962a8376f1e8428aa5ec33675ae08c680a64ca715256617274abaa8a0e68276b

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
04/04/2024, 11:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-04-04_34af67be694ec42b894b352bebe60301_cobalt-strike_ryuk.exe
Size 655KB
Sample240404-m552nadb3x
SHA256 962a8376f1e8428aa5ec33675ae08c680a64ca715256617274abaa8a0e68276b
MD5 34af67be694ec42b894b352bebe60301
SHA1 5ead3581bf858dea751c5df0f9fe4ce49fb951fd
SHA512 c8021b71c337c9d5ca574c35c2eb0d4600c9fdd9e2e924891c1757aa301f4261552538820647bb8dcd497a9f23b25f90dd38ae33475cb56a66b5ae81de0a47bb
SSDEEP 12288:tjC6V2lnFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:w7n8NDFKYmKOF0zr31JwAlcR3QC0OXxx
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
4232	alg.exe
2176	elevation_service.exe
1952	elevation_service.exe
1084	maintenanceservice.exe
1492	OSE.EXE
3340	DiagnosticsHub.StandardCollector.Service.exe
3948	fxssvc.exe
2320	msdtc.exe
3640	PerceptionSimulationService.exe
1004	perfhost.exe
1772	locator.exe
3172	SensorDataService.exe
3376	snmptrap.exe
4252	spectrum.exe
4352	ssh-agent.exe
4008	TieringEngineService.exe
3604	AgentService.exe
1892	vds.exe
944	vssvc.exe
2384	wbengine.exe
1436	WmiApSrv.exe
8	SearchIndexer.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in System32 directory 24 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\alg.exe	2024-04-04_34af67be694ec42b894b352bebe60301_cobalt-strike_ryuk.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\d69b1a5512d07ad8.bin	alg.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Install\{90C18CAD-5F48-47B1-8376-0F604ACAA84C}\chrome_installer.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Install\{90C18CAD-5F48-47B1-8376-0F604ACAA84C}\chrome_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	alg.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000095343eff7f86da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ad05d2ff7f86da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000935fad008086da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000759640ff7f86da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000de21d1008086da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004ed41cff7f86da01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001a1e88ff7f86da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f1222bff7f86da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection"	SearchIndexer.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
2176	elevation_service.exe
2176	elevation_service.exe
2176	elevation_service.exe
2176	elevation_service.exe
2176	elevation_service.exe
2176	elevation_service.exe
2176	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
672	Process not Found
672	Process not Found

Suspicious use of AdjustPrivilegeToken 42 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1388	2024-04-04_34af67be694ec42b894b352bebe60301_cobalt-strike_ryuk.exe
Token: SeDebugPrivilege	4232	alg.exe
Token: SeDebugPrivilege	4232	alg.exe
Token: SeDebugPrivilege	4232	alg.exe
Token: SeTakeOwnershipPrivilege	2176	elevation_service.exe
Token: SeAuditPrivilege	3948	fxssvc.exe
Token: SeRestorePrivilege	4008	TieringEngineService.exe
Token: SeManageVolumePrivilege	4008	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	3604	AgentService.exe
Token: SeBackupPrivilege	944	vssvc.exe
Token: SeRestorePrivilege	944	vssvc.exe
Token: SeAuditPrivilege	944	vssvc.exe
Token: SeBackupPrivilege	2384	wbengine.exe
Token: SeRestorePrivilege	2384	wbengine.exe
Token: SeSecurityPrivilege	2384	wbengine.exe
Token: 33	8	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	8	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	8	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	8	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	8	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	8	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	8	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	8	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	8	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	8	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	8	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	8	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	8	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	8	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	8	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	8	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	8	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	8	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	8	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	8	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	8	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	8	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	8	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	8	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	8	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	8	SearchIndexer.exe
Token: SeDebugPrivilege	2176	elevation_service.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 8 wrote to memory of 1580	8	SearchIndexer.exe	121
PID 8 wrote to memory of 1580	8	SearchIndexer.exe	121
PID 8 wrote to memory of 2116	8	SearchIndexer.exe	122
PID 8 wrote to memory of 2116	8	SearchIndexer.exe	122

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2024-04-04_34af67be694ec42b894b352bebe60301_cobalt-strike_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-04_34af67be694ec42b894b352bebe60301_cobalt-strike_ryuk.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:1388

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:4232

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2176

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1952

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1084

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1492

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:3340

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:1456

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3948

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:2320

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3640

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:1004

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:1772

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3172

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:3376

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4252

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4352

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:2832

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4008

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3604

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:1892

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:944

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2384

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:1436

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:8
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1580
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
  2⤵
  - Modifies data under HKEY_USERS
  PID:2116

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
Size 2.1MB
SHA256 8c648368c4c79653b22be7f340d1427d66377fa46286731b0a9d8ab9418e4d32
MD5 965d4f3e08785021f25ff5f530cf2cdf
SHA1 26ea390479b3667f0d4368bc3121bb81feef72e2
SHA512 b97288e5fac5dca1b1d58d8bd1645076a5eb3bb8490f127e31af04e9c03bc31a5106a9b4988f9a54347d33d5608d0f192ee26212bcad6974d504ec731a025fb4
SSDEEP 49152:QuYk3H5koUXfTqkkYLO/W2buywzMbOX+T7z5tgDUYmvFur31yAipQCtXxc0H:QPfTqi90bIU7dG1yfpVBlH
MD5 SHA1 SHA512 SSDEEP

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 781KB
SHA256 2c6149b353f8b3730b1b073a7424622903227b2eedb36769285ec4d0eed4c5f4
MD5 bdd7ac5779f1c92cecb668da79d07322
SHA1 0484181bdde0fd2ede7ae910a80751fd7fac903f
SHA512 e747176770b78a6efdbfef3725eba38003baeb98c0af3be755647cde65213129a08768454c07284baab0da16ce7445fd322dfbd885edb75b7779a44b9c356cd8
SSDEEP 24576:YPsJcui48NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:YwcuBgDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 5302da51479f358958e1f0ffc8fbe58bdcda91304f7e35bb41d73758dfa6f5df
MD5 e876c78c73cfc1ec90612cbe02e85de0
SHA1 c84bbdf450ff2763fd67fa3a5e4e7b6bb6712132
SHA512 c4be94893e8ef5a55d7e451a7625bf6ee0ce06a150dd9ad9b825637fd587589ef5f3f5949723ad3a1306aacff00e445229bf1f6a00348f7c4d6d301daa2b448a
SSDEEP 24576:/+gkEVfh4CoU8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:2gkExSSgDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 3107ca24218b4fb4c38a71be4b4b625e93edbfc736a5358f80f4b3ebd8cc450e
MD5 1a0c30222392b6b09636daacb1e430b3
SHA1 168ca1efb3293ddd3ad5b59dc397c523e84c6522
SHA512 f4548f35fcb30a8fd4ed5ee304620a6d92dac875f57e4e728b5a0856ef88cd2d9a68b006473cc628cbeb6eaf5753384cfc97ceb8fc89d33c97b2a40f4e7f4799
SSDEEP 24576:sBpDRmi78gkPXlyo0Gxjrp8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:4NRmi78gkPX4o0GxjNgDUYmvFur31yA6
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 8f7df3ad29e43b222787a965f279634fe5d479dbf5975758fd09359a84ede5ab
MD5 a32398ae069c5a4a2efcb874dcb84aac
SHA1 cbd0fbf453ea0cb73cb91023bc2d996c42395c71
SHA512 f5c2cae355bfb48ae3e2b03920d458ac9fab0bb98000962e01381c73c277ec42df1c5010ab2ab3fa516ea31b9919f1ddfa0488b6dda2db0059c34a92e2bed8f0
SSDEEP 24576:sLOS2oyPIXVU8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:0/yFgDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 3b1985770a1f1a4c6d31f21593907bf4baba8f7ab45e81f5b781dc432f371202
MD5 b68efb9cbc128d6507e433f151e3d2a0
SHA1 db16453d9f484c32eef72728a8dfc8af9046901a
SHA512 7e71e0613fa57a248dd1dcfb11254b7f5b069004c3df683429a170c73fbbc4bfa161a28b9bbea8cc46425bbb390bc6509f5694bcbd73230e29e93d1f48e5a3fe
SSDEEP 12288:JfyFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:Jfy8NDFKYmKOF0zr31JwAlcR3QC0OXxx
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 9705c0113203f5189038c4f84e799b827c3c3eb3142cf6251582921e79160f57
MD5 f4f40f35aef5c6d674fb3fa101c7aa66
SHA1 66f552e963d8a6c885dc3e40123ec03ad93d6efb
SHA512 3a72d7e208f03684600c520748bc8c035d9cfe5dd4ea549dae1cbba9ccda5e35289e3bdae97f6af2c15a6d3744d17e158eb9360ab4ab28fcef5c4c758203f967
SSDEEP 24576:jJIUn8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:jJIUngDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 8f99331b97737caad649471c95fca7e1ef3d0b93d341b5c61462e6450af5be20
MD5 4f1127019c966b215e7b4cbc1e09103a
SHA1 b208f2a85cd45332909cc319e9ad899471e9b79a
SHA512 a8325e84625420af377346e2ee8f77511cb1cb95306243cad8b785e5e493a73f91d69361f24e72ad6b5069ba202e66bf7ded846974c00e8376d030187143c636
SSDEEP 98304:MQvGAdlCEL8c/yRNw5CZU7dG1yfpVBlH:xvyEYc/y3w8ZUoiPBx
MD5 SHA1 SHA512 SSDEEP

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 0e8cbbc39f03ccd8b2b6d7f5c17140740316670fe613e1e398a0cea4db96f826
MD5 788b2f07e8e013fb579832a121222ff7
SHA1 8f1ff3e3f89b0c407bd4ad4ffe9a1c298afd55cc
SHA512 3103abbfc89d2a94cee995fb93b348c7f5b8edd75c332d3a920590a22be6dcb4b901b3e61eeb70a47a2f907f0a8115d4370799fefa9a929bc11012d3e526f303
SSDEEP 24576:udewsAjB8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:GljBgDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 871228384ae98c14fbbfd468e32d55919a22499aaaf86df48f45990e933c3301
MD5 a307b9843d00b0cf8fafdc6f5d730a66
SHA1 2af5228835b2c97728997a43bb109367fe3cc758
SHA512 3b13a8f76534ae01a66a653599776b52fc05211dd5bb518aa559ae11663dd80b951c3c7624b70df055be4053e98931e7a223aff4ac1d5db0348b3951e94342da
SSDEEP 196608:yUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHgUoiPBx:yUEtQevvqc2W1cpV2EI32g
MD5 SHA1 SHA512 SSDEEP

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 8a537a34038dcd4d5de2e1fcfb6fe5f14d6de8d471a7b9a83d561aab2d1fa408
MD5 3413fd32fee5afbc6e2bab16ec1457ad
SHA1 e6cb1f00aab3ad8a020d27fe6fb6b2010ae8bfbe
SHA512 8bf82ded399d7bead11a900d81d842d4986f965156e8b0d1c5e3b4afa4e8da52d7c9b7a12a049d9b0351c80c2a492e039f00e51216956a51e6b9a357040e6687
SSDEEP 49152:5CbRquA/m2yL5zifFiV+XenmE3/zhgDUYmvFur31yAipQCtXxc0H:WoqHVjnmFU7dG1yfpVBlH
MD5 SHA1 SHA512 SSDEEP

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 9f42f5d2518c2c443d21b25846d581417608c9fbb704c0de75019e9ebdda3d93
MD5 a9f64943583ed60abb4e7a3a59b4db29
SHA1 459f88fec548c9687bbbff0761e6d941031d31ba
SHA512 b09df730035cb705b4701b523c81cc3e406f6326084977b2674365072871f1c23108b4080246b91c905b5f0bd0ca0c99eb1a7344086aa8d5f221916f220f08ac
SSDEEP 24576:VAhGLJIFoiwtA5l7S53k8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:VAMyFoiq50gDUYmvFur31yAipQCtXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 9b267166a2496e20b7314a0afccf3fd23ab9c33815a2386cbd3b94f4f3961b93
MD5 8260422c4b9f8270192a63c6b5e76525
SHA1 48da13a59dbd55e2ed9257975d217a511748dd8d
SHA512 254f886d92c2033176ddd2be2eaf4306e3739315e643a4c867940ead9e95c7496642b29dcb22b38c91175bd444109f48c6609addd5552dc41c4dde3633daa95a
SSDEEP 24576:pwuoOWF8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:pwDOYgDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 10e02662de083e3dbce7385b175c00d6eddf5b9945fdae9803087ea549ac6d5b
MD5 b7b91b001d2311b1d3a968e07c54ba5f
SHA1 4da4953c9c3ad2fadcb6ea083cf7f41de071189b
SHA512 56c6aedd229abdd49438881321f41b978b97537410de1770a608a3c357cf99989c13cc6f491c060e893091a4bdcd937ebfca73c8329acf40583b2411329ec005
SSDEEP 12288:0BZ1IyxFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:SZue8NDFKYmKOF0zr31JwAlcR3QC0OXn
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe
Size 4.8MB
SHA256 63fa3bb1a8ee7e38a50e6f241f4d30525d3e50bcc0cd9449f37d10a4dbd3c80a
MD5 8f67abf522ecc8b1f4e7551b5c11e5f8
SHA1 b869a6c42a8149a5d6eb608a508ae0e9fb76010a
SHA512 3a4e2302a92bcd4e59f80bb9ce434a19538a1d543d2dbccc72ef068d20b886684c159e73b955d787b38a176f5637e26bf5bf164db25126267769b92197715b5b
SSDEEP 98304:xrZ4K5M+XDfiIewG+x6xZ14qU7dG1yfpVBlH:NZ4K5M6qIzv+Z19UoiPBx
MD5 SHA1 SHA512 SSDEEP

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe
Size 4.8MB
SHA256 acc259173203c902fdde794d1dbc9a303b5a91f0f4df8966d1a33f4453410754
MD5 379f89cf121762fd03ad66faa1c3818b
SHA1 86fa58555ace4b4a77261300c3fd732a86768b70
SHA512 9e7f16227b0c812f306c8f8f24c761142726fc4f4cdd6597d32c7ff4235e3bc185772f23378021213aadffbfb3632e4becc837eecf9b1e92d8585870e9b6b81c
SSDEEP 98304:erZ4K5M+XDfiIewG+x6xZ14qU7dG1yfpVBlH:6Z4K5M6qIzv+Z19UoiPBx
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe
Size 2.2MB
SHA256 d8c62c202f5941218f3ea049b1511b4a76fe63cd2f983051e59b262feb2da47a
MD5 1c8e70827ceee32c08ff4f6394254576
SHA1 3e7e14ac22d3f9a1d70bd1dcb93e3fdee09c6b10
SHA512 984384a5c37cd1291cd32c444c647b2ada7228f956a45f732aacf6e8756fc24183d29cde128751c13093f1af3c3d33ce1b1585745c10e28cef671750502f8d4c
SSDEEP 49152:WfzabJ8llj+SWWi2mkx+X+dikgDUYmvFur31yAipQCtXxc0H:rui2+U7dG1yfpVBlH
MD5 SHA1 SHA512 SSDEEP

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
Size 2.1MB
SHA256 081fd48f49bfc9bb7ecb17cbe51e2d6aeae1bb357af820a5255d40b9537d3550
MD5 50eb9764a3339d97af5ec233fa542502
SHA1 77ec287b5a9487423ece52735b65989225e10e09
SHA512 14acc40e838b1be3c97ddeb0f12d6b63f3590dfe39ab7f4b0dfa1976dfaf7416d1725cf4d80180a43943644395d1f1d73979cc3a36b8213f85f14198dc804217
SSDEEP 49152:ea/3xXBSZ4K5MJ1LvTMxbfsYBYSgxu9+fw4TfgDUYmvFur31yAipQCtXxc0H:AZ4K5MJabfsYNBU7dG1yfpVBlH
MD5 SHA1 SHA512 SSDEEP

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe
Size 1.8MB
SHA256 f1642ce23883cb5f94cd43cfb35d317a1acfe1ec8e820679ca4773f7faf55cfc
MD5 9a128204d9441613865113c561fd5a3f
SHA1 7aadf4f0eea98c3ad508bbcfe95ac35d209aeb21
SHA512 c395cb2b06b58e318ffe3284edcda1e3d6f1011577eead912175df2ef047079282fee1de272c8e2c2d5af047f163b6e0111df72a0472e0251733e98f3dd42f24
SSDEEP 49152:egNJtUzDu/9gKPxHC4VgDUYmvFur31yAipQCtXxc0H:/PxyU7dG1yfpVBlH
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 1.5MB
SHA256 bff3af92f6832514e754ed7166be90d914e089820af4142800c9c36bf0b34469
MD5 cf480b7b2bcf2702a70d332959770619
SHA1 b3555eeb2590eb080cde63281b048c16554310f0
SHA512 b76395ee151705b002c037096a645d835d848b5347564d61f6456a336a3f4fcf74ac27cdd51d6a1cbbf9e929e45e842cf36182997133964f1bbab48ba00bbd58
SSDEEP 49152:rOBynH1wM+v6UJxLQd7BHjdfXgDUYmvFur31yAipQCtXxc0H:9n4LQd7LqU7dG1yfpVBlH
MD5 SHA1 SHA512 SSDEEP

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 ba9722930df87685ccff1d09a591eb9fe0072b2faf33f9711c40407a16843a78
MD5 35fad723d816a6cdd3c6b2a6e586cbf1
SHA1 c7b2c9f95b8ff078d4b40217fff4490cce212ca2
SHA512 0e70565c121e31413245e1ed80efd79928755da8cf169c9c5fd67150f07dd39e5aa42f257b2375aae5b10d7fe0c98b26ab701f2a89461739481a4419fc6c024e
SSDEEP 12288:E6FCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:E68NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 12e0a2ac51d3e13165650f8487d84c84303411822171aa97b6785801da2e9e20
MD5 944d496ed3e09f05869a5814dc74a6ab
SHA1 0652aac5267767a044969a040b5b31ea1f449f3b
SHA512 a7c6ef908a7b2886215fabf74ea5d16a322640be53aafa74a405d53626332a869f1d17dca813235aff9609c125b5109406df9e18a5f925e23b3f26fc97e8f1a4
SSDEEP 12288:AdFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:Ad8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 1f271560378d72b0d65a02179a2e85a922e9e6e31168334145271360ae120603
MD5 6efb6d22e81e873bf6599ad40b1414d4
SHA1 bf2fe1a503ec1a84e0e6a68cd1831b002c6ee32b
SHA512 b953d93f451f40428a90a7c89ffc5f577dc2c8421a16028b0bcb130388b2b319fef0df45ad32a6ab12fdd57b6f1a42e39ab7f60b1e6bc021045b5e6a0499fe83
SSDEEP 12288:gPFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:gP8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 020a0bbee046e1ec1b2f4055206980014bc19692917706e6f0536d9a1176f5b7
MD5 c1a6353357da2118488b464b9945b0c0
SHA1 6b5d5fb5e08f01819d1ab0ac069e2d45acaa23c3
SHA512 a8d84e0f9d6f7d5fce084f7dcae639020a540705565743f846e18aae3f653e9ac758ec1dfa998ad9a0e6552b49d93c0b8094502979fdc11049b153d10ee094aa
SSDEEP 12288:+VEFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:x8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 1accf0655f99ecb06d9495ec8ab1d5fab98f1b0eabd1f192d6333ef6933a2b2f
MD5 d36441ae916a03870c5212cfa14c424d
SHA1 b463788391c8c9da2e8a21f69d004a63b82427cf
SHA512 27afb4719333577a31aaa5654553b119916c9db6751643537dec40cb1864f09a039c9f919bfda149c09ab8a9a06f4bef1e69bc5214ace44ab189c3f1e897d388
SSDEEP 12288:acFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:ac8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 75111f51d02b7a1d15bacf7d276eed6bd5b6eca25c02275f7fb475a788782605
MD5 e4228507d9d335c466407d00c9096e81
SHA1 91a09be5adfeda69d54c0ad6e6edd47598bd0de1
SHA512 6ccc0fba7fb251f69cc74d0388fce5c304a20fc33dffad1e2605fb571a0a9c69f8352c4ef772d29bef86b95e80715e9caef8c539d4a67f23e9a9d9a1bb449cd5
SSDEEP 12288:GpFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:Gp8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 ea0a39ceccddd6e4f1c4b6a9fab4021fb80d1186d8c0e5089f8fb7a2f79636d7
MD5 2962bc4ffbf3c2a7697f77e112a17b29
SHA1 dfa0ca44dc7388092b285208bac49bfec6282fe4
SHA512 82d435122c6b37b1be05d6cbee5e091e8cd74ae1db95cec382437205646a15b9ed0911c7b958ebcdbd65c6c2f360368833e1e7b44e2a983cce1bfc2317e44a4f
SSDEEP 12288:5VFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:5V8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 f646ddf7cdd6b50acc76077b1fddf0c4a8784aed5e9a5e09f68b7b1215646af1
MD5 18e190c8fb0acba32e8ef0490d73a13e
SHA1 cec3200f7ff37901558721f211fe5664b44e2e03
SHA512 e0f40e3a488654593f9a93381de7f103a007c7f5a82ea95d3d252fedc0f2cc68fdca044dfbfdb657cfe19785f7e5e37be069f9989e40bba820cd098508423df4
SSDEEP 24576:NZMSzFVSO98NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:NZMSzfZgDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 1c7ce586ccb19d1006c1b4bd1427e6f870c11e6f47a30ed7fbfa6219e0564af8
MD5 8a46103c8733f3c0f48cbeb3af547fae
SHA1 804529446f2a6a009f19e042cfe2c6f2b92cd668
SHA512 06cb20869282825ad916c4ece850c1197796e839a5742a778e2e1de0ddf2e21287318043dabf155601edb8978cf3e709d0cb688e5a1ac680809f9ce8e6d9ea23
SSDEEP 12288:sOFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:sO8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 d9460c4fa97d464a5b6ebb0396c014127f5a32128ead28dbd1d86b287c65a497
MD5 ad3ebc40cd0422019b398c3aa0c1a1f5
SHA1 7c9f33dc9b5a368242e6c41a4d1457f4beebf998
SHA512 2d3c6663de31bc437d30cca34b9cd8598e16fcb15509400a7d1da016700149c6a8590cc8582c0654d1ea55e452d956dd7817b99216cf2845f2fca143ad1c4240
SSDEEP 12288:miFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:mi8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 68b8e9284f4333b367a65f6e3ab9fc1718373449e2d61a4565620fff47475a1b
MD5 fcef1931687c0c3299d7729b0833a359
SHA1 08557635cb4b7a85501fb722f552648fd6ac0e15
SHA512 7d5ff7a7243049e09e15f3983915ccfe7bff4ed50912b4ec21baf086d76eb36c4e213ac157da8b3fe8e2ca2dea7a37273575b9e153ee31b79950aebc479d5536
SSDEEP 12288:tyPz5L8xFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:Ezyx8NDFKYmKOF0zr31JwAlcR3QC0OXn
MD5 SHA1 SHA512 SSDEEP

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 2be39a0f022fe03fa634349a19c716654f55deb72446f3edd121105aebf89e28
MD5 60ed467efa661c28e09967b09add9ccd
SHA1 0a46a069b458cad95d510961e75bb46f0b2a8b4e
SHA512 a82c5856297e0a3a253642431574b0ecab7d538bb71daf3d598c872357659fb7a400057c4c53ad75bb99f20d05cee1e31fb94c312d71cc2bd53f12629fc312ad
SSDEEP 12288:gOFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:gO8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 984b28aff731815f47e70deb313a1bff99a1b2d81782b2d0ce6497b734026fff
MD5 fe0d597711fc603e0e31c5908db9befc
SHA1 5e80ca41625a8ece3fca2fb16838b32361149558
SHA512 b877d6d8a8272010e835ac2556a7a953c3f0c421c5b9517d77e5427dc849f76256f0b3112b7ad217eed7a2f6a3f8458bca9f5ed983b649c707c2f3749bf0a0aa
SSDEEP 12288:LOFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:LO8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 cb7741a14e1af20e644c63059b384376c21c16bfe3dfb52370268bc9ccf77e97
MD5 d804cfbc0105cba5f33cf5d30074d3a9
SHA1 77f1c40422df33860a5c65e2dece2f283d04ccac
SHA512 ac20836a51513915ac00e2a448a890740535e23fcc29ad03beb781e5138b26f4100196f4245df709ea88c18b8c8b1552e731b21753cde1dc85dee04063de77af
SSDEEP 12288:2yPz5L8xFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:Lzyx8NDFKYmKOF0zr31JwAlcR3QC0OXn
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 8f467fb27d7029c5a4e674fab3201009ea53569d596d600815febcf5584ccaaf
MD5 7f1c78b2fc6195f6c7c01bb6446896ab
SHA1 62942fa517931e300d06703511681acd0b7e85bd
SHA512 b9eeaaf93e02ce9dc3dfc016cb6b6c29c7088b6642b515e6ab2094252535d1aa92d6dd8059ed988a8ad5744bf591c13cfb4128684919b53751fd0f2768158a38
SSDEEP 24576:TTHaLl3z0zDf8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:TT6LljwgDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 00c1b819c1e70d75c6baf21a5f903d69826d39cc82b113d6ae589bfc85984b42
MD5 075400cc21fe3a99ec77e2af0be01f1e
SHA1 826fb6ef6b229299962bde559abcf69b4dcd1457
SHA512 5df1f3221b82e96139ee2925f20133ab29eeef94117e549fb07e31ba5a910f92cb7bc36f8cbc9e3eab5ce3204116caf46bc7b08a1c9fa0d5c0782ca8519798dc
SSDEEP 24576:g37d9CHKy7GZL8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:q7d9CHKyaZgDUYmvFur31yAipQCtXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 3cf90660cf11198b33f69948aa67368d31536dadb5b7f11f37021afbde1ecf0a
MD5 db336dd8dc7de75a6148e6d24bc7994a
SHA1 7a0486fc62c488b8419f10feb8a6fdea3820cd30
SHA512 7a5efb4f1937e0703245abfc11b68e5cf2dcddb8431f0af4c22475a15db3639587452fd2b29c7315c920374f219c45b7e840d6a0b4847e183e2e19fafffc0ea1
SSDEEP 12288:FvFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:Fv8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 7bbf307f4c7d9c9f4ee08889614387c23cd1d2e2156767fb955ebb0d01bf888c
MD5 1216b0295c45851f4b7ab42d3e5aae54
SHA1 e658cb380c3360be05b4d583353cda5e40c9e47e
SHA512 4f58281b227d89897bd037b594251a0df43e4bd91a8c5d9fc1e4cf4891bd38b443662c825838e565bacc702db2e7b13a0fbbc3c9caf5566c80d9a4d350b9c64f
SSDEEP 12288:YRFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:YR8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 085e78698ec5fc415296eb0d45b6291876bce68fb6bae7b337b2b241e92090c9
MD5 21e29812fd15546dc60414ac3db7da8d
SHA1 0996bc3e422b60b0b2b163ed2cc57cec424383a5
SHA512 90983d929253a80f1bd46121669e7af5de81389468a9cf53191eb69d4ec78cb24145015c844e3ed6ea89624d8b6aba6959823d15b82a2f24b50ed96058603150
SSDEEP 12288:FoFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:Fo8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 de824f28cba3cce604608695013e4dfa7b0a55c699b3de6606b298d96a86afa2
MD5 127bfe41153656a93e4e48a246c80395
SHA1 cbb9d41ad4c23d0a9936b6711ebbb70ac9dce8ff
SHA512 f6e9ef7861785c1cef58c6b043fecee1cc6f574f7858a0baf38b6ac4fc3ef88c684061719a0012dc19fefd0fd934609962107c00a7f54710c62a227048b89801
SSDEEP 12288:sOFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:sO8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 0497b0c77abc47544b2650c2dc488694e18049496ee6f036c5987db3e3b80534
MD5 d9fe66d175baacf0ca99d70c7195db6d
SHA1 85251cb8d96a645fa45168549b56734882bfe8b9
SHA512 6b4e0ef98a60b5e3e495510fd32897d27426b793011c135322875f8f983ed3be47bb26c5bdfb4d7cd5903f6c8bcc1902a56c6cb44a2442da14a36afa026480e4
SSDEEP 12288:hvFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:hv8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 99383add4da886629824e4a0ef43d8a4308e2c1a1e219dc624212e46c5bdaf29
MD5 81e3ccd194c5ac2c4b0697d70d2d0750
SHA1 db09f19cb7d5822662ea2ba31c1d242c15e2d008
SHA512 4a501b8aaf2ad9700c0f6774a4b0e909b533b19174d489a53224978b737bfc8cf7d1645dfad252dadf585eb7318552457fc9046a2d3ec7cbee0b54891b4186d0
SSDEEP 12288:+mFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:+m8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 696KB
SHA256 a15f862672614921db0142dc2c5701f7e8ab2baee48875710808bb3b9b510cd4
MD5 11c17e3bf5343599d01f21760c6f028b
SHA1 3decaa16ce9ac8e0c1ef50077b506e8c8b30269c
SHA512 d2f8b2a3aaa80fdc06489446d28966d0fdf598fd646fae8bb61ced55aa460d5726f3e4abfea542e4a9d74d118f178a5c5e2da90ef0775c518c9c9ea0100d24ff
SSDEEP 12288:7FYq0S5FCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:7gS58NDFKYmKOF0zr31JwAlcR3QC0OXn
MD5 SHA1 SHA512 SSDEEP

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 3f9216a0c02c412a594dd5d4277e6c1076ab849270c01d7d464ac57ffb82ed82
MD5 372b99ad44a9f2c1db185f3aba0fa8b0
SHA1 7e7a38feeb868f7fde7f59c245bece474d432118
SHA512 4800d043982554495b2368fc3d8c7e7a7b3c96f276331a7bcdb77249440ed062a84d8acaa557acb04974af330303011a628e8edc356d1317586fc4cb3cb2ab88
SSDEEP 12288:ayfFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:aI8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 7bc1b8857e22d8ef66f9fd1a7b066f2a1cf1f9aaa8d4ca3a30ba97afd42223c9
MD5 274d5d3e3063a8b8e448d73a21634d43
SHA1 7f64a6996ebbd4ef9a7cda1a6cd3f5fb25e252d5
SHA512 0440151a6f4cecc7ca2bb3563b4487edaed5ef643e7dfff5ab890ca76052e19dbe4d1163b63fbc698fd1f1179536315daed430e8d1ac28a42dcadba04deccb98
SSDEEP 49152:+a0h2GEkuAe73q3pp46zwwQ6gDUYmvFur31yAipQCtXxc0H:+a0hNYG4JwSU7dG1yfpVBlH
MD5 SHA1 SHA512 SSDEEP

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 659KB
SHA256 469d080f0505022dc8d7c605a60e83a762ce26c227ceb0e15ef6f8b14e44aebe
MD5 55dc327b175788337b2c998b9789920f
SHA1 0734da42e532842c2f6f99c57c3aa5d11758107b
SHA512 2afcef169928319a9c1c36da4fe8fe3295478504383673f7d14527f9f41a22a349c42a5cd1e74973afc92bef8c24db40dc1900e71dc7f6b3ea8eb537b9da57b4
SSDEEP 12288:ahbHjfXbfFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:ahbHjPT8NDFKYmKOF0zr31JwAlcR3QCx
MD5 SHA1 SHA512 SSDEEP

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 555b020a44d8066626983bdea25d8e5ac406f03c960ade42af2d7b215becbcf8
MD5 18d646f82811a95f0e4eeb35d0febd7b
SHA1 0fa854ca19b714195a2111204977cb228d233eb1
SHA512 03fe87a9838ee66606aeb02e617cba076983d7f57bdc0a7374653f5280e28bf7d3a222ded953369089dc9a3dfd3dc320a2071c7430486e3cd49367c7fb62e15a
SSDEEP 24576:E3YgnJcRTk4yti+R5dpR/r8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:EIgnaTk46ppR/rgDUYmvFur31yAipQCx
MD5 SHA1 SHA512 SSDEEP

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 578KB
SHA256 dfd1a59329d1a9f06f1d614592fd0363d164ff7caad810914474af56f6ee9769
MD5 44560522b58fe72e5620b69dd4a7b09c
SHA1 98800cb523c4eea1de41fc945788af089a7828c3
SHA512 83c0cd2ed46f7775dd7a138ae24b61f23294c107b04ff51311b6c16d4c3ecf1cbaa37e9027915f00f18b58af553e1872379e5472abf11e895a49032dc684bf8b
SSDEEP 12288:+OfFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:+E8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 940KB
SHA256 671cb23ca13a38d8dd7a421cc1f57ae2839ad365af27e0eae052c9f315a62ecb
MD5 48d301a1875d73883137a16459040fe0
SHA1 dea8ae036fcd9989d026b9a8d64f62e54b37c68d
SHA512 7e24b976614e67688496e689b4b761383c3d6968f5829fb0d9cf3d41f04b64bdfca964fe958c821085727380d233ba761b6a1c26233eedd5f431c1c2b772b09a
SSDEEP 24576:upL3UT18NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:upL3UxgDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 671KB
SHA256 6bf75f0c189d7bfd66cb323d9896a6bd520666707ef3348d3e5fc0baff5d70d3
MD5 72afca13c367be331f72ab5302a2cacb
SHA1 572980f4e89628d7e4cb54a8654d7572e788d04a
SHA512 637cf491e0f2eeb5fabdcaf864d695627f0de580a77f55b59f1ed288bed29615607c1428add2f6bc892d27591ce4a6aa9f5d5ee366af4b32cd2c55a90d8d2f5e
SSDEEP 12288:vpFtpO9fFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:DOR8NDFKYmKOF0zr31JwAlcR3QC0OXxx
MD5 SHA1 SHA512 SSDEEP

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 521c7b13fb0023f620afa4eff880fe94e8d2256faab32abe82adceb77b6c3032
MD5 00a88667dfb21ba3434d1a1a362042a7
SHA1 f114bd830a7d1f6865268cc40d01af2bbf030fd0
SHA512 eb94046ec39683504e963b412f1cec44fefa79eb5fe800088d195ddc5b40007d495255cb6a3582692fbf75e7011a8b1f8cd0a94770cfe18a1e2082226df68027
SSDEEP 24576:Q7NM9YmZqmWMUkPjZM48Mv6bEhs48NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:Q7cBWMpPjN8DbEhzgDUYmvFur31yAipZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 724f59944c735bd77949a9f8cea614776d8523aefb4d6464bdf7c13c90a2417e
MD5 eeeeda770faee7b573acbd0c2b9f929b
SHA1 f58fa6fc14555512b4352598fdaefe6a7b1c6244
SHA512 bcb503cd6694ef112039869d7a097dac586564d54ad8a3c646eeef394ca88ba37e6bc55bfd2a18b8a1753814a0d9d8b112a4067a4ec9e53d2956e6855784dac6
SSDEEP 49152:sF2YuHNETovcvNYf8kmYgDUYmvFur31yAipQCtXxc0H:J6tCf8kYU7dG1yfpVBlH
MD5 SHA1 SHA512 SSDEEP

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 15a0072afeaa9f41d09b9b7e40b8905bd0da0abccb8b09d1a5abd4cf0cefe331
MD5 9689ef67e6081e4d0534a8fe272638a0
SHA1 595ed393faaf3fbe3b67c5d9987de2c9970bd52a
SHA512 23aed5e7a850943989d5f43ef16d29972ca7c31685b0a3038ad790ff58d0a5760f11f64ac5107464fe917cfc3e46e13e6c4575e0cc7d342dd94d148c84ce9e1d
SSDEEP 24576:9AFs06+Omlf3NXEbTo98NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:yFs060lVXuagDUYmvFur31yAipQCtXxx
MD5 SHA1 SHA512 SSDEEP

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 885KB
SHA256 2ca589b0a26445d49abbd7068afd3ca790fee12da394012f6561f90985c22592
MD5 75509fe6ce45e0dc6f0d2e5a6d61173a
SHA1 4433042f799f815f24e287ad85c08aecbb8e43f0
SHA512 b71837cc20b6d171d35066d984a1a94efc24fbda9925e853a232af474b20dcecece411208c31efd447a1e60a742e8cbce3a64009ca260e7342c029bde7a00c31
SSDEEP 24576:6JnJ5D3Wta8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:6JnJ5DGtagDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 b7a4d7130cfbea88e0f95c4993bdbdcf4d880369df4f1436b42001cd85132936
MD5 fe5c5c26cce6c55e4266663fd13b45c9
SHA1 5b51bf30bbde296accc5a7d67bf002a4ae8bd8ed
SHA512 dd4e2cde253f712d8e2514bb9a943ece1d18bec79aafdb1505a626fdbacfe680a9d48224a5182b4e3a96bbe4980fc3c0ed1c0a26dddecffa13cd0a642de25199
SSDEEP 49152:Lo06DIKdwc+eQnSt65aVsgDUYmvFur31yAipQCtXxc0H:ELU7dG1yfpVBlH
MD5 SHA1 SHA512 SSDEEP

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 661KB
SHA256 fde4ba894e9f8c947b885fab02d856c44d24c75e1613694c7292a2be3892de6c
MD5 62bf7d653d9a167cc7e595ccabdf5ad3
SHA1 ef98d0fed2a30460113b9c4e187d69ded7487646
SHA512 98a70a41f706b9ac37500b8166c70c156213d3a9da47a7c09aa6e9a5f6e7576a0a3a60cb0b381a19a9429251b7dfcfece0714161e794a78d2c93277d334e078d
SSDEEP 12288:VEP3RruFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:Wru8NDFKYmKOF0zr31JwAlcR3QC0OXxx
MD5 SHA1 SHA512 SSDEEP

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 712KB
SHA256 52667a31d10d20805d25cbece801fce5fb7c029fd1dae563c1b7a05ba47dcaaf
MD5 3f2f4d4445d450c9a7dfd172cc257a05
SHA1 e53cd075f6a0d65bde07c8567b2b724cb767ebae
SHA512 430f552710861d44c0c4a6120c7102c32b9c9fd1a13faab5c6f9dc3a64d5be1601d4c222c0637f99e41def7faf813816c485349d59793ff27beb19130a5c280e
SSDEEP 12288:DjkyLfFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:DIyj8NDFKYmKOF0zr31JwAlcR3QC0OXn
MD5 SHA1 SHA512 SSDEEP

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 584KB
SHA256 31ce4fc280d20517931fe881251efa034a0161a5096106ea9b1a41b94876ef03
MD5 c0e4d8e0347179449e20c24d9905fdb6
SHA1 d9b3a09be8e4adf944bf39129c9318cbbc2abb08
SHA512 bbc82bac95382edebb839e98e55b35782ac88d2cfffeee64d2d6fa05ca25c4321196f04a45159bd97520c476f8112b4994e865457db242d6592a1934561a4445
SSDEEP 12288:dFtfFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:Dh8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 c9cdce41226efd3548c6f66c39d948200b1c9314c97a0e86fa91e9a71839d3a7
MD5 d27dafa4a7c74d7eb4a8d701ef730070
SHA1 958195adb1e513cce85495a8a970ac84a6765378
SHA512 af85b490c3cbd73f5a652c7990e397bae091a3202d162f8a1424ba812825d73749d37e59417ec8990af13da9637ded442a5b633977acb0af51112a6e692c6eb4
SSDEEP 24576:WQ9MxZKdcz97w3A8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:WVKXAgDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 772KB
SHA256 6a866e88d28852ed5d070914b7518988d958653dc82faee463976f6491fdaee8
MD5 f69b749fe0ace6b6234bc929808a28ff
SHA1 c7a0cc438666c3cbf68b10433128adb79f0a2545
SHA512 4fd4535f6bc938ff1ada89a59908897ded1cf2568ec0c1a57356ca8c995e0df332e133aeb328ca1c291eae7e7b50823282c8c9c12704deaa259f2dc87f05a943
SSDEEP 24576:byocxApP8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:OocxApPgDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 043ce9549ae700f764b816e85010be8008eb1f02b0a8d9a31d2ce1b06de5e46b
MD5 4d30ed8a9d246d7d60ef29cf4933a3e8
SHA1 0c30c358b8d9e3ddb3909169e9c42c5b5b28b010
SHA512 1d5a82da888227141bb49e8b3afe1cd7a43e2878078cb34b4bbf943130514ab04fe581717c171f44463cc78ec7ffaf40f691ca2cd14409bbb75ac48af9025173
SSDEEP 49152:TWcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIKPgDUYmvFur31yAipQCtXxc0H:T0zuNI+U7dG1yfpVBlH
MD5 SHA1 SHA512 SSDEEP

Submit Download

office2016setup.exe

Path C:\odt\office2016setup.exe
Size 5.6MB
SHA256 802131c75ef2dd1f9693d0ddcbc75e55f2e3043400ce29fc2f17d0dcf647e3c6
MD5 47624db2c503fff97134a2f9f3284e5b
SHA1 58409bdebe1c15761ac7356eac25995ad3fdf215
SHA512 b3f16cfb0f92e20243018cdcc5267c3a963f7ffcbaaa89ca1c99e93a9937e5dbb25ecfd3b388d0555e52b3c3a264d1e85e19f346875e4e736003ec6aa65dbb84
SSDEEP 98304:17M701RgX4iuSl1DtlEq81xZPGnzURnBh6gGL/QmvD/cTwY2h3F0U7dG1yfpVBlH:ZM7pTXexZPGzURnBh6gGLF+W3CUoiPBx
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/8-468-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/8-460-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/944-421-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/944-430-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/1004-307-0x0000000000520000-0x0000000000587000-memory.dmp

Download

memory/1004-299-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/1004-363-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/1084-51-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/1084-64-0x0000000140000000-0x00000001400CA000-memory.dmp

Download

memory/1084-50-0x0000000140000000-0x00000001400CA000-memory.dmp

Download

memory/1084-57-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/1084-60-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/1388-13-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/1388-1-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/1388-8-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/1388-0-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/1388-7-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/1388-11-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/1436-455-0x00000000005E0000-0x0000000000640000-memory.dmp

Download

memory/1436-447-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/1492-65-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/1492-66-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/1492-72-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/1492-238-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/1772-377-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/1772-320-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/1772-313-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/1892-408-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/1892-416-0x0000000000BC0000-0x0000000000C20000-memory.dmp

Download

memory/1892-546-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/1952-39-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/1952-235-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/1952-46-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/2176-234-0x0000000140000000-0x0000000140237000-memory.dmp

Download

memory/2176-28-0x0000000140000000-0x0000000140237000-memory.dmp

Download

memory/2176-27-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/2176-34-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/2320-337-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/2320-267-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/2320-279-0x0000000000D90000-0x0000000000DF0000-memory.dmp

Download

memory/2320-346-0x0000000000D90000-0x0000000000DF0000-memory.dmp

Download

memory/2384-443-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/2384-434-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/3172-390-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3172-549-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3172-324-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3172-332-0x0000000000600000-0x0000000000660000-memory.dmp

Download

memory/3340-244-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/3340-250-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/3340-310-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/3340-243-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/3376-347-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/3376-407-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/3376-339-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/3604-405-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3604-404-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/3604-400-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3604-393-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/3640-284-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/3640-350-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/3640-293-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/3948-274-0x0000000000EE0000-0x0000000000F40000-memory.dmp

Download

memory/3948-254-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/3948-272-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/3948-255-0x0000000000EE0000-0x0000000000F40000-memory.dmp

Download

memory/3948-263-0x0000000000EE0000-0x0000000000F40000-memory.dmp

Download

memory/4008-446-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/4008-378-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/4008-386-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/4232-229-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/4232-15-0x0000000000700000-0x0000000000760000-memory.dmp

Download

memory/4232-16-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/4232-22-0x0000000000700000-0x0000000000760000-memory.dmp

Download

memory/4252-420-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4252-353-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4252-359-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/4352-364-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/4352-373-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/4352-433-0x0000000140000000-0x0000000140102000-memory.dmp

Download