c00051b62d378608698e3b73e7774784fa3061220b66df5ac794b0db92fe72bf

Analysis

max time kernel
142s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
03/04/2024, 13:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-04-03_e7100293ddf772f89795710563a8130b_ryuk.exe
Size 1.7MB
Sample240403-qallbadh72
SHA256 c00051b62d378608698e3b73e7774784fa3061220b66df5ac794b0db92fe72bf
MD5 e7100293ddf772f89795710563a8130b
SHA1 12fc87dbd53506ca5f5696237f0c0d97e707a9dc
SHA512 e87053888bc50ec619705900e2d7ebfb45915f3aac11f7665f8a589ac5f060f35b5ca19477af573262ef74dc04ec78504b2d321eb50c62e75b469216c7e8ed62
SSDEEP 49152:sgtHUujpj7AewZmZhRdhEHCks7R9L58UqFJjskU:vFh7ZhCC17DVqFJU
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
4304	alg.exe
4732	elevation_service.exe
4012	elevation_service.exe
3964	maintenanceservice.exe
3888	OSE.EXE
4892	DiagnosticsHub.StandardCollector.Service.exe
4740	fxssvc.exe
4220	msdtc.exe
464	PerceptionSimulationService.exe
2076	perfhost.exe
5072	locator.exe
4596	SensorDataService.exe
4652	snmptrap.exe
232	spectrum.exe
396	ssh-agent.exe
3476	TieringEngineService.exe
2436	AgentService.exe
1532	vds.exe
4808	vssvc.exe
4996	wbengine.exe
4432	WmiApSrv.exe
3792	SearchIndexer.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in System32 directory 24 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2024-04-03_e7100293ddf772f89795710563a8130b_ryuk.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\42229284205991d4.bin	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_77375\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\minidump-analyzer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_77375\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Install\{AFF521F6-AE33-4DA9-91C8-593A92655606}\chrome_installer.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9908 = "Wave Sound"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000090e3398fc785da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000804cc08ec785da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000017e8dc8ec785da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002722f78ec785da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fa340a8fc785da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002722f78ec785da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f837cc8ec785da01	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
4732	elevation_service.exe
4732	elevation_service.exe
4732	elevation_service.exe
4732	elevation_service.exe
4732	elevation_service.exe
4732	elevation_service.exe
4732	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
656	Process not Found
656	Process not Found

Suspicious use of AdjustPrivilegeToken 42 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3624	2024-04-03_e7100293ddf772f89795710563a8130b_ryuk.exe
Token: SeDebugPrivilege	4304	alg.exe
Token: SeDebugPrivilege	4304	alg.exe
Token: SeDebugPrivilege	4304	alg.exe
Token: SeTakeOwnershipPrivilege	4732	elevation_service.exe
Token: SeAuditPrivilege	4740	fxssvc.exe
Token: SeRestorePrivilege	3476	TieringEngineService.exe
Token: SeManageVolumePrivilege	3476	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	2436	AgentService.exe
Token: SeBackupPrivilege	4808	vssvc.exe
Token: SeRestorePrivilege	4808	vssvc.exe
Token: SeAuditPrivilege	4808	vssvc.exe
Token: SeBackupPrivilege	4996	wbengine.exe
Token: SeRestorePrivilege	4996	wbengine.exe
Token: SeSecurityPrivilege	4996	wbengine.exe
Token: 33	3792	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3792	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3792	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3792	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3792	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3792	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3792	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3792	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3792	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3792	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3792	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3792	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3792	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3792	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3792	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3792	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3792	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3792	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3792	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3792	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3792	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3792	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3792	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3792	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3792	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3792	SearchIndexer.exe
Token: SeDebugPrivilege	4732	elevation_service.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3792 wrote to memory of 1112	3792	SearchIndexer.exe	121
PID 3792 wrote to memory of 1112	3792	SearchIndexer.exe	121
PID 3792 wrote to memory of 3716	3792	SearchIndexer.exe	122
PID 3792 wrote to memory of 3716	3792	SearchIndexer.exe	122

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2024-04-03_e7100293ddf772f89795710563a8130b_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-03_e7100293ddf772f89795710563a8130b_ryuk.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:3624

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:4304

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4732

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4012

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:3964

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3888

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:4892

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:932

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4740

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4220

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:464

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:2076

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:5072

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4596

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:4652

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:232

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:396

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:784

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3476

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2436

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:1532

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4808

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4996

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:4432

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3792
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1112
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 916 920 928 8192 924 900
  2⤵
  - Modifies data under HKEY_USERS
  PID:3716

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
Size 2.1MB
SHA256 3d4616b124a87abf8ce1522af398d87bc8f78f318d9129751558639a44cd488a
MD5 72c0d9c0f03bb0a893ae53792c160024
SHA1 b086a8b8685d45ff2ddfb6eb57b864e1679c1ce8
SHA512 6976f3254f2e181e849a3378356d30c92f5b5b69e68a138a54b5679962e773495d349173200c1183d31a82ed38a936ff30fc5e3276803ea8e5427373107a9c2e
SSDEEP 49152:3uYk3H5koUzfTqkkYLO/W2buywzMbOX+T7z5WCks7R9L58UqFJjskU:37fTqi90bqC17DVqFJU
MD5 SHA1 SHA512 SSDEEP

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 bd32e08035b19fa115fea2e86bf1d44689995475c016d860f1a82cabeca96c69
MD5 f331ade75bfe44acecda3852398126b8
SHA1 649eda27a67eebc60a261de558ff318de5c69b2e
SHA512 78af033b95caf05a733cceda4c2b4b09a0fd410e0dd93cc08b416cfc89aaac94d7df07fd2b5048bbe49564473ea05ecae36ffd471b906d8bd58fbd4c1db596ed
SSDEEP 24576:bPsJcuiZCks7WE9F5pwg8zmdqQjC60jiHkU:bwcuqCks7R9L58UqFJjskU
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 ef486dc32cae848d363f9b825fca43e24a748863fc376d5c9b1bed3a0a6aca5c
MD5 1eac9bbb338516b56a383e2166efd79d
SHA1 eafca5a682111252e96feb35364b37726f3cdfe4
SHA512 b30d0773f711a7d3de7c89b0cc3f4adf7a48ed7db46593551f7ba013ad07de4477533da6ab0488b859182a472f245b666f3b4f1b8a55af7cf70f7e503d92dea7
SSDEEP 24576:s+gkEHfh4Co1Cks7WE9F5pwg8zmdqQjC60jiHkU:pgkE/SHCks7R9L58UqFJjskU
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 f489daf9837cd82daaa673a5b2998e6745a74792e6fcc88d17705ae3cd76ce3c
MD5 abb9c19576a724f299eecf5b5d52a1bf
SHA1 d662cee6daf11beb99dcb0a9696d2aede5aad323
SHA512 bc64022c4719a68f8350c1d1481839e62780ec2eff91d02b86bf0105fab2f5bf3c19eb3d8c040aafadeb20075377ef3f37ea69cd1e08fec57d70d867565d7bb9
SSDEEP 24576:zBpDRmi78gkPXlyo0GtjrSCks7WE9F5pwg8zmdqQjC60jiHkU:VNRmi78gkPX4o0Gtj2Cks7R9L58UqFJU
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 1e46a39320a9dd96fd357ce5c3779d10f043235260d3517ba03cd78a6794a2de
MD5 87309facc5055ad631b500155b7be0ef
SHA1 87835d9e6826f5109a1e62cb4c10509113b0fe13
SHA512 cd80732d0402b66afeecd26dd082940fb23ec154e418cdd2ce2afbbdb65c7d1537e9e4973b89da48736af7b652fa6d90500a58fbb50242104f060e9626277957
SSDEEP 24576:5LOS2oTPIXV1Cks7WE9F5pwg8zmdqQjC60jiHkU:D/TuCks7R9L58UqFJjskU
MD5 SHA1 SHA512 SSDEEP

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 9643ceccd1a4a296b2400ffaf77a123690a601375b624c20c7e6f67b2c0559f6
MD5 cc1c3c45e208be6efdcfc6083d7e99da
SHA1 88f8c995456efad43b9e9d2fdc66962885a18268
SHA512 a3f9207ef3a6592dc80a68675b820a1e6971f16684149662af7431879b1ba25f98e68eaacb63820d1f3c9d0e72a97528eb09049a8b82d70b8f26ba61fee78869
SSDEEP 12288:dtn7d0NxksRpWE9FRHSfNm1wgbIxnBw7dzE+e3gxZC6LgjigDy5fdv8fWi+7:dtnCks7WE9F5pwg8zmdqQjC60jiHkU
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 99459c85a379153b54190d5171df78a4c663f417142e6c983c84c66494991bf6
MD5 6196d8d37d12f206c327417915bcbabc
SHA1 ce6004f29bc31f5dd284be77d9a4d51200c6dda1
SHA512 48de2391ab08835979e01a9a1d929ce15e90280d674868721025eb60d3d801330e4428ae08c4cf4061c3025b3c032122097efa0b24f21a0878e4f0485d5bff27
SSDEEP 24576:LJIUkCks7WE9F5pwg8zmdqQjC60jiHkU:LJIUkCks7R9L58UqFJjskU
MD5 SHA1 SHA512 SSDEEP

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 66266cf1c08258746a9f164a74f2799f0e87657ad434005b36c765e5c0acd2cd
MD5 61b4f134dbc3b0da68aa97b82d3e4cb7
SHA1 6392ed510705f2151fee0cb64be8a053d7ceb5ca
SHA512 e15d127ca46c1b928a11cac0608e386d69a65c04542644010623bbb201d266cf4755f7b2913e60030d1c0abc51de4d43095724665b7d6449b917d12953e93813
SSDEEP 49152:KQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THR:KQvGAdlCEL8c/DRNw5CBC17DVqFJU
MD5 SHA1 SHA512 SSDEEP

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 a70fde96f622bb66547312966e7fcc1ccf20cdc3e044b9f14767a2c4ba7a195a
MD5 389f8c38e5b35ba9895b3e7674b251aa
SHA1 37a160f59c52f4fee6724dfe4d4d0f973c645c07
SHA512 5c4cf3532a9e5be5535f3a5303dbbeb4ed74ab4c7ebe3c6150c3f47417469eba23cdff0acf827ec904e541cdaff0707aefbd2066cb8b4f76ed1746221fd7c91e
SSDEEP 24576:v0ewsAjqCks7WE9F5pwg8zmdqQjC60jiHkU:sljqCks7R9L58UqFJjskU
MD5 SHA1 SHA512 SSDEEP

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 7279dbb5956b6b9c473680a373c9f64db39b25403cd6888cce51672eb92ea4b5
MD5 60afd88cf88e588bbd40c750ce8f601c
SHA1 b6ae7da7df0ea1e6bad5dd1df4b2cccaf15d756a
SHA512 964434bc65f05b2732ac4ec540aeda7ec772d99edae20083b2eb9a9d6a6bca1eed9913386824620eb96a54d955ebe3220c6759e1e247185af16de8496c239801
SSDEEP 196608:6UEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHiiD4bU:6UEtQevvqc2W1cpV2tI32ii2U
MD5 SHA1 SHA512 SSDEEP

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 dfaada1f3314303988d2c38c672b103da62ce1af89f1173f5304663874252af0
MD5 5f2025a3a9e91c09aae50e3c1829d021
SHA1 28fd5a1a4ced282ce0580a68623215ade9f8a5cc
SHA512 4d5b0903deb229c515f5aabf5fffd615812ecfc28184447fe83aa059445ba5720dd8f5711c440d01afb3001e40631e18497304141a9a05d950fa59689beb270d
SSDEEP 49152:ZCbRquA/m2yL5zTfFiV+XenmE3/zKCks7R9L58UqFJjskU:2oquVjnmlC17DVqFJU
MD5 SHA1 SHA512 SSDEEP

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 d580089eaeafc8c969d2fd6c186c017e258235d48e77d7931b4054d9e059b7f9
MD5 bd69fbe4f4bf4bd3de61a2e435903659
SHA1 3613c8d9958b0467c800bd79916c7776262fc12e
SHA512 9162c29646119dc70760ba6a9b01b96139f9c0bf3f04b7e312f6818102fc6c5050c69983ab5b9d681867e2379c7fcfd49c6d9b2cbb2439c7736f2bb2ff0ff6b7
SSDEEP 24576:LAhGL3IFoiwtA5l7S53FCks7WE9F5pwg8zmdqQjC60jiHkU:LAMUFoiq5VCks7R9L58UqFJjskU
MD5 SHA1 SHA512 SSDEEP

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 8355fc44116ce75787c8d71691d3c65815e3bf2e6e4d44a39ba58b30e2dd9e56
MD5 3f9321f2c8c842528477bae09494824c
SHA1 7336c93b4856411d0c41896a7756d4b6d7ecacdd
SHA512 6b3505b836bb054687e5e0a203c186637d434bbb92d26dde097aebcc3e025d555b90bc92c9b6cda357d16ac9e4e9ad89117f6bec58ea7ad3e6fd1462613e0565
SSDEEP 24576:0wu4OWuCks7WE9F5pwg8zmdqQjC60jiHkU:0wvO5Cks7R9L58UqFJjskU
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 17cf5452c98668c7a5db9430e67c13af9470378ffd8e6f3ab5417080e6110b3b
MD5 59d914253a5850e362c22182c59d15ab
SHA1 1b71de46ec2c4549b68eaecc42a2c45b3bb5041d
SHA512 a9f97028ab953092f6272fddcc39120230a3063b0efa65b7b71fbd26c4d2a29afe3be376d1011d6f490f3dc49c41c01ddfc4792eb975ae4b4580d332db4fcf4a
SSDEEP 12288:EeZ1Iya7d0NxksRpWE9FRHSfNm1wgbIxnBw7dzE+e3gxZC6LgjigDy5fdv8fWi+4:9ZuTCks7WE9F5pwg8zmdqQjC60jiHkU
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe
Size 4.8MB
SHA256 821b2847b42b34959441b54d55db657d613c8c38dbe9da3610e4b3d1a6e9fb7e
MD5 513bd0e58144579b1cf58428e53659e0
SHA1 29d82ba4a4a7e7b48c314381ff68b90d0e6dc0cb
SHA512 d6648fe82363086aca3cee5eac8949219bd3f72e9c73aaaf62dec5b761965b2f31690a77def8b50b5ee196e2299968a1bc0e7eda215983045464eec9bddffb54
SSDEEP 98304:/rZ4K5M+XD7iIewG+x6xZ148C17DVqFJU:jZ4K5M6GIzv+Z19iD4bU
MD5 SHA1 SHA512 SSDEEP

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe
Size 4.8MB
SHA256 6992ba1386f784fa3ebdbc97ce9c0694983000f69dd9732dee9daa987b6e0154
MD5 fb018afdcb33a9700b71585733040db7
SHA1 894db11dce91d68854ebde67e8166a27fe2ae418
SHA512 45451e128676f87d68a0fb9040dfc1ef78820b2e1b4365ae31720eb471490eb47d29cd96c5af7e9815a4d90dbffc060ddd894fad58ef9e6179b991efb87667b2
SSDEEP 98304:+rZ4K5M+XD7iIewG+x6xZ148C17DVqFJU:aZ4K5M6GIzv+Z19iD4bU
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe
Size 2.2MB
SHA256 8403a7b0547514474366266270b9cd952b8425ff19b49bda5d23e229cdd034af
MD5 2158f6b9ba7a1f2f9c9151d31a5bb60a
SHA1 51505b7861ecf7dd06e4c7f10413e6c0443e1dba
SHA512 0e2ab07d268287c19cb3ab8df7c7ed21fc5fabf1f77a4877bffcd6c26ce6442035e2bd390f8a59d78b1e9419baeca408aaadb4bb7e58068176eb0e355f7c8514
SSDEEP 49152:kfzabJ8llj+SWPi2mkx+X+diFCks7R9L58UqFJjskU:FHi2IC17DVqFJU
MD5 SHA1 SHA512 SSDEEP

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
Size 2.1MB
SHA256 e0fe4bd59c73d49c0252f0e01af3fe1f0bcbdcec6d61db98ded701fc5d4782de
MD5 29d91541c34bd21794d40329238876ff
SHA1 d41395f668876e31fa76a2afec548d7bf71c8444
SHA512 7a4b8ae2bb07ada223f1b107a9e1a835c230295d7485af16e31b4c3db666b682d739169d690e2e5caf31c95be6231abf1c74917007abe0c90279ae8ec614cce5
SSDEEP 49152:ua/3xXBSZ4K5MJ1LvTMxblsYBYSgxu9+fw4TcCks7R9L58UqFJjskU:wZ4K5MJablsYNJC17DVqFJU
MD5 SHA1 SHA512 SSDEEP

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe
Size 1.8MB
SHA256 eb4924ce5bf479cd47626e914dedf376a0f3f3f77c82bc88b45d26fb27223355
MD5 83384c976dbc023cd4188b0cf90e6f42
SHA1 fac0539152a7ec00a761819a2dbf894e4fe694dd
SHA512 71b1ba9faf50e76d5a651c8cb06e15387871e079dd5049e185f410dc8b7feb378b8e4271461fe2b54354c8862ef8fa4795a2258add737ceb4c15a652789ee89e
SSDEEP 49152:CgNJtUzDu/9glPxHC4+Cks7R9L58UqFJjskU:YPxEC17DVqFJU
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 1.5MB
SHA256 8db13a9ac2866a866b0573ffd4c7795b170af2e4bec6232060ab3e00695c6b32
MD5 69e5a67e4805adbe08a58a1905ab6296
SHA1 36522dfd63d54d33e7ccdf419753d53730f17c06
SHA512 a58544c0777de2c942374f02426b2d6950fbe82317b447dc86907f5eb7410d88b531a9cd952a70a7db70528568dc99a4d7859609671c6a11caacc9317a5d27fa
SSDEEP 49152:pOBynH1wM+v6UJsLQd7BHjdfUCks7R9L58UqFJjskU:rnZLQd7L8C17DVqFJU
MD5 SHA1 SHA512 SSDEEP

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 860db5b3513fa9617a9370c8816eaa5fd3aa5b5b567be67f3e159331b24214cf
MD5 6103fe00cacc51f8877197d5f2140486
SHA1 96b2e28c7dfdfba1e7f72050c23f22f6b8248858
SHA512 5f7526bf32dd76f33077ee002fa34d32ff43780103b1b4f14259b634f0a3a05357896123527c5ca792fd9aecc23aa5828ae69bd6f92d676bafdcc7d95c9d6aed
SSDEEP 12288:Xv7d0NxksRpWE9FRHSfNm1wgbIxnBw7dzE+e3gxZC6LgjigDy5fdv8fWi+5:XvCks7WE9F5pwg8zmdqQjC60jiHkU
MD5 SHA1 SHA512 SSDEEP

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 362ef78844db74d65f2318af3b72173d2ce5b3bd8600bf24428d671f9eca8228
MD5 fe034db41672de3ddee44e6db3f0e977
SHA1 59c9a5f374a8b40564bc647e8da213407dfc5854
SHA512 f8cc753f51b816ca55d0a4c39334aba5ceee479950f5e5defb1089dd5f23f53665a5a122a4719e82ec06fc8109d02b7f905ee12d75e49b42ef57806088b3d391
SSDEEP 12288:0G7d0NxksRpWE9FRHSfNm1wgbIxnBw7dzE+e3gxZC6LgjigDy5fdv8fWi+5:0GCks7WE9F5pwg8zmdqQjC60jiHkU
MD5 SHA1 SHA512 SSDEEP

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 eed07ed458886e80041355132baba276b6acbda873a536613eade0eafb9e074c
MD5 1d9e4edc4ef4260121c1d46e81802bd3
SHA1 c11642e22e94822580e4d6ef2e4a8eca435cb47c
SHA512 76bc9d231923ca8fa9b410759a6633091c9e786df82800afc13b3f5f3eaa8dd77d7b0da99930701279f4b25cb1a524496ad70ee69c496b6b5596fc1dbc753999
SSDEEP 12288:ZM7d0NxksRpWE9FRHSfNm1wgbIxnBw7dzE+e3gxZC6LgjigDy5fdv8fWi+V:ZMCks7WE9F5pwg8zmdqQjC60jiHkU
MD5 SHA1 SHA512 SSDEEP

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 9c4fbc0bd1fd96ac6ddfc91f8507eca3239ad843562a81c5315890e4a57461bf
MD5 037722af7fe99df98279383776f79f09
SHA1 9749e6cbe4ccd1778b8e375735ea6c92d483d0ad
SHA512 932ecbf9dd99d22254c43350dec9393f896cfe9618b01484405323903f7245e60202cfddda33ab41099bd963a773501bc716a0982a6f85635aad82820f4d0ad2
SSDEEP 12288:gVl7d0NxksRpWE9FRHSfNm1wgbIxnBw7dzE+e3gxZC6LgjigDy5fdv8fWi+K:0Cks7WE9F5pwg8zmdqQjC60jiHkU
MD5 SHA1 SHA512 SSDEEP

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 8fc4a842d97bddb90a69d32990dbac62caa2daf1dc3e126c3194dd85db1d8361
MD5 9914840bb8349245c39efe83059f9072
SHA1 5960eda0626e8ba461e65a51b2cd73eeab00f4ee
SHA512 a3d273fefa046ac0688e96b80fd410c7ae95a18120815c3b8bbea534014fb247d74655d42f029721a7ee1cf70b3718f0295ebc03775e6fcacd26042bca88d85a
SSDEEP 12288:cd7d0NxksRpWE9FRHSfNm1wgbIxnBw7dzE+e3gxZC6LgjigDy5fdv8fWi+V:cdCks7WE9F5pwg8zmdqQjC60jiHkU
MD5 SHA1 SHA512 SSDEEP

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 d1300ae5ae57cf079dbd0592bed7743a42bbc73cd03aa2111a37fdd45b7a3147
MD5 3dbf57133b0a4636c4f882317d632f90
SHA1 65f3b0cc08477f333e59276591a0801d999c2361
SHA512 779ff90428495eccfa6f6d8c5d89955499f319f10d0c3a068048750e8291ac8cc793acad0bfa2cf00f3b905c4c79ae2e09349c682d58e8119b189d6086aeda36
SSDEEP 12288:eS7d0NxksRpWE9FRHSfNm1wgbIxnBw7dzE+e3gxZC6LgjigDy5fdv8fWi+Q:eSCks7WE9F5pwg8zmdqQjC60jiHkU
MD5 SHA1 SHA512 SSDEEP

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 86d1280284d9556cd222ce5fb0730569f4339724062c8d0a62d7bd573d609509
MD5 f3f707934b5633a8f3bc0fe4a0263389
SHA1 7c61322d933e7cc9375f26eddcd64271ee83991d
SHA512 548d124238367a2ee3e12dca117b5872cd8d0f6795692622e307196faf6577c2921bf9943d0be9db66026d5ab52282c73bed248f8a51118f5c90e46fe80c212d
SSDEEP 12288:K+7d0NxksRpWE9FRHSfNm1wgbIxnBw7dzE+e3gxZC6LgjigDy5fdv8fWi+o:K+Cks7WE9F5pwg8zmdqQjC60jiHkU
MD5 SHA1 SHA512 SSDEEP

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 d7accf464d24cebd1b4c3fc82a5e96c03bc2f0fa5942f881456b85abf24a1050
MD5 4322a95365778c763284030daf579ee5
SHA1 891af318d356e597f2a9db38d6d996d49e37a7fa
SHA512 fceb6cb33f0fced2abda363f4ca9d6caea85e0309c7cf4285ed182a1c4c5644c6be5ff77ca7d828cdd53a64918ca8dc2575f2e6af5eeae00205638fe6a7c9f3c
SSDEEP 24576:TZMRzFVSOmCks7WE9F5pwg8zmdqQjC60jiHkU:TZMRzfCCks7R9L58UqFJjskU
MD5 SHA1 SHA512 SSDEEP

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 051a0541ab27991af03964b567f83b5f996917452c7858f820904cb0cc5bac4f
MD5 52f78a09201e2d26bd8d4b25e0667958
SHA1 c8ee9b369464b88f121c074c234138e8bfa87550
SHA512 d173875b73281aa3223de6f9a2deab97198e35e94c415fe282d7b57cccceb3913fc40fd1d22c0aff216c1f33519f0b48e30fc7a75ed5475d499868705522e873
SSDEEP 12288:1D7d0NxksRpWE9FRHSfNm1wgbIxnBw7dzE+e3gxZC6LgjigDy5fdv8fWi+M:1DCks7WE9F5pwg8zmdqQjC60jiHkU
MD5 SHA1 SHA512 SSDEEP

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 835ac9bf4686480decd5e7e1ea216dfb14d8a3e7410f1d284e4a3eb64d27c326
MD5 30c572dec14421030008ea3cb44ca0b0
SHA1 7c394709ec97d313829f7a1fc3d9427f017001f1
SHA512 484d2788bc913089b16294b3e796e1110f699e97c46597a4501e1249fa946fe5462f3904c74ca5241993f8239d511be496d43c30cc1a48a47922f916138316ee
SSDEEP 12288:zX7d0NxksRpWE9FRHSfNm1wgbIxnBw7dzE+e3gxZC6LgjigDy5fdv8fWi+M:zXCks7WE9F5pwg8zmdqQjC60jiHkU
MD5 SHA1 SHA512 SSDEEP

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 306cb017d236f0d1b5c5f599c4228d974682677dfe036741a021c9b56895d204
MD5 d01bb62a59daffa45b06b13eb1403b27
SHA1 21622d49ec0af84a1eefe7238c889b106bc70ae6
SHA512 0393b51dc00f0c9d6e668932a0fd938ced5b55260036d3e154f1d23eca4e4e4f7f9f7250a8fcf88b71f27ee53aa4a9dd00b1ef596af80277b3771b75c1e2d746
SSDEEP 12288:hD7d0NxksRpWE9FRHSfNm1wgbIxnBw7dzE+e3gxZC6LgjigDy5fdv8fWi+Y:hDCks7WE9F5pwg8zmdqQjC60jiHkU
MD5 SHA1 SHA512 SSDEEP

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 88aa2873309b94c7322e02c185ce336267b4deb97d7ea91bfa2e5ed39d9832cc
MD5 4261c380f0ed224a5a061cbc4ec77f8c
SHA1 dbdfa9377e83b1036c97959eb2c1876d9e52bd2a
SHA512 a923745ef3f3b04045b1b1663d56a3fdfe0675ec1107d8d7e8c4ba57bb84b5a61e8b527d2046c6ff5e5bd6074796f6e27ca5d7db5c00a5bd3030101874334491
SSDEEP 12288:tD7d0NxksRpWE9FRHSfNm1wgbIxnBw7dzE+e3gxZC6LgjigDy5fdv8fWi+Y:tDCks7WE9F5pwg8zmdqQjC60jiHkU
MD5 SHA1 SHA512 SSDEEP

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 042203c6095c6da4508e0acce68b98dbd7fc47a14542eb8bb6afd86f9fe92722
MD5 30f818d17a426b7656cdd923e7e458e1
SHA1 80b41a161f6f1dacd11ac3ebdb6f1444567a0cb3
SHA512 b1906ea7df0119f0a81e0c54a15f9e24841acd3c7786ec4d02c8bcb950f4594ccd87c801104a6af8ad2970534a5f0c1069ddffe29d79e65d6df4f389a16142a2
SSDEEP 12288:dyPz5L8a7d0NxksRpWE9FRHSfNm1wgbIxnBw7dzE+e3gxZC6LgjigDy5fdv8fWit:UzyaCks7WE9F5pwg8zmdqQjC60jiHkU
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 9d746ffc5284b24a605e592d15246d634abf7cfd9740e10ace68d9dde93edcaa
MD5 1e1f99d281e43e7f416470665736bc65
SHA1 8270011d50fef8da2327579f514a58574b24c482
SHA512 b2bca95ae7638c0afbc3de3fb87ddfcc3a43d0882408a4f8847ceb0e77f051bb6743b25cf0e09f4c64416e2138f6f47c831b4c2e198c9fe8d5060abc5b1146fb
SSDEEP 24576:fTDaLl3z0zDcCks7WE9F5pwg8zmdqQjC60jiHkU:fTuLljRCks7R9L58UqFJjskU
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 2dd32de9eb0ee7807e7ba1647f1a70a4ad823e66ec52335cd561ec6436232a78
MD5 518c387be72a9c4e84f597c543fb34e7
SHA1 c996487705faebedc5df068513e02e9297028910
SHA512 13f57f5743e61bfbd193b7f2161ef4f3a8b857d1dd94046e38be68d10ec2cf6a58ee79041b52d47daa98527bf782b207535b5fa1368f0db43f37056f93c2ab67
SSDEEP 24576:s3vd9CHKy7GZYCks7WE9F5pwg8zmdqQjC60jiHkU:Wvd9CHKyaCCks7R9L58UqFJjskU
MD5 SHA1 SHA512 SSDEEP

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 fab026108b5fa1186018c1a62d6b9b0b715862a2e3fbfd8585d9416efd883dcb
MD5 78722395b6ab7ac5a24d5b2ccb2bff1c
SHA1 dbaf5a5c1a56ceee962834e6a56530547bcf380f
SHA512 2b87fbbed9fa8226f24d2d7313695579216c0f4377fb4d307b4048ee5c517b27154c9fb328d1af03690bfac1e6eb462317779b6d74b34b09db366fb0b2f95021
SSDEEP 12288:Ms7d0NxksRpWE9FRHSfNm1wgbIxnBw7dzE+e3gxZC6LgjigDy5fdv8fWi+x:MsCks7WE9F5pwg8zmdqQjC60jiHkU
MD5 SHA1 SHA512 SSDEEP

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 66bca6615275b280512093c8e31bb26c07315bdc71f26a31576f1cc83b021b20
MD5 ba5bca285bc74e5b08b59ef7ab7044d7
SHA1 0be17161382a1e43f2e2dff06b288d98e597c20a
SHA512 ce020d60acdada0c7fe14b961afc2e76992cf89b827048b8ae6acba9ff23146b1fa4eb3336bb81ac81ceb19722a2ee91780ecc494d0d326dfdd2b40db0dad9bc
SSDEEP 12288:i67d0NxksRpWE9FRHSfNm1wgbIxnBw7dzE+e3gxZC6LgjigDy5fdv8fWi+0:i6Cks7WE9F5pwg8zmdqQjC60jiHkU
MD5 SHA1 SHA512 SSDEEP

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 51a77ec1c0b2602c446d22db5adb1659042e64461874629ec47f61244e6c8da2
MD5 9a920185d07b9d6c276d304e67d6789c
SHA1 e9da8e563e3065a17ef323feecdea62b35cc3dc1
SHA512 3a02de6e0f6c044f26aa154afb112e61bfb18126cb19848f766052153976001b154ba896bd02cce93c5a258e57f2e294aa8e7fd5931647fa8c2069dfd637f720
SSDEEP 12288:TJ7d0NxksRpWE9FRHSfNm1wgbIxnBw7dzE+e3gxZC6LgjigDy5fdv8fWi+w:TJCks7WE9F5pwg8zmdqQjC60jiHkU
MD5 SHA1 SHA512 SSDEEP

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 ff237bb81bacba4a7ce4effaac07261867fc36458858a7de3609e58e9a32a1e5
MD5 e9b13de6b858c874df8b0e99ea073ea2
SHA1 f1a0b82527624a417b775824fcb04e8fc2a4d2e4
SHA512 b7036d4969341bf4b214ea727685a7a16d0a98c5f0654018b6af324aa6f65d3efb62dd67bf0cd393a593ce0de9e80514734fa6bd327f32e5279a3312223169de
SSDEEP 12288:LD7d0NxksRpWE9FRHSfNm1wgbIxnBw7dzE+e3gxZC6LgjigDy5fdv8fWi+w:LDCks7WE9F5pwg8zmdqQjC60jiHkU
MD5 SHA1 SHA512 SSDEEP

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 884dadc26c5b7cfb4e7d03c74cd48f2ef52c92601271ab2f71b31bb55488fc2a
MD5 985751475297825418cd724d185ef342
SHA1 b3b852795a9ca4419e7f187a413920b72d69f7c4
SHA512 a1d31e0b261765ccb38c8b4c91dc62a9bd220272bb78f53e4a43f585ce122131d4e7f8bbee1b74f8e3c1c07c85d3b9242a163737b1f03afc6fa5c3a8e4f9ad10
SSDEEP 12288:fs7d0NxksRpWE9FRHSfNm1wgbIxnBw7dzE+e3gxZC6LgjigDy5fdv8fWi+3:fsCks7WE9F5pwg8zmdqQjC60jiHkU
MD5 SHA1 SHA512 SSDEEP

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 4c81032ff5ff92c3bb366eb15d691a05e73736d11e8c5fffbcc368540d7e12a3
MD5 b1426094b0e3f7ae8c884bf44490f5d5
SHA1 a58bc29b11f9274f662b943f06cad21a943a899a
SHA512 894619de2db56102bc99be00379301875043fe08ca53703a0dd0235cfb8f15c1d102f8939d9112cdb206ae18c0f778cb8b73958420933e757c54856845fe7a04
SSDEEP 12288:Q77d0NxksRpWE9FRHSfNm1wgbIxnBw7dzE+e3gxZC6LgjigDy5fdv8fWi+b:Q7Cks7WE9F5pwg8zmdqQjC60jiHkU
MD5 SHA1 SHA512 SSDEEP

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 65f69a73d3576f2adae2715e7b448f2e9a35fa21df1a646b0d3c4c117c655c1b
MD5 9d9339d1ce8dfa1f7549711f2c157ec5
SHA1 93176c4079915efaf8e9453b4c351c5b49775c7d
SHA512 67001f2fb3788e7b322e71edc400f3def06e157521fdacbecf3437ae4cdb381354de0bddadc3d10d8c24ea61f730b34d7f6ae7e2af07fce408beef7ff8e7bf13
SSDEEP 12288:/F5q0Si7d0NxksRpWE9FRHSfNm1wgbIxnBw7dzE+e3gxZC6LgjigDy5fdv8fWi+q:/FSiCks7WE9F5pwg8zmdqQjC60jiHkU
MD5 SHA1 SHA512 SSDEEP

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 385b79baa85a22250c8ecb1d7bce75217726f251fe5afc340a86e29674d2d9e5
MD5 8baef5453eb23db8e5319f4ff6ca3e5c
SHA1 140dd86be132a88fcaca319bda355ef4e3828263
SHA512 1b2d887a76a440eba68465c8be3aadc952119547933bdd9fa5402ed81ea6f28896ed0065de0984a698ee408fdedad81f7e9097d51b467dfe72e959a0e1fa0697
SSDEEP 12288:BU7d0NxksRpWE9FRHSfNm1wgbIxnBw7dzE+e3gxZC6LgjigDy5fdv8fWi+J:BUCks7WE9F5pwg8zmdqQjC60jiHkU
MD5 SHA1 SHA512 SSDEEP

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 3cfdc971b3299a77327488e0d96f8268aaabba5ed71ad7727df5de26197372bb
MD5 65cf438397fc5b20eb88c1f55642efd6
SHA1 3a0f07e246352fa57aac8de6c17d96a2eb0457bc
SHA512 8c49754eb2d85e66dc67aab23714efef4eca6b34c24aea93b1471e0dba349fad7d95f614a440e84a9fa0127acce674163c6c48fde5cd3976acab2a3d7a80c1db
SSDEEP 49152:Na0h2GEkuAe73q3pp46zwwQ2Cks7R9L58UqFJjskU:Na0hNYG4JwpC17DVqFJU
MD5 SHA1 SHA512 SSDEEP

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 aff65ae619299ba1a8003f00913a8094aeedbaeee98d115a34767b68cdb7134a
MD5 10fd2bf1ed9ac089547e0cb66ff370a6
SHA1 5624e8c40a6d238b2075478b93e1fe9b833ab595
SHA512 e33eabfa6cc8821396286f0af9e7a1fa40ee5bf6ef0afa4ccc9a93ae442828f830fbb0ba795e3936fb4de1ed9c16b70b44880168ae67515363a4930564e67507
SSDEEP 24576:AhbHjPFCks7WE9F5pwg8zmdqQjC60jiHkU:AhbHjtCks7R9L58UqFJjskU
MD5 SHA1 SHA512 SSDEEP

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 f05b79ccc9e003e1718d2394b99f829b38a620d2464b6479cb914591ca99f5b8
MD5 5d1e14da373ac8fbcc13305cdc8d8628
SHA1 9540f91ddc5fa926c776fab21e4c3b2907fd98bc
SHA512 bb2b773d3007842369e1f76fbf19d9af7b6a1561907efc95aa697ab545c7c2956a1d9581866d89de3e0fcca0a10082b11437ad41de0958f547aa0e09d722de9d
SSDEEP 24576:s3YgnJcRTk4yti+R5dpR/9Cks7WE9F5pwg8zmdqQjC60jiHkU:sIgnaTk46ppR/9Cks7R9L58UqFJjskU
MD5 SHA1 SHA512 SSDEEP

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 b4a719ba4cd87ed5fbab9be2179091f8b6cfec2784df7dedaf0ba8ccf6b8f331
MD5 04e24b895ded1327e09e78b1913e605b
SHA1 ea537dcc0c4bb842564172af60b46a84ef4570a0
SHA512 ab77375d98ef81af3e6d4c1a219fa30daa999fd2ce17da3a90cf6be816a191f16604db60dd45f4046d4bca7dfa15347c28135c0718ef0ff97cf8746cb91e8488
SSDEEP 12288:Bw7d0NxksRpWE9FRHSfNm1wgbIxnBw7dzE+e3gxZC6LgjigDy5fdv8fWi+8:BwCks7WE9F5pwg8zmdqQjC60jiHkU
MD5 SHA1 SHA512 SSDEEP

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.5MB
SHA256 e920362480306acbecf7a0893fac0be8d896d5ae500e406077e59d63c2450851
MD5 391c572514e1af57eed6dfeb306056e5
SHA1 77ca8f465e4e106a5fd3d86660aaaad0b9c2425f
SHA512 fce63c13b9867f1bf5845f109e35f56271c52a5e40034a2cbcb9b3ad06f1a6e9c51aa65d175deddcd43879b63c8345929eb07c26ea7bba21cdbc3f27d6926ce2
SSDEEP 24576:LbL3UTXCks7WE9F5pwg8zmdqQjC60jiHkU:LbL3UzCks7R9L58UqFJjskU
MD5 SHA1 SHA512 SSDEEP

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 8a598bdde3917710071974d683872f907538a2e75299cc5e91997939ce93ee09
MD5 18e49cd3859ff79c59a907d4efbd8f52
SHA1 cd387773ac422f42583fff961f2a49df8db0180c
SHA512 1a3a1de0494569f6fafb608149505f21e744d8272cc74e2ca3d511df273aece13e18d61f95908d905d54b49ed0334ad06971d50efd4a8bfb1f481685a8ca91ef
SSDEEP 12288:opFtIOT7d0NxksRpWE9FRHSfNm1wgbIxnBw7dzE+e3gxZC6LgjigDy5fdv8fWi+u:DOTCks7WE9F5pwg8zmdqQjC60jiHkU
MD5 SHA1 SHA512 SSDEEP

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 c57710852fcde60d689258a464c88bd68c5bd23c359d52082081326e0275d8ba
MD5 9660ec562b2c3bc709c3aae5921a7fb8
SHA1 c10262939f8d4a750257d47ec96dade52efab585
SHA512 ac69a3207c5352afa794118e04ce1139ad6de4a4ed4b019d02c38186aefd8ac9255d6bf690a6151839a5c7a3b184554db396f77759b7b8a174c900f6bb098700
SSDEEP 24576:V7NM9YmZqmWMUkPjZM48Mv6bEhsECks7WE9F5pwg8zmdqQjC60jiHkU:V7cBWMpPjN8DbEhlCks7R9L58UqFJjs5
MD5 SHA1 SHA512 SSDEEP

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 0d7ac5f2385bbaa340190286c361a5d32d7b75c40d95e85ef1553d06dcf73fe2
MD5 b791465a0461e60a95eb62f729793373
SHA1 1800deea5777adf58d35a269c6aa1314fcb2fae9
SHA512 ade9cacf1735e724b24f25aba9d3498ef632c5e6f1369cdadee5a60920d3a2657355936157791e8c57392e4759789edefba46e72ff41dc522df581b1d9d5e1b0
SSDEEP 49152:IF2YuHNETovcvNYf8kmkCks7R9L58UqFJjskU:N6tCf8kTC17DVqFJU
MD5 SHA1 SHA512 SSDEEP

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 09303a09670da38537e6fe93f3cf0a81f331f5684e1d1b09219ffba28504cec1
MD5 df92f202b5e2cc04a64715f8336566f9
SHA1 427ea2c4dd5ad8695148cb1ec7ba55a95c113730
SHA512 b357cf8e91ca921522c4a0247f2b89c26a4dad8126e2d0edf30d0206d6039f16e2e166f8617ecee5c801f9818e5ea6cd320872a92afc568afb88ffd985fd2813
SSDEEP 24576:AAFs06+OmlfkNXEbTo/Cks7WE9F5pwg8zmdqQjC60jiHkU:VFs060lwXuWCks7R9L58UqFJjskU
MD5 SHA1 SHA512 SSDEEP

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 b7752feb8940f19163bd3497b8438bcfd468cda58edd3a51ec1c1b24eef6ca1b
MD5 cd5ecd7af78df6ee46c1f57a3d3127ae
SHA1 746a174aa8913d828dcfd1605a6df9d3344156a0
SHA512 b0ec93a32387eb9fa5de8758ee320a008ad6d27666b4ee3913937082c6e439844bfbb1f75418cb69c3f9423d61830c9c177f9001bd06ba090a8b2ef743912cbb
SSDEEP 24576:5JnJ5D3WtWCks7WE9F5pwg8zmdqQjC60jiHkU:5JnJ5DGtWCks7R9L58UqFJjskU
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 63c1e3755f5030262b0a956ecbb5f29a6a763792961dd386a1d9243f2bd50c62
MD5 1ad1da6f99048f787fdbf1444bf6acd5
SHA1 64920229c9b82b6eaa285b236af30aac9e67a655
SHA512 1826b03285b20adcdbd864a0151318417db19deffc14748adb4168c5a8a9fba45d9bf6961e1da9e933f92152c4d7fe3acadebdcc3d8bedc3e243041ebb892d2a
SSDEEP 49152:Qo06DIKdwc+eQnSt65aV4Cks7R9L58UqFJjskU:96C17DVqFJU
MD5 SHA1 SHA512 SSDEEP

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 8d2c5513992d7f972ce7e1ade1dbd3d173b83e70cbba0fb1e4985072c080fdbd
MD5 61c525ed07a2436a590fb71767d2d533
SHA1 517aa6b874e01b1d60be0427927d95c272f1859b
SHA512 3e931efac0bdec03373a8bf0e18ac2c78635fac0f7678502bd7d653f1889af91348345a2d60bfcc58481ca70421df17b3c1dae5895e08cfc1ba898a27111a02d
SSDEEP 12288:gEP3Rre7d0NxksRpWE9FRHSfNm1wgbIxnBw7dzE+e3gxZC6LgjigDy5fdv8fWi+F:7reCks7WE9F5pwg8zmdqQjC60jiHkU
MD5 SHA1 SHA512 SSDEEP

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.3MB
SHA256 f244c53695f732b41b6e32821cac925bb5c5f73ab19f814101d2460c69b8b796
MD5 33934fd44f07edd97a55a54a2b3a93e2
SHA1 ca1130c5ac6f2f22a671b90e9a48cc79fbfcb522
SHA512 0b71dd025763aa18205cec3f54258548e836863809fb213d47330e2484dd9378a619405ed3dbf3cde0708e0915d222bbdfd95394019702601c46184aa9b6bf28
SSDEEP 12288:gjkyV7d0NxksRpWE9FRHSfNm1wgbIxnBw7dzE+e3gxZC6LgjigDy5fdv8fWi+X:gIyVCks7WE9F5pwg8zmdqQjC60jiHkU
MD5 SHA1 SHA512 SSDEEP

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 f8c5c645c502666a0e93cd636ca796256bc7a970f3494aec99e47917d7826db0
MD5 7e324fa4b1c7e2b35c0d9753af41ddd9
SHA1 638231ffbd767b7bbc14a1fcd85110100b196df0
SHA512 61aa12bb88c257312608846d080d632f1262e08e6e00e73ea4feee2abad8bd52c21eae9a23bcf88d6d800a011da2cdb359e75f77a0d3407bd845ae960f9cff0e
SSDEEP 12288:JFj7d0NxksRpWE9FRHSfNm1wgbIxnBw7dzE+e3gxZC6LgjigDy5fdv8fWi+Q:/jCks7WE9F5pwg8zmdqQjC60jiHkU
MD5 SHA1 SHA512 SSDEEP

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 b9cd2870cbe7a0c9c0fb71dc23bef2e2df972610233f12e25e9df758e84ad194
MD5 6834b3b9b1151c4328006a695fafa4a4
SHA1 345a5ec07f057c2cba0a13b320695d3832d4e713
SHA512 6e68074ee572f68ded3c6087246c6ec1ee3f2b0fef971829f02edc187df8cc32efccb69f92bc042e305363b54748be401d3d3ecbb4111ffd1d32fb004d54751e
SSDEEP 24576:LQ9MxZKdcz97w3MCks7WE9F5pwg8zmdqQjC60jiHkU:LVKXMCks7R9L58UqFJjskU
MD5 SHA1 SHA512 SSDEEP

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 90a551bf921ee1386a4f9343f8e78ccd2fe767c1c3113945573b29def9869a0b
MD5 bc659b3b49d21ef3b7c78006c1c1a079
SHA1 a38c7192582ebef834322d27041e9e72edf2ca1c
SHA512 6452db9b46d18d3838e9119ceb6ac3dbaba63a0d5f1abbba55b47486be3325289ebc6ba8ecaf7160373b53102f856755c135901e0a99a5c019361470b30dcd9a
SSDEEP 24576:QyocxApxCks7WE9F5pwg8zmdqQjC60jiHkU:docxApxCks7R9L58UqFJjskU
MD5 SHA1 SHA512 SSDEEP

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 d7157aadd454b44d77282ade076c1adbf78e51f687461864c566a81f80b2ed80
MD5 24d6797ce971e78d94a3d8d762c2be1e
SHA1 dde4c900795caf40ead68dc3f1974228ebdee342
SHA512 86cfeb142edde708d725c41e7a704cc0e75675622727cf55faf03b0a5ae9b23864d4b5a181def2c4117f9b6cad6cc3afc4334f13711995bfe326d4fb47996e1b
SSDEEP 49152:LWcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIKxCks7R9L58UqFJjskU:70zuNINC17DVqFJU
MD5 SHA1 SHA512 SSDEEP

Submit Download

office2016setup.exe

Path C:\odt\office2016setup.exe
Size 5.6MB
SHA256 30cd2b5831d5d85dceec412b00d776b190c92f3ea1e0e556e2f3762ded39b2c7
MD5 c53389252e728cbed32c1c9e522ed675
SHA1 a697ce39aac25bd7a729faeb9201fc39eed7c9f7
SHA512 f8615971f3437918ee2c5d2d51ff57aa7f7112b987b1cb977eff4af51b2a293df5c794ec6aeca2dd387e7ce25573886396ea6a917e62e47f87ea59abdf1d78d3
SSDEEP 98304:07M701RgX4iuSl1DtlEq81xZPGnzURnBh6gGv/QmvD/cTwY2h3FOC17DVqFJU:OM7pTXexZPGzURnBh6gGvF+W3UiD4bU
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/232-413-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/232-344-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/232-353-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/396-367-0x0000000000530000-0x0000000000590000-memory.dmp

Download

memory/396-426-0x0000000140000000-0x0000000140241000-memory.dmp

Download

memory/396-358-0x0000000140000000-0x0000000140241000-memory.dmp

Download

memory/464-352-0x0000000140000000-0x00000001401EA000-memory.dmp

Download

memory/464-297-0x0000000000BC0000-0x0000000000C20000-memory.dmp

Download

memory/464-288-0x0000000140000000-0x00000001401EA000-memory.dmp

Download

memory/1532-411-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/1532-547-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/1532-402-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/2076-300-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/2076-365-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/2436-395-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/2436-386-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/2436-398-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/3476-372-0x0000000140000000-0x0000000140221000-memory.dmp

Download

memory/3476-379-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/3476-439-0x0000000140000000-0x0000000140221000-memory.dmp

Download

memory/3624-8-0x0000000000920000-0x0000000000980000-memory.dmp

Download

memory/3624-0-0x0000000000920000-0x0000000000980000-memory.dmp

Download

memory/3624-7-0x0000000000920000-0x0000000000980000-memory.dmp

Download

memory/3624-11-0x0000000000920000-0x0000000000980000-memory.dmp

Download

memory/3624-13-0x0000000140000000-0x00000001401B9000-memory.dmp

Download

memory/3624-1-0x0000000140000000-0x00000001401B9000-memory.dmp

Download

memory/3716-548-0x000001B15CEE0000-0x000001B15CEF0000-memory.dmp

Download

memory/3792-464-0x0000000000900000-0x0000000000960000-memory.dmp

Download

memory/3792-454-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/3888-73-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/3888-66-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/3888-64-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/3888-239-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/3964-61-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/3964-65-0x0000000140000000-0x0000000140209000-memory.dmp

Download

memory/3964-50-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/3964-51-0x0000000140000000-0x0000000140209000-memory.dmp

Download

memory/3964-57-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4012-236-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/4012-41-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/4012-46-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/4012-39-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/4220-272-0x0000000140000000-0x00000001401F8000-memory.dmp

Download

memory/4220-339-0x0000000140000000-0x00000001401F8000-memory.dmp

Download

memory/4220-280-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/4220-342-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/4304-15-0x0000000000700000-0x0000000000760000-memory.dmp

Download

memory/4304-16-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/4304-228-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/4304-23-0x0000000000700000-0x0000000000760000-memory.dmp

Download

memory/4432-448-0x0000000000680000-0x00000000006E0000-memory.dmp

Download

memory/4432-441-0x0000000140000000-0x0000000140205000-memory.dmp

Download

memory/4596-323-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/4596-383-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4596-319-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4596-393-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/4652-400-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/4652-340-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/4652-330-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/4732-235-0x0000000140000000-0x0000000140237000-memory.dmp

Download

memory/4732-29-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/4732-28-0x0000000140000000-0x0000000140237000-memory.dmp

Download

memory/4732-35-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/4740-264-0x0000000000940000-0x00000000009A0000-memory.dmp

Download

memory/4740-270-0x0000000000940000-0x00000000009A0000-memory.dmp

Download

memory/4740-256-0x0000000000940000-0x00000000009A0000-memory.dmp

Download

memory/4740-269-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4740-255-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4808-423-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/4808-414-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/4892-244-0x0000000000580000-0x00000000005E0000-memory.dmp

Download

memory/4892-312-0x0000000140000000-0x00000001401E8000-memory.dmp

Download

memory/4892-251-0x0000000000580000-0x00000000005E0000-memory.dmp

Download

memory/4892-245-0x0000000140000000-0x00000001401E8000-memory.dmp

Download

memory/4996-436-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4996-428-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/5072-305-0x0000000140000000-0x00000001401D4000-memory.dmp

Download

memory/5072-313-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/5072-370-0x0000000140000000-0x00000001401D4000-memory.dmp

Download