01ba11e15624f60222802734e63c69629c45816e31e5e4311b8bbd90911ade25

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
04/04/2024, 11:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-04-04_87f37e108bda94ea21fd85d37622e13b_ryuk.exe
Size 1.7MB
Sample240404-naplvsdh44
SHA256 01ba11e15624f60222802734e63c69629c45816e31e5e4311b8bbd90911ade25
MD5 87f37e108bda94ea21fd85d37622e13b
SHA1 0e7da782a2eb863467a347e086267fb745551779
SHA512 df29a984366d09ecd42cb4eebabe08a6613c678ebcbd52a019911777a9176660a748e658b72082107a4ccf8abcd4b57f312e6105c917c3a74d58bc357d7a6a0e
SSDEEP 24576:UgtHU0FjpVPt7AeUVIGGUZhRxHh2WVG+XN4qLqEIH7sTrvIr:UgtHUujpj7AewZdZhRdhJRd5/IbsT0
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
5040	alg.exe
5004	elevation_service.exe
2684	elevation_service.exe
4100	maintenanceservice.exe
928	OSE.EXE
4648	DiagnosticsHub.StandardCollector.Service.exe
4772	fxssvc.exe
1804	msdtc.exe
4240	PerceptionSimulationService.exe
3684	perfhost.exe
2384	locator.exe
648	SensorDataService.exe
2388	snmptrap.exe
5116	spectrum.exe
3268	ssh-agent.exe
2728	TieringEngineService.exe
1628	AgentService.exe
3444	vds.exe
3956	vssvc.exe
1444	wbengine.exe
1748	WmiApSrv.exe
4276	SearchIndexer.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in System32 directory 24 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\adee4d9a12d07ad8.bin	alg.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2024-04-04_87f37e108bda94ea21fd85d37622e13b_ryuk.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	alg.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_91140\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_91140\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001807771f8186da01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006374811e8186da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9926 = "M3U file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000689b881e8186da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a21b6b1f8186da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006389751e8186da01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c6abd91e8186da01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000700edc1e8186da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9933 = "MPEG-4 Audio"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000792f5f1f8186da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003e71de1e8186da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
5004	elevation_service.exe
5004	elevation_service.exe
5004	elevation_service.exe
5004	elevation_service.exe
5004	elevation_service.exe
5004	elevation_service.exe
5004	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
668	Process not Found
668	Process not Found

Suspicious use of AdjustPrivilegeToken 42 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2396	2024-04-04_87f37e108bda94ea21fd85d37622e13b_ryuk.exe
Token: SeDebugPrivilege	5040	alg.exe
Token: SeDebugPrivilege	5040	alg.exe
Token: SeDebugPrivilege	5040	alg.exe
Token: SeTakeOwnershipPrivilege	5004	elevation_service.exe
Token: SeAuditPrivilege	4772	fxssvc.exe
Token: SeRestorePrivilege	2728	TieringEngineService.exe
Token: SeManageVolumePrivilege	2728	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	1628	AgentService.exe
Token: SeBackupPrivilege	3956	vssvc.exe
Token: SeRestorePrivilege	3956	vssvc.exe
Token: SeAuditPrivilege	3956	vssvc.exe
Token: SeBackupPrivilege	1444	wbengine.exe
Token: SeRestorePrivilege	1444	wbengine.exe
Token: SeSecurityPrivilege	1444	wbengine.exe
Token: 33	4276	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4276	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4276	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4276	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4276	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4276	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4276	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4276	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4276	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4276	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4276	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4276	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4276	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4276	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4276	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4276	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4276	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4276	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4276	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4276	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4276	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4276	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4276	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4276	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4276	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4276	SearchIndexer.exe
Token: SeDebugPrivilege	5004	elevation_service.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4276 wrote to memory of 4724	4276	SearchIndexer.exe	120
PID 4276 wrote to memory of 4724	4276	SearchIndexer.exe	120
PID 4276 wrote to memory of 2416	4276	SearchIndexer.exe	121
PID 4276 wrote to memory of 2416	4276	SearchIndexer.exe	121

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2024-04-04_87f37e108bda94ea21fd85d37622e13b_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-04_87f37e108bda94ea21fd85d37622e13b_ryuk.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:2396

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:5040

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5004

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2684

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4100

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:928

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:4648

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:3896

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4772

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:1804

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4240

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:3684

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:2384

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:648

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:2388

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:5116

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3268

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:1392

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2728

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1628

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:3444

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3956

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1444

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:1748

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4276
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4724
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 916 920 928 8192 924 896
  2⤵
  - Modifies data under HKEY_USERS
  PID:2416

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
Size 2.1MB
SHA256 d1cb504eadfa7abf9d96d1d720d5085d1e635c276955f0d7d5d49015da593494
MD5 f73f4d913294860019ea185831b8c4e9
SHA1 e1eded4d4bca013ff16b76f871b8aff66840de22
SHA512 9b0a08eeefe6f37d59281847cd79639261743ef249963054317651d0ac9b9b8ced6f8fa687e9c29cee1aae4935974bf161f09a0d76685aa04cfa7f7fa5da816b
SSDEEP 49152:NuYk3H5koUXfTqkkYLO/W2buywzMbOX+T7z5od5/IbsT0:NPfTqi90bc0bs
MD5 SHA1 SHA512 SSDEEP

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 503aae79683669bf45cef8ace97bd716245b95019ac6760d16cc68e651369956
MD5 cb8c8f8894167497adc9adae40ff6941
SHA1 241f80f899637b61489d7a26e6e123ab5bf92d0f
SHA512 ff4347bb6546a990dc710e053ab6077b17a702e52cf486424c8c2495383031e35b5853b34fc9b80d388f7da96b120eb3a1f7fa8ff83b04a24afc60a8600f4efd
SSDEEP 12288:sCiP9Q/JcuiCcZRXPiqwIkFPqQKj8DkBIHCP2sEMLRv1vIVq+:GPsJcuipXN4qLqEIH7sTrvIr
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 dd86afd22a6d5cce66f8f4b07403a179e499f0f5be28c3996562cd978023008b
MD5 7b7c877b33d1d29ab81a6549561547ec
SHA1 259a4804c34cd02249b72623a42311141ba6a511
SHA512 457c1a74121232f28d1c74737a0df902f966cbd36c31aa4d865fb086f2e6db5a263eda2025acad3d07883a52d30ad2b576cd19164e3282e29661cd634859da31
SSDEEP 12288:O7a3iwbihym2g7XO3LWURfh4Co2cZRXPiqwIkFPqQKj8DkBIHCP2sEMLRv1vIVq+:v+gkEjfh4ColXN4qLqEIH7sTrvIr
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 632314fa9ebb6183fa35fda2c52d6e0aec49c88ddc2d29610c41909c234d6bf6
MD5 0f131434e21c199cbfdd06b16291c288
SHA1 485b9ee78efd730221584f55c4ee1e9c8503739a
SHA512 30d5511754cddbad568bb5059c4b03c8d83c1084e9907709d856baf5423390deddc4040ae234efb784ac3a19fcdbf6f8e50d0f989e714cc67ea96ceedb418421
SSDEEP 24576:MBpDRmi78gkPXlyo0Gxjr0XN4qLqEIH7sTrvIr:YNRmi78gkPX4o0GxjId5/IbsT0
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 17e25979454177a5b29a4456627f09da7063b3eb2c5d0fc6d2f7cfc27436fc13
MD5 fb36581a73bd759b3ee57065edf7eb4f
SHA1 e1dfe655e0423b96b165ca52c3f6ce6518a0b7c8
SHA512 09342ce658fed26aaefc5e32822a163c75a1a429efe729635f4fdc91142683a262fe0dcfcab3904937093f64ea69a10c5484e1ccab09be9b8f7014b8683ef01d
SSDEEP 12288:NfC6Aj+TN5uixZN+8rKhUdTC/wE1MD0Ca5ZIXV2cZRXPiqwIkFPqQKj8DkBIHCPQ:FLOS2oyPIXVlXN4qLqEIH7sTrvIr
MD5 SHA1 SHA512 SSDEEP

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 a6be427992de18ad433ace856d6c557dae6476735466e64d430ddfb578ba5ad9
MD5 c23800fd90498384de1ef246fdb6cab8
SHA1 dd27f635b47f71720a2f4e90f209015482f88175
SHA512 871ac230a15d53fc3b997898589c3e0b67aa8aaf1add3d64b7bce03807edc1ab67720ad5d2e5b3614e8c2b4848e0ab51353b3312a2ce9bf53a4796831f8c662a
SSDEEP 12288:2xwcZRXPiqwIkFPqQKj8DkBIHCP2sEMLRv1vIVq+:2xzXN4qLqEIH7sTrvIr
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 8e1aee56f05096106784aba9f5ec620010051857be4bae84774304d99f8b3910
MD5 2a3827879133fd99502bc172b3c9d089
SHA1 eab08810db52e8c130b27af54bf5555903446ef5
SHA512 ae9b401f438e068c11255b61ec87f6c4207beee4c5b15ca6c57d67931f0dc515e0cbf6e0365c5a8e5e722d7ce169a9fa0e8c4a05e45290b667131b890ff8be7e
SSDEEP 12288:HeBNUbTVO86UjcZRXPiqwIkFPqQKj8DkBIHCP2sEMLRv1vIVq+:HJIU6XN4qLqEIH7sTrvIr
MD5 SHA1 SHA512 SSDEEP

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 03fdb0d21e6e43dc197b3394aed007ced9c8924748511eea39946f3f89e7a121
MD5 c7813b6582c7784581089e3cdb75d9a5
SHA1 573f6af88ab6b6f451198bedb8918a2d33a104f4
SHA512 782d701622f958469054783eccb733997446118db93e97bcf06d4c02cb6c2526bab3f89f879213e77ed13fd55de99af32eea819bf777fcf5308dd7b451fd4b66
SSDEEP 49152:2QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THH:2QvGAdlCEL8c/yRNw5Ch0bs
MD5 SHA1 SHA512 SSDEEP

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 616f4ea1c4a5aa72b61717eea96b14e0c055017ffe279f42a1344d9adb80ef93
MD5 70f82db21bfeaf517023ce4421656862
SHA1 0fe44e6e420ec9d36d3fe2a6cc7e8a78a1a10172
SHA512 0e94e7ba200a9f0a25095dfa52c492331541b3bb4f041299b773ff635bec3eaf063b060e1212661da80470980617cb518f3ceffaade9fa0fc9b33873801b5ba8
SSDEEP 12288:uAwSfxL/2Dc3ODLLmt0LDQewsAj5cZRXPiqwIkFPqQKj8DkBIHCP2sEMLRv1vIVZ:THewsAjcXN4qLqEIH7sTrvIr
MD5 SHA1 SHA512 SSDEEP

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 eb48bb1aaa0e83a84e98838b954a3831f34056beefac02b1cd50be5ce971c428
MD5 5b219f57d8a83bea86656e083fcfc299
SHA1 e6e78972e7a8d5a48a84d47e707c1cb123764750
SHA512 a6d42da65ef9c93ddb485585cb9c69cee9302a7687887607155abaed54870863307afe8803d3f3a5d8c19239a9269ff2a592bf8247da36f8c789402690344a78
SSDEEP 196608:LUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHk:LUEtQevvqc2W1cpV2EI32k
MD5 SHA1 SHA512 SSDEEP

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 9e47efabfef13b09678e1ce7e8ff43813735ee602e4e5c82bd948dad84e0f491
MD5 64129f21038f4c8962162ba84b49f9c0
SHA1 5ae82d386d07ff4d959992f0d29d0ccb9fdbb8b8
SHA512 7ac7c5ed551b3bfc099d0aa463d1fe4dbf8aea5257d1c074d8c6cb64732a16226844160178b9c1a9e5e6bd50d3aeea02e70e1b9c1bac1e08dd681fbb8dba9047
SSDEEP 49152:NCbRquA/m2yL5zTfFiV+XenmE3/z8d5/IbsT0:qoquVjnm10bs
MD5 SHA1 SHA512 SSDEEP

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 dcb28a5d52e39a2f7f9bfe6d79a92128a6ec8da6eaa1caa2e3e629687271ec4d
MD5 9c4561f33e217166f055b3e4e0b12b4d
SHA1 36fd4cc45b55ae0683b0583cb1f034858e0ab215
SHA512 3bcc66297ac32532400385017306d7d9a16fd017a0c6d1ddcbd7d6945638924e7c01f140aaef17f4f079edd3829870a1e423bbb41b98b08902236f65db9d97c4
SSDEEP 24576:OAhGLJIFoiwtA5l7S53VXN4qLqEIH7sTrvIr:OAMyFoiq5Fd5/IbsT0
MD5 SHA1 SHA512 SSDEEP

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 846336466c6677aef751f016c256c658bbf96a377efd5ec638fc6a27a0a6091b
MD5 a3d5610b5e0e75b9fb88df648da814c4
SHA1 cfaddcd432064d77e07bacbe7ebcdeabc6a234e1
SHA512 a7722e053a8c8d35af91b6d7ead8b1ca1ff410ca9c84326fa9c1ac8243f5b4b6ec54678ade8615b5a7c0e464770124f58630ba57895aa133cf765113c4d1a0a2
SSDEEP 12288:Emw5HEjsChNnBFgl0WDm+CacZRXPiqwIkFPqQKj8DkBIHCP2sEMLRv1vIVq+:hwu+OWQXN4qLqEIH7sTrvIr
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 f66a1a2cef65c8044d47396a5157772845703886b442a126b5977c4169b87343
MD5 017b51aad01e0bc3f3b2921e93408bed
SHA1 730816947c47437d637f7a9b2c2c798b13a2e426
SHA512 3c91448084b745b6d9159a2d1705da6f07aac0df9740fce1bd9cd6d0f7e91a131528ea35e9c5b8a932f5f9fda47b695170cb4b0b5f4a11c0ea289e4390b10590
SSDEEP 12288:/3Z1IypcZRXPiqwIkFPqQKj8DkBIHCP2sEMLRv1vIVq+:PZuvXN4qLqEIH7sTrvIr
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe
Size 4.8MB
SHA256 8254e76596f496f98f653a89adafe966f8377c8ad2eb3af29e390604193da742
MD5 7cfca8769717355b9f4189238f117f0a
SHA1 71d1ad8ba7246323694d92440ad24c15053fcc88
SHA512 9f033040af834af9dfe76aa246f2391a34c924a7a3634f0ad2a719959d2204bb48e2f16f2266df7a485a29f98b490dbadffdd934bb4e04b09185c6c308faa247
SSDEEP 49152:yj8f3jtqiCLg9LK2hIOR+k9jdAsizqxSiZ4K5MZqkL92c6nkdmbDfiIerM1R6ZP2:NrZ4K5M+XDfiIewG+x6xZ14C0bs
MD5 SHA1 SHA512 SSDEEP

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe
Size 4.8MB
SHA256 9c53d6eeec9817f094fd65a917cc1b2f9eab3d66795d6ceaef491cd30d31ded8
MD5 b2297462a693c6e6df2e84d3bb737fc1
SHA1 93c1b6ab2c7c20904920bd2530ee10daa5df3214
SHA512 e8211c538b40441c6d99a8358a35b34c1e273e89a5ef9938d7997b6a0d7546be4895549159c094893e95050733554b8cea2393c287997a0a935769fb84a9cb12
SSDEEP 49152:9j8f3jtqiCLg9LK2hIOR+k9jdAsizqxSiZ4K5MZqkL92c6nkdmbDfiIerM1R6ZP2:mrZ4K5M+XDfiIewG+x6xZ14C0bs
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe
Size 2.2MB
SHA256 30d4b6e5c338c0139338dca510ca27892997c0cf52468bcfa92cd68d682d6d54
MD5 ac515539eafc533f6903cd259c5b6b97
SHA1 96b556d1dbf405ea3404c1283a463c731e13d6c1
SHA512 13dfbeb8361ebeed25d0d8397e01bd793f011c26130900ac1e927f26c741ae570fc3d71d27d389b562ae12995514e683ec3ab943ace1b78d1f8a9f176df4055e
SSDEEP 49152:1fzabJ8llj+SWWi2mkx+X+diVd5/IbsT0:Oui2O0bs
MD5 SHA1 SHA512 SSDEEP

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
Size 2.1MB
SHA256 fdbebc3de873abeab4da5eb0bd9b2ca0958132fc5cb8714cb78388fc4760cada
MD5 1d8b7508279c65ec1fb04612f912b117
SHA1 22fe3ce9c994d36aa718303ad97a27f755db82da
SHA512 c7b66cc4c6be3103ae0c53d1c82bb187f295f9160f191d0a8792efaa684dc2a8ff99cca679b210bf5bca1e952249e9d81c336353712f61a1cbe527e7f8f0b8f3
SSDEEP 49152:ya/3xXBSZ4K5MJ1LvTMxbfsYBYSgxu9+fw4Tid5/IbsT0:cZ4K5MJabfsYN50bs
MD5 SHA1 SHA512 SSDEEP

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe
Size 1.8MB
SHA256 35718bd9eeda64ab82b336a0ba5164406d81cf949965ecdd90dfdbba081c7de7
MD5 7462311f6c595f02bd563f92f5110450
SHA1 49c43d4aec1f7a46a43534d1b0aab8ef0ccea08d
SHA512 1b386c38a89717dc2461f66ee9df9ebf765734b620915fc09f4fac264684075447e129b5d085dacd13d764c29cb7a8245ab36eaab1ee20003e375f911bad8c0a
SSDEEP 24576:+gNJw85yUKzDu/9gKPlfLO8C49BgK+XN4qLqEIH7sTrvIr:+gNJtUzDu/9gKPxHC4Ad5/IbsT0
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 1.5MB
SHA256 92b528abbad303fe2e3877ac665f188542179340dd8178a040ab008624f486b0
MD5 976ea69a9ae4c9bd0eeed5ad20248775
SHA1 a89b7551c03ad9be03b5e6b402e5bf15ce212586
SHA512 e79b3877639caa090c50cc6b2fa98f5e3e7b3fc6ca3213b1d8250fbf3f282422fd95177b459a637a9a1c4aafd3ceaa832393e649cabd144d69ef98625fca4e8a
SSDEEP 49152:QOBynH1wM+v6UJxLQd7BHjdfKd5/IbsT0:0n4LQd7LC0bs
MD5 SHA1 SHA512 SSDEEP

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 7a9b9978381eea496da0a4645240bcf2e85541c4c72613a4c72ea00054e7b437
MD5 80b4ec5599fc757846fcd23a1ccd5ff9
SHA1 3ff326cafef16559318eb20d5264551c7b11b877
SHA512 3accc1c76b9b51282ef1028a4d04386b195bcea4bc46de56557afe0b15fdc013c9ee302e9df4a706cc44a9d8982d1cd35ff52b96df5dd716cf894df0b0c92ca1
SSDEEP 12288:n4cZRXPiqwIkFPqQKj8DkBIHCP2sEMLRv1vIVq+:nLXN4qLqEIH7sTrvIr
MD5 SHA1 SHA512 SSDEEP

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 6b5bd5357da2d8831623197eb34f901e0b74ab6e429e74d226dc6722dfd910ad
MD5 c02e5d805a11d05b8c2b7935eabfc6f8
SHA1 414e11b0a3784b7d89dd8faecf43f58948a2d4c6
SHA512 576218e9a667c1925e4ae577d45318f10b9fb758ac7028f17c9c416e38d1581efe4a792ec24a53f6a0d139f15fa0c8b2d43961f3765aeefdc06ad7a9af02e16a
SSDEEP 12288:VNcZRXPiqwIkFPqQKj8DkBIHCP2sEMLRv1vIVq+:V4XN4qLqEIH7sTrvIr
MD5 SHA1 SHA512 SSDEEP

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 3cf6a4c380df5f238edb598157c786142350b746ee1fab74fd39b5457f671cc2
MD5 0dec9d2a040807d501f5ffd5dd906b8d
SHA1 cecdeaba9c296465a01e4234b3375276c3e15253
SHA512 d833b9daf0778d0d51139f523c1909fd85e5ca89235a3a225037a60775772eb7578179eb0d5f18b8bf3fa80352665955d44618dff175d08f84bf69a797094776
SSDEEP 12288:KLcZRXPiqwIkFPqQKj8DkBIHCP2sEMLRv1vIVq+:KyXN4qLqEIH7sTrvIr
MD5 SHA1 SHA512 SSDEEP

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 7192bf463c7d3ed059dba93eb03d2f6921be078354e54bd0bca450173eddec4d
MD5 9e17df53bd3f099bca4d70548ce86d81
SHA1 03f23b404e5cb657b205a9df3a63e1ba12d91b81
SHA512 e816660305dc5c2e9565664476221d87c96fa0c8eea5c9fa564113706d7e16edf779bd6b3d3081adca34d7a6ffae974397274ab77fc51acae4f8a211632d4235
SSDEEP 12288:fVmcZRXPiqwIkFPqQKj8DkBIHCP2sEMLRv1vIVq+:zXN4qLqEIH7sTrvIr
MD5 SHA1 SHA512 SSDEEP

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 e205127ec880189a4e8483cac87ca991c7b24f0e5d8dadee631942ccdfe9866d
MD5 960b260bb4cb8dbc66e39c983781c177
SHA1 4cd8eeca0df597b57c92fd7f3e82e4224e90c275
SHA512 523576bcd5260aa4f4fc1a1d0b3c896d734df849d9d344cf0e7110622a36a73cf30db9bc2af50862289568bb90d293e97008b6c38b6e7277681d96816f4c20ac
SSDEEP 12288:vecZRXPiqwIkFPqQKj8DkBIHCP2sEMLRv1vIVq+:vdXN4qLqEIH7sTrvIr
MD5 SHA1 SHA512 SSDEEP

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 6d34b63360aaa3c430ad85c53fd165f39ceb45e8c9eea7317dd4e6f348d43706
MD5 3c7f6105b73d675dbea7110e9452c77e
SHA1 ea1dc83e0127d4cd3d6294fe2e963839f0279e4b
SHA512 025a55672141e2a3068650fb773057e1b6bc62103405d821ca21188673876f25751d9e155f2d104f8fc8734831481d6921b3b928e9b64c526b4f91e039c75b85
SSDEEP 12288:CBcZRXPiqwIkFPqQKj8DkBIHCP2sEMLRv1vIVq+:C0XN4qLqEIH7sTrvIr
MD5 SHA1 SHA512 SSDEEP

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 a8b1ffa1a648279054367991b508196bb49fd863e2531b78906bd69d3452f6f2
MD5 ef2b560e59ddd605acda215bd12877c0
SHA1 28cacd6961f017f3d96d872690f1ba7dbede0682
SHA512 307137e42dbc532bd7eb485a877b8655ccbcab299cfb99024d9c7f689348b0ea552f41e33bb71672af2461c626d2ac390a12b962d386cd38cd67bada908a2c40
SSDEEP 12288:blcZRXPiqwIkFPqQKj8DkBIHCP2sEMLRv1vIVq+:bAXN4qLqEIH7sTrvIr
MD5 SHA1 SHA512 SSDEEP

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 24241127a1fb0ca850cd008cd60afade3cc4f1342df5fe327773f4e2c12d18b0
MD5 e62dfc1a09e71faa9fe63a1285ee7f36
SHA1 62931788f6987781c1cfc3934d3faa4adb5ef466
SHA512 c679d6edfa431562ad016338e1a14206c57078cd08e0b1f30bf0920695d26c7ef715458905b5945f711688a01e5be02272215961baca4686ed725e2d6607ce0e
SSDEEP 12288:BiZwbwzzFEoS2cPvytcZRXPiqwIkFPqQKj8DkBIHCP2sEMLRv1vIVq+:EZMYzFVSOYXN4qLqEIH7sTrvIr
MD5 SHA1 SHA512 SSDEEP

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 8c4a77e074a191487d4f2f2a6e607633334baa354ebefd829fd0ef319b900578
MD5 f7dbdffb5aa4aae4ece8605b7c7f51c3
SHA1 738b6097c7eb62088275f277141523b30d76d3e1
SHA512 5bb78ecc3aae3ae655d6df9a47867db1aad7886582b8142755e66d296e74f821fe83b7acc032456052d97b5c9010db5ada778c071ae08b2050069c271bd80e42
SSDEEP 12288:BUcZRXPiqwIkFPqQKj8DkBIHCP2sEMLRv1vIVq+:B/XN4qLqEIH7sTrvIr
MD5 SHA1 SHA512 SSDEEP

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 5bcb57b3683e2a79166f2bb22c59a603629ef4ce9f14a7f8b6946e09d1943203
MD5 295675f4b435d940a645301f3e4d3fc9
SHA1 91b781db65e8a016aaadde3399d1efac47491bcb
SHA512 886a0a35cc6e64f4ad384800ec4216954a04d22c9c7e6f13f00e392ec832364fdc75f586466f1ab8692efcfff2c0d4defb365caee447d234f66cdcbbb8d14517
SSDEEP 12288:FgcZRXPiqwIkFPqQKj8DkBIHCP2sEMLRv1vIVq+:FDXN4qLqEIH7sTrvIr
MD5 SHA1 SHA512 SSDEEP

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 1f72e9d04810f82a5651fd695587fd80d8015c196406257a1936d20e0b5bd399
MD5 fd56004717d91794ba3224e2fc1b0d68
SHA1 86a5f12dd3730162524d41925741fbe5df225cc6
SHA512 adf4875f351bd82ba90d295606f7e4cfc2b87e0063eb93526c76f423529bb806a9c994ca399ead4d70197936a315f27b640fee20b5d460797d85188633c28e76
SSDEEP 12288:DyPz5L8pcZRXPiqwIkFPqQKj8DkBIHCP2sEMLRv1vIVq+:uzysXN4qLqEIH7sTrvIr
MD5 SHA1 SHA512 SSDEEP

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 c2640cd2a84a1cb1aec4cde510b66bd40a4337b911f65890e44f5e11474057b7
MD5 7a6490cd694d8413c359b84fa9c80acf
SHA1 daf8ff3aa21c7ee7af4f86b529dac634894d4d5c
SHA512 b4145d6b2dfb1e4bd55cefb4bfc238e6e5c4342569b54694144646dfd6a087ae4f13f65b80c2a8eff9a35c06cd25d8ecdd1e67da3f563af36d3bf1abd032bf76
SSDEEP 12288:7UcZRXPiqwIkFPqQKj8DkBIHCP2sEMLRv1vIVq+:7/XN4qLqEIH7sTrvIr
MD5 SHA1 SHA512 SSDEEP

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 48f3397d7f0de3ddda177b9fa95294237b3a85f5ea9694c7172c19e41ea0e679
MD5 12e92bc1568629edb457bfa8f73fdda4
SHA1 e52259d208bb327e35347ad714bca16b8f6e7ab9
SHA512 f96be832cfd676b5ea1b3424d0221619788fdeecbe8445ab67009b58dc4af1f061af5f1d5cb75cbf5961a3347f3d3930501d0822e3aaf266925f481d0e5ebc49
SSDEEP 12288:UUcZRXPiqwIkFPqQKj8DkBIHCP2sEMLRv1vIVq+:U/XN4qLqEIH7sTrvIr
MD5 SHA1 SHA512 SSDEEP

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 3284c918afafc2720ecc8eef4b62181a996a511a487e4da62b2192aba274aeca
MD5 a2e95705efc1c7281b40694fb2a9c61e
SHA1 c9c02e472c16aecb667663d1ccc43bec94d35a90
SHA512 c37b6b2cc53e1b0333a6ddb99db5cc2d1b342daaada65f6e7b2bd5ca65ed6a471e66bc2947c3167700eee81de4f77aba37ea431498df82bbcea1e088bbd2e057
SSDEEP 12288:hyPz5L8pcZRXPiqwIkFPqQKj8DkBIHCP2sEMLRv1vIVq+:wzysXN4qLqEIH7sTrvIr
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 f9f705cd2bce691f1a1be68c8887c34d4c34f92540b77604667f731f6f507dd8
MD5 979bec8dc91a4cfe65269c0bd95f2756
SHA1 bb88f4f4b6d41886e84b247332eafe8b21dfb5f8
SHA512 afa5ac888d2b3bbab0e22977d87b956a24a2b7d4a38bb06e44188a72dfd6270c6ec832cb83e53a4983279d8de46d26ea92b4e0547b941945c67fc31245403e77
SSDEEP 12288:DCd9QWYoaLHF3z0z04PDvhbcZRXPiqwIkFPqQKj8DkBIHCP2sEMLRv1vIVq+:uTJaLl3z0zDiXN4qLqEIH7sTrvIr
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 a22f53280fce43487586615f6610a70a148943340cba28a12f9b8fde2777cb66
MD5 91d1d0e67fd59b22f15a65cfa7a1a8ad
SHA1 2d6e975b3d647badf662802e9a7b9c1749c6057b
SHA512 52165d7853010ce312af9035e6d428549fb0503807d8afe568915f580f6949c60d0081331c67e7a1bf665eaa907a09fcd7872aad99bfb5537cb5b9776a761da2
SSDEEP 12288:wi4e7MRdTfgwCHKy7GLbbdIvycZRXPiqwIkFPqQKj8DkBIHCP2sEMLRv1vIVq+:w3Vd9CHKy7GZ+XN4qLqEIH7sTrvIr
MD5 SHA1 SHA512 SSDEEP

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 12143276cf428c5cdcc43d3c75fad63573cbf81aff874530eb8a0869a1c7566a
MD5 576fcf43de78535832bf307686bbb06a
SHA1 3d48e5ad60521db28e359de2418076fca60b4656
SHA512 ad707c98c4db20f48dfaff58f85793a6b644099c8a00ad0fdbcde3a19269e043fd1e1f332351fd271d512bc8674f809458f40709c0eda43364c1caf431fe5394
SSDEEP 12288:yrcZRXPiqwIkFPqQKj8DkBIHCP2sEMLRv1vIVq+:ySXN4qLqEIH7sTrvIr
MD5 SHA1 SHA512 SSDEEP

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 953c7fbeb4cd94b864db7b190db4d8854689385163425df4387cdf6ad9ce5221
MD5 eb771041e9e8151bb2fb94864f8952d7
SHA1 7ca0404b5f1d1a97eefe7a9171ea804997ba6535
SHA512 a93caa96a6e1c2f236dfa90c7eb701ff7e5ef359dd499424a3904132999727160a1a373af0cf2ed9bae9e59d59666bd5f22b0304b6d369be60a5e984f5799231
SSDEEP 12288:LJcZRXPiqwIkFPqQKj8DkBIHCP2sEMLRv1vIVq+:LMXN4qLqEIH7sTrvIr
MD5 SHA1 SHA512 SSDEEP

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 3a716fd50f275c46b789ea14852467b8db32658c5ca7d7f9dfd649127d355048
MD5 421e9793aef4ab1e566242fc320ca024
SHA1 0a173fa49740fe638864b5d899c607d66e268593
SHA512 f6f62fc9966f258ed42399c57d1603bad4cda7bcb2f2496a46db299215eecd2680297134e33c82f90b34bd9ac40c8d4a70226f151c354ce1f55923700dc8304b
SSDEEP 12288:3ycZRXPiqwIkFPqQKj8DkBIHCP2sEMLRv1vIVq+:35XN4qLqEIH7sTrvIr
MD5 SHA1 SHA512 SSDEEP

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 6c33f652ce861ad91623ff2bbb65dd99627a11988655849eaf72ef6becedfac4
MD5 b230c13c3583a946882b7fe6a044d1dc
SHA1 c780fca3185aa01f6c235efd8cde977da14d5fa2
SHA512 a7433e77fd877f511691b8940a6c575883c1cd33987ad9e657fc84cc0771bfe365ead09991bf4916f44b401dedcbd8db12377a72ca0a0da344047ad98e9022f8
SSDEEP 12288:ZUcZRXPiqwIkFPqQKj8DkBIHCP2sEMLRv1vIVq+:Z/XN4qLqEIH7sTrvIr
MD5 SHA1 SHA512 SSDEEP

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 0d93cdf99441d9cfd2c8c7794793a575b6892f854eb1d631ecc5141f93c43a3d
MD5 a66f53285d0cae5d88c5c5c9c9db2a43
SHA1 11816e7e5df9c9ea0955389bd9efe709ae704f5e
SHA512 6b1b2a8e1d92f38a88ec1c8726b15089564199316c209a5e677c5d969a9ba394d4b8e32912a4106b38743fdef640e02bfc596da336c82bc831805f8d289d3273
SSDEEP 12288:ArcZRXPiqwIkFPqQKj8DkBIHCP2sEMLRv1vIVq+:ASXN4qLqEIH7sTrvIr
MD5 SHA1 SHA512 SSDEEP

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 0f70a777a236736964c885040cb877d4cb530d71976b8a2b2eab1f28d7782cf0
MD5 a1091f3f1ae1bf3a468c9e2f985ce902
SHA1 9b8ca3416cb9871c3b65cdd9541d7d370388a909
SHA512 ad5164443b40a6c0b65d020284e17d12787545727e6f179b912c866fef07a02b22b23654bdfe3ad80f3b761291f46bcbb70ca3c63faeb474b56f8b5c01ca6a8b
SSDEEP 12288:lMcZRXPiqwIkFPqQKj8DkBIHCP2sEMLRv1vIVq+:lHXN4qLqEIH7sTrvIr
MD5 SHA1 SHA512 SSDEEP

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 695914c59d79e1584c4c49db7f2c178a9d2e6c618918272de7ac5b2d9d9f1f53
MD5 cc564874d3b3913a261267b5b2ff8f67
SHA1 3215e327a0be7a660fcd62fd21d4b61d3fc66f46
SHA512 007d5b6d052bba6b849275d72a0f5b8b472bed04bc371e1afc81b1c3dd0819699166f276b68f9fa75a30b1d2ce206e9b57d4dee66a9728ebe3288d4de91e860e
SSDEEP 12288:QFiq0SRcZRXPiqwIkFPqQKj8DkBIHCP2sEMLRv1vIVq+:QaSkXN4qLqEIH7sTrvIr
MD5 SHA1 SHA512 SSDEEP

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 1a8dc01e41c0b985fb98bda8977d28194baff5be772f69bdfbaad702a14942cc
MD5 bf4c6065b0e78f011de1850e6e52c1e6
SHA1 a29adbd6eb9c5f0146e06f322f6b4488536a9cc7
SHA512 01b4a3728f7a4aa9cb1829eff095c6cd060c4e590cca663b88ca139ec95e49efbe937283d47a8e1e78f55e62c79df9be9833f885b7bec15c7a3dbcc501a147c5
SSDEEP 12288:ttcZRXPiqwIkFPqQKj8DkBIHCP2sEMLRv1vIVq+:tYXN4qLqEIH7sTrvIr
MD5 SHA1 SHA512 SSDEEP

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 5cd2e1a189142bbcec17a4874f910e5acc7c849dbbcc0aa45cb074a8771c8dba
MD5 605d16f486a573d91a44dee6495dc253
SHA1 683c63e74385d42c3414386d98d0e9dde4bec07e
SHA512 31cfce9e6b27e66bba6b4eb5a6d155b4b3287ed77062c3268b07e7fb41b6e0d9b25b783b20908dc900cc63454a87540384cd642539b8a0dcff429590395cbc6f
SSDEEP 49152:ja0h2GEkuAe73q3pp46zwwQ6d5/IbsT0:ja0hNYG4Jwz0bs
MD5 SHA1 SHA512 SSDEEP

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 8098d7364119c6a1f7ec77053b52ca05075d50477feb22fc91aed08b21e05a15
MD5 18c428024b5a0751f6a455050e712e55
SHA1 3766ef7c879d03581474eb91be1814f812715d18
SHA512 a89034cf90a5c1bebd7b469ebd7c819d77e56956471b8880d6d04c253accb3b1369e0eedac9daa9aa527960e8eccf5c210954a69412fd78d1c536ba3e88fd9d1
SSDEEP 12288:ZhbHjfX8cZRXPiqwIkFPqQKj8DkBIHCP2sEMLRv1vIVq+:ZhbHjPXXN4qLqEIH7sTrvIr
MD5 SHA1 SHA512 SSDEEP

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 2dcdb1a0d10e90458682fe265ab2e8a4b2542e6138015111093e6c5a4a446132
MD5 32a23aae2ac05930c0b70d17fd909c1b
SHA1 73a0a8864480386b9d18dd9fd301aa9fdd7ce122
SHA512 59cb5cea9136a70242a79fe9c4bc6904cb3ee9147476e74a213118ad7137b3a82b0df5e8f1edafcf461b42f2982651773ac4ffa10253de97cf3694f6323c65cf
SSDEEP 24576:S3YgnJcRTk4yti+R5dpR/vXN4qLqEIH7sTrvIr:SIgnaTk46ppR/vd5/IbsT0
MD5 SHA1 SHA512 SSDEEP

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 208305325a73ff3c8a43fe54d572148684676e9b638d1c6a9575f6b8f5ff7f9d
MD5 9b26f1d078a7d0bd28ea06e7458e3f70
SHA1 4bb2065d94a4169c4578bd4e35a792e7fd7afe0f
SHA512 e34e657ccdaf063a836be0d34604ffd56744d7b3d0d5d9d6781b5edcc5c6f179c66cc0a4301e510f92307f53da5799aaff9d6f3b7f423f18168b0aa8d8eded3e
SSDEEP 12288:CpcZRXPiqwIkFPqQKj8DkBIHCP2sEMLRv1vIVq+:CsXN4qLqEIH7sTrvIr
MD5 SHA1 SHA512 SSDEEP

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.5MB
SHA256 2507c5791b773498efc9caeb458396c270e32f89048d415a96a2b43cc2e02f3a
MD5 43105afbbdf8d052a9b38a0048c4e0b5
SHA1 b5ea39f503bc01f7dafed106e229be8ad9451120
SHA512 cc05d5095ac888afa66b89f201011a3c4e24acf7040f5207d82f384417f934b9beacc5380bc454d79f899a1c15d29399809f0709963a74abeac4a12f14c1a501
SSDEEP 12288:fObXA4LWOsvAYFTKcZRXPiqwIkFPqQKj8DkBIHCP2sEMLRv1vIVq+:gzL3UTBXN4qLqEIH7sTrvIr
MD5 SHA1 SHA512 SSDEEP

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 6d913ea64013f139a3fe9d4d6761e911f5eb08be39eaf6c04444f378e35cfda9
MD5 d11ae10df8a6743abd8c96e728bbc743
SHA1 93c91b5862fad0580983e7f3ee3c33320b4ad491
SHA512 71aac21987100cd00ce467cfd68b30ab3619b07d2933e600e6488a9e6e3c6b7c033cd2d6eff02b25ed7c780b5dff8595f99ead6f91165b0527d8bd93236c0c2f
SSDEEP 12288:6pFtTOWcZRXPiqwIkFPqQKj8DkBIHCP2sEMLRv1vIVq+:eOFXN4qLqEIH7sTrvIr
MD5 SHA1 SHA512 SSDEEP

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 5bef6aaa63093edff47e2db7228b2487cf1ba3b06bdce8f9fab07cc1b98f6d2c
MD5 fc356cdd92a4b2b4954882388af7c670
SHA1 a4923bca34c4150b2d868c07e56f7b452adfd894
SHA512 47780b7ca8cd14104cf26030e552629855d54fe266728a339bc3b75c3fb95018687713e786ac4d19107421949293634705805672c9cd4c2b12f56c0dbdaaab06
SSDEEP 24576:H7NM9YmZqmWMUkPjZM48Mv6bEhsIXN4qLqEIH7sTrvIr:H7cBWMpPjN8DbEh3d5/IbsT0
MD5 SHA1 SHA512 SSDEEP

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 f6c6749454b5d732c12e8d882a3ca36b916f35082bd2969d045201320e289bd7
MD5 28b1e610e2c93255bf875d9df0015d74
SHA1 06e7bcaa0809217f89fc829f180d5846c765e593
SHA512 e8d466c07054ff0f5876451e28e3a9a9befb45331a235a8e46674a6c6f5cc0ca20efc992c2c6cc1a6d0cc6ffc356cccc1adb8342cbe81155910da18ab01a4c5f
SSDEEP 24576:HW6BApg2YuyuNDYTabvcRvNYf8km1GXN4qLqEIH7sTrvIr:HF2YuHNETovcvNYf8kmod5/IbsT0
MD5 SHA1 SHA512 SSDEEP

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 02db42fd118a3971e63c3e46414525096b1c77be01c2c1165c40ee12973a8129
MD5 c62add7aa83b25c939edb6c50e4d2f7f
SHA1 1c3f92179b47bf01787dcbdbf8c131c41e4ec397
SHA512 fb9b21624a698a773954d5742167d4f3ae4bb7cfe09f7173de7c6974547cf6c664ff54fb55f2af32bb63538aa1efe07dfe8593fb4e897f71ef30d597f9a537d9
SSDEEP 24576:hAFs06+Omlf3NXEbTopXN4qLqEIH7sTrvIr:2Fs060lVXuad5/IbsT0
MD5 SHA1 SHA512 SSDEEP

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 3f561b79bf35be045f965c0e7ffa22b338272dca386b25e705a88464fc0c8391
MD5 d8e66ea36b560377e51740b8e26a3dbe
SHA1 be2d6f233e3b98dd3cadd32b24ff577fa0b95fa3
SHA512 9fb1eca276cde1e3cf602a2d169c72127c1afa9f73c3f85199e7e7b2bd83a4dd1b7fc1a092d2b8edcdac97366c1c76c642e7f4baf27d5d16b29980ebe09a3bc9
SSDEEP 12288:VCJnJ5D3VkrjzxdcZRXPiqwIkFPqQKj8DkBIHCP2sEMLRv1vIVq+:MJnJ5D3W3aXN4qLqEIH7sTrvIr
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 deeb7dac6fde21a994c6136dc0835a7b222c1ab3fa0253becb6809988930f04c
MD5 d3599ac7918fc52817f4a87d4332fa81
SHA1 28cea835f2d91be80aac17f5d8a9e63b8e167e08
SHA512 c736ce0a52b72de69f2034a4815181f4606a54b0317c141de82360a5ed95690e8159ba98cdc75b9b1b500cb4d2ae36c906e38d41947a974568caed0865718a21
SSDEEP 24576:FEPohm6/7IIXdwcXrif7qQncjlP65i3VuvXN4qLqEIH7sTrvIr:So06DIKdwc+eQnSt65aV0d5/IbsT0
MD5 SHA1 SHA512 SSDEEP

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 f9a25353cad6b8711c15be0978a85394eadc503fa9c379d7d998d686eb6c1a41
MD5 4bf00e4518ac8971f3d7e8ee5d9cb0ae
SHA1 73cb8a1ca6315203c1dcc2262acf68366bf258b2
SHA512 eb5058af8e70e2ecb5d4ede8a7d94df0cb6e8876d0f0016f41cd499ec0f85365cbeb29f8270515a3a0f2a0cd258152af4b52cf024c5c0d817ef732a3e2a53ae1
SSDEEP 12288:KEP3RFMcZRXPiqwIkFPqQKj8DkBIHCP2sEMLRv1vIVq+:pFHXN4qLqEIH7sTrvIr
MD5 SHA1 SHA512 SSDEEP

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.3MB
SHA256 8988142a4a6bafa5e9dc392c946e0bbd2585df9fe5f7dba79b5148f4e6428c81
MD5 2d83e43c70c50a1bf0823b0a2825b3c0
SHA1 f45a2141601c05cac63b4e3b34322fafe2f75a47
SHA512 8bef9e1d68aea5119abf39087ce3161710c1609cce23cf670f536ea3552175fd09a545cdf45b28e0f4a3028fd3158d1529552c18ed9cf2df3c1e2a75f51c0d11
SSDEEP 12288:rjkyscZRXPiqwIkFPqQKj8DkBIHCP2sEMLRv1vIVq+:rIynXN4qLqEIH7sTrvIr
MD5 SHA1 SHA512 SSDEEP

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 654642f8262cebb83c77bba14c2ecb2f2f293c7df1d08ee6cb1150df6f4e5803
MD5 025b25f0c816305b11e2eaabe40386c0
SHA1 364ab54fdae5d644a4824ae1e85dc18c79af10a5
SHA512 5fe0fad5fbd7cea73dd6d837fc0aa66b251a33f3392441a24396832a6f296cee2411ac17bbce93d3e4218237dd274d13751957592f2615b6a36d7ae4991796fb
SSDEEP 12288:0nGcZRXPiqwIkFPqQKj8DkBIHCP2sEMLRv1vIVq+:YVXN4qLqEIH7sTrvIr
MD5 SHA1 SHA512 SSDEEP

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 dc7dda3bb878b1a4294de03fa92ebb7666fb48f244529bd6b3c6a12620a42319
MD5 dc2f993a92a4f2aac38f4bb9e06a295d
SHA1 6c1e0dde95fe98bc71d10b0f5b0db629c5a0ecd0
SHA512 3adc66fce46d2f3cb93bf03fff28171148b47c005d094d413a52ca1fa122b1897edf81c5bbec229ae850df89eaba5d3ef8ad9a002c8ced871b980007c111c421
SSDEEP 12288:8LQZb3C97GYnZMv5zBcKY97MD31cZRXPiqwIkFPqQKj8DkBIHCP2sEMLRv1vIVq+:KQ9MxZKdcz97w3wXN4qLqEIH7sTrvIr
MD5 SHA1 SHA512 SSDEEP

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 5fc3945a9dd0adcd5d0f0a45d36e086afc9a39ddaeb1d702efc6ee02a4e25245
MD5 d3f994aafa23bcd7b080ee7fb8194083
SHA1 1c8a7df2ab0512523b125d369fd1123188873285
SHA512 7eaa3995cb3e1d691f0a068c1ec16537c7f9964ba905dc82532a93fcbd0903de01b80ba5e077de90810bd4494699d9f7c3d0f1c440ec7615764373cd293af2db
SSDEEP 12288:jyoKo2dRple9pocZRXPiqwIkFPqQKj8DkBIHCP2sEMLRv1vIVq+:jyoc/ApbXN4qLqEIH7sTrvIr
MD5 SHA1 SHA512 SSDEEP

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 70f545df9e40199fcfc5b8faea966591e9ca9a2f54b9e412f8966f02926a31c8
MD5 9052dea5a60cd4e3b21212bda069ce86
SHA1 86483a360a7db472b437c762148f60d6d76d0ea4
SHA512 bde0afbd57722125dd12a4e6827ecc6531b51cecf63a0770d6d8ca3399256799ddd6a1da2495c8b6d6b909f938e147ef55ad06ecad2f640df6aff918242908a8
SSDEEP 49152:dWcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIKbd5/IbsT0:90zuNI/0bs
MD5 SHA1 SHA512 SSDEEP

Submit Download

office2016setup.exe

Path C:\odt\office2016setup.exe
Size 5.6MB
SHA256 61b32e89bbb65a526ab8c8c35d465f8bb72baded29f510b738e009ad791dc401
MD5 bfc8473e7ac5f499a312e8b1837baed4
SHA1 cbb67c6b0ed042343aa95728a1ff73af0178b733
SHA512 6930ce46351adfb36cc5c6c590d40b706de5cc4229bae93aa46345b7dc0dd34dce957df91d4d6cd17666e521a14f4541726f049906eb62f0f3e25f3189e215e3
SSDEEP 98304:o7M701RgX4iuSl1DtlEq81xZPGnzURnBh6gGL/QmvD/cTwY2h3Fw0bs:iM7pTXexZPGzURnBh6gGLF+W3K
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/648-320-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/648-327-0x0000000000520000-0x0000000000580000-memory.dmp

Download

memory/648-385-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/928-68-0x0000000140000000-0x0000000140170000-memory.dmp

Download

memory/928-241-0x0000000140000000-0x0000000140170000-memory.dmp

Download

memory/928-69-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/928-75-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/1444-437-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/1444-429-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/1628-386-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/1628-394-0x0000000000580000-0x00000000005E0000-memory.dmp

Download

memory/1628-400-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/1628-404-0x0000000000580000-0x00000000005E0000-memory.dmp

Download

memory/1748-450-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/1748-442-0x0000000140000000-0x0000000140166000-memory.dmp

Download

memory/1804-274-0x0000000140000000-0x0000000140159000-memory.dmp

Download

memory/1804-341-0x0000000140000000-0x0000000140159000-memory.dmp

Download

memory/1804-284-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/2384-307-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/2384-372-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/2384-315-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/2388-402-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/2388-332-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/2388-342-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/2396-14-0x0000000140000000-0x00000001401B9000-memory.dmp

Download

memory/2396-0-0x00000000020E0000-0x0000000002140000-memory.dmp

Download

memory/2396-11-0x00000000020E0000-0x0000000002140000-memory.dmp

Download

memory/2396-8-0x00000000020E0000-0x0000000002140000-memory.dmp

Download

memory/2396-1-0x0000000140000000-0x00000001401B9000-memory.dmp

Download

memory/2684-40-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/2684-48-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/2684-238-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/2684-41-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/2728-441-0x0000000140000000-0x0000000140182000-memory.dmp

Download

memory/2728-382-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/2728-375-0x0000000140000000-0x0000000140182000-memory.dmp

Download

memory/3268-368-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/3268-428-0x0000000140000000-0x00000001401A3000-memory.dmp

Download

memory/3268-359-0x0000000140000000-0x00000001401A3000-memory.dmp

Download

memory/3444-411-0x0000000000B60000-0x0000000000BC0000-memory.dmp

Download

memory/3444-406-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/3684-367-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/3684-303-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/3956-424-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/3956-416-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/4100-53-0x0000000140000000-0x000000014016B000-memory.dmp

Download

memory/4100-52-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4100-66-0x0000000140000000-0x000000014016B000-memory.dmp

Download

memory/4100-63-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4100-60-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4240-301-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/4240-288-0x0000000140000000-0x000000014014B000-memory.dmp

Download

memory/4240-353-0x0000000140000000-0x000000014014B000-memory.dmp

Download

memory/4276-455-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4276-463-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/4648-314-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/4648-254-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/4648-246-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/4648-247-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/4648-253-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/4772-276-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4772-259-0x0000000000E90000-0x0000000000EF0000-memory.dmp

Download

memory/4772-258-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4772-267-0x0000000000E90000-0x0000000000EF0000-memory.dmp

Download

memory/4772-278-0x0000000000E90000-0x0000000000EF0000-memory.dmp

Download

memory/5004-36-0x0000000000DA0000-0x0000000000E00000-memory.dmp

Download

memory/5004-237-0x0000000140000000-0x0000000140237000-memory.dmp

Download

memory/5004-28-0x0000000140000000-0x0000000140237000-memory.dmp

Download

memory/5004-29-0x0000000000DA0000-0x0000000000E00000-memory.dmp

Download

memory/5040-223-0x0000000140000000-0x000000014014A000-memory.dmp

Download

memory/5040-23-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/5040-16-0x0000000140000000-0x000000014014A000-memory.dmp

Download

memory/5040-15-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/5116-415-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/5116-354-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/5116-345-0x0000000140000000-0x0000000140169000-memory.dmp

Download