311203d7fc1f6315c09341e5018761a76db43b7a783e793dd49a8f33379ea996

Analysis

max time kernel
149s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240319-en
resource tags

arch:x64arch:x86image:win10v2004-20240319-enlocale:en-usos:windows10-2004-x64system
submitted
04/04/2024, 11:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-04-04_734abeddf00662a86cbaa71c8cdd462b_ryuk.exe
Size 2.2MB
Sample240404-m4spyada7w
SHA256 311203d7fc1f6315c09341e5018761a76db43b7a783e793dd49a8f33379ea996
MD5 734abeddf00662a86cbaa71c8cdd462b
SHA1 1ac4ec30d929be096b8c904456e2d14f1f3f12fb
SHA512 ad04358152a5f200ca645dcec3645e6aed3a7441c85c275612db97cb731dbe0c591dd2c50ee484a102e922933fb01c97e1ae63aac95d7eec4d20d718c1f3f707
SSDEEP 49152:CWWu1zKeIxNj2bchBluP3GiyBKD9gDUYmvFur31yAipQCtXxc0H:CWBMNj3ZoYU7dG1yfpVBlH
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
4388	alg.exe
1628	elevation_service.exe
4944	elevation_service.exe
2528	maintenanceservice.exe
1308	OSE.EXE
1384	DiagnosticsHub.StandardCollector.Service.exe
3128	fxssvc.exe
4820	msdtc.exe
1648	PerceptionSimulationService.exe
1432	perfhost.exe
2012	locator.exe
3344	SensorDataService.exe
4900	snmptrap.exe
3264	spectrum.exe
4160	ssh-agent.exe
3008	TieringEngineService.exe
5108	AgentService.exe
4888	vds.exe
1720	vssvc.exe
644	wbengine.exe
232	WmiApSrv.exe
1364	SearchIndexer.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in System32 directory 24 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\8bf1303a4ab059c5.bin	alg.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2024-04-04_734abeddf00662a86cbaa71c8cdd462b_ryuk.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.92\elevation_service.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\minidump-analyzer.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	alg.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d40823b27f86da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000acaba4b17f86da01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000050cb46b27f86da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9923 = "Windows Media playlist"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b636aeb17f86da01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001b47e0b17f86da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fcecaab27f86da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f02d87b27f86da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
1628	elevation_service.exe
1628	elevation_service.exe
1628	elevation_service.exe
1628	elevation_service.exe
1628	elevation_service.exe
1628	elevation_service.exe
1628	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
672	Process not Found
672	Process not Found

Suspicious use of AdjustPrivilegeToken 42 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2664	2024-04-04_734abeddf00662a86cbaa71c8cdd462b_ryuk.exe
Token: SeDebugPrivilege	4388	alg.exe
Token: SeDebugPrivilege	4388	alg.exe
Token: SeDebugPrivilege	4388	alg.exe
Token: SeTakeOwnershipPrivilege	1628	elevation_service.exe
Token: SeAuditPrivilege	3128	fxssvc.exe
Token: SeRestorePrivilege	3008	TieringEngineService.exe
Token: SeManageVolumePrivilege	3008	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	5108	AgentService.exe
Token: SeBackupPrivilege	1720	vssvc.exe
Token: SeRestorePrivilege	1720	vssvc.exe
Token: SeAuditPrivilege	1720	vssvc.exe
Token: SeBackupPrivilege	644	wbengine.exe
Token: SeRestorePrivilege	644	wbengine.exe
Token: SeSecurityPrivilege	644	wbengine.exe
Token: 33	1364	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1364	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1364	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1364	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1364	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1364	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1364	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1364	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1364	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1364	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1364	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1364	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1364	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1364	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1364	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1364	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1364	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1364	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1364	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1364	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1364	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1364	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1364	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1364	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1364	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1364	SearchIndexer.exe
Token: SeDebugPrivilege	1628	elevation_service.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1364 wrote to memory of 5544	1364	SearchIndexer.exe	134
PID 1364 wrote to memory of 5544	1364	SearchIndexer.exe	134
PID 1364 wrote to memory of 5568	1364	SearchIndexer.exe	135
PID 1364 wrote to memory of 5568	1364	SearchIndexer.exe	135

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2024-04-04_734abeddf00662a86cbaa71c8cdd462b_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-04_734abeddf00662a86cbaa71c8cdd462b_ryuk.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:2664

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:4388

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1628

C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.92\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.92\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4944

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2528

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1308

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3744 --field-trial-handle=2260,i,4762972005863767630,9297428255150568035,262144 --variations-seed-version /prefetch:8
1⤵
PID:3944

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:1384

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:4924

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3128

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4820

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1648

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:1432

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:2012

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3344

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:4900

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3264

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4160

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:880

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3008

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5108

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:4888

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1720

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:644

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:232

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1364
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5544
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
  2⤵
  - Modifies data under HKEY_USERS
  PID:5568

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.92\elevation_service.exe
Size 2.2MB
SHA256 8712925083cc169795e5f69a61478d7a886c9110d41612de2e8ce3b396cef280
MD5 380516650a35dc15290a6caa85dbd7f5
SHA1 209c4644f37d88ec1e7b8caad85dac0e7d92a01a
SHA512 271a9b534b47b65168fd553f69e3a1aa7e4f81801433228409dbba7d2f4d552cd0d6744cb2c3b5ed924a155e5d274d6a9a15e173ffc2406c35bb42aecdbaa4dc
SSDEEP 49152:yWWu1zKeIxNj2bchBluP3GiyBKDAgDUYmvFur31yAipQCtXxc0H:yWBMNj3ZodU7dG1yfpVBlH
MD5 SHA1 SHA512 SSDEEP

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 781KB
SHA256 e03d53df10335a35f6a221352cc01a467882769dd236b24801db49bd6da2d104
MD5 bb58063a399bd346aca58c5662369339
SHA1 c7e4f80509f41e3c91a66b5c83d261b960f8c8f0
SHA512 29f9764ff570f88b727ea08c2f5c2df4b6cd073a32e4c51a34f6efc389854364d50e6dca24bdb069c314e92bdaed661c0fba7dae187bb8b299d9dfd4eb324a7a
SSDEEP 24576:oPsJcuii8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:owcubgDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 8d4a967be808efb3c2a8bd73675db7fd6fd2a00d208b296efc5f2940aa5e9ec4
MD5 602e17d27d2d6f64cbd022ca8f5a9701
SHA1 473bcad607b65c7777d6473cd13d69a81cc35db5
SHA512 0f61d57a0005c2c84ec7955e588946c76ee65403e671ebafe2ec6ca95a3dd7c3964f8ccf96ebbab48f7b5d97963fa7656b205db85cd88eff06be7ac49927b7f4
SSDEEP 24576:V+gkEVfh4Cou8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:8gkExSogDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 00a10c0e7d1a4d93e264acc9dbd1709eb3a8c78494842c4ec0d340e31cbd7cac
MD5 08ae23936faa998337b8f948d1423d2f
SHA1 7a7b2c26921f850c94a099183497a930c319d2a9
SHA512 10e02c38d0d1251eb01180f74badee80d5260e4203e5595dc269ce1090d1b74500725cf8cdd35f492572bbfc855de01e660fee4e96f36e0b9482af454d9978b6
SSDEEP 24576:VBpDRmi78gkPXlyo0Gxjrz8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:fNRmi78gkPX4o0Gxj3gDUYmvFur31yA6
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 b851b198f66e35ab4d3b58a31181299e0888997e13690fcd8157d0f4d703b8ee
MD5 0fa897bb50384e351d3c2cf7832bb596
SHA1 a47ed34e300d827125958c7089073672cafc5791
SHA512 7b56409a57738e3b9652db04fef0a01381152018b90caa4e34efe1287aaa03d04d935ab8519887e9d41f6cd056c94cb76666c2b071f43d8ccea6988b0c21f766
SSDEEP 24576:KLOS2oyPIXVu8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:6/yfgDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 fdba09ec7d529c9d171f745085e95511d9edc5df9a15311eb80dee46fadafcc4
MD5 7506ea1333e918d16727c139689dafb1
SHA1 90ccc8b3839e47fcada4c744d894f4a595cd0c7d
SHA512 3bbb5e3a213c8c09472fa96d1276f4f030f6eec0383fe40c861c135b97b4bcdc1528e46428dbe8495dd9a7decec8ed583e550a7d580e8e7eec0f02d59fb777e2
SSDEEP 12288:BfIFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:BfI8NDFKYmKOF0zr31JwAlcR3QC0OXxx
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 c997baa94be8d99873f5ac91bd79649132b99f5a20c5305986c9ea73a73a7927
MD5 cf6a7e9b9b395da22dea2a146d7bd4ac
SHA1 5e9fbd3a4769aa255c42103c985d007366a247ff
SHA512 3c3c69eda450fedd8c8dbabf846fe1e0de75824585cb354cc2ae3ed8a1a6cd7d53486758a9f79a92b70a01aa7c51a2d7351c56d1d6866c1672d3049ace0e84e1
SSDEEP 24576:0JIUl8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:0JIUlgDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 12a9fd490f315b5c2f2b53ef755a419ef33059e6309ab433d550885a6b538f1e
MD5 07c6b853654c2a27f8df1b078f54a548
SHA1 6bbd16a3e7e155667d91c5de9fdd2e95868b10b2
SHA512 32c1239c9a41074c0d4848f9e23fa45a44c82211bbea6d8e7a18c7a5239ad8399f77ec925b674c96315cbf091d8fd19510d5ae20ecede466b24ff743b31f691a
SSDEEP 98304:lQvGAdlCEL8c/yRNw5CvU7dG1yfpVBlH:yvyEYc/y3w8vUoiPBx
MD5 SHA1 SHA512 SSDEEP

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 093842f81c82d1c86b8b93ee8f7d66df2e5f7efafd68e33a61b5159b008ec4b3
MD5 c76ddc2ffffa0e37eb3cb5473b4f94f3
SHA1 04b0ca3e965e2a5d0a604c453eba015ff096cec4
SHA512 3177d648a76b82bbf2afcf6c1c5ddce92f2f14e4fa6785dbb750a9543355081fc48eeb4d23872f9fd842d7705c79e260afe548c640e21b040dd914bad625b92a
SSDEEP 24576:ldewsAjb8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:LljbgDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 c28e0a651052e9164b6051368a575dccc0df67bdbeafd56b351028446e15044c
MD5 73ac1b374e496304b68dc4e6daaacd43
SHA1 b5ad3e7d674235ce9d770005542ee636715b6e0d
SHA512 c3312cb48eed3393bee3fc8db4e145212bf29cd775461a37450f2f168908b473cf4ddbf08dbdf0565785042823f35d403808571ab44a422c890e17e7552e04a1
SSDEEP 196608:YUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHmUoiPBx:YUEtQevvqc2W1cpV2EI32m
MD5 SHA1 SHA512 SSDEEP

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 f470620b4cc81bdee7b3f9615d14913400b21f01fb3dce418890fc4c37261f77
MD5 029cfc5a64b3cc3baef4d6de36ee9324
SHA1 469c5568b7c9a7810deabaf53d7a63a2ec7a87ca
SHA512 61e276ced5efc33a694d20ea85267647c4dd9c07fa08668bb2933effc53145961b1125f0269df54f76be2d3ce84ec9b30cadd5b3f43e43a5a9c4003ec5bf0ac9
SSDEEP 49152:QCbRquA/m2yL5zifFiV+XenmE3/z7gDUYmvFur31yAipQCtXxc0H:5oqHVjnmLU7dG1yfpVBlH
MD5 SHA1 SHA512 SSDEEP

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 720a5b0229812cdd59d588c8965f055034775bef78e6fcb66fd6b850231af897
MD5 d1cc72aadc1ba5300478af09302a14b4
SHA1 49e33548d559f09c133ec2a9882f109018fe845f
SHA512 74de889a9bd5efafb70c63a8c384d067caf1148a718656a34d55dd91a3e26ac9247c53e3eef9b2cd298389d60f914ed72b3f3d68402519d1212bd75ce55d5f6c
SSDEEP 24576:ZAhGLJIFoiwtA5l7S53+8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:ZAMyFoiq5OgDUYmvFur31yAipQCtXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 96a11732172506e1b5fa3baa898e9299888374d943d2273759a38b4b07f16a19
MD5 b2e42adca8c67be1669856d431b131ef
SHA1 3b2b3c59c9fe7a2705027a0364f22eb9707a5ffe
SHA512 45f2356854041d7115858102de780eb4ffba8f787430b885a3e24cbf1545d3b18e3ce7f92590e435877bf587a8fd144015d378140effac4b60c66f306c737280
SSDEEP 24576:cwuoOWf8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:cwDOCgDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 d9525aaa7205270aed2a8881b1ebf464141354705524cb7cb2808da0ca67f2ca
MD5 a986233e2b816f003d48abb54b8ee840
SHA1 08f2208ec9ca6a48f5c9d2c22ac486d460a1c091
SHA512 cbdbe369fba50ed9222630c83cc7b77cfb249dea6d326ab7d76c81c58e85d3a89f9dfa252f770c4f7b0a783c59a3d6bdc73e6877fd78dc429a146484455d0d18
SSDEEP 12288:wBZ1IyLFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:uZuU8NDFKYmKOF0zr31JwAlcR3QC0OXn
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe
Size 4.8MB
SHA256 b1f65b497b37f61fb67eadf0accf376d40d24c99da5c669e24927dc9a4efce5c
MD5 0b501cc084013f720a6f11308404feb7
SHA1 ef99a6a6ea6de1d14ca4f5501892f353280b87f3
SHA512 3a59016bb237093ea0e9ffcbc3e60c55f3568456d9106f34c5d5bee820ebd85af6c780a8604e0afbdab70f4fdce2b14e404340a957f04a3c41acf84b9419b5ee
SSDEEP 98304:LrZ4K5M+XDfiIewG+x6xZ148U7dG1yfpVBlH:HZ4K5M6qIzv+Z1zUoiPBx
MD5 SHA1 SHA512 SSDEEP

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe
Size 4.8MB
SHA256 fd997b73b2bc94c72600e9891df1a101b24f6c72902bc0f984973dc52029b12a
MD5 3390abefd32a0bb98248b985f6eed413
SHA1 065f916cb654eb78d8253d83565f7fed6d5a298b
SHA512 c28a415ca52b15346e3260c7c2cd517463518d70c8242427cd240e11575f34ab4852c10beaa205b5f225ec46d76a1348a54c2540bfcaa5098a8a1121155fe407
SSDEEP 98304:4rZ4K5M+XDfiIewG+x6xZ148U7dG1yfpVBlH:MZ4K5M6qIzv+Z1zUoiPBx
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe
Size 2.2MB
SHA256 1b435843d6bc86afbcd9c5412d06d339082a4b1c9fd1ba443a8e8d9f2d7832a9
MD5 8d23efc4189a63129c3cc4bf73f8769e
SHA1 e94e5cd1d921292fbbeeea6ff91b2331923cacca
SHA512 ef1296d6c1262ae4f543d8c98d5e941fffbd09bfbc65c21f51bdb6a43aebfa29ebd2f89150d6556c330dcfaef111f6cc63a864b54f492be1076bba57fce358f4
SSDEEP 49152:efzabJ8llj+SWWi2mkx+X+di+gDUYmvFur31yAipQCtXxc0H:Tui2QU7dG1yfpVBlH
MD5 SHA1 SHA512 SSDEEP

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
Size 2.1MB
SHA256 dfd41cbfb49a4326ac0bddae4aea6f8209abc0cfc1168c5194a19c6643709313
MD5 da4d444f89e957348618ac82b4a9d09e
SHA1 bea9582bf283490a51ec02bba9a71b463767f55b
SHA512 66acca8237b36db11dd3a049cd1c893e3ab9dec51066de11e9fba342ce5ae2608ccc32b3b960de18270fb1106966696713fa108e831b7e979ffe459b7a2dab24
SSDEEP 49152:ea/3xXBSZ4K5MJ1LvTMxbfsYBYSgxu9+fw4TtgDUYmvFur31yAipQCtXxc0H:AZ4K5MJabfsYNHU7dG1yfpVBlH
MD5 SHA1 SHA512 SSDEEP

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe
Size 1.8MB
SHA256 3e739c641c4557c4dd760eaa4e8ff42c2ce23d2e9052b049f86893fd109408e8
MD5 c9aa496c0ff6014b7f6bc42c691bc85d
SHA1 f4f207b9b650132b6668eba8e8014118dc16005e
SHA512 272d821d8a25602d1f7587d44239d487e274da91266a84b8bcb90dc9a50e9462083ec7a9b5f29575a8a4321567ff6861e62aa585c2c13119d39785eec2e86520
SSDEEP 49152:dgNJtUzDu/9gKPxHC4vgDUYmvFur31yAipQCtXxc0H:SPxUU7dG1yfpVBlH
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 1.5MB
SHA256 0ad25decbefd00945081e9d6b8f183e91c95ecc346bd624e2f9d71c5065447f4
MD5 5605dfc7ccad8023d52bbad2c8a987c1
SHA1 ead19abdea059004f73d93b52f88ff0c1377bcc7
SHA512 daea72b2827df1714be28a23b94d1197d0c2519b467ab8e174fd48e0bf411776abca639ff845e93ae7777d09f19509d267bc7bf4d56b32cbd68f613439fa5a42
SSDEEP 49152:dOBynH1wM+v6UJxLQd7BHjdfVgDUYmvFur31yAipQCtXxc0H:vn4LQd7L8U7dG1yfpVBlH
MD5 SHA1 SHA512 SSDEEP

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 e29db538a54ced608a0f8493ca77076409945fcecc2d86dac64714b8f3eb56e8
MD5 257f381331c336f033fd9bd4bdc3625f
SHA1 bf596e29ed9f88294f41431081da09b92b92b860
SHA512 4538afd2f700b1db95b2340e67c9a33ac2cf274a549c75dbe0294c884b8a6b87d942cce8d8a23ce91829672f1dead9a1d156b3e4e13af23f6df5359521207481
SSDEEP 12288:GgFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:Gg8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 a4da32f61da4e5a931457eaebe95ba787ef2f354d3edb2723332a1afb5eacecd
MD5 607a05542412aa391f75e6e6965ed59d
SHA1 194a5956ed2e877e2e55245486a1588a6b3f5f15
SHA512 2b0101acc012c660dbd188d5878261146de077e8ebb9c4baccf52d8c8cfc4a20415cdfa02e0b1b477327501aa1e9a28b380b87a83c134142e29c8a3dc6f07c28
SSDEEP 12288:uHFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:uH8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 1ea3aa0970bf9bc1a414c36cd6f07d63718588da58100f1d41dd6c0545e08650
MD5 e7e48a582010ed252b6459d492cdc38d
SHA1 399af9fb920035d59b68ad6607f3e2d1789d3736
SHA512 af921aff55fad77f2314864d910c3f91478d517d8a39432a08d575f3e098ddf747209eaba8499d6693814435c977bec125cf8ce11029fcd3e2e41c6fa2e73d6e
SSDEEP 12288:xdFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:xd8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 1e5011cd9ac0c73eae162d8a037674f5cc2cbf4e2e33c365e4565d4f80e0bec3
MD5 918a47e6f479e96f894d441f77bfbac6
SHA1 91b4b1a68c2d9199cc69145cd29880b4866b2ca8
SHA512 7905e73e580949158418fe9390670a0768bf754465ffef665f0a0b0b3545cad489136d0d384555eb1f06cce17c571a7b4cf0211db6dd110fd6ed179338d617fa
SSDEEP 12288:IVeFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:98NDFKYmKOF0zr31JwAlcR3QC0OXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 fa0aae5e6efef874623e9d2b16dd73d0fc18669e1b107f433862479886053edb
MD5 d94852123173e8ebe48dafdcf68ac5b4
SHA1 46704ccf7b51e09f262e80cf69b5680dc8e3b6cf
SHA512 7347cf837f5e159bcfd73a145697cb92f433476cc4a4177a6e154bbc20f7b0d004113a77c6e08631403c3e9a448a3696a30cc288697432bbfbfcaba7bd8835be
SSDEEP 12288:7mFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:7m8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 f40861a7e9e445642ec69b2195c12ee03fe8bcd295aabd3961bfce352073eaf2
MD5 646ee9789f7be353d84dd5a421dd59d9
SHA1 aa09c3e1ecf4f9101c5143d01d33aaefcbb87b1d
SHA512 0affaf1f367e8502b0de39b7484b9fe586fae71b770bd3916df1d2f540fa5baeeef1c2ee8269ada8b8d597e57da1bac9b4f97cdede0c93dd84126efde830bcdb
SSDEEP 12288:uzFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:uz8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 e0e6c4d0773bbbfebcfad9069be47282eb8f2821a0de738cc63a3ae7ab933157
MD5 c04268e19836daae94ce12fde60f229c
SHA1 a002b86f010500e050404e3034aa8d3d6244c482
SHA512 4ce15fada5aa3d0e2fa7a151eab0242bca3aa2173b60b491c80350f7f13a46d12b98717699fe3d2444f40225348f2f90ace9b798893db74b18477d7facc4196d
SSDEEP 12288:cvFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:cv8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 36ed7b6b1255f63d0705c2dbd95b93a7a9a2cf332ea017945a3c81346bb35bce
MD5 93a8b17a3957efc157605232abd6c0e3
SHA1 e8a1d338f9b15f2cb6914e29b749e689c6828d55
SHA512 8ab0e46966228812239ccb0be5a29c46dd5a516332276d1ff0214955dd15eaec34e83dbb8ce5d066139c56751255574b34f41f2806df7dcd973130d086edf2c8
SSDEEP 24576:iZMSzFVSOn8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:iZMSzfjgDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 b6abc21e4cb99bfd4becc9678016d35916edc7838a5da5e4f511e3972eb09676
MD5 2e34cee4491bbb18862670b09d269bff
SHA1 b0f7bf0c400ff01bccdcf3b4e0be0f5f0fd5d837
SHA512 50b4b87804bed417938f5fe04a8d5a569fae489933ee2a47ecde6d9305bb9cd3cadc2aacbdaad45851f3fac970e7b89629cbbb68be785331bd3874e9696f293b
SSDEEP 12288:bEFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:bE8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 5e136c2d2223e33276d3f5e2b46910e82fe11c978c5af7712fadee4721b115e9
MD5 162b13f796c9c1026a5dd26411d3496c
SHA1 7a1837be35ec5c621c28abb2347b3bb414c157da
SHA512 3f595332fd5caba1f0a3678a39760eb8cda2680a0b2f4efeddd4975b46122fdf2dcc9a6123094fb0c2df40fc2b2d0aab6df222c2e5f9f413507306d6f2aab999
SSDEEP 12288:i4FCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:i48NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 073fcceb7f2d9f79e33169b17ee4c21b7787b00673ca2d3fb6114434d55d7d41
MD5 70c6372835f9d36bc4c8be5ff7d950be
SHA1 897e139aafaf12681b3f44f627866393944e2d71
SHA512 63dd60e6c3fce1992d22e25901d5d03da726dc688d8f0568cf8c1b6a57410530e527525fa4d86945efe3ca49f372af7ce93e183dde9a880014fb7f76a3f3c277
SSDEEP 12288:JyPz5L8LFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:ozyL8NDFKYmKOF0zr31JwAlcR3QC0OXn
MD5 SHA1 SHA512 SSDEEP

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 2f5bd7f564fe51cffc9208d15b8415e73aaa0e8a2353a8d9b4e09a4fbaf7727f
MD5 f8bb0b709341bd1315f0961e10cc2c17
SHA1 71d412c48cc73b875f2aae19d5833d9eddec7fb0
SHA512 545361b4e96dba05ef9b8d34c6ba79110ad9152a9881d290fe19097c7cb5e40c62f0f696aa24d4e64f0eeb65a7f91bf448ff6c29ead365f681626c0ece8dd6ad
SSDEEP 12288:aEFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:aE8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 1bd30109901372dac7d260135068e197d8d95f880fb42b37151b9430ad2b5f3a
MD5 2f5c2b54f91eac661017d40e5b971777
SHA1 fa470a9fd601aab5445cd755faa747574075cb4d
SHA512 5a413037a117b21ab6acffd7ebcf998df929f9bac1f597f3eb8a6978fdb96b7b7a14513828067a718b1fef6b2350710293c656396d361d50282bc2611ff00005
SSDEEP 12288:ZEFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:ZE8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 dcca35ae101588dae0c68b3e15af1b4459c1c8fbdd1fff4f74053087e7f6c68f
MD5 d15c0bb2f11e6cb5f2c4b10d7185e127
SHA1 6937a753d7b7d7005e2ab4a7b949a073a19f1c62
SHA512 e1a577222f6b5b416dafd1c9c760b23e6f429304245d459f0742b43f66f8660bacd5e9e3a2ffc073d8d255de8b192b7df33519834afe7b10d488391231827687
SSDEEP 12288:HyPz5L8LFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:qzyL8NDFKYmKOF0zr31JwAlcR3QC0OXn
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 3b5631b1f86300324200ab90056dfc847e38137d3a444527406f4038f71bb026
MD5 ba24652182e4fb3268428c4a99c996e8
SHA1 4a0b092c81c9435b23023cd894725400377b34f2
SHA512 39f6482176caaffeff444ea70b0fc9b5320087327fd03fc6504bdcf9ddb224279a170d16c28702753c4c14799256cfa019293b49dd9c55b42d873d020108bd1a
SSDEEP 24576:lTHaLl3z0zDt8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:lT6LljKgDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 3b508d9380eb08864e91f573d819d2699c7275d9ebd45d3c6b0b943fc98601ab
MD5 30b7bdbb64077e0a53596923205e8265
SHA1 55385e7d61be8b2d0cd7c9dddf2ccac6a98b8bc5
SHA512 9bb85102d08d8b8a8ef29fd3e1eac2e8cf02b42a4bbc7e0d24b9b607817bf36341ad23a2db941fabafd9621c4f5829f2b038e0cb4ceddf77e9da58094c4b1f69
SSDEEP 24576:Q37d9CHKy7GZ58NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:a7d9CHKyajgDUYmvFur31yAipQCtXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 b5af8b47997691541971bd2694226b2c26d84276a60d77a3f282f67528435558
MD5 b11daf2fd1c7bdfca45a6d54f374ec1a
SHA1 7b2388ed70b62c8987931af4f191edd7dfa76949
SHA512 ba16e825638e8f5af6ebc7eb8266c96b921f8541387703a82b8f43d114208a22f1ae1a5f70eb8bb58fb32600ca7d60f313182b28836e0165a9a756dfacc602bb
SSDEEP 12288:m9FCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:m98NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 5d9e73cd636de20d279800f0afa082265c3479b7d0dd31772a852f6c5eef6023
MD5 c4a2372f884f302112e50f68cd744e05
SHA1 a7042344df9ec1f061d857d0be0ff8fe8b21ad67
SHA512 34a36ceac3726b8e5ba776655e40f75dece67fee6ea8f5c4f2aabdf8252137a951f61b366d8bfe91a97c306ab175077c317aaadfd46e7ba5a36a1c0077eb15ed
SSDEEP 12288:arFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:ar8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 5c1e090e3cf2ae9a6728ed0cf6c2d7ba4d933eccfb0806b717c1496931022717
MD5 03243a31e619b2d5d36e6e479359502f
SHA1 d71e66519116c2882b17623fb5a648e03484a03d
SHA512 7b15acc40a01299cf4cb43969b7c8840236b989a0b198a24f3078c624547369503279fb4830b4b502ea7c66a1d6d65e079ebc7fb9bf20197917073a305ec89e1
SSDEEP 12288:cSFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:cS8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 ee6cbcd2f1f1d3fa189382437187e4a6e67be42e23370a1523d2140e5a9a09cd
MD5 e75ba1bb3f5410d27f8bd948e92bf511
SHA1 244ef89ccf518cc05001c331e9f28dde9b09538f
SHA512 80cce907bb384fa92e0a019b4a4f526a5913bde6745a416149802de1417085f52a1c6e8729420d4bbb18f8a63e183e84320ad0047b679180960fe2edc0854b53
SSDEEP 12288:MEFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:ME8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 6722c98575f456001afc078a9c73efea55c860d6e41ea347270c0639a8d9a3d1
MD5 8ebc4b344fb1ac54e7697d0f4043a398
SHA1 f78ec4430acba2c0523bc1f49c4c986322d10ca6
SHA512 4bf1131e593d33cd949a76ed7be23c9d73a51bbec49338757e13fca2fdc2b2f10937584565222b2feaba3255b4519275c7242499a055163cc5c2e77120ebacb7
SSDEEP 12288:19FCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:198NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 93d4d7624c204360b9c5bf42cd9aca157e66a52600a4b1b4339e0f1d14b990ea
MD5 5b57539cf7dc8a9085a85d2dc6de3804
SHA1 462c0fec96358b3ef6f2f1372e89a7d16bde46a3
SHA512 0ae7fc22719908c94091fd0cbe3ae53432013a0b1f060df1f3cf94afb2c1be829dd082d5497c81b0257a91903831585abb0c327964a63b3f9920bbed1fe21e7c
SSDEEP 12288:uMFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:uM8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 581KB
SHA256 21ebf2b3acf0891373850f1c1268a1939fa385ace60aa62fac3521e1e7906251
MD5 a04522d7bf55a4a9348b1dddb44f89a1
SHA1 8734b8c4e19bd399190ea4e7e90d8bb5e7dee5c8
SHA512 38c30c2fcd91c74d84c7962ec397b6b2bbc27daa6b56499fe71e5217bb8b1c46d6c267f0efc5f643caae7c80d476ca349e1114a81fa6c77c0c2c59669ff3aa0f
SSDEEP 12288:xmFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:xm8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 701KB
SHA256 906ff976ec59bd312d8a2f2ee352f1833c24b4f2a83a01edb948dfc628678d90
MD5 af30db79c1cf363eadca40ca60987653
SHA1 30e3903b1f8b1e92b65a66d89dce026bca521065
SHA512 260ae997cbce0381e04ca1fe899b67ea08f816fa5f91a3dce3c664a7c03885d988f658765e7d5a89fe09374a73e02f3af0b95abcd70d0c5a373b0add88ec7ded
SSDEEP 12288:vUFmDDLJFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:vJ8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 3bdea500c605d301b2ae253259221378c58456851c41256e613d538bfbc76210
MD5 ddc9fc7804cc4f9b092e8f1f4f7cd448
SHA1 56e8725082896b68ef9a71111064983981c2b486
SHA512 a52b428e72ff794f428406b4f329a6bd92909fb438f35c071e48eb7c57e3f72b656023fa42fcba9222032adc3354ff92e1bf4076fa27774cb8af5c7f22dd5945
SSDEEP 12288:5uFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:5u8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 44cb2c7b9d2ae0d2de137311c9e9aebcb9e0a367305aa37fd9c48e687abc5e7c
MD5 60ce44a335143cb9dfcb946d4ebfea28
SHA1 d3b93e3e2271c5ed573ed3668142d57813a7688c
SHA512 ec287d243ef318dcaf8dcbffa3332d412e4a2a03dac5e0914e021496751b84619ffd8349c4473225fa0ad287a6e08177e515d1fe7dae846a86660ce07a4a591c
SSDEEP 49152:qa0h2GEkuAe73q3pp46zwwQ4gDUYmvFur31yAipQCtXxc0H:qa0hNYG4JwwU7dG1yfpVBlH
MD5 SHA1 SHA512 SSDEEP

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 659KB
SHA256 9684c635082c50457cee3128024a57fcb3cdc8da82bee6537e1185f65739faa0
MD5 3b765c934a8328775a160698de0153f6
SHA1 35ef41390e041834b711478a9ef87b236d94ecae
SHA512 47fcd2ece410c93f3e14c679c20cb8ca04dfaa3ff9d12b4d73ddfd9b0f88e474aa614d75f5b595f765b6463f53b470f08d168557d49dea064f5b348743a86921
SSDEEP 12288:ThbHjfXNFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:ThbHjPN8NDFKYmKOF0zr31JwAlcR3QCx
MD5 SHA1 SHA512 SSDEEP

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 5ae5d6c53f8fa14e149913891961bf173f334fd5cd05451b0797725b99a72b3e
MD5 10be02737f446d4acc579f0c5b0d49d9
SHA1 1e0e963302b2a0d3a65537e3a85008db30e8486a
SHA512 b01fb93828cd3128dd763a6079fec9013ff70404940bd1fd8f1df4bba84896b7d8e6185a5a5c9eb59240cfbfaf2d193a8ecce71a8b6f51ee2c77522da427b31b
SSDEEP 24576:X3YgnJcRTk4yti+R5dpR/F8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:XIgnaTk46ppR/FgDUYmvFur31yAipQCx
MD5 SHA1 SHA512 SSDEEP

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 578KB
SHA256 98bbecc4a5a18e5642990bcc26d8bf9bf022a7dcbabfd20c1e32d524c83db560
MD5 85da670eb69ad2338a45767f52814303
SHA1 e6ee134b021f4e5be9d1666699cce93f388854ca
SHA512 fac9e61c1c65770abd7ebab53763dd55cb42a41d6e9b52dd663a103baddc55f28699a8c353468bb2fe4251b92dc6f1f4a5c10bb85a2da453d25c7d1f35fbd460
SSDEEP 12288:uiFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:ui8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 940KB
SHA256 7a78ab53d87ccc58789337870446de2862cbe83b0f6a4a556a15ddd3fed3d646
MD5 d47e38a1bd36d4333bd1237c18a11296
SHA1 c07ee2786dff115bf776ded39d5e0b2f8782454b
SHA512 8803de0b1e8b037df8e6f1111bfcfc3d56779fd84ed877035b948c2cb092f65e7e950aad4834b7973ddf20337a7a17a3c6cf124c92bfd477859362fd7df93808
SSDEEP 24576:MpL3UTH8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:MpL3U7gDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 671KB
SHA256 692e767db7b4681dc292256f96c6995c0ca6ec9c6f55a9b3c323886b8d75745f
MD5 6c6c7663030d2c7e9c8e5f5825fca997
SHA1 629b3e372e5ba7b053ca178c7a775dde83f8991c
SHA512 2e7a6816c958b15d6b91b8295fec0fe636700ef9300d35bf35688dd37f40798bd96ae4bab1270fa3efca1d71c14b7b099501405767c401c72a70ad4879341b1c
SSDEEP 12288:opFtpObFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:6Ob8NDFKYmKOF0zr31JwAlcR3QC0OXxx
MD5 SHA1 SHA512 SSDEEP

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 790eb7bed4ff9b9b7985d0d03d35d85d0307d20a3d359d97f79f3c948a65241f
MD5 f21e13d93042c6bb4e4b4b68365079ac
SHA1 fe1394cd61cc868fbdcfca41b9f2e043cd9778f3
SHA512 7ebdfe4b36162c8785d6d7d4235448bc7c1f53c5680f688bbc16ce1d1a5683653768296965dcbe3da70c42ec1ecd907986835d0b1dd1718062c14c5a87296e49
SSDEEP 24576:27NM9YmZqmWMUkPjZM48Mv6bEhs+8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:27cBWMpPjN8DbEhtgDUYmvFur31yAipZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 dcaccfdf91eaf328580bc7d7c50e7b698af926a4292774ea695cc7212f25fd23
MD5 970bd7eaba5b8b230acd67fd56bb2c37
SHA1 7d6368f76c0a2c1c5d641347be98882fe42150da
SHA512 70105dd62f1e5284f098b46482770ab5d8e3b2bba50c2b9fec4662a19b570c993fa2ffc69ec185ab19a5ce84a8aac58a5d857f091a1f8ef191ea4f99140e452a
SSDEEP 49152:uF2YuHNETovcvNYf8kmegDUYmvFur31yAipQCtXxc0H:f6tCf8keU7dG1yfpVBlH
MD5 SHA1 SHA512 SSDEEP

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 bbb6249cce37d4ec4e966b883d4365b7dc7b9192de2539f04e259308b9c61eb9
MD5 dc7599aed8c5598d3661ec9014258724
SHA1 231840090a551e43103a581b18ba7ebd70e66870
SHA512 4588f151c5cb08438b9d0397a0fbc291acc154b55678ca2a5fbed77a430d588145455f100b7804ccf8181bad41e556f2c4a3f4927f00940a41597eb0c2805304
SSDEEP 24576:NAFs06+Omlf3NXEbTov8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:CFs060lVXuYgDUYmvFur31yAipQCtXxx
MD5 SHA1 SHA512 SSDEEP

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 885KB
SHA256 b152931c998bcae7881643af85e95b66b48e803373b9c7368945218893deb6ff
MD5 71d54b7c6403f75682434bf8d37a47ff
SHA1 b086ee991b00fcf417be00945a49c6d35d463c63
SHA512 68e8e1a319b5144b0051f5dff6b481ec08985d691a93f0a4c72b2dbadb3a43b738f16664e94ca5bd088267494d9eece4afffca988b835afc61ac2a75cfa6ac7c
SSDEEP 24576:7JnJ5D3WtY8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:7JnJ5DGtYgDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 1f222c1ebd49bdd11cb914cb6b94a4402d22c65a7061d4e1c01975f003518a2d
MD5 6e8aba28ff0f6f7d162b9586afbfdb2c
SHA1 a53f6af22253e827d49d48de73bd27eeed2c74c2
SHA512 a6ea8789f3523ea1c580764b9d95cf108f879eef538dd00fff79ee08b485e9de38c70f4282bc0a6c07835cbcba22b3e97f5e51332d7121b6f813b1d9a77051c4
SSDEEP 49152:mo06DIKdwc+eQnSt65aVKgDUYmvFur31yAipQCtXxc0H:f1U7dG1yfpVBlH
MD5 SHA1 SHA512 SSDEEP

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 661KB
SHA256 14a23c5590211cebceedffb88cf123c3681e8d439922ca4c52360c1d1d6fb264
MD5 d6be95c8f894df6bf639ec7120a48e1c
SHA1 f1d5d4a67c59e521db751534d68fbc1200587bd3
SHA512 d7d9b14c66602a50b98fd02f961149bb1ee4168e8ea721938ff9bdd3ec64df482340fc2c7c2ea1bcafc23016ba49586812915a7ec708143db0dddb3de117ee5b
SSDEEP 12288:1EP3RrmFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:2rm8NDFKYmKOF0zr31JwAlcR3QC0OXxx
MD5 SHA1 SHA512 SSDEEP

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 712KB
SHA256 b89f485ea291072c7e8abe399274b91ce1c2f89ef8988a6e3bf558e096b7e264
MD5 500b8bc96f78e5894d08e71e44bf84d8
SHA1 294e74c8d0163f46b9a9edac3e7c8796af9f4a5d
SHA512 8cb68a4ba978dbf19f118348ec67a463ee0cf3a50eb7ad45d1a62f45bd91891ea0c8c7845c73729b8d23489fe109e9227ce7b5f9c519b4783b4f465d7e098b32
SSDEEP 12288:ajky9FCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:aIy98NDFKYmKOF0zr31JwAlcR3QC0OXn
MD5 SHA1 SHA512 SSDEEP

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 584KB
SHA256 a41c2ee2484b1f639c70b69aca1c1b2a6f91ed5aa7e62cad7fe37c55a2f49c44
MD5 0e562db97928a89ee18b4e7f89f3f94b
SHA1 5b4289eae2cd28c1be5e11f2b62b21c6f37324f8
SHA512 18199f03f75c00898408cd6a11e742d8fe97fd3bc629d6d015b1acfd595b0a9965e8288965d93ac19ddc83de95253fae72cc978f3b9853b85a26d2acb3fc0063
SSDEEP 12288:3FLFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:VL8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 b3e2f8ccc83cb77bdf3ffa356ed3925b95ec902b52908ae971b038f31bca5e73
MD5 8a8949da78d4edbb79f1198e926aa15b
SHA1 d9d7fce4d9382859f7ba637bc242ae3a91f798e0
SHA512 ad4d2d136ab35902ce9ee97029d436ffa961a741a4282f279be6db3f8179b409e685cfd1a40b2ddcdb2196f2e05c34a77218c556380a1f878a4e13a976fd1a75
SSDEEP 24576:gQ9MxZKdcz97w3m8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:gVKXmgDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 772KB
SHA256 f407402fe0444f895625a5a8d33ec791df0af2540e75b1b5dec93fdddcebee1e
MD5 2d78aa2b10f12cf05015f3ecdc32b5a9
SHA1 933355981540222a88df11b241b333b1159eb680
SHA512 b74d16c7116cf377f6035a9689fd86bb90b3dff3b4e814b06b10912763f9e3f165215461daa8c1558b63c8adb30b28dbcd27c94a4a3a5adaa28d3f32b12f5db8
SSDEEP 24576:JyocxApx8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:kocxApxgDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 a522fafcdbd4c0d48353192c5291be5b4389fa37e8bb4ffb1754c6c2a5b8cdbb
MD5 e4c4a471ecdabfa8cdda7f2029b1c08e
SHA1 d19d599de3092786958132b3c9ca3fff7f03f36d
SHA512 45c218cfcf4d7c1871834c371856f8af2cd1229f751067138f0ab3a7a175479a364caaa47ea89fdaaa5e6f8bdfa59b05173c297bae21aa508438e88c1a82a49f
SSDEEP 49152:5WcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIKxgDUYmvFur31yAipQCtXxc0H:h0zuNIEU7dG1yfpVBlH
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/232-451-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/644-447-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/644-439-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/1308-67-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/1308-68-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/1308-239-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/1308-74-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/1384-245-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/1384-312-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/1384-252-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/1384-244-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/1432-301-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/1432-307-0x0000000000520000-0x0000000000587000-memory.dmp

Download

memory/1432-376-0x0000000000520000-0x0000000000587000-memory.dmp

Download

memory/1432-366-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/1628-28-0x0000000140000000-0x0000000140237000-memory.dmp

Download

memory/1628-35-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/1628-34-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/1628-231-0x0000000140000000-0x0000000140237000-memory.dmp

Download

memory/1628-27-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/1648-286-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/1648-298-0x0000000000BC0000-0x0000000000C20000-memory.dmp

Download

memory/1648-352-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/1720-434-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/1720-424-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/2012-380-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/2012-315-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/2012-322-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/2528-62-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/2528-51-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/2528-66-0x0000000140000000-0x00000001400CA000-memory.dmp

Download

memory/2528-52-0x0000000140000000-0x00000001400CA000-memory.dmp

Download

memory/2528-59-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/2664-7-0x0000000000990000-0x00000000009F0000-memory.dmp

Download

memory/2664-1-0x0000000000990000-0x00000000009F0000-memory.dmp

Download

memory/2664-0-0x0000000140000000-0x0000000140245000-memory.dmp

Download

memory/2664-10-0x0000000000990000-0x00000000009F0000-memory.dmp

Download

memory/2664-12-0x0000000140000000-0x0000000140245000-memory.dmp

Download

memory/3008-450-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/3008-381-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/3008-390-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/3128-274-0x0000000000E90000-0x0000000000EF0000-memory.dmp

Download

memory/3128-256-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/3128-257-0x0000000000E90000-0x0000000000EF0000-memory.dmp

Download

memory/3128-265-0x0000000000E90000-0x0000000000EF0000-memory.dmp

Download

memory/3128-272-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/3264-423-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/3264-360-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/3264-353-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/3264-433-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/3344-393-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3344-334-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/3344-326-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4160-377-0x0000000000520000-0x0000000000580000-memory.dmp

Download

memory/4160-437-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/4160-369-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/4388-14-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/4388-209-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/4388-21-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/4388-15-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/4388-22-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/4820-339-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/4820-281-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/4820-346-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/4820-269-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/4888-420-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/4888-411-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4900-410-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/4900-341-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/4900-349-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/4944-40-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4944-39-0x0000000140000000-0x0000000140245000-memory.dmp

Download

memory/4944-47-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4944-236-0x0000000140000000-0x0000000140245000-memory.dmp

Download

memory/5108-394-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/5108-402-0x0000000000580000-0x00000000005E0000-memory.dmp

Download

memory/5108-407-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/5108-408-0x0000000000580000-0x00000000005E0000-memory.dmp

Download