5bf0b65e1049ebac3aee7734a6e0fc6bc884e154a5f6d183b801f11b56fbc250

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
04/04/2024, 10:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-04-04_6efcacb73bf9abcc240ee836f9af8a96_ryuk.exe
Size 2.1MB
Sample240404-m3dvdsda3y
SHA256 5bf0b65e1049ebac3aee7734a6e0fc6bc884e154a5f6d183b801f11b56fbc250
MD5 6efcacb73bf9abcc240ee836f9af8a96
SHA1 3f093c1fc0885dc11e6eb77734ffabd61325eff0
SHA512 27b62a8f226ff9e0d8a6aa821dba9842f79c178a8df9879084726d08bf945e6056ca4d7d98fcc1930c6e465732639d7a9b5e7f82a2cae8ecaf446ae2c4b19749
SSDEEP 49152:KsOwbb13ntb+g2nxDv1PZ1LTbjhG/1OfMUgAkp8:KI13tb+Z3HhG/2o3p8
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
3692	alg.exe
1040	elevation_service.exe
2128	elevation_service.exe
3208	maintenanceservice.exe
2668	OSE.EXE
2788	DiagnosticsHub.StandardCollector.Service.exe
3468	fxssvc.exe
4416	msdtc.exe
3696	PerceptionSimulationService.exe
544	perfhost.exe
4572	locator.exe
3456	SensorDataService.exe
4656	snmptrap.exe
1128	spectrum.exe
1060	ssh-agent.exe
2488	TieringEngineService.exe
3264	AgentService.exe
3964	vds.exe
3244	vssvc.exe
3876	wbengine.exe
1388	WmiApSrv.exe
2556	SearchIndexer.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in System32 directory 24 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2024-04-04_6efcacb73bf9abcc240ee836f9af8a96_ryuk.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\2b7a49ae822cf6b9.bin	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Install\{69188FC9-DE03-4F31-9660-69825F846706}\chrome_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_75875\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	alg.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_75875\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	alg.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d5bb7b507f86da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004c2302507f86da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005e78754f7f86da01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000589e9b4f7f86da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000b10ef4f7f86da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003d6f2f507f86da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005a009e4f7f86da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004a1e5f507f86da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f49bba4f7f86da01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ae72f14f7f86da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
1040	elevation_service.exe
1040	elevation_service.exe
1040	elevation_service.exe
1040	elevation_service.exe
1040	elevation_service.exe
1040	elevation_service.exe
1040	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
632	Process not Found
632	Process not Found

Suspicious use of AdjustPrivilegeToken 42 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4308	2024-04-04_6efcacb73bf9abcc240ee836f9af8a96_ryuk.exe
Token: SeDebugPrivilege	3692	alg.exe
Token: SeDebugPrivilege	3692	alg.exe
Token: SeDebugPrivilege	3692	alg.exe
Token: SeTakeOwnershipPrivilege	1040	elevation_service.exe
Token: SeAuditPrivilege	3468	fxssvc.exe
Token: SeRestorePrivilege	2488	TieringEngineService.exe
Token: SeManageVolumePrivilege	2488	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	3264	AgentService.exe
Token: SeBackupPrivilege	3244	vssvc.exe
Token: SeRestorePrivilege	3244	vssvc.exe
Token: SeAuditPrivilege	3244	vssvc.exe
Token: SeBackupPrivilege	3876	wbengine.exe
Token: SeRestorePrivilege	3876	wbengine.exe
Token: SeSecurityPrivilege	3876	wbengine.exe
Token: 33	2556	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2556	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2556	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2556	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2556	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2556	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2556	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2556	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2556	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2556	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2556	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2556	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2556	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2556	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2556	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2556	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2556	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2556	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2556	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2556	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2556	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2556	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2556	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2556	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2556	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2556	SearchIndexer.exe
Token: SeDebugPrivilege	1040	elevation_service.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2556 wrote to memory of 5068	2556	SearchIndexer.exe	121
PID 2556 wrote to memory of 5068	2556	SearchIndexer.exe	121
PID 2556 wrote to memory of 3144	2556	SearchIndexer.exe	122
PID 2556 wrote to memory of 3144	2556	SearchIndexer.exe	122

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2024-04-04_6efcacb73bf9abcc240ee836f9af8a96_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-04_6efcacb73bf9abcc240ee836f9af8a96_ryuk.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:4308

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:3692

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1040

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2128

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:3208

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2668

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:2788

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:1528

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3468

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4416

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3696

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:544

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4572

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3456

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:4656

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1128

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1060

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:1772

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2488

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3264

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:3964

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3244

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3876

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:1388

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2556
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5068
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
  2⤵
  - Modifies data under HKEY_USERS
  PID:3144

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
Size 2.1MB
SHA256 8332b36f6eed09614cd5a95426a4d32b801d1c6ca86f222e29a066d4d917e258
MD5 91620417c0649f09b7879a25650a3a75
SHA1 77bb7974f7d4f98866d93138866f3bb0a98726be
SHA512 e10d5664aa528eefb9ba60c823f97cac83774a8b7777203db54ae97d896fc0e5441505da2804854862b72680cb0c375bc6140f33b86dbe82d2d19c9616c4323a
SSDEEP 49152:vuYk3H5koUXfTqkkYLO/W2buywzMbOX+T7z5nhG/1OfMUgAkp8:vPfTqi90bbhG/2o3p8
MD5 SHA1 SHA512 SSDEEP

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 a42d10dfe171e07c3053bedfbb13a8dd5d6d16235ec6c4afe28b83a5fd0fec65
MD5 9fd2a96d6c76267fc6718895ccf4368b
SHA1 a0723455edea3ccbd4d843cd844446ff962da1a6
SHA512 da1fee448c205d81fc864dde98bdc2b38a7955ddda39b316cf4e4c79aa2c06074e6768023ad8ee9e162d3f357cf1a9dd1a4848e1113c69a35fe08be426070fec
SSDEEP 12288:3C0P9Q/JcuiSvaylw/IyES7zN4kqho3qJlW7puLThWyEIPB44CNTnpjFqQ:VPsJcui4hG/5ESOhoaJlmUvgAPS9pjY
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.9MB
SHA256 158d444bbb6e139e5e9d5717fa976bc069363384305d2b55862f93e3d77be0ce
MD5 5a091e59ae087a4ddfc71306b01cd20c
SHA1 ca72e19e34d229c6bd315ed529873fe5d2acf3cc
SHA512 963d17f6e6bf89114c8de234318c10687de0078fba05bc9a742e0bac52f35131e3b53aae4a90db61621167e543892df126c9a7518a5159b684fd9a89c6364460
SSDEEP 24576:5+gkEVfh4Co0hG/5ESOhoaJlmUvgAPS9pjY:ggkExSmhG/1OfMUgAkp8
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 b1ec8981f2ba53170f214bb5bab41af9e1a7ee4bf3f817b1962ecffb4cb8d534
MD5 3c5554ea0412dc775d57442cd773ef18
SHA1 b498a1c9c3c3f96bbc5255cfe499b5d329d82a3f
SHA512 ee7ef2f5ae332c6897341c20b68aa72ce010b12b80f73e9df9c76f47b0f65900f191ffa1b2ede8b6c822a9f069559d66ac7508d4470fc99e451edad6dcf5a348
SSDEEP 24576:uBpDRmi78gkPXlyo0GxjrjhG/5ESOhoaJlmUvgAPS9pjY:aNRmi78gkPX4o0GxjHhG/1OfMUgAkp8
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 123aac7ac32b5196c26499d4cc12ea72305428c8517bc9f30390e260ee3f4670
MD5 324590fc0d97e7b8ad0b7fd968bac7d0
SHA1 2257f02a9aceb296c661e3df266b563495bf71a9
SHA512 2d0779440510dcc87783589929346d8872980b2a013271f5aade6321656d0581ca345f86152394016fa34163868c2749597d0a607c31969e650093bec9bdd17d
SSDEEP 24576:nLOS2oyPIXV0hG/5ESOhoaJlmUvgAPS9pjY:R/yfhG/1OfMUgAkp8
MD5 SHA1 SHA512 SSDEEP

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 8401e0fc79ba11ad5265be737f5a4d95a2628b929674b43001fa248d10fdd4e2
MD5 9d69b71f50743e1a5373b3c1e40336ce
SHA1 22c947b9c8f38535b1bca470e672a915bcd63919
SHA512 55cf0b3a1cea9fb633f3d221ddab36630dec0c542b89a367e18c8c316f713b3d596cc0c882eff7e20f7e519e9d710730abfb0e3a4a24a8eae0da97dab673c467
SSDEEP 12288:TfYvaylw/IyES7zN4kqho3qJlW7puLThWyEIPB44CNTnpjFqQ:TfGhG/5ESOhoaJlmUvgAPS9pjY
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.6MB
SHA256 1820a6e6c4a5ff385d67baddeebea8b174e00f97645f304a4ee355aaaa110cc4
MD5 da769895cc9caed8769e48ed96d05730
SHA1 eba6054a56b5cc0e6a7a0dab942ca17556dc6ac5
SHA512 52cf1c582afc42c5cb9cb9c5730d11c926cd4b512063196548f0ef5cef6dc354e22eee2f34febc94cccd9a2cf104cbc62d23a14d9ebef5c98ddb360aa4be9a6c
SSDEEP 12288:geBNUbTVO86U9vaylw/IyES7zN4kqho3qJlW7puLThWyEIPB44CNTnpjFqQ:gJIUFhG/5ESOhoaJlmUvgAPS9pjY
MD5 SHA1 SHA512 SSDEEP

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 dd03fa84d94992434fcb49025579f29f5dec78b838c21cafee4894998e2bf417
MD5 21415a5c9924dece2f69865b0ff0aa99
SHA1 b833ab0ccf01d47910fd52c137188ba272177d27
SHA512 9aaf58b34d4370e9701f1ef25dd00d2c32eb704386b41dded52fa6175c038463fdbd5afd7b5071e806a7d7d841c6dd33c45385c3964b827761c1de279da48a59
SSDEEP 49152:LQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3TH7:LQvGAdlCEL8c/yRNw5CAhG/2o3p8
MD5 SHA1 SHA512 SSDEEP

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.7MB
SHA256 99cfc8ae4db8355691094b0b6afb1e54bd755a429538962b35a3fa4c33fdba29
MD5 5ed32dbd871a02456eecda44aeb6d14f
SHA1 f6be3d9f40e6ea3a3e6dca919805cd36b186b266
SHA512 d6c009d4ff97325695884d4f27407ae2074bcb342b932270fc16933c044f36ac0e52f767e60041d12114da159ad58fdd1a6f5457afea10698d8e51ce7d060c36
SSDEEP 12288:tAwSfxL/2Dc34DLLmt0LDQewsAjTvaylw/IyES7zN4kqho3qJlW7puLThWyEIPBE:edewsAjbhG/5ESOhoaJlmUvgAPS9pjY
MD5 SHA1 SHA512 SSDEEP

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 93b37becaf5576c46ddbcab99fadab78b3f9a3de610b05341b0ae8bb719a88a3
MD5 edf31b925a2c00fac1c176b843b4de9f
SHA1 4bc379f0a172f182ff3ad74b9293d1dac4469272
SHA512 9002fe4ae0a13060e9c7d3859a0fd14d2664d141ed779e73ae1a972e604268bc8f199842997ff1685222ac1b7fa6af37c4f8528824330b4e3ea67076cf823019
SSDEEP 196608:OUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHzs/2:OUEtQevvqc2W1cpV2EI32zs/
MD5 SHA1 SHA512 SSDEEP

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 f3584152b7323c7f2b2a7954e39cd56b2be211825c41d4af2b9e80f7bf99f759
MD5 0a679d8bec709cb8856a548f822fa64f
SHA1 33e771a5e5a6f4ae533600e42c566a3fd2fa67dc
SHA512 973a2f6b8718e7235a6e227f814517b0116c9a03db7ee45f365dfa82aa8432dd3beeb4f9266d9d3bbf4a0c1c7334cb887a306cdc83cc49e78b7b685b01acf9f3
SSDEEP 49152:yCbRquA/m2yL5zifFiV+XenmE3/z7hG/1OfMUgAkp8:XoqHVjnmkhG/2o3p8
MD5 SHA1 SHA512 SSDEEP

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 7348520a9ff1c18d3d1cf2f3637da0f89241af1fd22fafd3605a1397b7105e2e
MD5 1dfcd02878865c99c2097de9a4ea81ed
SHA1 1b0d8e341515b71a33c1c8fe000520e0e2c5489f
SHA512 402efab410f3f65c255d943c19cf32066280789472571a01f160be8aec38b85397570e3405adca8fba5aff84d3c465853a40a3183e5c074062f9f0f1c91afb32
SSDEEP 24576:qAhGLJIFoiwtA5l7S53EhG/5ESOhoaJlmUvgAPS9pjY:qAMyFoiq5UhG/1OfMUgAkp8
MD5 SHA1 SHA512 SSDEEP

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.6MB
SHA256 850001844c489737f28c23b435ae25fdf58d7990adf6172e6ef3a1b6286334ba
MD5 91f9c54e366addd111089a01b1ca378f
SHA1 8a219a59c716fff08053c0c32be74d5184dafdb0
SHA512 b7f662a37b9a25f4c53086c7a15ba44c3c14e07937dcb66f04ddd12e3ca1455f47d8abbde767323c9f3705a9825fbaf17a184c924bb769c8f6041aa3677fa98d
SSDEEP 12288:Rmw5HEjsChNVBFgl0WDm+Cavaylw/IyES7zN4kqho3qJlW7puLThWyEIPB44CNTL:MwuoOWfhG/5ESOhoaJlmUvgAPS9pjY
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 16dd80563af8c2f7c6e91bbe0f6eb02615f90a0c02d72236d0f136189696a2f2
MD5 a3457844adc6ce3a9739eb5d02c069fb
SHA1 2ffbb727cdb437f064c8afcb5f8e1080bf59c185
SHA512 78c62a5aa17f8c7521f4c986a30fc001e6f06ce135c5297bc5623bbd90822640408ea8c8ce21d5d22f673b76594d770d2be257ced82db84b5e760402e0111f2e
SSDEEP 12288:lBZ1Iyjvaylw/IyES7zN4kqho3qJlW7puLThWyEIPB44CNTnpjFqQ:TZuyhG/5ESOhoaJlmUvgAPS9pjY
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe
Size 4.8MB
SHA256 1a8b6825e3549058ab60250b960541494326a66b547593a16e50fc0aa64ee100
MD5 5acfc7235a4953e712a4d298e1733b3d
SHA1 fdb4d9904ebbe0513bd1867fb9943a8241f5179e
SHA512 a8fa63a55f7f1d18bf6b94d8c858015f5ddf6e83dbb32c285b6314d1ac8fb867bb18c0a4d5e1e1bd7fe948addede0032665f282bf5a2860f49c4ef495bb31d4f
SSDEEP 98304:drZ4K5M+XDfiIewG+x6xZ149hG/2o3p8:BZ4K5M6qIzv+Z18s/2
MD5 SHA1 SHA512 SSDEEP

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe
Size 4.8MB
SHA256 365d54baee03516727e2fd172f21d075c5fdad455c104477f9cca043c2422250
MD5 01f343b97815b5714158c28b15cc74bb
SHA1 2ed0476946e51d1e26dc83c5621a16dfdb2262cb
SHA512 44d3979fdebd51609035ecec3b8c5bcb0b3f089f43607e3b0605bc2166c975ef50cd3c43b6c5af5d87f25957542d64bf5a2db7959b677d1eb7351271716067a2
SSDEEP 98304:GrZ4K5M+XDfiIewG+x6xZ149hG/2o3p8:CZ4K5M6qIzv+Z18s/2
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe
Size 2.2MB
SHA256 cbe1b486b6735e4e952a17a5d975bdc89f3c55bec1c50a6f5446797443de68c5
MD5 a7429b59b4e2686411b106d1de8e07eb
SHA1 a8d3149226e38ce11a597e76aeb10a7385a9851d
SHA512 a59bfdb85c31c98a31bed9b9df854a89ea4e921f5d719111240b5f363ad4f6fbbc5d0120bce584ac612451267faf763cf372d8b236d1e60f961eec1ba0d4a7ec
SSDEEP 49152:4fzabJ8llj+SWWi2mkx+X+diEhG/1OfMUgAkp8:Zui25hG/2o3p8
MD5 SHA1 SHA512 SSDEEP

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
Size 2.1MB
SHA256 007a4d92658364a5c722a13a5d08bdf91ffbda5ec5ddc9a2717f27449313ad34
MD5 882a03771d06e0d94fb4de840cc427be
SHA1 dbcbc40272090591428cdc8174a8b0a2cdb9ea12
SHA512 0ad32371c7ce7c5e09c45160ba2b0298a5bf7f8d593e79a5960d6de80ca18a518040f9de9e8d08aefb5a7abe3a62015309b26fc80b45d1a7018de2a14f75fd26
SSDEEP 49152:ra/3xXBSZ4K5MJ1LvTMxbfsYBYSgxu9+fw4TdhG/1OfMUgAkp8:bZ4K5MJabfsYNohG/2o3p8
MD5 SHA1 SHA512 SSDEEP

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe
Size 1.8MB
SHA256 64c5c4ff3d057d41ecc694a40ce4f67901b2db1d6f5fe3f245675c49b974dea0
MD5 a5d058373882f6ed54971b80fe4c9e8b
SHA1 8d35b8c791e9348215912e8cfaa4b21c27d2cc89
SHA512 15fd4194edde9ce7a42532c19b23bcc5b51d1871d81dda9459701781b59c33ab33b2d90ea2b67cd4b9345199b02509a80a2b66db3b15a1c75c5feadb4cd7f4df
SSDEEP 49152:zgNJtUzDu/9gKPxHC4vhG/1OfMUgAkp8:YPxlhG/2o3p8
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 1.5MB
SHA256 524ec35ac75525d6164168f20c42d78223575ea2143ce0e8a1be276756035c70
MD5 9d3bdd74c6f660774d6cf7dfbbbd48b4
SHA1 9ac82019a8aae18cb010e27051d47875e18a5810
SHA512 9558978b122b1cf4f54492aaffc209f90d208aa386df9e0162e0bc4b0a907299279014b6e966b9088726b859aa6afd02ac67fed8e7dfee403890767f21253fd8
SSDEEP 49152:NOBynH1wM+v6UJxLQd7BHjdf1hG/1OfMUgAkp8:/n4LQd7L9hG/2o3p8
MD5 SHA1 SHA512 SSDEEP

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 ca807f3d908bb19a9d74fba5c8f170364a7d30af512767c9311db4ba07d78276
MD5 60ffffbdb8f533c5e6ec28cddb3335ff
SHA1 1691d64e6fcecb3d4410a44b321caedd9dc75ae8
SHA512 3301c7dbb9c6203c1183b17b8da3b116e90fe05dbde9d9be2dfaf80e189f8ff3b211a112a53f5066454d50ebec659f810d8a99a883a928cd2b6ca7fa409ca0b8
SSDEEP 12288:vwvaylw/IyES7zN4kqho3qJlW7puLThWyEIPB44CNTnpjFqQ:vuhG/5ESOhoaJlmUvgAPS9pjY
MD5 SHA1 SHA512 SSDEEP

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 3f119b911f072087ccc3165649f227ce5f1b7874783c3b39b4403b4dc24a96f5
MD5 983e80588ea07bef0a3d6a0e46021db7
SHA1 476712ad65ab55b18a3dd56d16b1c2474512e2bd
SHA512 5c9219e3cfc026d9ec218e4a7e219aa44391d6927a92152c0cdf17a30942f50a7dc8500d09c0a4783f9b30a48c7d920b50382fc0615a653f3c5c359133be5467
SSDEEP 12288:afvaylw/IyES7zN4kqho3qJlW7puLThWyEIPB44CNTnpjFqQ:aXhG/5ESOhoaJlmUvgAPS9pjY
MD5 SHA1 SHA512 SSDEEP

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 7a0f7ff7e9900d047b2da97da523cf187a980bdbe0b1d1a3eb86aeb35e9c70e8
MD5 12be14175d68f4022b45fa146f4fda71
SHA1 ce69b2df2577766082ced597d829118936c618c8
SHA512 4db1f728b85f584909abb0a66bf8dbf795b8f7614f794191160776bfe1bc10ca7acb970ea4fc4dcb6aa7564adcbf31900590da559c1606f97d2070e7733c7e19
SSDEEP 12288:c1vaylw/IyES7zN4kqho3qJlW7puLThWyEIPB44CNTnpjFqQ:cNhG/5ESOhoaJlmUvgAPS9pjY
MD5 SHA1 SHA512 SSDEEP

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.4MB
SHA256 570019756b9f510b4ac7c16cee034e09317a22fb28bde0b36209e6f08a667c0a
MD5 cfa6cc5b0e8739d2118055bd52de135a
SHA1 dc3c1317f22bc049c1f72e8e72731140616f44c1
SHA512 5b9cb1ccfa4f8fc5d1dec4b7e4ef32f129fdf36c4d929b66ad068810042231fd30fc17701e1616393e543fefd4cf8e4120793e1f52ea28e81ee042c4abfb69b4
SSDEEP 12288:XV+vaylw/IyES7zN4kqho3qJlW7puLThWyEIPB44CNTnpjFqQ:OhG/5ESOhoaJlmUvgAPS9pjY
MD5 SHA1 SHA512 SSDEEP

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 16557e8fee8d41c3d0bc78d12ee6dce7851ea480a3318398299f4bb90a383135
MD5 8e07dd077747726ecc69b9d15606daff
SHA1 7e6b8e034507825dfd55535041e664fe81910b6b
SHA512 287bc0b9506347fc8d517ee1eddc8b7a36920454ed359bf2a0682f5575106953fad70c3aa0942673d526e1d2e6b4f3b774a62e68a2469ff4cfc0c72a0305c65c
SSDEEP 12288:oGvaylw/IyES7zN4kqho3qJlW7puLThWyEIPB44CNTnpjFqQ:ochG/5ESOhoaJlmUvgAPS9pjY
MD5 SHA1 SHA512 SSDEEP

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 f9a1a362be1f68537fec0dfa7a6b1d4cf452d522f8cd0dd4adb1932cfc2c8451
MD5 bb2661d21ff12bdae69e40dea863384a
SHA1 d3151c315a942508910a97c267016170a4ce3df9
SHA512 4d7106fa872ddada105e462f37d2d863e82b3b8dc734560b75c77030eef3f9d4d9afec7ff6c569614a67cfd3d11fe0331f03b148b651c07514d0f42340551f25
SSDEEP 12288:eLvaylw/IyES7zN4kqho3qJlW7puLThWyEIPB44CNTnpjFqQ:ejhG/5ESOhoaJlmUvgAPS9pjY
MD5 SHA1 SHA512 SSDEEP

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 bbf09c1919d005ae0cadca8b3315b90c0f4aaf0b9795265d25a600a6eaa6a248
MD5 a8a5fa877c5b45de83817271ce5f5024
SHA1 99d39cc24dc04b6bc877352972c8526840a57f6f
SHA512 f8559a60bd38edeaa57c2ec48ab15eba729a550a9c3b80ee07d8ee7594ac06568e3d10d3e78e1bfb4226f0bebfc4e4aca3d2d958b6433e990606f4613eb6007b
SSDEEP 12288:vnvaylw/IyES7zN4kqho3qJlW7puLThWyEIPB44CNTnpjFqQ:vvhG/5ESOhoaJlmUvgAPS9pjY
MD5 SHA1 SHA512 SSDEEP

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.6MB
SHA256 3234e6ab008c19127e7d43043ffcbac32a9c30705a567137c3da8c1e3863ef14
MD5 71aba0b134485e72481d9e24746b5b37
SHA1 c97cf6c15bacc2fc89b25f1c0718af7fab8f81fa
SHA512 4f26a24aa7fd7baa44d9327fc8c566abadc959e58a4b53ce8884e27d852fe7aa1e39941f9846145b726edcfb5fb00ff1938ef07e65ee072538ef28ba2b369197
SSDEEP 24576:aZMSzFVSO3hG/5ESOhoaJlmUvgAPS9pjY:aZMSzfThG/1OfMUgAkp8
MD5 SHA1 SHA512 SSDEEP

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 56b0dfc9a2293af8796a6a5fae8ad5418b2ade231dd0df12c8370caa26c72467
MD5 dfadad6b45b8f08b2827ab7bfc90929d
SHA1 044a85e401329e0134c323f8fe654e82c2d6195b
SHA512 daa62531ee0ba5e73befa5d85e18a354a97c88c9a28b119f4b45007a5491f5947c7bc8893f469477869483ab1eb36268b3d3b96f08508e8386d6fc908672dc49
SSDEEP 12288:qkvaylw/IyES7zN4kqho3qJlW7puLThWyEIPB44CNTnpjFqQ:qihG/5ESOhoaJlmUvgAPS9pjY
MD5 SHA1 SHA512 SSDEEP

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 3d4f79ffb5301b73fd8cb50b5f3f4813d097e4df7a077be909739aaa75f480a6
MD5 653a239a03059e24460bc4fbb3a29ad4
SHA1 9a2c1a0d0339578d06cf4063b9a3ea1fab6faeaa
SHA512 cbf2533cb1dd12886b147258a09e122ec6967fa06462200b1e7fa15f387dba704473f41f0717dd0542e93e180e2c907b081ad29dea19e96d73ba1998a30adb23
SSDEEP 12288:lovaylw/IyES7zN4kqho3qJlW7puLThWyEIPB44CNTnpjFqQ:l2hG/5ESOhoaJlmUvgAPS9pjY
MD5 SHA1 SHA512 SSDEEP

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.5MB
SHA256 1d6e64c94c6b786048ae401f173dbb0428ef464a7ae7e1a790952b2a5a45178b
MD5 3eba96e634258a9e9072f765045b1ebf
SHA1 85f79c782b6a8756936b9dfaa9425233662d8087
SHA512 7557f9be4c307f5fe8ce0e89234d5ea04eb7042322a707443ca184a8e681fed17dec1fe08469f593bfeb4c54409b22c14b6c4a7c498afc19eb905fdb8cbe2d7d
SSDEEP 12288:3yPz5L8jvaylw/IyES7zN4kqho3qJlW7puLThWyEIPB44CNTnpjFqQ:6zyLhG/5ESOhoaJlmUvgAPS9pjY
MD5 SHA1 SHA512 SSDEEP

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 a3f99eea2a460977d6b79676f81fbf217d67ce5fd2fb5aef3922510b46694601
MD5 348039a88c7cc9467d1d751aa101df2a
SHA1 2c4b2132612168dacc0a9bb7bffb0b14e732fc8d
SHA512 8790f292c7ec07c9a4bd366cad627b15208d640a39c505a720d3052c03c8d4c31baf85a78df82d3930423c6cb4b447865f6aa7f14914034d73d1c2e8935c928e
SSDEEP 12288:Pkvaylw/IyES7zN4kqho3qJlW7puLThWyEIPB44CNTnpjFqQ:PihG/5ESOhoaJlmUvgAPS9pjY
MD5 SHA1 SHA512 SSDEEP

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 cbc2bdd8fe641d1ca996cc7f4ab25f02d5f3aa79afa5e73bb17ba86ebb7279f1
MD5 18d69ff15e573d952d0f9a8bd59f91d7
SHA1 0e27dba2afb189337dd50cbe1071c5c00c6c15c0
SHA512 e3b3db78643cf4fdb93acf2a3c74e5beeef7c3b11629cb912fcdbc5170a0c39b43150e18538d1bed669071b81e85ca69375a681323387e7ba843636190f2a6d9
SSDEEP 12288:Akvaylw/IyES7zN4kqho3qJlW7puLThWyEIPB44CNTnpjFqQ:AihG/5ESOhoaJlmUvgAPS9pjY
MD5 SHA1 SHA512 SSDEEP

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.5MB
SHA256 5119a3cb862aa2b4c5cc4fdd4e63ae3db1c3580442f0b419e703bd51852e943f
MD5 baa4457f1dbc1809d357f89e1ecf0280
SHA1 29eae337f5a6f43066ebf46abd8997cd4e292f0f
SHA512 f17eda29ea1e10f7cb6ab1cd7c70838ef9657460e90cfe9566033eabab67ebf3e9ebf7c1fc99302dc0e09858611c05f150c5c9861f18d3390f911446cd46b56b
SSDEEP 12288:UyPz5L8jvaylw/IyES7zN4kqho3qJlW7puLThWyEIPB44CNTnpjFqQ:NzyLhG/5ESOhoaJlmUvgAPS9pjY
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.6MB
SHA256 9c0ae9fcc897e8c4c87243ec56dee0b2a89c156e50529c5ed1281485da1d13b6
MD5 501662b88f0ad9f936333ba16d5bf3b0
SHA1 1fbf729c0f1f9b8ff23453ca4fed2a3b006426dd
SHA512 2e10eecff5cfabda371cf41536ed3429b35a6b70e4809e1b86535b9f18558f41175d9358242ee84a612d085b05e61cb425045716d15da56327880f6811129513
SSDEEP 24576:ZTHaLl3z0zDdhG/5ESOhoaJlmUvgAPS9pjY:ZT6LljQhG/1OfMUgAkp8
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.8MB
SHA256 72e4e03b962171965084e940d044176b4bab780d50cc3468248479e20a437c59
MD5 4e25a8447440bb215f18eeb2fb492e18
SHA1 f42b05943fa498b0a006611d72a75a3d49e8e0f0
SHA512 bbdc9ce0b660aca6aefc452a36a100b37d93599319776910753f90372b47c2e0ac6a5b3c40407a1975e2250dcf930e3c7b4f04db6aab095b1f1b5edfe92538df
SSDEEP 24576:U37d9CHKy7GZJhG/5ESOhoaJlmUvgAPS9pjY:e7d9CHKyaThG/1OfMUgAkp8
MD5 SHA1 SHA512 SSDEEP

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 e12e72b73135143018f7797a06ba6209db82e0bf7e89b2b6bbcb94f8dbb26f0f
MD5 1082815f689e8fbaef16bb5df1acb94e
SHA1 df7465a0aa66320cefa5db22c653c67c36182831
SHA512 ac908e961993838dbd45b1ccfc6d9d6201469147b919f519ac6eef3ff3390e688f5ac0358aef3c33aacbd60114d63fa1449fd7984f6193925149e40159744331
SSDEEP 12288:2Vvaylw/IyES7zN4kqho3qJlW7puLThWyEIPB44CNTnpjFqQ:2thG/5ESOhoaJlmUvgAPS9pjY
MD5 SHA1 SHA512 SSDEEP

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 40b08bea941e289b31420564fd8ecd0456077bafc73e928c2bc06cee9f1c7109
MD5 9a6803adc8735f3ad0ff31790b87cd26
SHA1 92758d212c7dcc810ea2884fcb0195d903f7357c
SHA512 9b616872556f98c461718496a259444609775e4854feb96d53598cff3b4df19fa7c50b204d90ea1ee2390b62664fb542580bdda9eb8abbc4a12c5dfe0d6f633a
SSDEEP 12288:pDvaylw/IyES7zN4kqho3qJlW7puLThWyEIPB44CNTnpjFqQ:prhG/5ESOhoaJlmUvgAPS9pjY
MD5 SHA1 SHA512 SSDEEP

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.4MB
SHA256 3fb27237e547baf1f4820f9c816904996d8b5a90408910228b77a57febc0ac40
MD5 1ea495922f7296e96bcb2cbbf52053aa
SHA1 d37c16077937f85efad99dfdf577e4a9b1db56b2
SHA512 f81529d2645365fd4f8c4d2e9c07290abddba75a0498b97b80496dfb4418f1262736cdb7a6f5dbdd43625f23bf391d018469c0bfbe80744608277c26d2e5bb5a
SSDEEP 12288:eivaylw/IyES7zN4kqho3qJlW7puLThWyEIPB44CNTnpjFqQ:eohG/5ESOhoaJlmUvgAPS9pjY
MD5 SHA1 SHA512 SSDEEP

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.4MB
SHA256 c54483109438d42e46bd48c84206e9812b1fa3185a38ed9690abdd20ec5b6eaa
MD5 cd3372992b1fdd5a65a227bd879fb169
SHA1 23d5629ca5eb66e85358ada2fe9e4af0f46d974c
SHA512 63e44c9f4a7beeeea01c499ea29e869b38560196ccc38fe3b885c563bb19bb678470905144d9e65c9bd26cb806cbf7d944fa3ff5fb5f2496aa84a79f7d1676e4
SSDEEP 12288:ykvaylw/IyES7zN4kqho3qJlW7puLThWyEIPB44CNTnpjFqQ:yihG/5ESOhoaJlmUvgAPS9pjY
MD5 SHA1 SHA512 SSDEEP

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.4MB
SHA256 732382bf4acbc9fc8453df582c3c5a3bc2789ef93f7df420998954005839407b
MD5 9f5ba972726dcf4f99ba8ea1680838a0
SHA1 9a94add9507d29b3be76c6677f3436961d97a3ea
SHA512 39124313791bbce6597a848f8e5d0f2e1eb6db95ef6b27592c0fefd10494ec8f99348ce1e4a728fd417b8d1a5c317a8d077435e5384c59d94f72e1414a220857
SSDEEP 12288:AVvaylw/IyES7zN4kqho3qJlW7puLThWyEIPB44CNTnpjFqQ:AthG/5ESOhoaJlmUvgAPS9pjY
MD5 SHA1 SHA512 SSDEEP

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.4MB
SHA256 d8a6798bfc9a52914361958521128bff4bec8c6cb5a72b9476770294b5e6a2cc
MD5 f4c644d23ef54524a56cc001d82c2d3c
SHA1 d5e24b1ec3feb31e56f9dfb9f56d6a6eb5ccec54
SHA512 44df89ba6d2620916ded1d05892570e0a902d9cc58ccbe1a140f7929369cc919b8f24fa84c4ad3a2302ad1e6e8273db9724f761f989c05a944e168c1fd852997
SSDEEP 12288:Isvaylw/IyES7zN4kqho3qJlW7puLThWyEIPB44CNTnpjFqQ:IahG/5ESOhoaJlmUvgAPS9pjY
MD5 SHA1 SHA512 SSDEEP

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.5MB
SHA256 514e702b63d9744594a01f78404d7754c4c30680a3b00c63cad293167e3c5f3a
MD5 cb204ba3e67c9cd5a10509241313a878
SHA1 890c9d29f1491fb0ed58dec432d3e1286bc31923
SHA512 c9d56cf7adacbbaf059334c4a050609b5d1e12d630a618fd3e63db7f1befc92a9807b09517591c882516afdc6146168a0890f1a21745862bd44d19715218ea5f
SSDEEP 12288:vFYq0S7vaylw/IyES7zN4kqho3qJlW7puLThWyEIPB44CNTnpjFqQ:vgSzhG/5ESOhoaJlmUvgAPS9pjY
MD5 SHA1 SHA512 SSDEEP

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 6a9463125a3c490c3e6938c393c3b1963ad5cc8c47b25f3b99b721b4e8d74e03
MD5 a57d0247f489968a0540a343226bbba8
SHA1 562d570309edce2add02559a75ff42088634df7b
SHA512 194f5e3f8c43ad4e7dbfff8a6a93779550ecef9bcc35016fbc64dd0d617741c420e1efc38e31a24f17e8472cb97111a5c3269e1bfe2ea7c373a1305674f8ac2b
SSDEEP 12288:CRvaylw/IyES7zN4kqho3qJlW7puLThWyEIPB44CNTnpjFqQ:C5hG/5ESOhoaJlmUvgAPS9pjY
MD5 SHA1 SHA512 SSDEEP

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 3df899d29cb0f43e8bde5d2c1aaace11e52429399f94bab041f21d67cfb6ea92
MD5 3445eadb951ed4d3304eeb53f1efb95e
SHA1 bbdf9002e03cd405102e047b8bf1270fbed4a7a9
SHA512 a383ab1191cb8c47ec6d3d9d73c4c40998a50a9b262312bf156068cb41e0bc7c18ea92dde6e1588e4999bbc7010ba448a313022d670bddd2b9341c906cf1acc3
SSDEEP 49152:wa0h2GEkuAe73q3pp46zwwQ3hG/1OfMUgAkp8:wa0hNYG4JwshG/2o3p8
MD5 SHA1 SHA512 SSDEEP

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.5MB
SHA256 60e574db72d1fd1f49f3bd025c690b0a167c3f11c5d83ac1a3a516825a4ff777
MD5 4d8010886e6295d6128a501b48e1f555
SHA1 a9096c266eeedca20ff7a8852e89c886e5903537
SHA512 843d9104dea9d38ffc7222dfa6977bc922769926375aacfcc146d2fc3dceafafdc93d40a867fae013f8a8d337f47b00448d54768648a59750b8dff03937506bc
SSDEEP 12288:IhbHjfXSvaylw/IyES7zN4kqho3qJlW7puLThWyEIPB44CNTnpjFqQ:IhbHjP4hG/5ESOhoaJlmUvgAPS9pjY
MD5 SHA1 SHA512 SSDEEP

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 39ebb53cf80a045665d20e3730b2ccd78eb49eec95b6baa22a8e09097c4fd276
MD5 3120dac1d0a1feef794e24177b50e493
SHA1 7288476adb420922f3eaeafd2c1e3e834b291a23
SHA512 f5ce3c3d0160fe684c4dbbcf55089d5f71a19f6b889a9cdad27be26f935664e6f7a9e43ccbd5b7f39dc8bc32fe76bda4f9197b30c381c44345a17a1d1dd630e6
SSDEEP 24576:k3YgnJcRTk4yti+R5dpR/whG/5ESOhoaJlmUvgAPS9pjY:kIgnaTk46ppR/whG/1OfMUgAkp8
MD5 SHA1 SHA512 SSDEEP

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.4MB
SHA256 4cfc22e202090c8dc7f7e6c446708578dd8ebdd77a76d12c828204cad0d5c7f0
MD5 4d6f99f75d7b6804c6571b860262b396
SHA1 99ca5a631d621e236db66c4522433e63c94bd3f7
SHA512 30afba0eb9273d0938ee92cd976bc01a86fa787dcf69778b21d65ab48f4ef9c52be3f356cf61c70f5c763364e75337d54b0a00fdce0360bcfa09f9e559fa018a
SSDEEP 12288:+tvaylw/IyES7zN4kqho3qJlW7puLThWyEIPB44CNTnpjFqQ:+VhG/5ESOhoaJlmUvgAPS9pjY
MD5 SHA1 SHA512 SSDEEP

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 0414456eb931e58019f78083d05e37c8d13e3cc5e9229e817747762ac35ebb49
MD5 5ed04e3dae1f7c5dfd746e1db523be66
SHA1 a68df5f1fe230f11742c9acb82019e340d7886c1
SHA512 2b6a5fc94f0290173ef0b805449895cbd9147ab59324fddfa1a65850126328894d2118f3e78855fb1f6c2ce27ec2f0f99c75afcfdd05d71af9ae69bd3d6e5a59
SSDEEP 12288:wOb9A4LWOsvAYFTwvaylw/IyES7zN4kqho3qJlW7puLThWyEIPB44CNTnpjFqQ:tpL3UTuhG/5ESOhoaJlmUvgAPS9pjY
MD5 SHA1 SHA512 SSDEEP

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 55f016dcc8945e0c47c08f355c9ccd4d3a4ee2f52b034afac35fc05823553959
MD5 46d9a76fba43f45b4048bba7c75c2013
SHA1 acefccb37029e2987b05766dbabd887f6be1c712
SHA512 5f2ae71ff22be2fa4e5f0e7a174c576ebe4bf9b64e0c3f5c88fad6a9ce0b69ee0eea0a8080e7020223b435b884add57523bf4e7bafbadf11ef5ef6b77d099064
SSDEEP 12288:RpFtpOcvaylw/IyES7zN4kqho3qJlW7puLThWyEIPB44CNTnpjFqQ:hOqhG/5ESOhoaJlmUvgAPS9pjY
MD5 SHA1 SHA512 SSDEEP

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 7c2b759cfb7161f8612120d16eee21cfe4859851e71196c690d2729222499540
MD5 ad552e774ebc386bc7ee7d6de657c385
SHA1 4797e5ceb1680c9500876bd8da7c7d282427fea6
SHA512 36835517237a86808a62d45d3d602fa592efb2e8d657571cecf8fd808fa3eb73a2552397ce3ee1cbd92025e0b7254c8a8a20dd15afd5ef7596495034383c8696
SSDEEP 24576:I7NM9YmZqmWMUkPjZM48Mv6bEhsJhG/5ESOhoaJlmUvgAPS9pjY:I7cBWMpPjN8DbEhYhG/1OfMUgAkp8
MD5 SHA1 SHA512 SSDEEP

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 e9f8fcf932b257c4af6b88c4e57658ce28908a26871060f88cc422c899341e1a
MD5 6bbda845d93e2a6b0c859d838cf8f7ac
SHA1 a09d6c2e85e13595e557b53ea6f8114ebd61a60a
SHA512 fe3c527ea14bdca45ea9a1b5da3bc1089a61174a4ce33c5f50a3a7d7a70e2b5409b449516e5b94471c4f264cfbcf935dc28940d0c15f269b11052acb0c9ae951
SSDEEP 49152:IF2YuHNETovcvNYf8kmphG/1OfMUgAkp8:N6tCf8kqhG/2o3p8
MD5 SHA1 SHA512 SSDEEP

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 af4f13792f3f4bb6e0e71ca7ec3b2ffed0497e9bb1208e7aae7f54b797f48518
MD5 65564e43d3788dbb5d0dc964c81577cc
SHA1 527b8b8487000495c1d58a4fe22d61a97b89697b
SHA512 26c1551566b14fc217f32e4e083c0458af6fdb69b37dde69c3ad027b1364bd1ffde877f839007d2d4ad6b68c67e0be5a28a10428ac824925076fd8399cba3ff8
SSDEEP 24576:5AFs06+Omlf3NXEbToWhG/5ESOhoaJlmUvgAPS9pjY:+Fs060lVXuXhG/1OfMUgAkp8
MD5 SHA1 SHA512 SSDEEP

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.7MB
SHA256 68aac6503e45680779c79794ec524b9f79da33603b6ddd3be444488f562d053e
MD5 c1d97ca1e92916c17c3c65e675673f27
SHA1 78c878e0aed4c1e43e780ca8d0c2a18be4096df3
SHA512 24f98b872c5ea2507e2cd8680b6d3c5ae4923e489e5128baddfdb200aa3e0d38f1355d99367c35f9a81c9ffda35854ab40b87f85b11561efed67cdaae9b2eb52
SSDEEP 24576:TJnJ5D3WtXhG/5ESOhoaJlmUvgAPS9pjY:TJnJ5DGtXhG/1OfMUgAkp8
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 ebee9859816b35a189fdae3b63d1b3b317c10677a7599574958d1230e8cc7423
MD5 078539678fb01a65bd4cb3045ce07af1
SHA1 ec194b9c5ddecc175ef54df117a167ea189728fa
SHA512 a880357f0363bcb8d36cee3b3f193f491425b59fff751c0864ab53ab1d00905323fe3469f79d24abe98244e05a4d10a82c7f28aeac11b084df7d6ec8c4fa5228
SSDEEP 49152:Fo06DIKdwc+eQnSt65aV9hG/1OfMUgAkp8:SrhG/2o3p8
MD5 SHA1 SHA512 SSDEEP

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.5MB
SHA256 7423f8b9236efff7bb07a783aa7a3713799237dabfb88b083fdc91ca6dab35c1
MD5 d8ced79ecf7e7ecc757681a003dba99d
SHA1 366076efa393ca54f19f070d37e52b521fca3900
SHA512 a5ba7486b975c38ee9972306ad91c63bfdeb0cba3d2dbc11831a74305d5598df7561bb7bef2f59055e3c9ea8413d97c35e61e9c2f22c93c5217920d1a89b0560
SSDEEP 12288:UEP3Rr4vaylw/IyES7zN4kqho3qJlW7puLThWyEIPB44CNTnpjFqQ:PrmhG/5ESOhoaJlmUvgAPS9pjY
MD5 SHA1 SHA512 SSDEEP

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.5MB
SHA256 3cb8aeea95b0be205d933437d6e94f6819f78b731414009e70b9a31449ab686b
MD5 a0167d7a8df94955022df47a1a29d60e
SHA1 f86176a1d08b62decd1c1659084a7d3cd9a1976e
SHA512 342b681e8f78a1fb2d00858b552522df8c87f86d1af2a90003c89af626efba0155be1718f87d6370df1b3d2533818e054208b44e1e29320b932fe99140d9013f
SSDEEP 12288:Tjkyivaylw/IyES7zN4kqho3qJlW7puLThWyEIPB44CNTnpjFqQ:TIyohG/5ESOhoaJlmUvgAPS9pjY
MD5 SHA1 SHA512 SSDEEP

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.4MB
SHA256 2bed4331c1041f166abf9d61f08f6b79539718532505efca4f61bbc6087b6e5a
MD5 92c853c78d12e9125ecf6f0c472fa6eb
SHA1 ba7ef93ef28a79329455d45799cd88597bb58802
SHA512 f852124d46136a05489e1549b75cd32cc0a7b2dc76db7fb9a26ecfa8ea719e29d2b4d09f3eaab40d70dfc5ba2e35d014864ab0009b8ed1ab4355d331ba2b7ae5
SSDEEP 12288:cFsvaylw/IyES7zN4kqho3qJlW7puLThWyEIPB44CNTnpjFqQ:qahG/5ESOhoaJlmUvgAPS9pjY
MD5 SHA1 SHA512 SSDEEP

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 2bafe8d0c67cbf23287ea10ca2f1ac9df0ab5c0cac6c527ac4b36c582b24cb44
MD5 98de2eebd91d39edb96c08c2f720eca5
SHA1 2b38fc2760021d0cb9cb05c564377fd8e88548cb
SHA512 335ef8cdd78051091188f3f170670cec052fddef3fc25ca14800e22ff285acfbcac4680a92dedc654475a686917abb4c968306d226e79cc5d6f4323e4163dfdc
SSDEEP 24576:DQ9MxZKdcz97w3RhG/5ESOhoaJlmUvgAPS9pjY:DVKXRhG/1OfMUgAkp8
MD5 SHA1 SHA512 SSDEEP

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.6MB
SHA256 a49493a67824d021307f5cf0f196524bf293c78476184fa01d02b85094a30030
MD5 db43caa93764472381b82834e064577b
SHA1 9f84e07c697072a92852e4c5fa01d1a7c28f2d6d
SHA512 647e042c2d9116f6022c40c8ef8014f4eafdca58ecbf9830849dfc4e71eb6e8a8f0a8417a5fe038e63ae49cc9bb50f4c7735a6663a4cb66e36d924e7cb63fa2c
SSDEEP 12288:vyoKo2HRple9puvaylw/IyES7zN4kqho3qJlW7puLThWyEIPB44CNTnpjFqQ:vyocxAp0hG/5ESOhoaJlmUvgAPS9pjY
MD5 SHA1 SHA512 SSDEEP

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 c5eb39e1be5f9407e7f17bd870bccb8f20abb3ed69ab62656b753c56d6e4b99d
MD5 8421db9b2b205ffd9f366f1762242187
SHA1 c9abaa36c3119f101e7b8ba4f04912ce1d732b28
SHA512 d6890229f1bc289225cb12765cd3caabf5788667391b37a68a8d718b6323893a317615102ebf166372247b4c5acfcb21cb8ce8191d87f039bbb66d3c7dbd8861
SSDEEP 49152:TWcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIK0hG/1OfMUgAkp8:T0zuNIghG/2o3p8
MD5 SHA1 SHA512 SSDEEP

Submit Download

office2016setup.exe

Path C:\odt\office2016setup.exe
Size 5.6MB
SHA256 d702d535a2bc067262442806a89e860edfaff1f97ef0ea923747ca51e9a2bb65
MD5 a89bb5a3518541215e275db1164db54d
SHA1 0b81c854a1b96b316ea1eac2f7f16a7e537e8ab0
SHA512 7547c3ff7f74a3969091898c2a1f74c3baa39a68f93a2d05b34eaa74a8af990625f2a33b62b76ddc516d4e13929516bc6343163e9d5aa5c0210467d71cd50301
SSDEEP 98304:37M701RgX4iuSl1DtlEq81xZPGnzURnBh6gGL/QmvD/cTwY2h3F/hG/2o3p8:LM7pTXexZPGzURnBh6gGLF+W31s/2
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/544-308-0x0000000000710000-0x0000000000777000-memory.dmp

Download

memory/544-300-0x0000000000400000-0x0000000000636000-memory.dmp

Download

memory/544-364-0x0000000000400000-0x0000000000636000-memory.dmp

Download

memory/1040-234-0x0000000140000000-0x0000000140237000-memory.dmp

Download

memory/1040-34-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/1040-27-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/1040-28-0x0000000140000000-0x0000000140237000-memory.dmp

Download

memory/1060-374-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/1060-366-0x0000000140000000-0x00000001402A1000-memory.dmp

Download

memory/1060-433-0x0000000140000000-0x00000001402A1000-memory.dmp

Download

memory/1128-353-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/1128-360-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/1128-420-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/1388-456-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/1388-447-0x0000000140000000-0x0000000140265000-memory.dmp

Download

memory/2128-38-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/2128-40-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/2128-46-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/2128-235-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/2488-379-0x0000000140000000-0x0000000140281000-memory.dmp

Download

memory/2488-446-0x0000000140000000-0x0000000140281000-memory.dmp

Download

memory/2488-386-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/2556-469-0x0000000000610000-0x0000000000670000-memory.dmp

Download

memory/2556-460-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/2668-66-0x0000000140000000-0x000000014026E000-memory.dmp

Download

memory/2668-65-0x0000000000850000-0x00000000008B0000-memory.dmp

Download

memory/2668-238-0x0000000140000000-0x000000014026E000-memory.dmp

Download

memory/2668-72-0x0000000000850000-0x00000000008B0000-memory.dmp

Download

memory/2788-251-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/2788-312-0x0000000140000000-0x0000000140248000-memory.dmp

Download

memory/2788-243-0x0000000140000000-0x0000000140248000-memory.dmp

Download

memory/2788-244-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/3144-554-0x000001E490030000-0x000001E490040000-memory.dmp

Download

memory/3144-553-0x000001E490020000-0x000001E490030000-memory.dmp

Download

memory/3208-51-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/3208-63-0x0000000140000000-0x0000000140269000-memory.dmp

Download

memory/3208-61-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/3208-57-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/3208-50-0x0000000140000000-0x0000000140269000-memory.dmp

Download

memory/3244-421-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/3244-430-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/3264-392-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/3264-404-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/3264-399-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/3264-405-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/3456-325-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3456-332-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/3456-390-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3468-264-0x0000000000DD0000-0x0000000000E30000-memory.dmp

Download

memory/3468-270-0x0000000000DD0000-0x0000000000E30000-memory.dmp

Download

memory/3468-269-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/3468-255-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/3468-256-0x0000000000DD0000-0x0000000000E30000-memory.dmp

Download

memory/3692-22-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/3692-15-0x0000000140000000-0x0000000140249000-memory.dmp

Download

memory/3692-16-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/3692-229-0x0000000140000000-0x0000000140249000-memory.dmp

Download

memory/3696-288-0x0000000140000000-0x000000014024A000-memory.dmp

Download

memory/3696-350-0x0000000140000000-0x000000014024A000-memory.dmp

Download

memory/3696-296-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/3876-436-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/3876-442-0x0000000000B10000-0x0000000000B70000-memory.dmp

Download

memory/3964-417-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/3964-408-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/3964-552-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4308-14-0x0000000140000000-0x0000000140235000-memory.dmp

Download

memory/4308-11-0x0000000000440000-0x00000000004A0000-memory.dmp

Download

memory/4308-0-0x0000000000440000-0x00000000004A0000-memory.dmp

Download

memory/4308-4-0x0000000140000000-0x0000000140235000-memory.dmp

Download

memory/4308-7-0x0000000000440000-0x00000000004A0000-memory.dmp

Download

memory/4416-337-0x0000000140000000-0x0000000140258000-memory.dmp

Download

memory/4416-281-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/4416-272-0x0000000140000000-0x0000000140258000-memory.dmp

Download

memory/4572-314-0x0000000140000000-0x0000000140234000-memory.dmp

Download

memory/4572-377-0x0000000140000000-0x0000000140234000-memory.dmp

Download

memory/4572-322-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4656-347-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/4656-339-0x0000000140000000-0x0000000140235000-memory.dmp

Download

memory/4656-407-0x0000000140000000-0x0000000140235000-memory.dmp

Download