6de0066ab407478c51f6ebfec86a9235d8b5dfc7d39bcd498d303508bddc5cd2

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
04/04/2024, 10:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-04-04_1f3fb1aa7d0c8edb817cd408f1d55ebe_ryuk.exe
Size 940KB
Sample240404-m2wntach91
SHA256 6de0066ab407478c51f6ebfec86a9235d8b5dfc7d39bcd498d303508bddc5cd2
MD5 1f3fb1aa7d0c8edb817cd408f1d55ebe
SHA1 916e018c673671ff08266c6bc5b134e1ba4651dd
SHA512 3f0231f226dd4cd15fd9e14777e94edf6265db405a949d0c692a9d033fad9ac19ed570d761b5879d7ef2346310a7172c0864992cd55b7dc9dd831a8e987648f7
SSDEEP 12288:rOb9A4LWOsvAYFTqa6CaQ0BaNid7Nj88pSaAPO3A87JBGSXuMXRg7ZVh:0pL3UTj6CaQulhoMXX7lu
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
4460	alg.exe
3932	elevation_service.exe
856	elevation_service.exe
1084	maintenanceservice.exe
4776	OSE.EXE
3860	DiagnosticsHub.StandardCollector.Service.exe
1728	fxssvc.exe
1900	msdtc.exe
2884	PerceptionSimulationService.exe
5012	perfhost.exe
4336	locator.exe
3080	SensorDataService.exe
3952	snmptrap.exe
3796	spectrum.exe
1948	ssh-agent.exe
2416	TieringEngineService.exe
3056	AgentService.exe
1388	vds.exe
1612	vssvc.exe
412	wbengine.exe
3928	WmiApSrv.exe
3604	SearchIndexer.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in System32 directory 24 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2024-04-04_1f3fb1aa7d0c8edb817cd408f1d55ebe_ryuk.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\1b9a2a9a822cf6b9.bin	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_75875\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_75875\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_75875\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\106.0.5249.119\chrome_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e919582f7f86da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ac55532f7f86da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000eacfec2e7f86da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000288e8c2f7f86da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a2f8d42e7f86da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002ac7a62f7f86da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
3932	elevation_service.exe
3932	elevation_service.exe
3932	elevation_service.exe
3932	elevation_service.exe
3932	elevation_service.exe
3932	elevation_service.exe
3932	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
660	Process not Found
660	Process not Found

Suspicious use of AdjustPrivilegeToken 42 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4500	2024-04-04_1f3fb1aa7d0c8edb817cd408f1d55ebe_ryuk.exe
Token: SeDebugPrivilege	4460	alg.exe
Token: SeDebugPrivilege	4460	alg.exe
Token: SeDebugPrivilege	4460	alg.exe
Token: SeTakeOwnershipPrivilege	3932	elevation_service.exe
Token: SeAuditPrivilege	1728	fxssvc.exe
Token: SeRestorePrivilege	2416	TieringEngineService.exe
Token: SeManageVolumePrivilege	2416	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	3056	AgentService.exe
Token: SeBackupPrivilege	1612	vssvc.exe
Token: SeRestorePrivilege	1612	vssvc.exe
Token: SeAuditPrivilege	1612	vssvc.exe
Token: SeBackupPrivilege	412	wbengine.exe
Token: SeRestorePrivilege	412	wbengine.exe
Token: SeSecurityPrivilege	412	wbengine.exe
Token: 33	3604	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3604	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3604	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3604	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3604	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3604	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3604	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3604	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3604	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3604	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3604	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3604	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3604	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3604	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3604	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3604	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3604	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3604	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3604	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3604	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3604	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3604	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3604	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3604	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3604	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3604	SearchIndexer.exe
Token: SeDebugPrivilege	3932	elevation_service.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3604 wrote to memory of 1244	3604	SearchIndexer.exe	122
PID 3604 wrote to memory of 1244	3604	SearchIndexer.exe	122
PID 3604 wrote to memory of 4032	3604	SearchIndexer.exe	123
PID 3604 wrote to memory of 4032	3604	SearchIndexer.exe	123

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2024-04-04_1f3fb1aa7d0c8edb817cd408f1d55ebe_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-04_1f3fb1aa7d0c8edb817cd408f1d55ebe_ryuk.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:4500

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:4460

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3932

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:856

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1084

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4776

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:3860

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:1956

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1728

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:1900

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2884

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:5012

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4336

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3080

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:3952

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3796

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1948

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:3748

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2416

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3056

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:1388

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1612

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:412

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:3928

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3604
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1244
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
  2⤵
  - Modifies data under HKEY_USERS
  PID:4032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
Size 2.1MB
SHA256 27c948d437a595ec6c289395207cbf80247755cb0d9ecf98e5bc2ca108391495
MD5 8a19300aefeb2957adbe240311916468
SHA1 cb494481ae65ea10d3fce13bf9661267e1367a52
SHA512 ac5f0094218ef3e6585aff00fdc1b26f7473e3fc4df74a97dcd793ef12e2d4c1d074808adea2e6c4dd1a7f19f6bf192716340d255dbddd967cc9c714b27d805c
SSDEEP 49152:0uYk3H5koUXfTqkkYLO/W2buywzMbOX+T7z5qCTulhvXX7:0PfTqi90bGphvH7
MD5 SHA1 SHA512 SSDEEP

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 781KB
SHA256 19dfd672e13d945ef4405ad2532a222d47298f8501a76645c2381124ccbf7802
MD5 bbec511e6527a8e357bfed6d0f94fcef
SHA1 c033a45af7570842ea74fb47f0f42f1519e75a6e
SHA512 7ccf3f60fed435f5269c87f05ac2dee87faa1013795c8208812dba6bbd9fcaf967860e175489df6c32e40f21a70fa7b0cf924b9c5397d95b602af0c5a821bb34
SSDEEP 12288:GC0P9Q/Jcuipa6CaQ0BaNid7Nj88pSaAPO3A87JBGSXuMXRg7ZVh:iPsJcuiw6CaQulhoMXX7lu
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 753f6bff767c3b049ccff0103c6e7d5b697ef4b8154e529bbe51ee6e350297bf
MD5 fe4d10aaa2c2d715832308793a498096
SHA1 ab7c37031a89a992bb2d1daad2353022b3465836
SHA512 0cbfde02625406a4d33b555d24e50266a670c5e4affdc6858de45a4c102a6951870d5945eec1d7bbdce5c96f517a6539dcc72c5e5bd774bf3766b69223ede311
SSDEEP 12288:+7a3iwbihym2g7XO3LWUHfh4Coda6CaQ0BaNid7Nj88pSaAPO3A87JBGSXuMXRgh:/+gkEVfh4Cok6CaQulhoMXX7lu
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 fc622d648e9216e8cb06d8ccca5b8df7c5d87e7601f9cbe184fb7763329fbbcb
MD5 98260c9cf299e7fbf0f634b456de288b
SHA1 ccfe8039c9405bff765ad2efae29774e949d7f5f
SHA512 658226d2d4b9c7f479f40677f2ccb9e25b8a1f8d19b6da4121a07b83148b6b700054289f1a34f38a3c60af214585e0d6459d3f9113875dc17b1116cbce778a57
SSDEEP 24576:/BpDRmi78gkPXlyo0GxjrL6CaQulhoMXX7lu:pNRmi78gkPX4o0GxjKCTulhvXX7
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 5b4aa71c59eb9b67c00671757e72aab4290daaf75e7c93d94930cf27f7f88fbe
MD5 8a74d5fba254ce068d8b923aae25c0fa
SHA1 9cec529b14ac057ff7fc57132960d7f5be2ce0c8
SHA512 727eef030d1f216ca52d2e2605bbb0f9c662a06a7b85cc696597c29460bda927b524b75bfc537e1f1e1488c397cffb3f2713ff5e6c911730e3e9589984bd8a88
SSDEEP 12288:YfC6Aj+TN5uixZN+8rKhUdTC/wE1MD0Ca5ZIXVda6CaQ0BaNid7Nj88pSaAPO3A9:ELOS2oyPIXVk6CaQulhoMXX7lu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 87084fe935b900b2aa20a747ae4f588a564c4fc91c0bc7ec595398f1c8e64a91
MD5 b4080dfc62c3c7f33a11e0198b9c9190
SHA1 bd164c0aa599490908278103133952719f2996df
SHA512 5757c6e3aea9b8a50bf3b125a7beb7cb8a87a9534bb06ae8effdfd0032cf356869e2b18baa7ce3f00d8d1a7c3455395e6607d2714214e8e7dc82bb9ed8c3ef93
SSDEEP 12288:cfza6CaQ0BaNid7Nj88pSaAPO3A87JBGSXuMXRg7ZVh:cfW6CaQulhoMXX7lu
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 34c28a7ce40820f0511cd12be7fdee019c7a5adf3669c19bb3e6a02ca279bbf5
MD5 20aafa7a94ca877b899fb337af44d127
SHA1 2cf4f245d16607bba2719886832dd32f85b6a6e0
SHA512 9ea8827b587e3ea897e54ce4517752a67f1ecd0e12eec187c3d95cad878dd27fbba082f6a29839beaf7401a4881d6b6e5b2087a8995a09d4ec0a290de9daf663
SSDEEP 12288:3eBNUbTVO86Uwa6CaQ0BaNid7Nj88pSaAPO3A87JBGSXuMXRg7ZVh:3JIUl6CaQulhoMXX7lu
MD5 SHA1 SHA512 SSDEEP

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 9c9de0ef5b1a0620b5ca27a8de0fbb09bc09f8e50800f01657bf2e4a133a8329
MD5 24cf5549e8d3e0b0018e77fa7e9679ac
SHA1 a84b41a20401dfa35c3a6aa292698589e60e0c78
SHA512 0ed6e053fbe99c4cb65c0d9a3d0cf4cc0ceae68ae1b83ec57794155609c1846ce5230437be2e72477949a161e56c41cd3f4357f69165c8a5e3ff878c0e79c5d6
SSDEEP 49152:lQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THW:lQvGAdlCEL8c/yRNw5C7phvH7
MD5 SHA1 SHA512 SSDEEP

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 c8fec8f9bad8ba4084f27bb557a0c120e0d9825a457c53b8c004a1d08f6e8c61
MD5 ca4db81d5b2cfc862a5a067366db5b10
SHA1 93a9470abe6ca151786ff7e524859bb81bac691b
SHA512 b1433ba770b000b8ee269ee3b00148470bfd57163c4a369bfcd2082f4dbc2825a81644c0fa1e4fdd51a56c3a2b712c371e26fbaa760742edf4131cfeab4b102a
SSDEEP 12288:ZAwSfxL/2Dc34DLLmt0LDQewsAj6a6CaQ0BaNid7Nj88pSaAPO3A87JBGSXuMXRg:KdewsAjz6CaQulhoMXX7lu
MD5 SHA1 SHA512 SSDEEP

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 0e0d70af062798a85371163a67e32c9124d515e0365760dcf6f0f29d6f490c35
MD5 df94157498c669d5b77fd7fc1b4bb9a7
SHA1 9a32da1cafa4063777ce1b9c93076011a53b9061
SHA512 a6542bc5c3d1ed8f5a9c4fa563bb7567fc5ebf2fc8450bf3f16e51803ca939bef89f16503921bf553064fdabe4feda533553e12172c88a8316d01ffc32f9662e
SSDEEP 196608:sUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHuppb:sUEtQevvqc2W1cpV2EI320p
MD5 SHA1 SHA512 SSDEEP

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 98e2aa8ddc21e7c91ed5547df162afea76d25571bd44a7ceb925f4f7650ff32f
MD5 f20775104f5fc94d5a06ce25364837a0
SHA1 2b1c0483c6616eb28f1f6aa6f351e364c769d476
SHA512 5e9789707f3fb01752b14168e0b19254d44810d4a8c3defd0377dad8e3f58b7376987484989efd412a50177d5b384c7694599a4139eba1b0b59d81211722aaee
SSDEEP 49152:LCbRquA/m2yL5zifFiV+XenmE3/zmCTulhvXX7:UoqHVjnmnphvH7
MD5 SHA1 SHA512 SSDEEP

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 3db6221c7f906e704056934076937c6d6db564cb29ae0e910526e8b9f8024c6e
MD5 4a307fdd9b080ea432ed1c2918782d2a
SHA1 58bec52c62acf67f6298c6788230588ae537a138
SHA512 628d63488ecf699a5a108eca51947401c30eda8801876ba7ae5f71fb9443e797b0f34f7c210dc9ac106f632006ef3539e3eebc1c4b4abf8709d87daabb0e584e
SSDEEP 24576:YAhGLJIFoiwtA5l7S5306CaQulhoMXX7lu:YAMyFoiq5XCTulhvXX7
MD5 SHA1 SHA512 SSDEEP

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 9b327191b48d2e3581eb67e5746c1ac3ebac1ccd947f8f47347c4a67fa7237f7
MD5 abb20a503fb0e47b67d1a101c75b984a
SHA1 b72d28a32a30d0049f1ba3e8bc9ccc85d805ba45
SHA512 da7910e84bef2b7df4357e3401e47c8d526f4cc71c03ce499dad1f2205a60e8a7f8721f294805f504d5b80f1f0f31ce82eba42aec9647b9ba20f419692405d4c
SSDEEP 12288:qmw5HEjsChNVBFgl0WDm+CRa6CaQ0BaNid7Nj88pSaAPO3A87JBGSXuMXRg7ZVh:jwuoOWf6CaQulhoMXX7lu
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 73dac6424fb5a701a2cd3aa5d1ff16c883003ab474fc4ca43c3643e401e98a9a
MD5 71e4d0d0523ce8ced1bb050c3268bd7a
SHA1 5326337dc414ddd11fc4b70456c4e9f376285f97
SHA512 30b779d72651c1608ab4d62f0063cd802fbed082e1b596c94f535e8e2e1e9c0e56ef0d9b8c3a20a78b825855c6cd186290e7ea5e9d2ea5d568fed9df176c415b
SSDEEP 12288:wBZ1Iyqa6CaQ0BaNid7Nj88pSaAPO3A87JBGSXuMXRg7ZVh:uZua6CaQulhoMXX7lu
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe
Size 4.8MB
SHA256 232e95536205cd8e702ebfabb0f19dbf908d2606f1ac190a72fadd5ba00ad043
MD5 3a312d001d491582a04f8dcaa39b33aa
SHA1 83922b14432c1f8688165804843f72f479975502
SHA512 f998813c19ce41790ad9e88341fd8e484f0c10bd6b7189899589983469ba3dac1f2f0015be5a881f4799cd8dd1f39927fd9ea39f2b00c26ebb5bf15f50128beb
SSDEEP 49152:Uj8f3jtqiCLg9LK2hIOR+k9jdAsizqxSiZ4K5MZqkL92c6nkdmbDfiIerM1R6ZPz:PrZ4K5M+XDfiIewG+x6xZ14IphvH7
MD5 SHA1 SHA512 SSDEEP

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe
Size 4.8MB
SHA256 d1afd6e902d9d376477081df5f39419ad0f9a38f51e8181a9641f694848f7477
MD5 1188491235691f7d2f1d9bd122cc56db
SHA1 72bbf485592e08687fe1496868e2bc9a9444595c
SHA512 5961049a948b8452499c53e4addcf12a5982dfc6fc8c4d42c6b8f1343f273a7355b26bcd3ea8664e3c90f4857c5b315b8765170683d451e51b3a0267d9116321
SSDEEP 49152:zj8f3jtqiCLg9LK2hIOR+k9jdAsizqxSiZ4K5MZqkL92c6nkdmbDfiIerM1R6ZPz:MrZ4K5M+XDfiIewG+x6xZ14IphvH7
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe
Size 2.2MB
SHA256 aedd8a8c902c36c0fdbf16d8c56ef9318adea7956cd3741da5739243bdd78e9d
MD5 1689bba26dd6066b8023ae0d4105f615
SHA1 45d2f6564518209269a03051b5cf0f23c21c97e4
SHA512 844f26ec7d3d2e56b35435cc9a4096e2d2d9d864ef2261dce9b2fc192ed269274c28a335eb6e18fd3eefe3d5af919b09ec6aac71a5289437a99ed812d9678488
SSDEEP 49152:pfzabJ8llj+SWWi2mkx+X+diHCTulhvXX7:iui2sphvH7
MD5 SHA1 SHA512 SSDEEP

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
Size 2.1MB
SHA256 fbe45ebac4cf2f8fd475e98691c3e6e88249457560c79d4e949342a9225bb81b
MD5 fd756bd08163a57e4dfb888ac8b669c0
SHA1 817aff2c9b4277258dc891d6bfbbfe4060135bdd
SHA512 8e02c3d5005639e6d6d519b72adf6ab73e78096c41db5c8778690842a8791e7adbc8dd19e5c851ab02bfb2c3dd77dcf580dd73fcbd9ac7034677b46656c47e4a
SSDEEP 49152:/a/3xXBSZ4K5MJ1LvTMxbfsYBYSgxu9+fw4ToCTulhvXX7:HZ4K5MJabfsYNzphvH7
MD5 SHA1 SHA512 SSDEEP

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe
Size 1.8MB
SHA256 5b358219ad8e62953e0b5bd843d5d7b98efe31ee7103678e2fa48df6070bf59b
MD5 c3fe140837698c368e624147efd802f1
SHA1 dc4b87d6c06612467c9b02e64ea00db2c558d9e3
SHA512 e0b4edf4b9339ddabb2d5c4387e71d78256e33fa0eadd97d3a9e919792ccb3a7fca3e37d39ba856b6613729a612c476bc008f4aff6c3c77c1b2722aa141d7412
SSDEEP 24576:UgNJw85yUKzDu/9gKPlfLO8C49BgKx6CaQulhoMXX7lu:UgNJtUzDu/9gKPxHC4iCTulhvXX7
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 1.5MB
SHA256 6cc8401dc9256bd403b44b88d93055006e0a8c61336e59786b7e8f4a7a5e5296
MD5 d09c7a0c849d5b556bb7c512901e2b4d
SHA1 e86aac1a67caac3c16f936d18dcbeedc424f4025
SHA512 d2a1ec6b304791a4462f505b756fe6ea5a87660075c80c849235bb70971bd41ec06edef82f2025d37800c3dfbf406327537dffee5f1414061007622ab5e6fb81
SSDEEP 49152:2OBynH1wM+v6UJxLQd7BHjdfQCTulhvXX7:Kn4LQd7LIphvH7
MD5 SHA1 SHA512 SSDEEP

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 075f9c5b7322efd22280e740b051c6d0e31219bd955d78646b115538b12b9898
MD5 cc4f6008f1b0697acc4b965e4efb81f2
SHA1 42104015cb004f4a73488f52e61a8a391eee3c64
SHA512 97942e9b894cabf42446f636b6758032b38d8cb877ad2d362f6a7647a14b5bbdaea0938609c125ca6f1c942e4ab7aa076a44d242fceffedec8a9fdfe355bdda9
SSDEEP 12288:1ra6CaQ0BaNid7Nj88pSaAPO3A87JBGSXuMXRg7ZVh:1O6CaQulhoMXX7lu
MD5 SHA1 SHA512 SSDEEP

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 c842f502ce471c6a695c031da67200e4f41a53888e18e1f9d9037c20c8ba91af
MD5 1b28f6371c5dd6423be8ac80231cd539
SHA1 952bb4d38dac7843f02b9d85bc0144d757b97f13
SHA512 797888f81ea0d62de5ecbde3ddd66a3615a4846c9850cc981b1a867c46ff1dbc40c73e1ce48f8defe517b03205d41935f6df298c0308b930a079e5c84d0ce3ba
SSDEEP 12288:E+a6CaQ0BaNid7Nj88pSaAPO3A87JBGSXuMXRg7ZVh:EH6CaQulhoMXX7lu
MD5 SHA1 SHA512 SSDEEP

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 a0a822acb5cc6f814c7d7946307b2e095985d472b59e308320f165f2f7c583b1
MD5 aa59655beac1a37d212c57c25bc5cbcd
SHA1 7b2d2fe79c66596ebc2f1c63e6841bc40bfebca4
SHA512 d6a64824d6e309c96a6730356c92c06758e9fa2ec5e182a1a25fe7d1930d6d41e26a64017664f416e7f5615784a8d007fa9e6160e4421af396ad39487b5b32f3
SSDEEP 12288:2oa6CaQ0BaNid7Nj88pSaAPO3A87JBGSXuMXRg7ZVh:2d6CaQulhoMXX7lu
MD5 SHA1 SHA512 SSDEEP

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 68c611dfbcd10793fc9a9579453a2dac369f06c61dcf6e92affa09b28f2ad8d2
MD5 1e52535ca9e672d31cc582824dd22250
SHA1 9ba29a2a81f8cc6d1fe0e8b99a2f3ff166361b20
SHA512 656e5bdc196e0833565a9604d3f9723d4b2efa56d7f47b9d95c18cb0710a0bd7ffd3d46b6242e252bc49bbdc119aa27d05e04489350d33703893de5ed63c43b5
SSDEEP 12288:2VNa6CaQ0BaNid7Nj88pSaAPO3A87JBGSXuMXRg7ZVh:76CaQulhoMXX7lu
MD5 SHA1 SHA512 SSDEEP

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 fcd0aa003a6ce3692250b147c393a7f1af2227687a79167a76be1431b8526715
MD5 cf532dbb9529fa8101474497678f99e9
SHA1 8d14ec35873d6059d1c1d1340a323772cae2f816
SHA512 bd0f455713ce388291fdf5bb72c009a55ade921975d8c873804dd5492ed275be506cb61cb85c1e9d38ddfa51957b7c2547b3e14927565f29171bdc471cd9f316
SSDEEP 12288:E1a6CaQ0BaNid7Nj88pSaAPO3A87JBGSXuMXRg7ZVh:E86CaQulhoMXX7lu
MD5 SHA1 SHA512 SSDEEP

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 46c5a367cc10cd4bb3d6aa2f9432aa93ee9b936667023cdee5284b82702d35d2
MD5 d257ff10e81eff609ceec912d3d20f84
SHA1 4e80d783de2c4d148f720bf51c3c74c605dc2837
SHA512 d812d08ee9579712ccf0a74a0d0d1ef6df56a663e4281de1ad2825e5407b0d07dfdd028577dfde1a573629fd9dd847542bcfa110899918556cd2dd0acbd136b8
SSDEEP 12288:Hya6CaQ0BaNid7Nj88pSaAPO3A87JBGSXuMXRg7ZVh:HL6CaQulhoMXX7lu
MD5 SHA1 SHA512 SSDEEP

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 3ff017307b0bf65c36ae3844a49f674eddd234acf4e0ba0c6eaeff9aad44c14c
MD5 84c092bdc6dd7fc004904105e68dff8e
SHA1 d0ff1ce81c48dca465ea98eb64296fb5d90bccba
SHA512 15197340f52cc2389f5f3b9842412151d252e54dc073a1a61dc2e18d1b7f7899367650a40704f080628f9c2724a2f003990cd4f4149b56d0b6a2dacf12613f89
SSDEEP 12288:Cma6CaQ0BaNid7Nj88pSaAPO3A87JBGSXuMXRg7ZVh:Cv6CaQulhoMXX7lu
MD5 SHA1 SHA512 SSDEEP

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 9d202e5a86c45623478d6af297e177b170ceb60df2e255a1552e62ebadad3012
MD5 40a901233f4b33f8edb16c7a519220dc
SHA1 81c34b5d38f19ced30996f225bf95d26dd05a3a4
SHA512 98af5c4b850c9ad4d9f7727c618daf52b126cc9f6865975277ffbc6490a7f6b8fdcc30d73b2646c262b0b637e8ae8c01eb6d959c150e9d11a350c01fa27398f1
SSDEEP 12288:LiZwb6zzFEoS2cPvyea6CaQ0BaNid7Nj88pSaAPO3A87JBGSXuMXRg7ZVh:2ZMSzFVSOn6CaQulhoMXX7lu
MD5 SHA1 SHA512 SSDEEP

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 10a1d2a5e44615a10ba0bd8830fd99bb4fdd9078e7047033c69815e63c8714c8
MD5 1463b4e81841fa7ab208d144fe4210ea
SHA1 b814c359fc22f72832966de5930a7d2c34998e98
SHA512 f88c8dd604386dcca5abfc4b200bef1b13e6570fd78d380303c68ee113b2da62e0820548c84ddb67f891ed3abd0c19dcdcd340dafe155a3c06f5b0157564d30e
SSDEEP 12288:hXa6CaQ0BaNid7Nj88pSaAPO3A87JBGSXuMXRg7ZVh:hK6CaQulhoMXX7lu
MD5 SHA1 SHA512 SSDEEP

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 c49dc0c475852f447c31761671e5240640b99d9724b54b6c169d90ada8f306bf
MD5 9ae63671b537820e312c191cb4f4c870
SHA1 b4e04eb52542b566f9ea288e128281ef8350da6d
SHA512 6b7b52d60535cc86ea0e9af804b91f80e1712bb4f54fa5a823d0013315223f24c432942595b5212399957b311b688f199ddc2115fc8f826583e091617c4e9d97
SSDEEP 12288:gja6CaQ0BaNid7Nj88pSaAPO3A87JBGSXuMXRg7ZVh:gG6CaQulhoMXX7lu
MD5 SHA1 SHA512 SSDEEP

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 fbb5cd5c78d33ef811a0b72170ed821633977591ebe794ea99f2aae4f6cfca83
MD5 2d9d0a2a06dae3b648701c2b57253541
SHA1 39d488fb0c6c31f91eb821a23b68252e3df22555
SHA512 580da851f818c8b08e6a9ecc05f4b62c7fa99ede0c6d206bab1eb766a3be590db4524dd32d14a95beb3ddacaed8fac778a6bc4fb56c4c0197c5a235b2015ded3
SSDEEP 12288:IyPz5L8qa6CaQ0BaNid7Nj88pSaAPO3A87JBGSXuMXRg7ZVh:Jzyj6CaQulhoMXX7lu
MD5 SHA1 SHA512 SSDEEP

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 60b853b0f8fdb3b350f6f32df5bcc4cd1d846cb45e41f249d2490b544e3179ce
MD5 12746234c5641b376575119c06930959
SHA1 1797edfbc2637eb1f9103665f4108e270cbc5033
SHA512 06795748346e16ccf38e65887da2cbfaeb5acf636fe0415e8e55f6738c1ab75ff45eb75e1c616652270ddc453776af10e9d85e081b8ddd7cc797b90d61bc1dac
SSDEEP 12288:PXa6CaQ0BaNid7Nj88pSaAPO3A87JBGSXuMXRg7ZVh:PK6CaQulhoMXX7lu
MD5 SHA1 SHA512 SSDEEP

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 b74485c377021dba1ef6094cdbfdc0eaadd431ef6336f7b594341984e37b738f
MD5 4cabc8afbd1e224e3ce86e5a582b48ae
SHA1 c8b0231653e0c80802c31241720f01ee707f5967
SHA512 8932efc156fefceed1d7f9e7affba74aaf3f6e9bf3eaf397d5d84f8d8237bfbed92a6233243db6cb0d629d33ba0429c3fd6e7c3126b9f19401b8aea79164abc7
SSDEEP 12288:pXa6CaQ0BaNid7Nj88pSaAPO3A87JBGSXuMXRg7ZVh:pK6CaQulhoMXX7lu
MD5 SHA1 SHA512 SSDEEP

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 1aca580b8c4b4abc72681ed24c02eadfdac0acdc46f07209c78fb6d76bb4f775
MD5 87d8a5b6ff085957d9dae812ac2df50f
SHA1 b1415fee49649d8b4d0e604ac4cace0f93b9679b
SHA512 9eeb01ac426e3b353988abcf84c99fdbc32ee8e344c6ea18086f2efe9d9f41d0d9dfaf1b682b4a5f0108723ef2bd15102b9810989390134cc03784f6c06f9434
SSDEEP 12288:nyPz5L8qa6CaQ0BaNid7Nj88pSaAPO3A87JBGSXuMXRg7ZVh:Kzyj6CaQulhoMXX7lu
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 69f9f1dd9b1641611dad9bd0b0ea19f489c4d7f751c4013e0d0f78f4a6a1df9d
MD5 bd4af8eb48ff27c01c7b5e44abeec9c3
SHA1 82edb82b2eef32d454ea4f3974e2bfb92ca7c06d
SHA512 ce05de99cb3f9917e6e5a1c2fa8e039d6f048c85a25deabf0b01486c468cf6c77b7ae78cc85a00e072861e28a1790de5e736d829c99107bb24f04cb2d5ecbd26
SSDEEP 12288:jCd9eWYoaLHF3z0z04PDvh4a6CaQ0BaNid7Nj88pSaAPO3A87JBGSXuMXRg7ZVh:OTHaLl3z0zDt6CaQulhoMXX7lu
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 f40184b734c527c1a576fff08bdb38b2dc33179919864dc3cda98f603ef39375
MD5 defcc3129201085906abb43f95505a2b
SHA1 16161442e5135f6befb0cd295039a1c1dde8b142
SHA512 ab409b2d76c30a79fd74add1db6c4ace431ddefeee4fec25ca6f7606538a897b1f444d34f7fc6a06eb6b6c31d0efa4c0de21a1471352eb3ee09b45f2a18ab0ac
SSDEEP 12288:Ai4e7+RdTfgwCHKy7GLbbdIvZa6CaQ0BaNid7Nj88pSaAPO3A87JBGSXuMXRg7ZX:A37d9CHKy7GZx6CaQulhoMXX7lu
MD5 SHA1 SHA512 SSDEEP

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 2bbb0af16104a301fb9da31dd7a64a029e322ff426f35e1308c3a8cd6646c8e8
MD5 8d5794ea3b0c2ce7a97b1b360a3367ec
SHA1 e11d7eacc85a244517be84db1b4889c984f20fd1
SHA512 168b0d0ccb2570282888614ac81ee66c56292c2d70d8f7d8feb2462b8dba1f98a84cd582ddc6f909b57c738fbcd1724384eb1c5b882823bb8b1d40d943b4834d
SSDEEP 12288:OIa6CaQ0BaNid7Nj88pSaAPO3A87JBGSXuMXRg7ZVh:O96CaQulhoMXX7lu
MD5 SHA1 SHA512 SSDEEP

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 1bddbb5779318c3dcf2a26e7cceac02a8187421e51197956dc0013d62764faca
MD5 9fe8670630ef468e5b55a550d28bb857
SHA1 ef1790efaba3972fac075b2984fc401284f870ff
SHA512 06e7fb425891b9259f87f7c0a5570f557f437b821cc31540f56ca220e38277faa9684ad69a0c376eb3570b3fd46a66f04c0114e069cdb00a96ae93000b2b0970
SSDEEP 12288:0Ka6CaQ0BaNid7Nj88pSaAPO3A87JBGSXuMXRg7ZVh:0D6CaQulhoMXX7lu
MD5 SHA1 SHA512 SSDEEP

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 b1cd91950dedc66c897fbfa0ae4517887019e5f32b2c26c708fc5b2b6435284d
MD5 1b9b3eb96f3aa632b24e6d615168db4c
SHA1 2129920ebd14b719a9ba8e01256c82039118e6ad
SHA512 6d68c84db48bc22ebfeeda2ac619f2ae97498fbdd0054d87ae866c8cc98a6d5c916d53b11a3da34718d6ba884f34a03535be48367a8068aced7299458335b952
SSDEEP 12288:eZa6CaQ0BaNid7Nj88pSaAPO3A87JBGSXuMXRg7ZVh:eg6CaQulhoMXX7lu
MD5 SHA1 SHA512 SSDEEP

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 d665aced71c13f694d95da653ca3bad0ba9394ae55ed5af8edcb4d3ce2ac045f
MD5 678256d0d94b1212ebd6d0960d953127
SHA1 bd3aaf059e2b57a98eaf9e30fdd553862c715006
SHA512 88c1990f1116331a61d483086562b688390e76a0ec21ea2013288427289540923588e01890b3c0ade6f14f22d587f5944b808d17518c81a32b55b4b569e65727
SSDEEP 12288:2Xa6CaQ0BaNid7Nj88pSaAPO3A87JBGSXuMXRg7ZVh:2K6CaQulhoMXX7lu
MD5 SHA1 SHA512 SSDEEP

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 fc6bde6995fc7dc6212711f99df7f5a1c30cd76d6bd062c7bbaa8e14787e9c63
MD5 ae1083c921986a7a5e02f8515920f947
SHA1 cbddee0bd0565f8c1f44e3ee615f522d426092da
SHA512 438a942466ac24a9f56dc326ba52db97b0d9dff59b0de3aae5f66119360cfdbde1f3cc63a62a8370b33b4366db97091a28d1d99744fd5474f0aafe60e7b8ce53
SSDEEP 12288:nIa6CaQ0BaNid7Nj88pSaAPO3A87JBGSXuMXRg7ZVh:n96CaQulhoMXX7lu
MD5 SHA1 SHA512 SSDEEP

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 067b10501b59a34495537447db84dbb9a7f542647cab2dd2bc8d9d7778c783b9
MD5 dae01448967f47b19cedc74227b365ee
SHA1 082832990e425ea1f937d18d408762aa2f482033
SHA512 a5b254ce2dac6aed8a41d3df3dbcd8dde257a17c66f4e5bb669ea8b10ae8249a4bb5b938c208a07d7832535ccfb36e0feb6ff28ca77205731a051165122006cc
SSDEEP 12288:dfa6CaQ0BaNid7Nj88pSaAPO3A87JBGSXuMXRg7ZVh:dy6CaQulhoMXX7lu
MD5 SHA1 SHA512 SSDEEP

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 696KB
SHA256 87bd4cb4985b0eda3af2afe421436ef2db36ff8a0fe9cf49170ec3ba385122f5
MD5 ea9c5e62d7611425a2f9081e9d097cb7
SHA1 24695381856b9762f51e04f7c27b52bd177c9e76
SHA512 c9c66d97fc860f9172d25d494194abab1e787ea73ecde22659d871d1cc6a966f15b63ca082e54b41326cb0c905aa65161ae669641ec7816f14e7f0e78045847f
SSDEEP 12288:fFYq0SCa6CaQ0BaNid7Nj88pSaAPO3A87JBGSXuMXRg7ZVh:fgSb6CaQulhoMXX7lu
MD5 SHA1 SHA512 SSDEEP

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 d17a83b3ab157e8aec077cc4a57da1c267b2ce487f1080b183d5c0da805bc035
MD5 3e7ffaae5bba8d9d59e37a46eeee1735
SHA1 05e7a6b23866365151d12bde757f94d14f97aa4a
SHA512 12affb48c219b9e36c54418376ec081ade9bc36216291a72af0f29e65fcc18b7fa1109c86d7fda0891f5766bd523197858dff037c1a178d890bdf76c75a4fff3
SSDEEP 12288:jua6CaQ0BaNid7Nj88pSaAPO3A87JBGSXuMXRg7ZVh:j36CaQulhoMXX7lu
MD5 SHA1 SHA512 SSDEEP

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 030afe485d2998128aaeec7ecaf6cac637939ffd040e9a2f872f317a862d3efd
MD5 5c5fcec2136ec0063c720c046d3b4757
SHA1 0215e11f882d09a82f70e17b8d17c29dd8fd4954
SHA512 a128714b3c0ae04e9e68b6fd2732d9db4b4afabe2afe98b8736f157c1fb4d3887772770881274815307735402608876dd9b8674ef81b8b3e622916d96c5fbec3
SSDEEP 49152:Za0h2GEkuAe73q3pp46zwwQ8CTulhvXX7:Za0hNYG4JwtphvH7
MD5 SHA1 SHA512 SSDEEP

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 659KB
SHA256 d37667add8a07f096181eb92ba1d14ff6313f4d713b73b01d65f05200fb7ee40
MD5 5a77f9ddcf05b1417afaaadc23332d09
SHA1 a713daef7418e40b94cd0b87a1cd9d0ed2a80a30
SHA512 3cbf47a07e533f217d6d76cf4444d683aa074172784099883c237877b105e6d74fd7f2fe2f47df120eff9a805f6e60d4b51ade36fb32fdf511abe5b67fe8ac1f
SSDEEP 12288:FhbHjfXza6CaQ0BaNid7Nj88pSaAPO3A87JBGSXuMXRg7ZVh:FhbHjPW6CaQulhoMXX7lu
MD5 SHA1 SHA512 SSDEEP

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 ecf5cddfdc96044701eac588cd50189ce4e75fbc2b3b64a99b5ea59a03b71863
MD5 1b02a1618f8a47f6d517af5b3ca1642e
SHA1 f97a0a634c926d9b32a09a82cd8c2982315e3d35
SHA512 bf0834912aa4fd81ce52a4d8413875eb87f875131cfb064c30388be08ff9f87a9df775be00a48cd313aa9e24c3c1771b5a196be198bc5b0f49e1c1307b43673b
SSDEEP 24576:q3YgnJcRTk4yti+R5dpR/O6CaQulhoMXX7lu:qIgnaTk46ppR/pCTulhvXX7
MD5 SHA1 SHA512 SSDEEP

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 578KB
SHA256 cf4d77d568b34964e9d1132e6ceef6211603d4e7fdc21b96b5c7d4bbf72c3a60
MD5 5b94eb2257bf4a260d4d399bf63918e2
SHA1 11c2783af082a257de5ff46e1da15893bff9a013
SHA512 71dffae35f41d73a76975e694442356437893d93987880988ffb1a48f72f0029959c4e90cb4533b888c586ea53375bb067fd42ec7a15dd65caed9bba118af799
SSDEEP 12288:oya6CaQ0BaNid7Nj88pSaAPO3A87JBGSXuMXRg7ZVh:oL6CaQulhoMXX7lu
MD5 SHA1 SHA512 SSDEEP

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 940KB
SHA256 4d4f728b7916bbb980d5ed74612a264aa9414ce374960c83cc5209589d144f00
MD5 b97efe45e3ecf2da062c980ab81064eb
SHA1 ed0a7db07a4fde240236f88eb99df70f64cb3bbc
SHA512 c39ea666239002d53a4f4fca517288878996ceee001bbfdef6ed0fa6ca06a2c39c7bb3dcd97650a580c58b23b40222837a8a95b4fc999adc790e13a5a3d316d5
SSDEEP 12288:rOb9A4LWOsvAYFTZa6CaQ0BaNid7Nj88pSaAPO3A87JBGSXuMXRg7ZVh:0pL3UTg6CaQulhoMXX7lu
MD5 SHA1 SHA512 SSDEEP

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 671KB
SHA256 6c5cd43b0be66bcbab556e621d5270b26e43a6308d884e9f35e190d178cf12e8
MD5 8191abf5bf714bcbf6832d66d440844f
SHA1 1ab04e19bbea8d2cd83238dab8ebb161d22b725e
SHA512 5d65b3201f15dc3d0c911755f6f963cfd6af93562d0bd86596e11b1656fc62e1aa870b93e4230ce86d104bd636917d1cde25a6dacd3a63b5a893021fd0c977c3
SSDEEP 12288:4pFtpOta6CaQ0BaNid7Nj88pSaAPO3A87JBGSXuMXRg7ZVh:KO06CaQulhoMXX7lu
MD5 SHA1 SHA512 SSDEEP

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 76f58f4b9e6e239979a82b3ea91f8ce5d925322d0ac92c63844ec932a58ab434
MD5 a0c281ff49f01baf6edbb0aeb157a6a8
SHA1 39e3e0f2660772769b4f94ce349ca6ab9981820c
SHA512 6db2dc386ae8473e7e0ba4c8ebf240cdeb3484607fee624b86bed756571e1cc220028cd17d265056b168f6588471e9849a376cefe30c6fb56da2be6facf6d547
SSDEEP 24576:U7NM9YmZqmWMUkPjZM48Mv6bEhsn6CaQulhoMXX7lu:U7cBWMpPjN8DbEhxCTulhvXX7
MD5 SHA1 SHA512 SSDEEP

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 796007a8f0cf0967ccb79b8dbf1590e929e636ef9195aa5d848d7bace891463d
MD5 237287e9047aa55d635e089e7e3ebe01
SHA1 7406848c975bc520dbf37e2ae49508fbb6542b26
SHA512 be9ad2c15b439d0f8eae2e1fd5ca4940ff5a2abb9d71151d055203eadaaed44efc664675c4a7ae88110e227c37660529648ce94681300892c0ea394060bc009c
SSDEEP 24576:UW6BApg2YuyuNDYTabvcRvNYf8km196CaQulhoMXX7lu:UF2YuHNETovcvNYf8kmaCTulhvXX7
MD5 SHA1 SHA512 SSDEEP

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 f82331c28fc0491062d42f6e512972e872515e7dab17fe4e0ceab71f4b8a51da
MD5 d8b76d431da96ec058f6c8914f0679aa
SHA1 79b6f20f36d2acb0ed64b51b83c65c7ec5c62de1
SHA512 ce82b6af64bb9455b3a96335cdd5ebeeb281ce983d3dd9e89f7a609653eec7b00928c9f1a2a1313aaf82c14bf5b79806ccf48e67157cfd16321af56c8c6a8702
SSDEEP 24576:AAFs06+Omlf3NXEbToo6CaQulhoMXX7lu:VFs060lVXucCTulhvXX7
MD5 SHA1 SHA512 SSDEEP

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 885KB
SHA256 3c88de16d045e940c5b4c8960f8c07295a07a7245a7451c6843740102a9aab1e
MD5 249bb062ad8605a4f7ae0f4335c961b5
SHA1 9aa09d1ad7bf9a593d561178f38845193feceb38
SHA512 4bb4518679fc6980a05e9553d29a33de92462c673929bada45d18ec1b078dae9259cce302c7d397363c3a9480c2ec7ffa8849ac96d8582c327e6420aaa9fc215
SSDEEP 12288:vCJnJ5D3Vkrlzx+a6CaQ0BaNid7Nj88pSaAPO3A87JBGSXuMXRg7ZVh:qJnJ5D3WtR6CaQulhoMXX7lu
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 665cf9a4fbec7c845dc2df730286f8d3883b631789169777733f7074b8bf61b9
MD5 1f5a4243a0690d626429ddc8e11d41b8
SHA1 52e22edc415c37f538d8c1e8c8e5165fc799ece8
SHA512 6a0eff5c7242de2c428b8e9be593450795dab679a09abca676f688d81cce0917c8b44700c913eec2f6e2d3d6b14c318395d81e88431151adaf4456585607eb6a
SSDEEP 24576:vEPohm6/7IIXdwcXrif7qQncjlP65i3VuO6CaQulhoMXX7lu:Io06DIKdwc+eQnSt65aVmCTulhvXX7
MD5 SHA1 SHA512 SSDEEP

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 661KB
SHA256 588ffc6b01e61b244f422c810b7b8a8ae3922dfcd63eb3ff81f4d998032e7705
MD5 02932d276c31bcbc366f1416c05a53fb
SHA1 b9247f0ec33c7ae123d57bcd047090d7108a3299
SHA512 f8c8faa790255b152e59cbdb126c95d3e5d8f537871db017df4b3475ba24165df1292bffe9e32870dc68d95d72b22c91c8512a6cb8cb5f38dafade5ae7a6cc39
SSDEEP 12288:0EP3Rraa6CaQ0BaNid7Nj88pSaAPO3A87JBGSXuMXRg7ZVh:vrT6CaQulhoMXX7lu
MD5 SHA1 SHA512 SSDEEP

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 712KB
SHA256 233cf7bb257a1b965c23547821a698cf26f08394983594eb3e3a9208052fae81
MD5 ae5963ad4268badd20c025618bb2e381
SHA1 7471e50f9b9d8888585b36ab0eb74e28595504ec
SHA512 117c73e3fe729ce1ab0bed6b0ad1f307481cf9d5c5d431c86e53994fbefb2484698e70a5d3eba34d080f32b36909c59677b89a2b19ebdabae2f09326c562fc13
SSDEEP 12288:VjkyDa6CaQ0BaNid7Nj88pSaAPO3A87JBGSXuMXRg7ZVh:VIym6CaQulhoMXX7lu
MD5 SHA1 SHA512 SSDEEP

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 584KB
SHA256 8450648a9ccfafa5cac87b985b9595fb05e0d65598c916fd4546d9f340f2dd3f
MD5 cc15aa2c64f080cd3e05cace7f7a7a83
SHA1 0472719e199ad4b2783ebd2c419674de2c1d20c4
SHA512 7973d71240ace763db30287350f0bdcf434399e139bbad77755681c607c779ce12968cf12a9455faa428a9cfa1cf9e8ed1eb06c8da6a7adbb873dceb67e0e01b
SSDEEP 12288:cF9a6CaQ0BaNid7Nj88pSaAPO3A87JBGSXuMXRg7ZVh:qE6CaQulhoMXX7lu
MD5 SHA1 SHA512 SSDEEP

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 3d9a495ec22ab31fdc12412e4e60532f7f614bbc7bb62de305dd9bf2c1689035
MD5 e5bf5a974726ed1f2f249aa7d5d0978c
SHA1 e68618e55f245e3526d105f107a3ab6cda8a2e75
SHA512 70a607a9065d0e5883473097cfa9e1c74b60e6d10b5353871ac956b6af57775ffefa782bcd8f55e434e339c1ecc97bfa603fe3dda3a3d7f681a1f2df2d19165d
SSDEEP 12288:RLQZb3C97GYnZMv5zBcKY97MD3Ga6CaQ0BaNid7Nj88pSaAPO3A87JBGSXuMXRgh:pQ9MxZKdcz97w3P6CaQulhoMXX7lu
MD5 SHA1 SHA512 SSDEEP

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 772KB
SHA256 d35a96d6703a89c2ca51718aa888790f6b31d31d7c7afe6d402c76cab096735c
MD5 73fb7b9f879fe011d89f4f04b0b820ac
SHA1 d485eaf01b2bfb05e1c36498fb911ecce1aee1cd
SHA512 f038e7bcd89b9c45beaefc87cc298348e74233bf01981925dd0d527cf5e3c85d95c120a044cfc2239c753668e7b48f1c8de9045a27d79fd363909321a5d5b9eb
SSDEEP 12288:PyoKo2HRple9pHa6CaQ0BaNid7Nj88pSaAPO3A87JBGSXuMXRg7ZVh:PyocxAp66CaQulhoMXX7lu
MD5 SHA1 SHA512 SSDEEP

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 58d0a91df3c1d86e5d0c81763cc3a5a8a079ef6e37d2041683b289e512608202
MD5 7b6feb013f953d64f0821c34b1270046
SHA1 7f69f8ceefa6001f0b6e669556f36e296d0e6b0d
SHA512 ef2ff8fc95432a5c1264a49c3f54676d5dacde58ef54bef08c7a9d88c808a6f0d230f1822b26c047dd09f984055abe653e7446325cd410df852caf8d32fa1302
SSDEEP 49152:AWcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIKVCTulhvXX7:y0zuNI5phvH7
MD5 SHA1 SHA512 SSDEEP

Submit Download

office2016setup.exe

Path C:\odt\office2016setup.exe
Size 5.6MB
SHA256 f084fa1e899fc045b20475524639bb414de70b3e8a5c10441e32b7be0f457b55
MD5 893fd1a2e46378a76d94783b1a9fbc8d
SHA1 f6263769a7dffc6fc3982615e3ecb4381fa8fb3c
SHA512 a3672417bd87f43f9f6a0f61a8db65cf4aa78a7be524dd1bad99cb2430d99b5da062d2f4f3c821b11986f832184eadd23db6b0e6f6ce8484ee5c6607a34d5e91
SSDEEP 98304:l7M701RgX4iuSl1DtlEq81xZPGnzURnBh6gGL/QmvD/cTwY2h3FyphvH7:JM7pTXexZPGzURnBh6gGLF+W3Qppb
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/412-435-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/412-443-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/856-235-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/856-46-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/856-40-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/856-38-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/1084-50-0x0000000001A40000-0x0000000001AA0000-memory.dmp

Download

memory/1084-51-0x0000000140000000-0x00000001400CA000-memory.dmp

Download

memory/1084-60-0x0000000001A40000-0x0000000001AA0000-memory.dmp

Download

memory/1084-63-0x0000000140000000-0x00000001400CA000-memory.dmp

Download

memory/1084-57-0x0000000001A40000-0x0000000001AA0000-memory.dmp

Download

memory/1388-548-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/1388-415-0x0000000000BD0000-0x0000000000C30000-memory.dmp

Download

memory/1388-408-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/1612-429-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/1612-421-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/1728-254-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/1728-270-0x0000000000DA0000-0x0000000000E00000-memory.dmp

Download

memory/1728-268-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/1728-262-0x0000000000DA0000-0x0000000000E00000-memory.dmp

Download

memory/1728-255-0x0000000000DA0000-0x0000000000E00000-memory.dmp

Download

memory/1900-271-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/1900-336-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/1900-280-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/1948-433-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/1948-366-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/1948-373-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/2416-385-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/2416-379-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/2416-446-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/2884-293-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/2884-349-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/2884-284-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/3056-405-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/3056-404-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/3056-400-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/3056-391-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/3080-389-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3080-331-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/3080-323-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3080-398-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/3604-460-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/3604-468-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/3796-359-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3796-350-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/3796-420-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/3860-243-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/3860-310-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/3860-250-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/3860-244-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/3928-455-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/3928-449-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/3932-234-0x0000000140000000-0x0000000140237000-memory.dmp

Download

memory/3932-34-0x00000000008E0000-0x0000000000940000-memory.dmp

Download

memory/3932-27-0x00000000008E0000-0x0000000000940000-memory.dmp

Download

memory/3932-28-0x0000000140000000-0x0000000140237000-memory.dmp

Download

memory/3952-339-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/3952-346-0x0000000000630000-0x0000000000690000-memory.dmp

Download

memory/3952-407-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/4032-564-0x00000248B03C0000-0x00000248B03D0000-memory.dmp

Download

memory/4032-563-0x00000248B03B0000-0x00000248B03C0000-memory.dmp

Download

memory/4336-312-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/4336-320-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/4336-376-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/4460-22-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/4460-230-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/4460-16-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/4460-15-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/4500-11-0x00000000020E0000-0x0000000002140000-memory.dmp

Download

memory/4500-13-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/4500-7-0x00000000020E0000-0x0000000002140000-memory.dmp

Download

memory/4500-1-0x00000000020E0000-0x0000000002140000-memory.dmp

Download

memory/4500-0-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/4776-238-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/4776-66-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/4776-65-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/4776-72-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/5012-363-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/5012-299-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/5012-307-0x0000000000650000-0x00000000006B7000-memory.dmp

Download