94a0ece3d5922b518a3ba2fe7aa227d9d50b32d2ba2eea30d0533bd557f1b073

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
04/04/2024, 11:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-04-04_4759051b91e6a71b8857006213d24241_ryuk.exe
Size 1.0MB
Sample240404-m9wzjsdc4z
SHA256 94a0ece3d5922b518a3ba2fe7aa227d9d50b32d2ba2eea30d0533bd557f1b073
MD5 4759051b91e6a71b8857006213d24241
SHA1 e83b2c94701aa6189890cab7647b90e466a9a0ac
SHA512 3ba4c4688a35c4a7a56008db498a5f2bb6a1e70c57c725a3375063ac00e7eaddb22c91120386a3dbc653807739938791f906024cc1910d6cbe5763b2f67d199a
SSDEEP 24576:s6V6VC/AyqGizWCaFby48NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:s6cbGizWCaFbxgDUYmvFur31yAipQCt3
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
5016	alg.exe
2992	elevation_service.exe
4024	elevation_service.exe
3872	maintenanceservice.exe
3456	OSE.EXE
1276	DiagnosticsHub.StandardCollector.Service.exe
4744	fxssvc.exe
1868	msdtc.exe
4560	PerceptionSimulationService.exe
4936	perfhost.exe
1640	locator.exe
3672	SensorDataService.exe
4664	snmptrap.exe
3372	spectrum.exe
5112	ssh-agent.exe
3148	TieringEngineService.exe
420	AgentService.exe
4764	vds.exe
4968	vssvc.exe
1064	wbengine.exe
3168	WmiApSrv.exe
4056	SearchIndexer.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in System32 directory 24 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\674aef6c12d07ad8.bin	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2024-04-04_4759051b91e6a71b8857006213d24241_ryuk.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Mozilla Firefox\minidump-analyzer.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_91140\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	alg.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000036b869e98086da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9926 = "M3U file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fd79ace98086da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000054a918e98086da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration"	SearchIndexer.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
2992	elevation_service.exe
2992	elevation_service.exe
2992	elevation_service.exe
2992	elevation_service.exe
2992	elevation_service.exe
2992	elevation_service.exe
2992	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
680	Process not Found
680	Process not Found

Suspicious use of AdjustPrivilegeToken 42 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3144	2024-04-04_4759051b91e6a71b8857006213d24241_ryuk.exe
Token: SeDebugPrivilege	5016	alg.exe
Token: SeDebugPrivilege	5016	alg.exe
Token: SeDebugPrivilege	5016	alg.exe
Token: SeTakeOwnershipPrivilege	2992	elevation_service.exe
Token: SeAuditPrivilege	4744	fxssvc.exe
Token: SeRestorePrivilege	3148	TieringEngineService.exe
Token: SeManageVolumePrivilege	3148	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	420	AgentService.exe
Token: SeBackupPrivilege	4968	vssvc.exe
Token: SeRestorePrivilege	4968	vssvc.exe
Token: SeAuditPrivilege	4968	vssvc.exe
Token: SeBackupPrivilege	1064	wbengine.exe
Token: SeRestorePrivilege	1064	wbengine.exe
Token: SeSecurityPrivilege	1064	wbengine.exe
Token: 33	4056	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4056	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4056	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4056	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4056	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4056	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4056	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4056	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4056	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4056	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4056	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4056	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4056	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4056	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4056	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4056	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4056	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4056	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4056	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4056	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4056	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4056	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4056	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4056	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4056	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4056	SearchIndexer.exe
Token: SeDebugPrivilege	2992	elevation_service.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4056 wrote to memory of 2180	4056	SearchIndexer.exe	122
PID 4056 wrote to memory of 2180	4056	SearchIndexer.exe	122
PID 4056 wrote to memory of 1804	4056	SearchIndexer.exe	123
PID 4056 wrote to memory of 1804	4056	SearchIndexer.exe	123

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2024-04-04_4759051b91e6a71b8857006213d24241_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-04_4759051b91e6a71b8857006213d24241_ryuk.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:3144

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:5016

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2992

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4024

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3872

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3456

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:1276

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:1836

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4744

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:1868

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4560

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:4936

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:1640

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3672

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:4664

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3372

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5112

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:4236

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3148

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:420

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:4764

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4968

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1064

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:3168

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4056
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2180
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
  2⤵
  - Modifies data under HKEY_USERS
  PID:1804

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
Size 2.1MB
SHA256 c49c7527a82ebfd23d26231e41c4206e2f1b7db221f12f3ce633126a7e2824fe
MD5 b1aed461c5bfa9699e3067e19e1a7a8a
SHA1 93d46d38f8cbbd8399133ea19712c4b8aa0e01fc
SHA512 cf67f4db11f48cbac804475e00ffd10f6f40d39513f4e3a02005f04c3b013a02ee3830e4ed7169150d05b26c3784aaac96d2abb3c86965f190c75fe7377e2f50
SSDEEP 49152:NuYk3H5koUXfTqkkYLO/W2buywzMbOX+T7z5LgDUYmvFur31yAipQCtXxc0H:NPfTqi90bqU7dG1yfpVBlH
MD5 SHA1 SHA512 SSDEEP

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 781KB
SHA256 10e657ba9028ca193be16ad6ecd1af2ece6c6537755d028fa401a542ed2f6f0f
MD5 3b6f2a14b9eb8059dff5cd2b734c25b4
SHA1 21ab3fa2680e3a290b5d6fe795e01386613b1472
SHA512 bfd374a07c3d655b0399333c5cdc10d9a1ad995161b1a6b2b42b973ce5e369ccb4682cd0c8707a7bb1f32d254ba8e003b54798a0f4360dc79ecd862649ed834d
SSDEEP 24576:8PsJcuiy8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:8wcu/gDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 255e2226519673b1cc1666cd9c66b3f898b5f0b4ae71a17c6fb3005e60748475
MD5 42c16f3e8362f015f8a5789718d76534
SHA1 6496d3e062d9e9647e7e7aac29b036432b9c41a9
SHA512 399c5f94392f0321003f415d145d7fc8f013cebbb59acd1fc73cf023e3452a837837b1eb3f0a7df85d9751117afd54601df2692b3302be767aa0309530da4200
SSDEEP 24576:Q+gkEVfh4Cou8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:9gkExS4gDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 53d257e86b3e088a2b52a794a22203e68f566943b269f8b1122c162fdd7f1a01
MD5 0580471ba0653b9830b6922db9bffb89
SHA1 cd9ccd78140681d972e2116268e042d2425e680d
SHA512 9c7637f8e92ccf46903c50a75590e9be9a42b35dafacc1418dbbaaa4f9e6fce5524c9e8403f13dfda96d068c8d1e68d294e83f0da7c8a876ec71a063f135ce59
SSDEEP 24576:UBpDRmi78gkPXlyo0Gxjr38NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:wNRmi78gkPX4o0GxjrgDUYmvFur31yA6
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 5f110edb2b483a4441bbff15e9123d8d44d0f53616abeea3f44d60543338cdc1
MD5 2e007b0b830766ee85ec3e3d51f9eb5b
SHA1 3e03f45bb300b90075edef6209dfa9b607c37863
SHA512 23bc9dc673c865c9303556c2baba74177843b5b0c702eedd408f72ea9592d7cefe0d80fbce7e960dd6e7fc80aa41e17efed05459a77ea3efdb2a411c3117e66d
SSDEEP 24576:uLOS2oyPIXVu8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:O/yTgDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 4eb371fa6f597fcf218d8152eaf0c8d766b36023458054edca0c3dba4643decd
MD5 355310565dd14dfb6a05c384880bc29d
SHA1 a7d85bdab993563c501a18c313f840392d7c34ad
SHA512 477f65f3b85b45a867f02797491cbe81708f41251397db30c94f02f497208a100c36aedd1f28554cebe5bff4eeb6f45970c5440c171b2795cce040a6eb74fb19
SSDEEP 12288:3fYFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:3fY8NDFKYmKOF0zr31JwAlcR3QC0OXxx
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 02172d70bedd1f8c247aa9f8607c85ae087e1eb4b34614f4980744c95e8acfb0
MD5 20c272b6c6bd84a89f0ba3a6551bfe33
SHA1 e6f30dfece5ceb3ec00ecc87c003e94e1dd65ecf
SHA512 381a5bb8003dd5917710313c40f51b57ff78ab9e6cd1afbc2dfc9d491734df52d302102e9b00dac6f26143554c2c8f9f2fe3ce3980f64fba0ab3368ec16e7f1c
SSDEEP 24576:OJIUJ8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:OJIUJgDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 762115e8641cf307f969e9c083a5a052fbf07010fdfed11660d77b5d86f537ed
MD5 979c18c6f65570f83b2529efb195edd4
SHA1 6015ad6f48082a61eafa0ecf5a9d48d34c498c89
SHA512 2783ccb0b4c9acc37258c3075dc78dcd2cc5007878d12a1a2959565bf103c245ec62a5a7f75646944526d3aaf02e2fb1bf567e5c6b8c28d41eaf43d839f6493a
SSDEEP 98304:dQvGAdlCEL8c/yRNw5C/U7dG1yfpVBlH:avyEYc/y3w8/UoiPBx
MD5 SHA1 SHA512 SSDEEP

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 221e3ebf6a6f276782dd00315857749198b872893823ea382f905d947c7cd2af
MD5 75a853fe5c642a975892aa92d50891f9
SHA1 8a1dc4fee691b41c66b657e50ab7dcce3c33a4d4
SHA512 6b5d1448d55d89c29cdf82f8db27f47e8abf09ef199ba92136a652a50face0303dc31fc9f56aae0e5d54932af23d9e204eeb8ce0ae58a45a0f435fea69be5a81
SSDEEP 24576:BdewsAj/8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:/lj/gDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 4e9b52516995dc7d8fd54b583a0158c91b28dd44a06ac9a651cb08e594025f62
MD5 9694b839ff9544cfbe0069d8673f9eab
SHA1 f941e34342219057487f141dac974a5bd52166ac
SHA512 8ff7f09ff951cab943abc88a710eb899354ed82a6fee92b37486ef4cf1dbda1a66e1fa8aae663f20f394840edb20172b1b6338531858ddd8f6911be928eed421
SSDEEP 196608:DUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHSUoiPBx:DUEtQevvqc2W1cpV2EI32S
MD5 SHA1 SHA512 SSDEEP

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 063f0514445bf6cc0cfa9ea284f90323b8beb275c272d9af2cbae5b4d0a93efd
MD5 592ce1e84565b7dd1f32484bf807937b
SHA1 8f22b3a22392817906c739828ab6e35f5320d3b1
SHA512 c8a736a4b3bfd21ff854bb6590995731e6404f565ebe2948c2b75b20611c93416dea676a8170759a06212d02068c2240e123694ac771c773aef7fa1fbdc255d1
SSDEEP 49152:2CbRquA/m2yL5zifFiV+XenmE3/zfgDUYmvFur31yAipQCtXxc0H:7oqHVjnmrU7dG1yfpVBlH
MD5 SHA1 SHA512 SSDEEP

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 c15e7b13f3126115f556e01147b16f95550630de16953b2912c39dafa931418b
MD5 6cffad72554a6948a27ed1a1a0e33a43
SHA1 e302d3df6eee553b16582d20327d14e27359a9b4
SHA512 49ec903500221ad5bc8b48bb3736539246bf898fb54d9a8daabb6679f7beee9242c62316a9a369b034238143614bb1eafe2b01bd6c60c15df38f9da7f63f101c
SSDEEP 24576:0AhGLJIFoiwtA5l7S53e8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:0AMyFoiq5OgDUYmvFur31yAipQCtXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 0cbb849ed71876e2d823a4d40a6d33d1b7f5a17e26f7afb6ee907ea59e14cba1
MD5 d7bfd2bf32c64b8c5e844560db3f37f4
SHA1 26701e4a480f990d5b9f73c2c18cc40a9abf89db
SHA512 a0bb7e830469e5a6c2cef3f682480b6e0df987dfdca5198faaade5845ccd6f6549b4d627c358f4b9825470fead824b54e4651a3c63fb978c02277054bead61ef
SSDEEP 24576:VwuoOWT8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:VwDOSgDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 4b1ee29481947fba1bcffd7ad384032bb6c84b4956a1efb13ec98b682a1aeb75
MD5 8b20cfa7fdd35bf0b7c9843fb044c6de
SHA1 805780cf4c81ada2582894daf6ece8e935ac7754
SHA512 69c2b6490f6f1a74958036c5be55ec86032a2867b8009a4c8474235aa60f2eca490d2bd81c6ad604419c510e0e88f2675604ef9a0cc69eb4dfaecc9e199e14e2
SSDEEP 12288:zBZ1IyPFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:dZuU8NDFKYmKOF0zr31JwAlcR3QC0OXn
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe
Size 4.8MB
SHA256 31731084a635219715d88d3e30098642573a94a008d789fbb11da6f7296ae6d0
MD5 8145b3c2fe71793164df4cd6699b6911
SHA1 7fe21b14da3a6d0fffa47f9e1f32e5e0cb99c7a0
SHA512 363caea5cbbc464d4a2268c8dd236057e21c239c8c079b7c2a18103fae757e5acc5bb7740643c299ccbdc7d909105caa235d665748f0234c5a266183445378ac
SSDEEP 98304:vrZ4K5M+XDfiIewG+x6xZ144U7dG1yfpVBlH:zZ4K5M6qIzv+Z1TUoiPBx
MD5 SHA1 SHA512 SSDEEP

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe
Size 4.8MB
SHA256 e86bfed3ff406b9b2b0ca9bf3222aa1e5ed70aebf63305842a965133328a2ddd
MD5 d9cdc2b18257a1d5327f37dc26a559c5
SHA1 4d506a9da5b6113d2572c00ad47402d6b4998343
SHA512 a27219cc52447bd7d7adbae5274306b8d39bedb39b092cec17bdac27138982b01526e99e0880fd442a4153266abc9797db351a53eea4ab2615cfb0ee7fdce9fe
SSDEEP 98304:4rZ4K5M+XDfiIewG+x6xZ144U7dG1yfpVBlH:MZ4K5M6qIzv+Z1TUoiPBx
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe
Size 2.2MB
SHA256 48d47fe2e6243785d7654caefbef6e3e9b87006837d30dec5396c94372efd8b9
MD5 6b28125ac5e3ca371e14d8c0dc8512e5
SHA1 d0722e34317328b9067bfe456710328e0b635acc
SHA512 42f4f351ed523256fc12644f1a5c341c8b710cc0d8f4e0f4cc136000ebe1c3ad9da9e88f4315ddc27d2059c933a3ac8670875cb4a537ae4f31e25b021d6d20cc
SSDEEP 49152:6fzabJ8llj+SWWi2mkx+X+diegDUYmvFur31yAipQCtXxc0H:/ui28U7dG1yfpVBlH
MD5 SHA1 SHA512 SSDEEP

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
Size 2.1MB
SHA256 18b32c04dc40986daebe4197fdaa584773dc59b76a3c89cf453093f7c44e8932
MD5 01b2be5263bd675fb285bbc10c63387c
SHA1 61e99f696953b5bf7b8fb42c79e58a30dbb71ae9
SHA512 c11a1a3e0f3f8ca1ad3fd5573a6a71ef50ee4caf9cfa949ceb1f567a258271f06fa6146944108317440f920caa53f312c68b7090e3574508a7a3e518474894b5
SSDEEP 49152:ga/3xXBSZ4K5MJ1LvTMxbfsYBYSgxu9+fw4TRgDUYmvFur31yAipQCtXxc0H:6Z4K5MJabfsYN3U7dG1yfpVBlH
MD5 SHA1 SHA512 SSDEEP

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe
Size 1.8MB
SHA256 d938eaa384f0ef8befa5cc1265253e766c34b649ab5cac8d6bd7b54c3c2b4fd2
MD5 2855f560f665c677985c506026ce4793
SHA1 22f08bded6a78a42c1aadfbdbc030649ac196183
SHA512 10b9423b3355c857f1d197f868166a158c11ab3ade43e4ea5b8db8c7b297d428c93928b03efb3bc1455bb736e5619803b5ccf734b0263784d5c5b9ab8aca530c
SSDEEP 49152:JgNJtUzDu/9gKPxHC4DgDUYmvFur31yAipQCtXxc0H:uPxQU7dG1yfpVBlH
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 1.5MB
SHA256 bcce788907ee7fd444f86f1969e13b30309c45543e6ab7728ba78cfda257c29d
MD5 cb34986452a23a112d79fa6c2778fa11
SHA1 ad467aa77ad047f1bb7077b3904280efd4b00209
SHA512 a0612a7212e9c3a84daabc14bf8fc16535e1b6e3670aed91320b9a7ab258042dbaaf799b5e54ca40129aafed79562cf0c27881a1387c66adb8762a3b542e03d5
SSDEEP 49152:SOBynH1wM+v6UJxLQd7BHjdfZgDUYmvFur31yAipQCtXxc0H:Gn4LQd7L4U7dG1yfpVBlH
MD5 SHA1 SHA512 SSDEEP

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 2dbf6fa047e26499f839ee9191ce8c25de0c17bbdc293eea2ff29386721dc097
MD5 ac7a98e6edb02e143ccbdc6a597ef829
SHA1 b3c0baf054af1c25a7766df1492ea680ec7ae723
SHA512 8f28e350d0d740bc1d9cc9adfc9f79d988c0a2b99fdba47a645d625a722dff8cd92e500160b50062a83086e9f55bfc1b9ff9b39ade4680a7d7b18f270b1f66c8
SSDEEP 12288:dQFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:dQ8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 059e7f7f421812c70e39c26d0bf10fb652e75bd1d891166d03ecfc746f1f165c
MD5 243e73149af0ea7269039d1638a4223a
SHA1 ec18ff7e3e776e62fbba759e181284a2f6336478
SHA512 727abcd675a13cf402d90c7eb1038c9e16dd32a8cee003e306e965a5c0ed28c99dcdc9d4f47b175ce42f6d07842d294cb7bd428a237288e528fd0b91118f04a2
SSDEEP 12288:rbFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:rb8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 bd48ba2b399791d237cb072e9e9e1799b8be9bfcd5a6531f572a19aa663f1570
MD5 afc0fb836c2d45478026e33c5bae5840
SHA1 603f909446877116b0c01ab53d81c902e187cfe4
SHA512 a38881892d6d9a5bed2e83d00b7376eec2cf9d24beca608dbbcaa5b539f8158db72bebc4bee43ea0f5540ab202dd516a4c23d46e6dd93ce05ade5a7fc4850658
SSDEEP 12288:LhFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:Lh8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 dd5c6bbdf881434dab04bb497cfb139cce6af5287f6b61500b33dbc3f2d76039
MD5 c48b8e695676ad80b5f2b86786067e5d
SHA1 24bcd8fb13ba24f80dc0f77f7428db02747edf48
SHA512 f52a4876a4ae5be36a79fa4a33800655fc9322a125687035966991d533d6163c86114adfb4d38cd6b3c43238895869e9eb91ef28ba4593e5223c96ba4afbf005
SSDEEP 12288:XV+FCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:w8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 fdb676215808e3334eaf1fe6960a62f54cc0453e25b9ec61e0fe774bbb6b2d99
MD5 4bce352f612463968ec9db0dc14808b9
SHA1 b5fbe3c7a8adb57122dd9cbcdf13fc86e411f885
SHA512 8a0e19822a5d7792e040a9ffe4f56bff4ffc23bb3b85e043697ccd7d13c9a6b378f9c1a7e12bf9e6049d20770312085ea135dc64555df9c729fe3b1abda1ec04
SSDEEP 12288:OGFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:OG8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 e4a7a77d0ef5a3a7b8d69576e71716a46f53a0ef6c3137ad98baacfa472a9009
MD5 37176d76d20f853568093f23b367cd38
SHA1 5636d3027e35af2d120b5aaee01ac71f5e9e8e39
SHA512 6bd3d8642ecc673f732ed33846857a60ee57c216ed285943ae42d86bcb31d3e30322884b495d75806c73a6ce97476a15c00a37ce032d4d2d2cda3cfcf6d0f19a
SSDEEP 12288:x3FCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:x38NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 684247a3dbdbe49784248e2a2fc27ae9cc863b9927d1d0c043fb589428b1a012
MD5 9c1ea148cec4172458c114c572ea366e
SHA1 7b9af2edce4026cc2d1e6ab4cc75dff8880a8a15
SHA512 e018465459cba3fa31e694b53854b6c3400fb4f8116b7cba684c0eb1c3d4e6bcb92c922df034134600aa7c176a6c69651b80a64a4e5bca29366a4fd669884300
SSDEEP 12288:nDFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:nD8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 f120876495e10ae2e2908115dca3f00acc693990ee3f174e68f696c4538127eb
MD5 4b812e566ae3574c113b0191a991df23
SHA1 7bc5301eb22651777df002f90b384c9d764851f2
SHA512 984c2b334ffeace0834e7c99e956caf50e2fb21e48f9d97c40e0393d1ec06a05a3bf6f047c67245ed7e5c32e69ab4d19ce654fc45469fb1e49455b870f757265
SSDEEP 24576:BZMSzFVSO78NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:BZMSzfHgDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 b80ecd1941f60975ae5879e37fb9ce5d3d58e2379d2e09ba4a3aa6905ba19ef2
MD5 07054a9fc5d43bb9b1ba39a72edcac11
SHA1 7ffc0e2bada246a6f61989195080e731cb71abbc
SHA512 492652bb6dd4fd0672e09f7af5949ef6f22d72a944f4f7c0f6c041180435d7af67c50e9f9b476231bf946088fa085485e657387076a6cb67029f995168d570fb
SSDEEP 12288:VkFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:Vk8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 b663a4452dc47b864b5b2cc6cc4716e78230a8167cabab429d6a77661eef32f6
MD5 737b5ea2b45b1a632d35f633b35b57ef
SHA1 8508215ef531cd11fd0e2624d1d9bed42a1e65eb
SHA512 a22786d29486f5c25394679699c9b0114dd2b18f125715f62dfbe984b2c7eef86d03115035709d30fb49232f6c1129134a60916dd457c8ccefe1fcd9c70a16e8
SSDEEP 12288:GoFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:Go8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 5174f46ff215735d0749b2a707ae55c93866baa813c438be2f0d2c2149300b34
MD5 15615dc85ab8d008a6b18ecbdc8cf4d0
SHA1 5afd2069401ee443100d361e7335260daeb923c8
SHA512 d95e6c1ae947d2b43a3168ff40aeb81186ae4a3b7cf562cb17aa20b597485cc46f768c86d07f45c89adb7ebe6a7bfc04c5a31b8c9dd4c6315f5c7261c3db375a
SSDEEP 12288:wyPz5L8PFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:BzyP8NDFKYmKOF0zr31JwAlcR3QC0OXn
MD5 SHA1 SHA512 SSDEEP

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 e53524003d886dc240432ca1190a700a03dee02b82939876e70f31742f41d6e8
MD5 de5f7435c998f99b4da815f9e9e768a1
SHA1 fb61355839214338e05f248e87a533298f136b7e
SHA512 b1407f9e1d5aea4c5b5df770e50cac130f5a0bffa8cae0758d25a786607ff53ae9317e4c27cd962211f90eddb81fb9b3dbb94fb32bf2712fcbdfc6513e1064f9
SSDEEP 12288:1kFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:1k8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 abc10c7e18747bb461a0ca4c3c5bbdffde729d311bc4978eb31d6ef05b3adb00
MD5 6192e69ee4cdc9c62fb9baff053fbdda
SHA1 9789cd23b27b3a3fa9ed3515ab5735840d556000
SHA512 5b5e366e41e32898d18cf6edd8d78701a34aec209c3e26b34cf80453e7c68a0d22f12181ed39e9a65b116311b5a27222519f7798baa75d0c865f4c9dd1a7b94e
SSDEEP 12288:3kFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:3k8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 bcd51d32ec2a719d07ced16e1afe5d823231da1ef0e888c74c83a7da8b8ea263
MD5 4a079241d85f27f920f7ca6a4933bcbc
SHA1 ad5dc63e96661409ae2c944e67a0634fa612d610
SHA512 2ed3c38da76b5bc0b81b7a1882d0a4d0f501150483a14679f3bbbf569f994decf96a6baaefd169b4cc97288a27c62f0d59b2bd0ab549b559be62b09efc79fa8a
SSDEEP 12288:cyPz5L8PFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:FzyP8NDFKYmKOF0zr31JwAlcR3QC0OXn
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 8358d65af6b5f3148c57f351833a69b636233ed550615c8293808d7f8e44eb37
MD5 86a657f0600e207f04a5982906019585
SHA1 b59f6d911d91181bcbed903dfdf7b21b4f478db0
SHA512 3ce3486c47f50da135d36a01206d3d778112ba128c0c6d31c79cc7e5101211e51f5d551280aa7272881b219ac448dabee9aa3f6c2c4ea96b0d24418ffbc06775
SSDEEP 24576:1THaLl3z0zDR8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:1T6Llj6gDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 bc0997b628cb5544b68213f932be54385aecb2b1f9a87810f6ea3a68ddfca4c1
MD5 db672bc7dbb96f88bfc02c667a99c14f
SHA1 726f0762c8025e29e39b23a5bedf0e7e91b38596
SHA512 20b50285c1ca8e0e4aa51741cd1af9135ae05ff2528b98aa663d7e363ba5da0536d2ababf11044caa58f7c44cef0970c1e378abbbc193c9a0f0c9276904fdf01
SSDEEP 24576:N37d9CHKy7GZ98NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:t7d9CHKyaHgDUYmvFur31yAipQCtXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 b86c6a3c05a4c5fc091ec78b9a5551fac3668dfabd4528fb788333f786b0706b
MD5 8c0e25759d0d270153a22a8878ba96c4
SHA1 8aeb2485dbf8b8e473aa5f5a17202913c82374bc
SHA512 6a799e25e9fdc3a5da43a1237f7946fd4c3a45a99eb92f9412a2a17303fe2ac3dbfee48275d2b4ee36d84ea3cca8c2d21e8df5da7518668765e3f64353c1339c
SSDEEP 12288:7BFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:7B8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 7e9f8e432892c22230eb51d2e4ea628e30989323ca9ab875801ba6848875b0b4
MD5 ba2b5a148f834b4cc7225c462cb13ac6
SHA1 55917ad936123b4e0134874a06ad5133f53fa585
SHA512 1766070b9c0b500f621a8a480719db778fec8e6497c7ddec2ce099019212f1f2ad19d3550c731bc0702ddb7a0cf7c557123666878360321147b0809efc607abd
SSDEEP 12288:ivFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:iv8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 78bf60816b9f5c650195a0c0c6dc807b7a66425cb81b20b07a0be7a6290fd16a
MD5 fb6e636f226be345756b3f6eedfa9240
SHA1 a423b12d0ac607bdf5ae6127313316ba0c32bf1e
SHA512 08da9be22befaeec8f54af463c97d4216a0900aacfc158f8e50fb1a7a00a8ce179d61cfcf417ffe6c56f56538d6e760c9ff3c98b1fc04203ef5a8b76bc49bc3c
SSDEEP 12288:0CFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:0C8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 6820eb02b918f44071d486bea354b6a265e601c3efac8c3faf97199668865a3b
MD5 438d357f19f340a79c15fe9606c248da
SHA1 e7d75290fea59548beed45a33c867e36b357b163
SHA512 499cdf58f645a4b3994c92ec5bf225d8004f6037498193fd62ab41328345993ce927191e49ec6d411a0c552355a9b2fe9a63d02de5c1898e352f23bd73cb32d1
SSDEEP 12288:AkFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:Ak8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 8c64badb0474b09fd92b32a9fb3cd83b6ee28a8a139112a157c5cf6f4797635c
MD5 0d7bd59ff9759f38fa85530707bddcbb
SHA1 35b818079448b9a8bdd4666f9c422fa52426592d
SHA512 0c02a6c86a91eb4d9a641d6d53f42ed12472d3ed2e8d95b6f4cb88c59348bdf7960df6270b3e7138869712bf7538b148d186ac163a6751ab6344ae3c22a9d838
SSDEEP 12288:2BFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:2B8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 91b965ab901a34c217a5939184abddae0d0d5e75a8ede03efa7701b9245be4aa
MD5 e01f701976dc5218ed60473a588dc125
SHA1 d9663a080e84328439a7dc605eeb6225cd91098f
SHA512 87db78f36ea2f5dc43f5937a85571bfce714db0f7a26a5062b81cffd82db944d453900632d3ce90a3711571986ff15358af7ae1c52c0269d5d62335db37795c5
SSDEEP 12288:qsFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:qs8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 696KB
SHA256 0a173500f7e5400ff7249e93c905fe97c5bcccda2d1cf5d8dc02146909ecbd38
MD5 653a206c9252f8936f3f434654428590
SHA1 f498b4e3d2e6755ffc313f6dec7f7e793d5ae639
SHA512 8592d644aaf863dcc5b78f26831cb399bd0485fe8c48fa725323cc63674d68dda35f3e66a2f5a78df481ede874545028fd4a9dfdb3a10bb8075c5d05f3c85099
SSDEEP 12288:DFYq0SnFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:DgSn8NDFKYmKOF0zr31JwAlcR3QC0OXn
MD5 SHA1 SHA512 SSDEEP

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 638d9271dd9b63645baa160861434a10388f2a2bb59926e3b88b6b5eb5501111
MD5 d10a219a43f487e8b0802afc49c34cc4
SHA1 55b66b8610361d6e128b67428fce3acfabb14ae7
SHA512 1b4136e81bf02a9e8b2951850509e683b71530f9d23f3c9a2fd94b0e3190fc60e704f0fdf54e67f38191b9ec8519d27715bc0edbf0fd68c2cd70f441fe962631
SSDEEP 12288:ssFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:ss8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 55570dbf357b64e50294c5575a1fc5e597dfe7edee2ffcc845423f008e292301
MD5 64c952b50b7d98250661d1664908fa7b
SHA1 c204f2553a9b4482b3bd2861ebec8004a55117c1
SHA512 1cd6595401393cea5beee3eb74062f0d63178737c99cbc0ca7ee8206fbca6d9b623458edfa2d98d8220372e9c5761311d734952ddf07608180d0d53312a964cb
SSDEEP 49152:ea0h2GEkuAe73q3pp46zwwQ2gDUYmvFur31yAipQCtXxc0H:ea0hNYG4JweU7dG1yfpVBlH
MD5 SHA1 SHA512 SSDEEP

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 659KB
SHA256 481c982ef72bb6c33cb1e18d06f1f171b40a5babfdd9f2322d0176eb9147d118
MD5 2e401fc7f19accefc805baeb602573a1
SHA1 7d63fae018444cace863145dea0cadad78532b26
SHA512 eec23865d991fd81264c8807d2aefd81dd36164b9894d83ec7892df5ed9c69e793b6b78469c6278adce167ba05e102b050a5d7191ecff57ca39b552d8442145e
SSDEEP 12288:QhbHjfXHFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:QhbHjPH8NDFKYmKOF0zr31JwAlcR3QCx
MD5 SHA1 SHA512 SSDEEP

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 a11ed65aeb5cd3627296be66d092f778028906f5a04582627f42d9d789eeb3c8
MD5 dd23c93dc3e662b92fd6933eb6fe5819
SHA1 1114fc3c6f0ca2004099189fbb702804ec14ea62
SHA512 62c7418d3f57fa6c8e14f3ce86e76f778b9fd07708336d9a71d8488ef342a476d8f268a66a4aea81bf8ab6d5fc28ceeb8cf549c2605b2ee4afb8b81c890db102
SSDEEP 24576:33YgnJcRTk4yti+R5dpR/v8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:3IgnaTk46ppR/vgDUYmvFur31yAipQCx
MD5 SHA1 SHA512 SSDEEP

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 578KB
SHA256 1dce7494d124525ea779f297206c86dffc9f3832254ea7c583b338304eeaef00
MD5 06b47a06582aca6bb67c8bc1b41bfa4a
SHA1 bf125fde905ce5cae04cec9f9229c285c0adcae9
SHA512 23221c49499797d346444b38d4bfcc1af18343962ff819db7c3283daf9eb4473478f7012598bdb85bedbc81e1fbc0155cd9fcb9a5fe8b6c2c062dd69d766d161
SSDEEP 12288:W4FCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:W48NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 940KB
SHA256 2f41754745f12c71fe90a14e6218e63049948ffd94137aaef07afc8d9d2dd982
MD5 9631d90ac3c83892654c53361d3ba442
SHA1 2062363db50f5feb176e04523168b214c8201033
SHA512 48ad8b1787d9a6f0b8681c1395ead7504a0fe285e195bed4789c85d264b445b9ade620a4ef9b55adfb477a3ce4f6ab9548c4e2a7239b8354855256587d1442b0
SSDEEP 24576:7pL3UTJ8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:7pL3UVgDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 671KB
SHA256 327c9360761bf7cb749788c1530072afc5cb581c12a680d6431fafda734b5165
MD5 0f13b728f1a4d0425c11de564fd41a3e
SHA1 1f4203010156a947b3638f8f97e73ed618fdb4c9
SHA512 4113188b7d729988ff341d98fde9d518b4d866be0660d800740bdc87fdd46ccecaf11f9ada54e2032796ab5e4b266a979c82ead2a7e93252316cba21da8113d8
SSDEEP 12288:hpFtpO1FCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:xO18NDFKYmKOF0zr31JwAlcR3QC0OXxx
MD5 SHA1 SHA512 SSDEEP

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 cd44b65682cb68812c38c33d130d0fab1b739cb6b54fea4d67b46f9c6a8aefbc
MD5 04efa6c70202928a455277472b976253
SHA1 3b336dedc1359909ec129659023a096352e5f1d9
SHA512 c79c0c07a79aa2b76af112c561f4a7279302a29aa6b5a4c021c4e0ba9c1fd9f69711d9c134a22b1f0188cc28cb8c300e6af6886af3ff22102f3f8a47fdc0bf89
SSDEEP 24576:o7NM9YmZqmWMUkPjZM48Mv6bEhsc8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:o7cBWMpPjN8DbEhngDUYmvFur31yAipZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 133ba6fed07c6712e90c22b3a3319cd9ea4dacaac0377a1bc42e2b486d038dea
MD5 fd5cdc2c14ddcd713e6c10eacc17ee8d
SHA1 aae503d4f391e8bfd6845d74050089f54b3c320f
SHA512 02fa8d3f4275389e1b9e5577fefa25bfba4e4f1f1ceadfc04f4a24394bb41b825f632a2d8dde41e5adf1fdf5cf94c568b0359105065d1effc781179fd1ffafaf
SSDEEP 49152:HF2YuHNETovcvNYf8km8gDUYmvFur31yAipQCtXxc0H:e6tCf8kEU7dG1yfpVBlH
MD5 SHA1 SHA512 SSDEEP

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 6d4cc42a4108aa1cb9303f1c845bc5a29fd9e05908530444553272eafc7439c1
MD5 ced8989c4e2a38ab8c8afb7d51a9b7da
SHA1 7c7ab3e8b1a3f83881dac7dc5fc7080ed9b5f60b
SHA512 c39e19fb4a3d41c5d13830f667f78bf85c28551b8ba4793bac817c6cd6fa47fb7b3ce1c179f4969b160705b98beee5d4d01898912217d811b07b726ffa9fbf4a
SSDEEP 24576:HAFs06+Omlf3NXEbToB8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:gFs060lVXuWgDUYmvFur31yAipQCtXxx
MD5 SHA1 SHA512 SSDEEP

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 885KB
SHA256 45745b3f820caa1e19d1243dfa6fffd9f37892ec514cfd2b4fd6d775bd56601a
MD5 1be74d1b24775de7f0b979096a39867b
SHA1 201cb1a90e5960fc195b2b9de589538df4f6a693
SHA512 8aa6cd91814a96a18f9c24cb6648ff7ee5baf272421a3d5d73d98ee4373e94e62b02a828bd375a751772e53087b61441c092208585da3449b2eb12036c0d8d81
SSDEEP 24576:DJnJ5D3WtW8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:DJnJ5DGtWgDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 69bd38db843799c758d0ca55c7377c44f3089812a52b93b0a29371e8dd07e302
MD5 0980b232b23da5efdd4fcadebedde6ea
SHA1 36b611c7687c926cfaf0854fc2afa3b6069704cf
SHA512 9cfe04be65045faee2d955af7da5ff506e190b75945557a51cc665213afad53b34d3e849db1904e09fbaca3b64f2562ad4a5d53c2496500028ca754e24e533ad
SSDEEP 49152:Vo06DIKdwc+eQnSt65aVQgDUYmvFur31yAipQCtXxc0H:C/U7dG1yfpVBlH
MD5 SHA1 SHA512 SSDEEP

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 661KB
SHA256 cd4ca3ee6d85202148cd4df74adc1bd91733a177418d28f559039cc43eb2cfb7
MD5 2524b2ee7b650214379d74fff3c0aa10
SHA1 89108554903eb10dba0486c7bbe0ee6127a9eb09
SHA512 a57e6195efc2eb619f952bc0fe4024b2e4de1c82c967dfad131f1e454895a03c232907dd31dcd506bc4be8997441de9d2734737183a1ce89f36c6991dce447b4
SSDEEP 12288:yEP3RrdFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:xrd8NDFKYmKOF0zr31JwAlcR3QC0OXxx
MD5 SHA1 SHA512 SSDEEP

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 712KB
SHA256 3b8d3dd67f265c2fab7d1495863c6fd5334cb3cc3a0a22d30809423a3e985150
MD5 823fc57a011a4a13e5453e7810d34d9d
SHA1 cbb1bfb1db1c401164487f30cab79510ae73b9ed
SHA512 0140be7fedc14c6d2bbe77ccdc577b36860d55c570cca122a357fb3db5d9c0193b784a688a9f711646595e190a6d32db9e7ae0b1b1e522b0e32e0a84cd292263
SSDEEP 12288:PjkyXFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:PIyX8NDFKYmKOF0zr31JwAlcR3QC0OXn
MD5 SHA1 SHA512 SSDEEP

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 584KB
SHA256 7a1f03bce0227da4e681e39580f8f6ae800022a03a1c247d75b4275b9a02ee0f
MD5 952f5ad7ed56b3b45f2972a55945c338
SHA1 385074e35069c252dbd6602181cd7299e8b8e22b
SHA512 a157adb1ecd1f08d8062b6607fefaf86506286d941f8263f9f09c2dfedcf4c20311ff01d8889dea7f88d9b847c081ba2bc53c5f6867fa3800c2d186a96ccdb7b
SSDEEP 12288:LFFFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:JF8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 ca58322cb9cc6adc1764df4023a67a30fa25e404251556aff439b162ef6c1384
MD5 2fbd8ea596ade647aef2c8efc70f9b09
SHA1 4e9dfb3d12433cb12b7517140b1072e119b02a44
SHA512 9f75214d9116a4450b40bb6ca4f57407d40f2ecc6c9704b91720ded8a7f0919f9a79033a974c9dcec7e070b7c17420f895a2749dd5d965883393003a7dfdc615
SSDEEP 24576:JQ9MxZKdcz97w3U8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:JVKXUgDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 772KB
SHA256 2166329face1dfe545ee61cd591583e6f672f422c999a7ba63952371f01ea4a0
MD5 532a0e68d28063605e32427c4f75fd1f
SHA1 a4a9b59328037399b28deb1939ba59491688b91d
SHA512 c5d78dad46fb00189e66370dd349e3250e57af47020237388704b96255456958ac61015222a7bb7102f3cd9c733a443fe249c5d8900c51bd1cf968eebf640145
SSDEEP 24576:SyocxApz8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:PocxApzgDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 b98afe2b24780f8ceb58679a5b2051655e33ebbc5f4ef754bf7ca59694e712aa
MD5 12ab3bedd73317befa999018aca3d173
SHA1 e308e332eb23d36fa86ddfb05e22e2adfcc3a455
SHA512 7f391da1f890deed3e79d9efe6cf49852523240d3d943d77a96c784f99dbf11ae544152b71f1b1a52fcc1c7f844009aaf5c61f0211fb84d73fc5f79491448be4
SSDEEP 49152:nWcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIKzgDUYmvFur31yAipQCtXxc0H:f0zuNIqU7dG1yfpVBlH
MD5 SHA1 SHA512 SSDEEP

Submit Download

office2016setup.exe

Path C:\odt\office2016setup.exe
Size 5.6MB
SHA256 ee47e241a45271b7e10f345d412db92176c9957217d22b9bb3643575f4388093
MD5 05a73d2e32c883d9425a0017f8cf70de
SHA1 28e095a24f24647382a50c5d3d56266e86c126f3
SHA512 a71b43938ccc89c2cd443878b3cb811a1d04962b60e952f1966705bbcb09ed7ebe21ea352a25b00c93acb1de3470c2d2e27784fc2d1d6c2e4352e115695543d2
SSDEEP 98304:h7M701RgX4iuSl1DtlEq81xZPGnzURnBh6gGL/QmvD/cTwY2h3FWU7dG1yfpVBlH:FM7pTXexZPGzURnBh6gGLF+W3AUoiPBx
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/420-408-0x0000000000BD0000-0x0000000000C30000-memory.dmp

Download

memory/420-407-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/420-402-0x0000000000BD0000-0x0000000000C30000-memory.dmp

Download

memory/420-394-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/1064-438-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/1064-445-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/1276-246-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/1276-247-0x0000000000580000-0x00000000005E0000-memory.dmp

Download

memory/1276-313-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/1276-253-0x0000000000580000-0x00000000005E0000-memory.dmp

Download

memory/1640-315-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/1640-323-0x0000000000540000-0x00000000005A0000-memory.dmp

Download

memory/1640-380-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/1868-282-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/1868-274-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/1868-340-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/2992-35-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/2992-29-0x0000000140000000-0x0000000140237000-memory.dmp

Download

memory/2992-237-0x0000000140000000-0x0000000140237000-memory.dmp

Download

memory/2992-28-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/3144-1-0x00000000020C0000-0x0000000002120000-memory.dmp

Download

memory/3144-0-0x0000000140000000-0x000000014010E000-memory.dmp

Download

memory/3144-7-0x00000000020C0000-0x0000000002120000-memory.dmp

Download

memory/3144-13-0x0000000140000000-0x000000014010E000-memory.dmp

Download

memory/3144-11-0x00000000020C0000-0x0000000002120000-memory.dmp

Download

memory/3148-382-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/3148-449-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/3148-389-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/3168-459-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3168-452-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/3372-423-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/3372-361-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/3372-353-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/3456-67-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/3456-241-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/3456-68-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/3456-74-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/3456-75-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/3672-327-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3672-393-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3672-335-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/3872-51-0x0000000001A70000-0x0000000001AD0000-memory.dmp

Download

memory/3872-52-0x0000000140000000-0x00000001400CA000-memory.dmp

Download

memory/3872-59-0x0000000001A70000-0x0000000001AD0000-memory.dmp

Download

memory/3872-62-0x0000000001A70000-0x0000000001AD0000-memory.dmp

Download

memory/3872-65-0x0000000140000000-0x00000001400CA000-memory.dmp

Download

memory/4024-40-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/4024-39-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/4024-47-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/4024-238-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/4056-463-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4056-471-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/4560-287-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/4560-352-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/4560-298-0x0000000000B30000-0x0000000000B90000-memory.dmp

Download

memory/4664-410-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/4664-348-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/4664-342-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/4744-266-0x0000000000EB0000-0x0000000000F10000-memory.dmp

Download

memory/4744-257-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4744-273-0x0000000000EB0000-0x0000000000F10000-memory.dmp

Download

memory/4744-258-0x0000000000EB0000-0x0000000000F10000-memory.dmp

Download

memory/4744-271-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4764-419-0x0000000000B70000-0x0000000000BD0000-memory.dmp

Download

memory/4764-411-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4936-308-0x0000000000680000-0x00000000006E7000-memory.dmp

Download

memory/4936-302-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/4936-366-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/4936-376-0x0000000000680000-0x00000000006E7000-memory.dmp

Download

memory/4968-432-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/4968-424-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/5016-16-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/5016-15-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/5016-23-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/5016-230-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/5112-369-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/5112-436-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/5112-377-0x0000000000510000-0x0000000000570000-memory.dmp

Download