1c406bbefd3f09a1683e603bf0447fca6ef94895cf255059c8cf42e4081c173e

Analysis

max time kernel
149s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240319-en
resource tags

arch:x64arch:x86image:win10v2004-20240319-enlocale:en-usos:windows10-2004-x64system
submitted
03/04/2024, 09:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-04-03_2c3015edc65915e3c2f8f2a4c4c77429_ryuk.exe
Size 2.2MB
Sample240403-lvtp7scc43
SHA256 1c406bbefd3f09a1683e603bf0447fca6ef94895cf255059c8cf42e4081c173e
MD5 2c3015edc65915e3c2f8f2a4c4c77429
SHA1 4e22c6661d73a154e7148a3a42f6469e8725e1b9
SHA512 ac36a1b0080bfbfe2d341a8fce1c911d7653397cbd07280f1af3f0ef467342f7ca389fb07c688dee57987ac534baa45c25edf3d50b6992345652f556ea7b1e5d
SSDEEP 49152:aWWu1zKeIxNj2bchBluP3GiyBKDwgDUYmvFur31yAipQCtXxc0H:aWBMNj3Zo1U7dG1yfpVBlH
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
1432	alg.exe
4776	elevation_service.exe
2208	elevation_service.exe
3780	maintenanceservice.exe
1408	OSE.EXE
2000	DiagnosticsHub.StandardCollector.Service.exe
3872	fxssvc.exe
1692	msdtc.exe
2960	PerceptionSimulationService.exe
3380	perfhost.exe
4284	locator.exe
5012	SensorDataService.exe
1396	snmptrap.exe
2104	spectrum.exe
672	ssh-agent.exe
420	TieringEngineService.exe
3980	AgentService.exe
856	vds.exe
4908	vssvc.exe
5224	wbengine.exe
5332	WmiApSrv.exe
5444	SearchIndexer.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in System32 directory 24 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\6668e5094ab059c5.bin	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2024-04-03_2c3015edc65915e3c2f8f2a4c4c77429_ryuk.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_135953\javaw.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Install\{E620FD1D-1243-4CA9-AB2B-6C02435E0E01}\chrome_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\106.0.5249.119\chrome_installer.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\minidump-analyzer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Install\{E620FD1D-1243-4CA9-AB2B-6C02435E0E01}\chrome_installer.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	alg.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000845b2cc7ac85da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007e49dbc6ac85da01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f7bff0c6ac85da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000697947c6ac85da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9923 = "Windows Media playlist"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000062acfcc6ac85da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000666761c9ac85da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000062ff8ec6ac85da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009bb3ccc9ac85da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004e8a5ac6ac85da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
4776	elevation_service.exe
4776	elevation_service.exe
4776	elevation_service.exe
4776	elevation_service.exe
4776	elevation_service.exe
4776	elevation_service.exe
4776	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
676	Process not Found
676	Process not Found

Suspicious use of AdjustPrivilegeToken 42 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2748	2024-04-03_2c3015edc65915e3c2f8f2a4c4c77429_ryuk.exe
Token: SeDebugPrivilege	1432	alg.exe
Token: SeDebugPrivilege	1432	alg.exe
Token: SeDebugPrivilege	1432	alg.exe
Token: SeTakeOwnershipPrivilege	4776	elevation_service.exe
Token: SeAuditPrivilege	3872	fxssvc.exe
Token: SeRestorePrivilege	420	TieringEngineService.exe
Token: SeManageVolumePrivilege	420	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	3980	AgentService.exe
Token: SeBackupPrivilege	4908	vssvc.exe
Token: SeRestorePrivilege	4908	vssvc.exe
Token: SeAuditPrivilege	4908	vssvc.exe
Token: SeBackupPrivilege	5224	wbengine.exe
Token: SeRestorePrivilege	5224	wbengine.exe
Token: SeSecurityPrivilege	5224	wbengine.exe
Token: 33	5444	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5444	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5444	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5444	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5444	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5444	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5444	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5444	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5444	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5444	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5444	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5444	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5444	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5444	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5444	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5444	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5444	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5444	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5444	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5444	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5444	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5444	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5444	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5444	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5444	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5444	SearchIndexer.exe
Token: SeDebugPrivilege	4776	elevation_service.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 5444 wrote to memory of 5992	5444	SearchIndexer.exe	134
PID 5444 wrote to memory of 5992	5444	SearchIndexer.exe	134
PID 5444 wrote to memory of 6016	5444	SearchIndexer.exe	135
PID 5444 wrote to memory of 6016	5444	SearchIndexer.exe	135

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2024-04-03_2c3015edc65915e3c2f8f2a4c4c77429_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-03_2c3015edc65915e3c2f8f2a4c4c77429_ryuk.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:2748

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:1432

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4776

C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.92\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.92\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2208

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3780

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1408

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4092 --field-trial-handle=2292,i,2927097380497635931,2014459809064723663,262144 --variations-seed-version /prefetch:8
1⤵
PID:3392

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:2000

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:1732

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3872

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:1692

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2960

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:3380

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4284

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:5012

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:1396

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2104

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:672

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:2724

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:420

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3980

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:856

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4908

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5224

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:5332

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5444
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5992
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
  2⤵
  - Modifies data under HKEY_USERS
  PID:6016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.92\elevation_service.exe
Size 2.2MB
SHA256 ea707df8288fae6063c2635b5527eb7eacad3b294b7030c02e583672b97f597f
MD5 7a954fbde02abf1db7bc5789fbbb848b
SHA1 63d4bb4edabdde3f54d5acccaf6cf2b68ecc387d
SHA512 d78548341300591800100df45320f53db197d41b387baea18e7aeea98ae287c79c3b1aaa8862c137c41414e97c5aa45e232c3b0f3f742fd121001880159ffcaa
SSDEEP 49152:jWWu1zKeIxNj2bchBluP3GiyBKDzgDUYmvFur31yAipQCtXxc0H:jWBMNj3ZoKU7dG1yfpVBlH
MD5 SHA1 SHA512 SSDEEP

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 781KB
SHA256 15bf06b8c350d238a5a1c6e3459e75bc9f06e645d175fe56fcae71d9bf9f4864
MD5 2c484d424da70913c08a3ff2c08f3827
SHA1 15192762c44566f2639021aec4262c3567d683df
SHA512 e2d94352766f99f1a429c2fa8f92b4f73ebe49c7f2559a13de7d18d1b1a82424efa06caee55c0a9a372a894c1c5fa97f0abf014a3f8085de08d32c5f253200c2
SSDEEP 24576:LPsJcuil8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:LwcuEgDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 50a4901a4bf8246889d9e4386e759c29f04d0568174b176f8e525c308c71db5b
MD5 010833b1f661164fb90855b21e4faa54
SHA1 5a749e26c42043a6957a0c1042abe4ad8b229b0d
SHA512 7b29506a922de1f80146ac556b036bcc701af68efa711b7a10587acc2d6d52e0fbc0494f1a4c7b44014c9d492cec938ca6d6ddd3f5f107bc911c93d01603d814
SSDEEP 24576:n+gkEVfh4Cox8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:+gkExS7gDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 c8621f422f19e0bf723d1504260a10a735e49831307be33fecae4cf7c2490c7e
MD5 1f0c63f413584ca3c1ec9934dbbffe3a
SHA1 15dd0d793feada56ef47292a4cdc04c6b067dc38
SHA512 8c63e6a152fe7faef901a1464dd77a52a1d68d927655eaec23dcdb47db49586dcb736510019965008f4cb5c6fad19d51e92bad333375908952662076b27973a3
SSDEEP 24576:GBpDRmi78gkPXlyo0Gxjrc8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:iNRmi78gkPX4o0GxjggDUYmvFur31yA6
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 7d5451acc103ae7dc1e550937c05834939399a9abd10a7dfe84958f5bd9ef450
MD5 15584156d4295c4ef17a67693e1f4419
SHA1 7030f742b5305ab79374295f9ac98be9e4968cb3
SHA512 dbbee1210197418368086cef2ee1068f385246e7ac16ccf0ddae08ef7646dd11210f49232c35e4a187d78d5c5f82d113a9ba93bdb64b480b2bab8ceffdcb142f
SSDEEP 24576:kLOS2oyPIXVx8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:8/yogDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 141f1b73592334a7400703aff87e9480ea91fb36b52a393d3fc545534229b0a0
MD5 8943bebd964639fd71be682d86f0f552
SHA1 d867d15d82df64ce7e605cfc9dcbbdaea762872e
SHA512 c5583727859825b027eb9fddc47b2cd74c8d62141121d60c0322324941640a1e22b2dd9c3cc4df28b1bc9cc9c9d05774b3d80c5f4beed73a953a5ad6404bc2e1
SSDEEP 12288:/fbFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:/fb8NDFKYmKOF0zr31JwAlcR3QC0OXxx
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 dc941071e444273e5924c9bde7bdb2961cfc031ddc21c96df1853ed534cc6f7e
MD5 df3014d3d4c821f04634c63a68b5e1af
SHA1 3b059a14f4942a0f3bb0e04082c4986c988ee13c
SHA512 ed9ccae0b1a99767fc6b46cf70df3e087a9f50fa9f3dd50268e691223ace1e214a95f52377bcd013e55d48c0dd89ed7720d6e164c4f66f5332514f1b3bc77ed0
SSDEEP 24576:zJIU+8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:zJIU+gDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 85284c42e5edf58766e87d7f5f0492657b68c7ea46ae498c86c8ae5230d1f82d
MD5 1c4de713f7bf39d150cc39f23a3c6d3d
SHA1 84b06c41279fe3665ec912f5735863aceec4de25
SHA512 fbc6048a15b91e1ceb5c67f62fd4502ae0a802f350d90d1733e96a021dff8fba885b99e92e49720d7aaccfcbf4a641794560860c94e12a107dd13df73c3a7d7e
SSDEEP 98304:uQvGAdlCEL8c/yRNw5CsU7dG1yfpVBlH:/vyEYc/y3w8sUoiPBx
MD5 SHA1 SHA512 SSDEEP

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 badcba6944cc3ba68bae0f57d0011dfc6fb3c812a3e17218743373e1aed779b9
MD5 e1a559a4e4b68402a2b8ec26827692f7
SHA1 9209ee17bc513b873fd7d19ee571a7a5c0759fed
SHA512 94c6bd147f06b5249f2cd87ce2d66624c14b9b6f2f5fc0e9ca5de8631b82168e99e9b0ba6ce6fdda4eaf0137fd35c0269ab0e230d55b61ca0bcf29967bff9d08
SSDEEP 24576:fdewsAjE8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:FljEgDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 5e93eafa957092f6bf34ae0a124fa908949fc17f08f48a4fbbfe2a2f4fc47131
MD5 53eed22fbeb99d76264414375741270d
SHA1 7199f7743db22b5e3580a7ca36198476cf8451f8
SHA512 62d1d92167fb2a31f20b21957f693cdca8a220311396932865177eea388fceb15c7df9c12fcc302ad097191a5cc6484b5d5a673d48563daeafd0ead87caa29cf
SSDEEP 196608:YUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHtUoiPBx:YUEtQevvqc2W1cpV2EI32t
MD5 SHA1 SHA512 SSDEEP

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 857b866fcc5c03d96290509b0574b9e80e6a9b06a37ce05ae29bbfae1fad56bd
MD5 660ee8dca850f01d8879259587064e21
SHA1 a92450d678f464ee258dec98b076f598ba97ea6f
SHA512 561708e6bb357919aa1e9daa3e30a894f76c83d7d066ededa8da4979a508928b99cc1cef330a10504123b17d54f9143773e5d56ad39cadaba329e40b45821974
SSDEEP 49152:vCbRquA/m2yL5zifFiV+XenmE3/zkgDUYmvFur31yAipQCtXxc0H:ooqHVjnmoU7dG1yfpVBlH
MD5 SHA1 SHA512 SSDEEP

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 8a2f820ba59409209353466e357a40f721a3486e3d126ab675290a20d32dd525
MD5 f18aaccd8c470b43c0dd67f2b11bd462
SHA1 dd99b09a80f08ab97a7897f95ff69a53f07198e5
SHA512 132803aa937fa14e2d7ecbc12c44ae64da55fdb52d5685ca98266789de0cab3ad4d07069debbb50ad830de63a66de577b9fe3472b4c6f5edc101a4c62e6f470a
SSDEEP 24576:3AhGLJIFoiwtA5l7S53B8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:3AMyFoiq5RgDUYmvFur31yAipQCtXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 ed0bb0c228808d96108a1f72ab8a505f6eba5be26a0f00720f6eb7dd902033bc
MD5 afb14dde5e37f8305ecda215ce8c05b0
SHA1 6220a33557f4e2f2d8c9cb9431bc35072aa8eeae
SHA512 fa6f31f3f6dbaa0ed2eb0710e022c6b86964628d118f0170bd9b535799b30321370070f87a41f5307be4b8f56cca5ca2c849713aeb10e9b7b4ec70b08bad849b
SSDEEP 24576:twuoOWo8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:twDOFgDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 08af7ef02e7781ead9385f03b4541fc094c5792d4126df6225a73ca25e99835d
MD5 7183c1706ef28a17aa0b34b6af48a582
SHA1 4b3447bfc5f8b0273d9b41e61a5edbd9cbc7bdb6
SHA512 8f263c804fe684b53eef6d77e8cfd8031e1d1fefd4c4cbc17bdb01ffac73630dbdcaf95b76edd6eded3af8a96154f85fc441a44d1a9eccee252243e5736e90e5
SSDEEP 12288:cBZ1Iy0FCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:qZu38NDFKYmKOF0zr31JwAlcR3QC0OXn
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe
Size 4.8MB
SHA256 c5ebc2b2f39cbfaf5d56662cb18cf347f0464f0d2c352e3ffb7dd62d2f9021c5
MD5 cc9c9789c8d626475924e718ab473cdd
SHA1 2261253b93011b20d6cd0e8f2e9634da5f84b5b6
SHA512 847293b02d82bb88d1d065b5ea5a18ea64837df37b17998fc3e18f437caa86847583169313062d1bdb42a8d88e947972dde98069a15f4b287b4cfcfdb6d17473
SSDEEP 98304:frZ4K5M+XDfiIewG+x6xZ14TU7dG1yfpVBlH:DZ4K5M6qIzv+Z1QUoiPBx
MD5 SHA1 SHA512 SSDEEP

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe
Size 4.8MB
SHA256 b33a7bf75a0ee3c6c10a41c3c2cfa33b9a98ec65bb10655484aed5254f6255b5
MD5 07cac5f01ba0b88b4d4073375d3edffa
SHA1 ce2a2abbadc48907dc13204e5aae73a5eaa56db3
SHA512 7d74ac38da662e73df9fc76106253544c6b7aaee3297ff6d28b2906f2f81176fae7a7ab0543fc2eb9a37f34c354376e858851238166aef56f370d8dba4d1ab9a
SSDEEP 98304:5rZ4K5M+XDfiIewG+x6xZ14TU7dG1yfpVBlH:1Z4K5M6qIzv+Z1QUoiPBx
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe
Size 2.2MB
SHA256 5cc283a2730a1c54ab15d987d924c768def285304c922fe167151ba1d4036e42
MD5 50914d8f4b1f1f6c52bf3fc97dc68293
SHA1 32d32ecde1b44385d5bf04e45b3e0569197f1533
SHA512 581c93a6e6a02be72e9c3ea5c6350c21641dc109befc019dede4b938867f2ea82735e5cdb95a038bdbf27b4b242e6f1e68a62dfd801d3f8000cca87112da3f04
SSDEEP 49152:hfzabJ8llj+SWWi2mkx+X+diBgDUYmvFur31yAipQCtXxc0H:6ui2HU7dG1yfpVBlH
MD5 SHA1 SHA512 SSDEEP

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
Size 2.1MB
SHA256 e906daab5a0026a294d8d14c7ccf2c8968a3b1d3eab745f0bb06622b8b282a03
MD5 62e78ee31d6b9dac0af3c6f77b9358ac
SHA1 0d16458923a6e74f25a5060269539b1752ccdd88
SHA512 50bdb46a6cbb3b8d7b713cd6a528e70212d912f360880ab9a2512c6fbf7f789c37dffddcf540e7e058eaca1ed7c664aec6b1f5ed6ba2d7894ac66f3dce491675
SSDEEP 49152:ta/3xXBSZ4K5MJ1LvTMxbfsYBYSgxu9+fw4TGgDUYmvFur31yAipQCtXxc0H:lZ4K5MJabfsYNkU7dG1yfpVBlH
MD5 SHA1 SHA512 SSDEEP

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe
Size 1.8MB
SHA256 d8b9790ef1f8d244d5b595559bf4ddb6d5a6891062e0c72c6b8934a96eb8d7b4
MD5 37d44f37d8c21a3664365f4aa19eb97d
SHA1 03ba1d3c123c7cd58576f6147863767fb0ca72bf
SHA512 3af0338be9000d76800784c66d975317dde42cba6c5a97bc1b687e44b51cd94d08e762933c3d66e4481ee7a9d2997612401e3f3250713b1c0f6f0151791a2b78
SSDEEP 49152:qgNJtUzDu/9gKPxHC44gDUYmvFur31yAipQCtXxc0H:rPxLU7dG1yfpVBlH
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 1.5MB
SHA256 5a40a80b7f9b4cf372ca853a4f05a7d0412e1d2d6f68247ee28e693a7a3be790
MD5 c7d079a41cfa0254f0cdf15f3e5327c4
SHA1 84df34e560adf0ef97e59bb223f0c164f6e29308
SHA512 2e7741ec9fbdb73286b6325f0a1fcc2300e194720cec3a77bcdf3e7a367749795fe82a4b6f6105b76ab171c0a52ca6d675abf1c2fe42f8420006291a54255ce6
SSDEEP 49152:DOBynH1wM+v6UJxLQd7BHjdfugDUYmvFur31yAipQCtXxc0H:Vn4LQd7LTU7dG1yfpVBlH
MD5 SHA1 SHA512 SSDEEP

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 f8d97089119eeefe5c32349d9cec34d4d7308a545e7d6df916949b9e79389e0a
MD5 53391818b5fb45f857f31b43c10b29ef
SHA1 b062b89f1efdd040aefbfd8d79261e515646be4b
SHA512 627454a7773b5ea80874740bcc0902a767b4584921840979318214535b1a52abd062be8f65204c6f511150958d2a30b965db005487c3b9d5b545d7a460ef301f
SSDEEP 12288:GTFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:GT8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 838c5ea673838e5c585ddffafc452a85f8265c75b2ec21c5e9754cc9cb05ffed
MD5 e9ffae2bb0bf02a2c45ff738efe0f528
SHA1 256e5317ce743c87b9ca1bf431c84e431213a1f1
SHA512 88a7a29d452ac0552416244e8f35dd0d723db9d3142016e1cd966cf4d14d0b20e4d497a4c16cef732c9ea0bd5635835cb554a0520a6c747e0ad6073b5a2bb6b8
SSDEEP 12288:5wFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:5w8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 37d70327bdcdc67e3f36cf2c1528df42d806232a59936481c352738714b57217
MD5 cef30d2b92d4e56cb970cf43096abfb7
SHA1 9f67ce296b7c15b86c4dfcbb6dcd9fe2726bf390
SHA512 47ad2169814cd864b0f7ddbb2426e6f47855f4ad9dad1e6a5ff878ffaf5ef1f5f994e2bfd068676355aac6e8de5c12c3ceaf341ac4fe47ed3e4383eb32acbad5
SSDEEP 12288:o2FCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:o28NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 f0d0a142134a12ae861aef622d71425aa9e0d22ad8b39cdd9827a186f8c744ab
MD5 2573fe76dd311f01429efaa4a85754ff
SHA1 adfeff092610dd796039705e0cff4fd025d1f811
SHA512 2332d39d8251629218f21d152ac951ab25671f54e1887e485c1a37a3acf2f1c156c0487585511ce3c0b5726febb682b4a45966da5cd329acfca1ebf53da65b57
SSDEEP 12288:iVhFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:48NDFKYmKOF0zr31JwAlcR3QC0OXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 c7d4efa136238f2d6ce37e856c068113e57df0817d0aa59a56c44c841020e137
MD5 0c162a9cf2cfc32812f9e96c42080029
SHA1 67a6a5bfe69b32076c5f4fddd9d0db2911212aa7
SHA512 807ffdd37f608de94981242bb6997ea1bbba3de4e1a9b413ca35d3ee5120d0708ee5d1258d967f3198f3d584581578edb8cff1b5b0bc63df34520ffc41bc5cac
SSDEEP 12288:xJFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:xJ8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 b28c5d75bac4de232ec6660f2e9fe033406a094aef60fcd9345d26d0a418d579
MD5 ba3e6eff1f3c338382c1bde9b2313a1f
SHA1 8359866320dbffe7b889920ed43ba80e99b891d4
SHA512 1f98ea3b612fbdeff186a948fb1a08f6c6f7b67fae1049cbff17ad9330a828d75e64d43d934f9a009f0fd9818044fb0ff5089d21f82cc78edbb142f8f25cc750
SSDEEP 12288:kcFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:kc8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 05acf5588dcee33cf7acf0d10d978a501c0b94441b625f5c8418eb31b2054e56
MD5 fbda4e2c8f8d0014ff858493c5f4018e
SHA1 013cb92346cb1a57e21d5d901b41865c0e36fab4
SHA512 2d862cfb462a773dad78ec8f98a6a824cf972a782bfd51c2f904b10d713d88d77dc461bba6bdc6861ea77a8b7ff5fda214e6e1da30f44104fecfb6f5cfd30a15
SSDEEP 12288:u4FCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:u48NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 a9a2b5502940e31adc06e6cca0c8d2dfb0e1e3254b732c626a985134b81f61d4
MD5 62f2ccdc270914ed13f52794cefd86b9
SHA1 95f3afd4a0a89585e8a7f331f2e517b9e7109be2
SHA512 19a00c1d19925470e39e9bc02d9b998a58ddb51801141b95760c01061f338655e610aaa1bfbef9024f608e68541e677c7398634990ae117516b34a3321687582
SSDEEP 24576:QZMSzFVSOQ8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:QZMSzfMgDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 29bd8bdc6831cbbea963aa9a24e2f8087d41b7b2086524d37d8f161543d6cb40
MD5 72b06c7e7315d9070e64d87cbd3ad1f0
SHA1 5cc9a781a40781d05199f98506feab69dd824e8b
SHA512 3c625b5feb4a9ddb7bd140c0a7eedc0e27ad15fb471895ac7546daef8348f8ad94bd58b9da2fa92bff2eb547c4f2b71d34d78cc757ae15e5c299cdc4e6c37c73
SSDEEP 12288:pnFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:pn8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 147431091a295652c2b90a9c455899263964451b4f0feab80a3eafc22f1bb32a
MD5 ace4b42fd57ad4ac18152facfe216605
SHA1 1ca761f5edfa21b6d8cbad5287e76e3e9122a8cf
SHA512 93f0191d4c32c87cb89bfb298c068694f16de6e9aee7d68d5d4f6facdb004f23c997fe205fe1c8bd91961f44a1b19fd87bb2121aacd8d45740ed53ebb06c79da
SSDEEP 12288:pLFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:pL8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 b9dda5b7fb9fa84dda3632b7a4c67d0b00314fe770ea403b8f1f1a81509d39bb
MD5 76ba8529aa6e3b3e6fd158c65150db92
SHA1 edc3fad50d24410ef2312f5c695a9625fbcdc414
SHA512 4cbd9c5375ede875f58abc16016488f997c535159ce8530e84c5902fb90fa226dc61b022a617000fe94fbf39af8811e359e64e96a5ebc9da1b0557e4c214f4ad
SSDEEP 12288:/yPz5L80FCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:yzy08NDFKYmKOF0zr31JwAlcR3QC0OXn
MD5 SHA1 SHA512 SSDEEP

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 90a162dc80c8676a7ce6fa25a99b331460deebf35ec665c17159986b0e7a93fd
MD5 b87f89bea78989fc35be838aaea89f06
SHA1 e70961d8b6dac92c3eb75f849c6e6807193b0998
SHA512 2a45a421956f4d6aa274f655ba55f4488ed381b804766facf070f598df63799bb9dff24ace683d3b92ece8b12f0992f608042c642e6df4963c9fa79084ce5be1
SSDEEP 12288:HnFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:Hn8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 f51ddd271c3b54e3351dadae167d86fbdbb45e8cffdd94fec2274bc50a0f9245
MD5 33fc7a6532b53c54f795190d1c0b2ec7
SHA1 f49fcfc37969d2025d24e903191fdf70267d715a
SHA512 2ac9a60a23978ad02781382a245228b163e520dd889f8e1cd43419c74559b9063d6bad68dd6a2dc8e2e665dabdeb854e8726c4eb4adea1ec33be8f4a62dc733b
SSDEEP 12288:AnFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:An8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 b80d8da91034d832efacec123eb5607f41a591ade101da7650811b34ea82d1d8
MD5 e35cf616ae0f7c9044f5d1e1d3d6da4a
SHA1 f8cb66dacf2d55671f774dce3bf9a90e84d0838e
SHA512 d186b2facd04ca6c132f766c74257a55d9a4637f0f050fae7965b0486e1cd556742d595ffcae3f2e28de3d2742055167b7bd26f32e4a6eeb7d01620f97f5f27e
SSDEEP 12288:PyPz5L80FCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:izy08NDFKYmKOF0zr31JwAlcR3QC0OXn
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 e40a02f4793e05f80998d9acbc2564403dd44a6a1f34ad9dc8b805fef5144d08
MD5 0837840c6fb7f0147c4f37f3e432e4cd
SHA1 bedfd703dcd835febe9b1921722a648ae234d4e9
SHA512 0054e4f8385a07abcf382a1447bed310ad9dae14724144cccc84668aa4c3865ada02231b8dbfc8385c9c2f8cc19594d1c20b78b4b3aaa1c35fe4836b6c8be9ea
SSDEEP 24576:8THaLl3z0zDG8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:8T6LljNgDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 31f0ba1273b065130cec6b1fcdef81d58b33ec387e667db0a646e99a91c18027
MD5 5f39ceec27d064f121a9f93df184860c
SHA1 bca3d46ca9acb2d08132553d109558555268378b
SHA512 e033835ea95d73a558dabd6b24806d60bba09fe2978674cf2c1964eb7431a259ff553271fe025eeda645334b0397fdfc7f3444e2795ba0410337173e40cc3ab9
SSDEEP 24576:q37d9CHKy7GZi8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:M7d9CHKyaMgDUYmvFur31yAipQCtXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 40edc3a0133a034f19227b246c688dea5d9eee26e881e01ab21726d2e3bf2dcb
MD5 74a2c7cf17898242ec6f34e9a0904b0a
SHA1 408516fc44bedd72c53c2a0fc0e4e1be0fc289a9
SHA512 dd04050ae8b425fe972560d607314e6cc7da84f45ae98d5b4db698808fcd38c30a35b95b036a3af7273a0e66f7d4478a451d778535e71334c336c0d1fe2e9500
SSDEEP 12288:kWFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:kW8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 1b6c8f48342d280d036737032e531845fa934a8cfdc9de937f45d29b4064b84f
MD5 391bc8cbe3908af666fd447434518d5d
SHA1 e8a65974fcec4cd72e328670900aaa4d75e5c94c
SHA512 402c87f3e4dbe62453ca55d316436f883d4062ff38bb6c4295a18ace81c1b7c891f4e10e3a7e5e300e418478fbbd92e332dd7ee93c1dcf0454af7f61d9a27b82
SSDEEP 12288:IUFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:IU8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 fef613a7f0e9a9bd541f56d4acab2fe1bc4500b2c339e75a42592411078d7152
MD5 0d7991c3ec10e2e78ea6bd041b5572e8
SHA1 8170ff7586571aa2a3498214557c67560ba236bc
SHA512 15cf7e7ab490d7cee03e4d1a78707949050129095eb37377f6a08bce850226c47f9057235aab2f0b2ebe1273436ab1b51bcb779cb6c3488ef1693f01cd9b7871
SSDEEP 12288:0VFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:0V8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 16e19d3a6053d53aa3146dd7db38d3088646c0718a53375ac4ac17b1a299519f
MD5 0b1e44817c9a10f78f10aa62ca81a43d
SHA1 8e8f9b6833bf278160cecaf7aa43948f2ba68a25
SHA512 0506ee2b3325fe6def12b07137a1e5f0746d28ccfc150d98939788560befa3554e1cd4ed335fd80230393280b252a4df260efd72d94aa33b1725b75ccf15f6ca
SSDEEP 12288:BnFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:Bn8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 5086d1749e29cf4ea047bd3f5d049c8258b662f3374abdc0c7920e687ef26f1c
MD5 78f9d5d3a1e677d29c8fbad7ce761c00
SHA1 7d7cd3c94bd903a8626f3e58be24538163caa8ee
SHA512 6f4e54f1b42a9567c47e12537ac40e0b180809a5ff1871d1c4e7ed08f5b687e500b34bea6550da161625c332712666259af3a79a08267ce3e4625b0328dbc583
SSDEEP 12288:cWFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:cW8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 3e991640d5518c619775ea6c59f07355973188842f113909302744f0d56a5390
MD5 1ec44ff9778d486851550959480157f8
SHA1 9f3bcf1463ce4ce10c3ed4fe51317e412eb92729
SHA512 1e931297248f9d009afd09b7d425c8cc8c899b481b5dabef2fab4c556b7c5d8a33a801654ae040e8da864f9c31be4f79064f9606134c6a248f6a139ce30b004a
SSDEEP 12288:lPFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:lP8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 581KB
SHA256 df01fa8f7c87c5f2551ad51ef7ca227f589a10ef6e7a8c55829c173444b9c016
MD5 663b3e6a5431e51ca04311e36ff81973
SHA1 f77c9daaf47353cad9bad2e3e73f2ea97aa6514d
SHA512 eee7c7769329f0be89568eb7151c0224b4440b3706c2c23e10924bd8e192ad5c65620e897780644347be91b73513f01f0747c7f4d168993e66615d8a393c7bb0
SSDEEP 12288:mJFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:mJ8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 701KB
SHA256 5b3cd4ea4dba4dfa31dadac0fec11570e600647c7acd88951b7f6f6280410e09
MD5 63b924f683a5900129deee8b46d2b070
SHA1 ceb2259d280ff5a851546b9b9a7abe818e5c62d1
SHA512 53a542a5da2c1c063c888f8777d92ec2501fdb2d5cabf4e90bad0f6494efe44b06a2893ef39d7e7779638da0a3a3293085151adc45a3fecbdf3b7f6273c1929b
SSDEEP 12288:eUFmDDLyFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:ky8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 de09f0f300f51f4a2dd12aae203cfc66ef3966cf2f827db98ed08577019db63b
MD5 ad88df96c08ac77064117f26a0f51aa6
SHA1 562e0907ea687d58fce2485d58acafcc66ec79c2
SHA512 5cca4b6af33b0ff715bea161f279888b45965183e9228e0d87239ae89b34531211df4a6404fec03222b1410b8ac6c2c6a1822e4d029993da5a0c73388eb8d29f
SSDEEP 12288:mzFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:mz8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 f6370fa43d0948f05dc3e4b5bed485123a7a1e57113ca51ca38a60ebc23e091d
MD5 e0482281ea8ee3579ab563a129c6a009
SHA1 c9d0721ff6039f6175ee280afc2635fca3b7d181
SHA512 3eb3294073e077d28dc112e24c3b851193440a3e893cc62d6830155109a9fce20fdccd16b1e396441b81176163dfbe0c4df705a04e9cbb044d470b26f0774dd9
SSDEEP 49152:ga0h2GEkuAe73q3pp46zwwQ5gDUYmvFur31yAipQCtXxc0H:ga0hNYG4Jw1U7dG1yfpVBlH
MD5 SHA1 SHA512 SSDEEP

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 659KB
SHA256 7b7f9d344fc5550c8fd49cdffcfc9546534b2fb4a2025802d10e3c172cd619dd
MD5 2738a43481565bd0aa6f061eb01a0dd5
SHA1 818e94c4fb4d6d4020c56e8840434220a0db1870
SHA512 0f03cfe46e21f0d68df5bebfc1863ead2e66e0179bcf3cbf6b2483a5c434cc2598083e9563bfd5be08317d11f370fba7ccca3e32383ea4f62ca76d877728a5fd
SSDEEP 12288:PhbHjfXIFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:PhbHjPI8NDFKYmKOF0zr31JwAlcR3QCx
MD5 SHA1 SHA512 SSDEEP

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 baef04292d6370d9e413c9b2c5a1bb4a9d58e84034557fa0420f701401a4e75a
MD5 a381035d9e685628b958bb156e676503
SHA1 6e0c9bb992e0ad8ce25b0d4adfbb3b345e9c84fe
SHA512 2586e4ec21268edc85df2621c719ca25f0fe3c47ea80afbc9f7f8deec92e855f98c60ea3b03803e7bba9eefc45e6d1a9f26ca9f69b6716ab372e8f25fc2c7ffd
SSDEEP 24576:q3YgnJcRTk4yti+R5dpR/w8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:qIgnaTk46ppR/wgDUYmvFur31yAipQCx
MD5 SHA1 SHA512 SSDEEP

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 578KB
SHA256 20afc3ef4b453ca8577f07eea34b1dbb8c43328501d7fadf668f133b6f5207f5
MD5 e6e6d0eab97f82b805ff83b5e8f6aa97
SHA1 a7c050e7cb7c63a7ab830b8874408a392c357698
SHA512 7d02d62e4048297c2daa072e55f3861a116e683f8d0e495ad6e8371a96b2e7470dc07564f7ac361648f00bb14cfe231b58881c9b1dfa1ef390d308dc3b420fb6
SSDEEP 12288:W3FCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:W38NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 940KB
SHA256 fa462192acd1e61ae302ce0dc8c53cdadbd053e05d99c9d5bc10aaa58d80ac3e
MD5 adaeaa0e016632ad73af52deb7aa59ce
SHA1 1d09817b2b5d44b162e5bc3c09554f2cb2c379f6
SHA512 90ebafbcdebe839471e80e74fcac07a2df469832da568bb49dd9514edce154c4eeafbc9ffea2c4a66628577aa48b8b48ae541067ce50168ab4df8bdbeb73e719
SSDEEP 24576:cpL3UTm8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:cpL3UKgDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 671KB
SHA256 1e0b15da83bfb2c65bd09a7c277a7866400325e32e573972d59d1d4e148d24bb
MD5 3e196877f4c89527e554743dee382251
SHA1 1346b577608c029ca0299b761aa0a9efefaacc74
SHA512 95314ea2f8b1750f2477ae5fc853171100c5711d2050390f44e9d72432f9f81018e8f568448829749940926f0c8713f15a274d3c66cc2926bd5c03d8909ee7e5
SSDEEP 12288:1pFtpOqFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:dOq8NDFKYmKOF0zr31JwAlcR3QC0OXxx
MD5 SHA1 SHA512 SSDEEP

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 3c69c8805bf3c65f2f21c5df64c999b3ae220fa5093888075255989f8d4577e7
MD5 a70cb63839e81ac5e8292cacadd7b6cd
SHA1 bde4f24c36075eee14b8530dd6739aaaf1ec6dd6
SHA512 52161b4dc0ac847f337a415f1ce39f1794bfbcdc85630a10aa7d82703536321c207b499abab82e0807a607aba9eba95d0df513fc3b06a03268684e5eed7d5cc2
SSDEEP 24576:S7NM9YmZqmWMUkPjZM48Mv6bEhsD8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:S7cBWMpPjN8DbEhogDUYmvFur31yAipZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 2a3334e08895e517052bd42b8127ad3939c71e344529c1526b7eb77e53a83dc8
MD5 908d402d18826583ff56de259b22c0b6
SHA1 3d4959e5ec1292bc49d8d1ecf649e013c3f3f477
SHA512 f9226ad996c0429adb00cc5605a94c8ab711b90bc21f60ba73c6b38e6442887a78acab15e988128dc21963d09a5e0254993aba9e3777237cb4b8093f1ee628a6
SSDEEP 49152:6F2YuHNETovcvNYf8kmjgDUYmvFur31yAipQCtXxc0H:z6tCf8kfU7dG1yfpVBlH
MD5 SHA1 SHA512 SSDEEP

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 3867f64a4093041ea1389564308ea2cd277b30e3a16435830070441bbf1dd749
MD5 cdc6c14870db68fa547458fb65d41eb8
SHA1 6bcc4888ff5641c3fa2be59e4bf0a2940bffd2d3
SHA512 c88c8e8e60716f108aacf6db1039a3d40a71d0db7d80c1c994b852568245d65f7ea4e9958fa90b9b6240a78da0d11b83c532cd97a571b749edc948a71069f670
SSDEEP 24576:AAFs06+Omlf3NXEbToe8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:VFs060lVXuZgDUYmvFur31yAipQCtXxx
MD5 SHA1 SHA512 SSDEEP

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 885KB
SHA256 b900825e8c93c2ad454b48c8809333b2b7232a2f5a52cf7b49cae5b1ca8cd3bc
MD5 d7ada748a1b2214b6af171bf0392903c
SHA1 7c8416107fa3bb7f33850d1156483288115dd2ce
SHA512 5ae6920c340ff9da92fa696a0dcdf9dd8def24a95be4066a2267887ef6c517063b45dea716eeaa928c778bcb1152cf24ffaa033eae03e2d1df6d37dbd6e96c37
SSDEEP 24576:RJnJ5D3WtZ8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:RJnJ5DGtZgDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 f3d16ddd7b10a9455dec7fba4f53a325a77d50a8f2ca4e21dd98e5afbc3805d4
MD5 9f558dd9bd360bab93095c542e5ccb8c
SHA1 0716fed9eff28c41d4c5469cd61fa0d6eef578bb
SHA512 909c9a47fe04512119faea260ce691475f2fdcf628b16084864c0d30c30bc845a16b0cb51faf3a91c17cb6ecdc0022abd549da27202ce24281679fa627f0158c
SSDEEP 49152:Zo06DIKdwc+eQnSt65aVPgDUYmvFur31yAipQCtXxc0H:OEU7dG1yfpVBlH
MD5 SHA1 SHA512 SSDEEP

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 661KB
SHA256 5a4f0de6be5f7ddca98af41073b8f59cff6f3c7d11b274256aebd85095d41757
MD5 292bf9700507d60044d684bb0b39630f
SHA1 70ebc021cfbbacae69abee3e20040e235f92825d
SHA512 94eb1ec77d8ada29d8eeac6700cc7d43faf452327af9df5f072f9626d1a85d9096a676cdd1f06311fa54502332d96424afce431e7388f57aa2375a0b049a0f33
SSDEEP 12288:5EP3RrkFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:Krk8NDFKYmKOF0zr31JwAlcR3QC0OXxx
MD5 SHA1 SHA512 SSDEEP

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 712KB
SHA256 ed64c5533a6d672a3c0489de0bfe6c67ac6e2c255b60458df99015329fecf3d6
MD5 36d1c77a0e10b5acd317bce1abf4f365
SHA1 16a25b567d25f5ecfbbf60c73efb77c30bdd6bb5
SHA512 8f821e9bce1fda75dca87f3f0c8b9925ad3f3c1e6f785e6b96286aba79e66ae2096df0f3daa0b162d25ad006962619c83b61cb1efda576d7a16f258f562379d0
SSDEEP 12288:Djky4FCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:DIy48NDFKYmKOF0zr31JwAlcR3QC0OXn
MD5 SHA1 SHA512 SSDEEP

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 584KB
SHA256 6682dfd738a980c5527bbcb9cfb4d157f54ba0caff5b48b503c2d1c9b5d3ae9a
MD5 6c5659dacdd1dc71e9fb1ddddd547a5a
SHA1 6887fd0a2ae84b1324bcedd92ea29fbd3821a8d9
SHA512 04c7b87652e410478a0f416b249fb57b28db6523440137cecdd186da1f8097308a8b0d9738bfe07f3e33fbc1e3b22947336301cd51732bbced58da56744a193f
SSDEEP 12288:2FaFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:0a8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 69936a71707ef97b15cc163567072a0f0b4573258ad365c033544f94bae10bfe
MD5 6ade5d83fb01e7bb203ed1dc40a013a5
SHA1 0f2b5aa354dbf63e4e6b28ac40d45812421a6fad
SHA512 0b52cf044ff783d30ac4637f31e318a83eaa86b7b6d18cfda2bbd4a39a25b6575a5e046e0730c832bae4173a400eae347651050e89e56a5575506738f5a26aec
SSDEEP 24576:MQ9MxZKdcz97w378NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:MVKX7gDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 772KB
SHA256 878084980dcca76bd2848185a247672c4400496ce68d29557b29b254abb225c7
MD5 b68eb9b55d2fd7bc566290a2a1572394
SHA1 fb7cb720ee49726c482a31ea932b5cb1a6b87bdc
SHA512 79dec13f4f5a0871ceaba20dc2d39e9c50bc5c915fddfbaef73c9f64bdc9165139ff30f3a24e8c56ba8b653695c2a115f80871230e32f5bf271f41b85c73de55
SSDEEP 24576:syocxApM8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:RocxApMgDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 5c17a3f626ee754e1acd32166f4ee7178d8913023cb74602c8a372d96883ff00
MD5 2b92ba1f01a6b01559122feb9ba79379
SHA1 e1dd77c2c88b3fe0df9d4a4f530f1c900221cd75
SHA512 33002e02cccc1fb69e2067f7d72d9bf47a7270ff6e119a10effff0039e39fbca5caab75c39479fc9a6947028ae7af4e99be3f6c193a6bca29403ff812eab334a
SSDEEP 49152:aWcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIKMgDUYmvFur31yAipQCtXxc0H:c0zuNIZU7dG1yfpVBlH
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/420-446-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/420-386-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/420-378-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/672-374-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/672-433-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/672-365-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/856-408-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/856-415-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/1396-339-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/1396-407-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/1396-345-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/1408-67-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/1408-65-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/1408-73-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/1408-238-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/1432-17-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/1432-194-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/1432-23-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/1432-15-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/1692-336-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/1692-269-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/1692-280-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2000-250-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/2000-244-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/2000-243-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/2000-310-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/2104-420-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/2104-350-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/2104-358-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/2208-235-0x0000000140000000-0x0000000140245000-memory.dmp

Download

memory/2208-40-0x0000000140000000-0x0000000140245000-memory.dmp

Download

memory/2208-47-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2208-46-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2748-11-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2748-1-0x0000000140000000-0x0000000140245000-memory.dmp

Download

memory/2748-13-0x0000000140000000-0x0000000140245000-memory.dmp

Download

memory/2748-8-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2748-0-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2960-349-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/2960-286-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/2960-295-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/3380-373-0x0000000000520000-0x0000000000587000-memory.dmp

Download

memory/3380-299-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/3380-306-0x0000000000520000-0x0000000000587000-memory.dmp

Download

memory/3380-363-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/3780-62-0x0000000001A60000-0x0000000001AC0000-memory.dmp

Download

memory/3780-66-0x0000000140000000-0x00000001400CA000-memory.dmp

Download

memory/3780-58-0x0000000001A60000-0x0000000001AC0000-memory.dmp

Download

memory/3780-52-0x0000000001A60000-0x0000000001AC0000-memory.dmp

Download

memory/3780-51-0x0000000140000000-0x00000001400CA000-memory.dmp

Download

memory/3872-255-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/3872-261-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/3872-271-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/3872-273-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/3872-254-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/3980-391-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/3980-405-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/3980-404-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/3980-399-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/4284-311-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/4284-377-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/4284-319-0x0000000000700000-0x0000000000760000-memory.dmp

Download

memory/4776-29-0x0000000140000000-0x0000000140237000-memory.dmp

Download

memory/4776-28-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/4776-233-0x0000000140000000-0x0000000140237000-memory.dmp

Download

memory/4776-35-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/4908-422-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/4908-428-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/5012-390-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/5012-332-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/5012-323-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/5012-545-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/5224-441-0x0000000000BD0000-0x0000000000C30000-memory.dmp

Download

memory/5224-434-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/5332-455-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/5332-448-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/5444-469-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/5444-461-0x0000000140000000-0x0000000140179000-memory.dmp

Download