MD5 e0dc397a0baec9674ffaaaeb4e1de0a2
SHA1 4ce4698413e5e2b92d45987f2980f37b56cb60ef
SHA512 95ec0e7675040d52d2ad05def4f4530ad3f94accf910f61f5d4a22cceebd36b128b242178a367885696bb4af011ddd3027f069384c395cfc1c24a4c5b73c7815
SSDEEP 12288:7pFtpOYi1sXYuHa53u4wU0VZAsztwy9IU6FpbOI+XsD:HOYksIuHa53YUS9wLDFRW
MD5 SHA1 SHA512 SSDEEP

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 146d6ea8d7df9e3c1299c463c731f22a3c765781934c9aadc2a0b8ee8fe28866
MD5 21b28d7307783c31591f996edfe033d2
SHA1 e8da5acb140b311f87df77ac0d69ce3e4e8c831d
SHA512 41fc15ea3126c82fe4f230634abc91bc234789ff690052bb13dfc713e5c586c72c2d1fd467ca925f71859250bc8c37b3dc539eeab30668b99d89bb3590077efd
SSDEEP 24576:c7NM9YmZqmWMUkPjZM48Mv6bEhslksIuHa53YUS9wLDFRW:c7cBWMpPjN8DbEhqvHs3M9sR
MD5 SHA1 SHA512 SSDEEP

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 47190d14aca28c4116039225f059638a2ab94c654487efa224c99538e90ffc8c
MD5 1e4f826858344314e3f885d9153b5b1f
SHA1 f08e948df97002b53f32853395edde296800c5b8
SHA512 6e2014a26cda33649d57c5ac0cbee3c5f56af8c11f95b8bd27fab355fc73f8e3ebed6f19e3b30357175fcf81c076c921372cf76e9ca0ab2478df3295a0625830
SSDEEP 24576:uW6BApg2YuyuNDYTabvcRvNYf8km1bksIuHa53YUS9wLDFRW:uF2YuHNETovcvNYf8kmFvHs3M9sR
MD5 SHA1 SHA512 SSDEEP

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 c23c6b8a357478653f48cdc13911f55af641887737e2103c5948c6e065ed9f6c
MD5 e5c1db4174644e4264f1696e384042f0
SHA1 2bcff54e6ad1efde708447b7fa4c0395259e0fb4
SHA512 8189b406fc9d7860650a6e6bbb07305f0e9e381ba489b937e7c1dc480b3d9fdfcd6a481304ddc8072cb0300d790a2189ea4b09ea0625fcbfee3cdcd9bbf1f669
SSDEEP 24576:RAFs06+Omlf3NXEbTo8ksIuHa53YUS9wLDFRW:mFs060lVXuvvHs3M9sR
MD5 SHA1 SHA512 SSDEEP

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 885KB
SHA256 7e509f0a839807471491d7c5baeb99d5dc890308a78b4afee86556b5d4f4f9e2
MD5 a68b8dcf8df897aee8d57601fb973f22
SHA1 cf78f172b26405d33ce5c0a69c71ad0d46999fed
SHA512 cdfb5ad6952661f5a58a987e00dbcf12258789fe6e85dbf12c8550ec177885830ec889dff3e612b3dfeff91c4037e4e4fa20144dd9a56e2c4604268b05703774
SSDEEP 12288:TCJnJ5D3VkrlzxFi1sXYuHa53u4wU0VZAsztwy9IU6FpbOI+XsC:uJnJ5D3WtvksIuHa53YUS9wLDFRW
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 8f821863491396cc9297c76bdf0400ad98243911fe4e3cb3398a59982d656ca3
MD5 429614778533d05849c4b6aad8bda86e
SHA1 7b2167470fc02bb46aad888eb371726b9ac6a135
SHA512 1c886fecd4dd62e682cc4521ba5771ff6208aded34e38e2ef88e314a032396ea2332e07286b4317b3db780c14054ebab91bacf69645dfb130682466c027c73d5
SSDEEP 24576:mEPohm6/7IIXdwcXrif7qQncjlP65i3VuiksIuHa53YUS9wLDFRW:ho06DIKdwc+eQnSt65aVRvHs3M9sR
MD5 SHA1 SHA512 SSDEEP

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 661KB
SHA256 bfd5e791f2fe6ae0a063746553ab8a794505bde73a1a02bf8b95da678dc69f92
MD5 c28f4e95d594c7887f9b563c222375ec
SHA1 358c11891e04f33626cd8ecfbfe0a38e22144f73
SHA512 dacf226d9a73f3274198983c07ebb62c2e523105995fb11915bb109849a2e37f0002820052c6ee613d5582d201f345b6011f60495686739d391adb54de18611f
SSDEEP 12288:jEP3Rrai1sXYuHa53u4wU0VZAsztwy9IU6FpbOI+XsB:oraksIuHa53YUS9wLDFRW
MD5 SHA1 SHA512 SSDEEP

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 712KB
SHA256 d56b8eed0b952a627ad88ac8753d9d5ff6f1d8d9b338d327263fdffc13a4f32f
MD5 bd20e1838f830b92f4fc5c5ccc6807cd
SHA1 2096e3814e53485d257edaed23e8229eb647e2d1
SHA512 705e0dfbf4c6ff307ff800228b4cd9e952cb7a020ab755d15727fc45cbddeaedf861ec2c470915ee74b9a37f500b5a90907a2607dac774e9c464ed6645295486
SSDEEP 12288:Bjkyai1sXYuHa53u4wU0VZAsztwy9IU6FpbOI+Xsp:BIyaksIuHa53YUS9wLDFRW
MD5 SHA1 SHA512 SSDEEP

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 584KB
SHA256 d496c7d3015166e8cda101bb483d5fbb2e1acef54c3cb1b380337b4d4cd937b5
MD5 82b22d65ae67f53a0fa6f90868e367fd
SHA1 9934d37be16b395393851bc1d6246805581c3cb9
SHA512 9a3f0da443244ffe23f932c1f914866b9cee962b9309dc14ca1c320d7dc7a54fb985431d75edbba18f4ba821ce2062a00c92915580ddbe8d1a2958f5ff20b6d0
SSDEEP 12288:+Foi1sXYuHa53u4wU0VZAsztwy9IU6FpbOI+Xs1:soksIuHa53YUS9wLDFRW
MD5 SHA1 SHA512 SSDEEP

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 6924113bdb360781f46e2c79375ad2b8d106bef192c633b215c93dacc830cbb1
MD5 6891a2431ca8f986af473cc6e79eadf4
SHA1 2bb625f0d15b0fa83fd9681cc9741a44dfff6651
SHA512 014a6859ea68a62d6453f4af26ba0c9a6baea3db3a564d4cd4f9f9463c6d196fc35cf82f72efc542bf80761bc6bcd05e3fb7fb9571aa8f517eac4ac7641a7694
SSDEEP 24576:/Q9MxZKdcz97w3NksIuHa53YUS9wLDFRW:/VKXNvHs3M9sR
MD5 SHA1 SHA512 SSDEEP

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 772KB
SHA256 6d6945f8733c8bdf7b5200829f07c7235e716a29a46dbc7b1e75bb9b57a9a186
MD5 9ee6ba0bb1e966f009dd2d831292bbba
SHA1 e6a9f1585ebed46152cf701975e25444a12cb03b
SHA512 10cb22947dd7ac1ed4cf64cbb2994cb7834ee6facfac1f6ddfe2410af639a93020595c3ac7302e305aa2f11b73018c6943b9df72b69062a387ea3d0402850188
SSDEEP 12288:9yoKo2HRple9pui1sXYuHa53u4wU0VZAsztwy9IU6FpbOI+Xsk:9yocxApuksIuHa53YUS9wLDFRW
MD5 SHA1 SHA512 SSDEEP

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 c684edda404d7d39c1ec34cfa0d171824d13ce256dc07305849de525253a0874
MD5 1b279e4b832c17572067a5225b6209d3
SHA1 765b6ccf9e296e893e7697a3ac63cd700fbdbe81
SHA512 b2c0bb207a92373aa304d0447c8c7728ea8ce86db6162a071f2331c6007d270750f061200f874ee0ad1141dde35a3d2bdd93c46c228226293667e61bb5b570f6
SSDEEP 49152:kWcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIKuvHs3M9sR:O0zuNIUs3/
MD5 SHA1 SHA512 SSDEEP

Submit Download

office2016setup.exe

Path C:\odt\office2016setup.exe
Size 5.6MB
SHA256 0b3da40df7cf9ef7de5c6840ae7cba3e79d9c635a9a68a35a4fb732070d37189
MD5 465f1ed10683901ba4ab6216c011aee6
SHA1 7404cc459079a41c7ef8a70b8d014d04a90d6d4c
SHA512 ed262600892c726e5f4d8b28af68d41a1dcd9fbd594fa2fda333d76f4df03a507cf7c3aece4ad66ddd1791fdd0e23a06c227e762c94d6b3951908bdcffbd1a01
SSDEEP 98304:c7M701RgX4iuSl1DtlEq81xZPGnzURnBh6gGL/QmvD/cTwY2h3FYs3/:WM7pTXexZPGzURnBh6gGLF+W3e6/
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/784-470-0x0000000000850000-0x00000000008B0000-memory.dmp

Download

memory/784-461-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/1140-337-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/1140-280-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/1140-270-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/1188-40-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/1188-47-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/1188-236-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/1188-41-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/1292-422-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/1292-431-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/1380-406-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/1380-405-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/1380-400-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/1380-391-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/1560-66-0x0000000000410000-0x0000000000470000-memory.dmp

Download

memory/1560-68-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/1560-73-0x0000000000410000-0x0000000000470000-memory.dmp

Download

memory/1560-239-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/2036-235-0x0000000140000000-0x0000000140237000-memory.dmp

Download

memory/2036-35-0x0000000000A00000-0x0000000000A60000-memory.dmp

Download

memory/2036-36-0x0000000000A00000-0x0000000000A60000-memory.dmp

Download

memory/2036-29-0x0000000140000000-0x0000000140237000-memory.dmp

Download

memory/2036-28-0x0000000000A00000-0x0000000000A60000-memory.dmp

Download

memory/2192-58-0x0000000001A60000-0x0000000001AC0000-memory.dmp

Download

memory/2192-52-0x0000000140000000-0x00000001400CA000-memory.dmp

Download

memory/2192-51-0x0000000001A60000-0x0000000001AC0000-memory.dmp

Download

memory/2192-62-0x0000000001A60000-0x0000000001AC0000-memory.dmp

Download

memory/2192-64-0x0000000140000000-0x00000001400CA000-memory.dmp

Download

memory/2444-421-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/2444-359-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/2444-353-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/2760-0-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/2760-2-0x0000000140000000-0x0000000140235000-memory.dmp

Download

memory/2760-12-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/2760-15-0x0000000140000000-0x0000000140235000-memory.dmp

Download

memory/2760-8-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/2872-255-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/2872-274-0x0000000000520000-0x0000000000580000-memory.dmp

Download

memory/2872-271-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/2872-263-0x0000000000520000-0x0000000000580000-memory.dmp

Download

memory/2872-256-0x0000000000520000-0x0000000000580000-memory.dmp

Download

memory/3012-231-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/3012-16-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/3012-17-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/3012-23-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/3108-377-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/3108-314-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/3108-321-0x0000000000600000-0x0000000000660000-memory.dmp

Download

memory/3276-287-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/3276-296-0x0000000000670000-0x00000000006D0000-memory.dmp

Download

memory/3276-350-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/4024-386-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/4024-447-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/4024-378-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/4072-408-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/4072-347-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/4072-340-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/4188-434-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/4188-374-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/4188-366-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/4428-437-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4428-443-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/4520-410-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4520-417-0x0000000000B00000-0x0000000000B60000-memory.dmp

Download

memory/4520-548-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4660-245-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/4660-244-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/4660-251-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/4660-311-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/4712-549-0x0000027A00E00000-0x0000027A00E10000-memory.dmp

Download

memory/4892-364-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/4892-300-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/4892-308-0x0000000000710000-0x0000000000777000-memory.dmp

Download

memory/4908-448-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/4908-457-0x00000000004D0000-0x0000000000530000-memory.dmp

Download

memory/5056-324-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/5056-331-0x00000000005D0000-0x0000000000630000-memory.dmp

Download

memory/5056-398-0x00000000005D0000-0x0000000000630000-memory.dmp

Download

memory/5056-390-0x0000000140000000-0x00000001401D7000-memory.dmp

Download