7327ed39ce6f64923be7ef0088b7c50c0c1be7e87c87f4b2e7b3630ce83bde15

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
04/04/2024, 11:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-04-04_51b72d4deef83c5eb4d61e350dfc428f_ryuk.exe
Size 1.9MB
Sample240404-nbj3rsdh66
SHA256 7327ed39ce6f64923be7ef0088b7c50c0c1be7e87c87f4b2e7b3630ce83bde15
MD5 51b72d4deef83c5eb4d61e350dfc428f
SHA1 cfcb34d101ba9a071fe4464e898d37a12f1775b3
SHA512 53351cfa081d1475b94424cb784f8dc3ec9e406a09189b7de07a04b199623ba5444f9c923fbd31b5ff640efac5f26d88369416282f267f9d982f93d08f3732bc
SSDEEP 49152:clOVDTtQY6SoNtaUJ67UnHpclbwbWAaJiwmcTdcoOcW+S8:jqSUHxqPFi8
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
4528	alg.exe
4980	elevation_service.exe
4076	elevation_service.exe
2376	maintenanceservice.exe
3820	OSE.EXE
2348	DiagnosticsHub.StandardCollector.Service.exe
3580	fxssvc.exe
1220	msdtc.exe
4344	PerceptionSimulationService.exe
2560	perfhost.exe
4656	locator.exe
3496	SensorDataService.exe
2400	snmptrap.exe
1616	spectrum.exe
220	ssh-agent.exe
3904	TieringEngineService.exe
4428	AgentService.exe
3828	vds.exe
1608	vssvc.exe
3080	wbengine.exe
4960	WmiApSrv.exe
2868	SearchIndexer.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in System32 directory 24 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\8074c03d205991d4.bin	alg.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2024-04-04_51b72d4deef83c5eb4d61e350dfc428f_ryuk.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateSetup.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c8cdf34f8186da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fbd1964f8186da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f0f7bc4f8186da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000019551c508186da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000037f99d4f8186da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fc5aa04f8186da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b4969b4f8186da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008021864f8186da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cfd0b54f8186da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
4980	elevation_service.exe
4980	elevation_service.exe
4980	elevation_service.exe
4980	elevation_service.exe
4980	elevation_service.exe
4980	elevation_service.exe
4980	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
664	Process not Found
664	Process not Found

Suspicious use of AdjustPrivilegeToken 42 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1160	2024-04-04_51b72d4deef83c5eb4d61e350dfc428f_ryuk.exe
Token: SeDebugPrivilege	4528	alg.exe
Token: SeDebugPrivilege	4528	alg.exe
Token: SeDebugPrivilege	4528	alg.exe
Token: SeTakeOwnershipPrivilege	4980	elevation_service.exe
Token: SeAuditPrivilege	3580	fxssvc.exe
Token: SeRestorePrivilege	3904	TieringEngineService.exe
Token: SeManageVolumePrivilege	3904	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	4428	AgentService.exe
Token: SeBackupPrivilege	1608	vssvc.exe
Token: SeRestorePrivilege	1608	vssvc.exe
Token: SeAuditPrivilege	1608	vssvc.exe
Token: SeBackupPrivilege	3080	wbengine.exe
Token: SeRestorePrivilege	3080	wbengine.exe
Token: SeSecurityPrivilege	3080	wbengine.exe
Token: 33	2868	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2868	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2868	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2868	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2868	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2868	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2868	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2868	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2868	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2868	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2868	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2868	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2868	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2868	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2868	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2868	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2868	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2868	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2868	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2868	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2868	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2868	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2868	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2868	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2868	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2868	SearchIndexer.exe
Token: SeDebugPrivilege	4980	elevation_service.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2868 wrote to memory of 408	2868	SearchIndexer.exe	121
PID 2868 wrote to memory of 408	2868	SearchIndexer.exe	121
PID 2868 wrote to memory of 2812	2868	SearchIndexer.exe	122
PID 2868 wrote to memory of 2812	2868	SearchIndexer.exe	122

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2024-04-04_51b72d4deef83c5eb4d61e350dfc428f_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-04_51b72d4deef83c5eb4d61e350dfc428f_ryuk.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:1160

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:4528

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4980

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4076

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2376

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3820

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:2348

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:3620

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3580

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:1220

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4344

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:2560

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4656

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3496

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:2400

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1616

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:220

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:2976

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3904

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4428

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:3828

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1608

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3080

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:4960

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2868
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:408
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
  2⤵
  - Modifies data under HKEY_USERS
  PID:2812

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
Size 2.1MB
SHA256 d7049958112d98e2b73d76b197150febb52dae9a0f47f7d03afca853393901e6
MD5 29c9f245b8d6cca5575d16ee413ae14d
SHA1 e7d6a0ad916b797ca01b1ced33d08efd4993a740
SHA512 c2593ece3f8cee848325a556dee88ec2a623f38fc6e3496ec814be540d75a88583a3f731ff492ff114eb9b6d0189af92e44ba263fc745f3f8e241f9eda24141e
SSDEEP 49152:SuYk3H5koUXfTqkkYLO/W2buywzMbOX+T7z5ScW+S8:SPfTqi90bM8
MD5 SHA1 SHA512 SSDEEP

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 781KB
SHA256 99bab1126575f55bfb1a5b7556f96e3b22ea9cff29fdebe88c8f297fbd29715d
MD5 6e72cf50090c3273f6264a86411658d3
SHA1 103b39e085b5bb0551cccf0eef0608b03c3bc1c4
SHA512 bf64c5ff2f5fee8567f5c7c1196109ea3784b826f3427b580d9493c5e2cf17ab3a37a4e8221c318878a563dcc3c6e0635df483978be9fd9b1846ef000028d387
SSDEEP 12288:jC0P9Q/Jcui66JvY67VMBNO/aXpXI22+VufvdIOKek1h4TA8bXQJYe:hPsJcui66J17W8CX32+KJNA80T
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 452249697c3180b205b5830fee9532e1298edd414b390509d33d01d03f1bd46b
MD5 d8f44c1672644ce9e771b3394a3a4777
SHA1 c636ab36cdc3ce68d67d0f43218bee788ca02bb8
SHA512 903c4f7ac4e01c0f4723f39dc8b1c1cbf642a0f7e8b7a5a30d99536fdea2f278dfd59f1bd28534f905ec7b5c14b46ed4d07572608408ca22a97406f2f77aa699
SSDEEP 12288:47a3iwbihym2g7XO3LWUHfh4CoO6JvY67VMBNO/aXpXI22+VufvdIOKek1h4TA8s:1+gkEVfh4CoO6J17W8CX32+KJNA80T
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 d733f6c40c6f0254b5965b57fe27f4c26658fe34aa7bd040c7608babd2a480a8
MD5 f5689fa0019add9caafdbc855703074c
SHA1 a8fe70155f638a90921aa085074dcc8d4fadb7cc
SHA512 5ac83e0251416ff61ed817a50e7723fa86ff0b658db5d969799d16f0da1c94884c3170f74de20b7d13c213a763e0607abe4f6d1c0d1a5c2b4bfc3baa948cbb5b
SSDEEP 24576:kBpDRmi78gkPXlyo0GxjrT6J17W8CX32+KJNA80T:gNRmi78gkPX4o0GxjycW+S8
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 df72383bc4e9f79640c1041dd0a1616b6bc10fb9a2d142321dad093a35975649
MD5 99e0d8b56d18ffa13dd0f95075ca9d9f
SHA1 8f73a4c1b6b054ab0c3d1b17b799ec052cd5d781
SHA512 790b35e0932d9f4e829d6561ce872b49711997943a2c7f4f4596d86f7644b831a0b6813c801abd624e6a6f82f20e165109e58b4e5a9a84356ad75ec68203388e
SSDEEP 12288:1fC6Aj+TN5uixZN+8rKhUdTC/wE1MD0Ca5ZIXVO6JvY67VMBNO/aXpXI22+Vufvq:NLOS2oyPIXVO6J17W8CX32+KJNA80T
MD5 SHA1 SHA512 SSDEEP

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 e13e3537d169e87bdc529fdc328c5b6569f553030c128735478f733bddf4e081
MD5 6dde3855fa29abb4bc90507cc32b9cb2
SHA1 f9ad81921c1a0004cdbd4913385c6babb039bce5
SHA512 75c458c7ab7c3c17d6e26574ab4d0e7232834a9305d6432ea568299627722d9550fa12c3f9590668a2adcd6e7dfcc81d9a92356f625cae9fcee5801f0ba0e302
SSDEEP 12288:KfU6JvY67VMBNO/aXpXI22+VufvdIOKek1h4TA8bXQJYe:KfU6J17W8CX32+KJNA80T
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 96910173b2d7ee3e1b6803df2562ed891638c9ef4bfae7bf6915537a6eed18ed
MD5 91eda733b2b96ef0461f623b7acdfa90
SHA1 22cb08f03d311c5f010f2b464c6654cba1b41f00
SHA512 aeaf152f0d39cfbd7b757fef6bb6de52778d3b82033042284d0d631e8b4f71de858da0b955bc6ae4f0b9d1ad203a5603ca926f2ea99d14770a500b9006ecb322
SSDEEP 12288:EeBNUbTVO86UR6JvY67VMBNO/aXpXI22+VufvdIOKek1h4TA8bXQJYe:EJIUR6J17W8CX32+KJNA80T
MD5 SHA1 SHA512 SSDEEP

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 6618361af5c5dda7210cce87f236c3959857828a7cfdbfb3d81c423da4279500
MD5 f32cbb0a7ed403d3539500d588e156fc
SHA1 f6ecba5041405fdc37798fe4c667ed726579d4f3
SHA512 1a95742d4ed280345c679d944e2af9604e720b828ea0aca3fb9e0acc4ced651fe8891a44dd62e254e0c32e9d4d72a8c3b1a9f522d0f64695e39a66d806a5b56f
SSDEEP 49152:YQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THb:YQvGAdlCEL8c/yRNw5CP8
MD5 SHA1 SHA512 SSDEEP

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 0bd9f8df19e17ef680f7f69925ea8df6020cd4cbe7fd06f7969240e43b42cc1b
MD5 f22817e641a800a1b9d51626c21a1945
SHA1 aa04e9945b76faf7e6b9f0493163a52ce3e9499a
SHA512 d4ffb7c796678df9b2f1069fb2050e77adc42aa10398e1bf77cc2ce23a34c3059be09ff7efa204e405e18a4151566aeefb9ab072a93c29f1eeff11cce9e8a5d0
SSDEEP 12288:RAwSfxL/2Dc34DLLmt0LDQewsAjb6JvY67VMBNO/aXpXI22+VufvdIOKek1h4TAn:ydewsAjb6J17W8CX32+KJNA80T
MD5 SHA1 SHA512 SSDEEP

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 5000c73da98aa8ce50fd6db087ce2d45f5e3b13c2b20de55631923022b94c97e
MD5 60931fe32c7f13a9508b12f3f820852a
SHA1 b15542ffe2fcf0d0fd16e2863232595b80c25810
SHA512 90596a4bf16ffca1ab9f198de8eb5090fcd339a7ee3cefd6279a9fb189ded2d29933d07d85788aa9f2f0df60487adee9c235844694fec42e6d989a1a6030e71d
SSDEEP 196608:kUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHU8:kUEtQevvqc2W1cpV2EI32
MD5 SHA1 SHA512 SSDEEP

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 88a19168dae756d303907ca9fefc1b4862e82c307d46b843cd34f280562c55a9
MD5 2e51de218c83bcafa531e5d07610709b
SHA1 b0e79959e167e0ba6f7676ba605b76f95e167d33
SHA512 b13ba77d92a863ef81485c60a7e6fc987b5045cf5d02b185bfe10294a1818e72cfc878dd91805cabfb35da7b5e6f08317424cc0d45bfd40a5003b3053ba7f143
SSDEEP 49152:NCbRquA/m2yL5zifFiV+XenmE3/zOcW+S8:qoqHVjnmT8
MD5 SHA1 SHA512 SSDEEP

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 aaaada585e561a2a82080e434a9ccff7ae196969ce5aa1aab5f0e14957b19360
MD5 294ce42939bcae2b9d439f4c3238e4e9
SHA1 62f115ac06d87fc6b47b9ca7a17b85fcabaec004
SHA512 f62b6e2184697a6030f99e145a733b71ee7cf42b81e2b345d0a7f5b56eb86fbd2f74b2f12575a9ad87c4ae997a57812b3814e867c90ae9ea79f5fd0d53badd33
SSDEEP 24576:YAhGLJIFoiwtA5l7S53+6J17W8CX32+KJNA80T:YAMyFoiq5ncW+S8
MD5 SHA1 SHA512 SSDEEP

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 cd8d04253a5409d7a7556c64f01fec9e4872719e8d476e4bdaa2a14e560f4dca
MD5 7c73c4f28cfd3049d49cad7cb4fc9ccc
SHA1 804b26f372f0c0aad99aa9b8fb1068bd4329225d
SHA512 59d70bab7e6c148fa03b31eafb2c30d947390f7795daaca9ec6f161f3b9503e7fec84b83abf2f16aed9ea89c301491fae25387b1f7df003f67a3a58a766c3b1d
SSDEEP 12288:imw5HEjsChNVBFgl0WDm+CC6JvY67VMBNO/aXpXI22+VufvdIOKek1h4TA8bXQJF:7wuoOWH6J17W8CX32+KJNA80T
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 db5ed6919987c9484e11f9004fa96da2874b2cb5b0ca1d33c4e5648a231ecb87
MD5 8f584429bfb94bc50f47f60eb6bf8bbd
SHA1 0c799f3b333089e8ca1df96dac0bcf9d7ffa1869
SHA512 0dadeb95b8607acf30e1d855f91073186749c804d81302ed32669adfb99967d348f41fbccf96eef6eb1d54ca282d682fd927231513e1950195c3922c17d6f59b
SSDEEP 12288:BBZ1Iyr6JvY67VMBNO/aXpXI22+VufvdIOKek1h4TA8bXQJYe:vZu46J17W8CX32+KJNA80T
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe
Size 4.8MB
SHA256 c03074223e948a9e698f0bb57924ad70f33b4f3fbe67fd5afacc058417a87fc1
MD5 639e75084bdc8eacdbc6962d7fb1d93d
SHA1 c3846fad71f735f5cfb1deaece36e6946ed8fd69
SHA512 2f098bc84a1b3370980f6f3bc11787becb7116002c48a55926f1147abe272ea2ef39f8e338ca93ec0737722426a4caa34cee7acf7fa44acf7226f01d77c24596
SSDEEP 49152:fj8f3jtqiCLg9LK2hIOR+k9jdAsizqxSiZ4K5MZqkL92c6nkdmbDfiIerM1R6ZPY:IrZ4K5M+XDfiIewG+x6xZ14u8
MD5 SHA1 SHA512 SSDEEP

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe
Size 4.8MB
SHA256 c57ce5c036469f683e4f2e4484a66d56cf05bdd9ed43a710d65134731ad229c3
MD5 f3e4f8f24ee3af9817660cc8405210e3
SHA1 125a8370a50efc6ca8ce11ab1860ca39eb77b37c
SHA512 ab9da7d949fae08318d1b7efb7a5dce0f5ec372c58a1db82a94b204b8875bc705ca6d1d79c97d6a0f79f7886f6fed8f3334fd3551aebae999996b785767d7b01
SSDEEP 49152:Dj8f3jtqiCLg9LK2hIOR+k9jdAsizqxSiZ4K5MZqkL92c6nkdmbDfiIerM1R6ZPY:crZ4K5M+XDfiIewG+x6xZ14u8
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe
Size 2.2MB
SHA256 b5cbefd7fb95a4ea74cce7aaa4f917335e23d95bb14e77a41351d6bccacb5513
MD5 d20910d52e75418263545d2d2b47e6e8
SHA1 3b8dfa4ede5741ad5ede822af1978f02413242e4
SHA512 f5746551b94d722bd4219d050484cb08e729bbcca1520ebcef17963897e16c8e1cccc9b733ae147a01a3c0807f140cb288764045a7655e17bd4c7bef693fffe7
SSDEEP 24576:BfzeNbBmwfn8Nrlj+SWWiEboxHmfx+Xeo4djO+6J17W8CX32+KJNA80T:BfzabJ8llj+SWWi2mkx+X+diXcW+S8
MD5 SHA1 SHA512 SSDEEP

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
Size 2.1MB
SHA256 32ef1938f34047f76d0d3db04141fc3361de1fddd2d92d0b9eab91066d1143ea
MD5 ce217bd97c94695717da64a205269f9b
SHA1 f2ea039996f34cb81dcc21cbcfff6a8ea3c3d611
SHA512 ef0e4284a9691e47af8bbfa080ad0a760cdb9ecc31d1a6a8e2d02d1d7536d76e806412d01b75b653e8a33d09e4874d4c27bfb891f2a724adc15ff4360049b97c
SSDEEP 49152:Oa/3xXBSZ4K5MJ1LvTMxbfsYBYSgxu9+fw4TccW+S8:QZ4K5MJabfsYNH8
MD5 SHA1 SHA512 SSDEEP

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe
Size 1.8MB
SHA256 5a3c4d43ae148c43494c9a8f8b07534bf6c4c53ce89bf1bae3b03d137e5e8463
MD5 9e781893d703610a2f2b8835a113d19f
SHA1 68c9ced8d4f23f6df01d8ef273bcd4ea8140cc9e
SHA512 95c7d78416ab7602db289444763a0617fb95a77190faa0cc23cf7841659adfa660fa4de2933ec88bf163915a9afd63a47e5287f5f0622369e8afb413d11a2bd0
SSDEEP 24576:ugNJw85yUKzDu/9gKPlfLO8C49BgKd6J17W8CX32+KJNA80T:ugNJtUzDu/9gKPxHC4qcW+S8
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 1.5MB
SHA256 c60f51830b53e4bd46061ef1a79053a8535632ddaad3c46751a8ea5c4b126f04
MD5 e9f71bdd09bd91b40ab10085bf0487fa
SHA1 a5f7f88f75d4738ebd789500652b8880497a0d6e
SHA512 d47438fc7e38782ee6818f70a2327cc90c73c6ba9f4962cc6f47d49394816ba1884ef8ab45200034e2f5847e9b61d50b66263e8a5f2cadf75b987139f4b7df82
SSDEEP 24576:LOBbunHBDSswM+v6UJxLBdAdoYBHL/dfRV4k6J17W8CX32+KJNA80T:LOBynH1wM+v6UJxLQd7BHjdfkcW+S8
MD5 SHA1 SHA512 SSDEEP

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 b592a52dbdb67db2e79943667558659171ad9657cbccc4187cc46fc9ab64e5dd
MD5 3234888ad9bbf474e0f0a2fedeb9667e
SHA1 ef04c915d3ede0fdecee5868e5f953ea048325bf
SHA512 28d1c47e3f14b280c348fb3eedd14a347bb995382dbd08cd31c13a052481153a474323a134fdb4f9f37a63ca9b9b89604f5fd79f2557c14e93684cc57b0e4e06
SSDEEP 12288:YM6JvY67VMBNO/aXpXI22+VufvdIOKek1h4TA8bXQJYe:YM6J17W8CX32+KJNA80T
MD5 SHA1 SHA512 SSDEEP

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 0736845ce6e8b1e8b55f516f770e741312456d9150078bf874f4ec0bf29f06bb
MD5 7cc9caa982899ecc686258fd94787dd9
SHA1 b1fec20ff3bb9768d6faa852aa19b8f58da5f60b
SHA512 4a1a43ae6c246ba9b2b8b99c043b160b49c2a2f9e7e7d7f35c7c5abf1d5607638ca256ae425cb6c3ad386f44870343504693b799e4bbac8faf96757e5890fcf9
SSDEEP 12288:Hv6JvY67VMBNO/aXpXI22+VufvdIOKek1h4TA8bXQJYe:Hv6J17W8CX32+KJNA80T
MD5 SHA1 SHA512 SSDEEP

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 7189171e7bb73903c389cd033efef5784784331a92f3d46b16435ac8856d0881
MD5 35829907ffb95a8553356048cfdb8793
SHA1 de8c702a8feb09b7750d6e5623c418703c4b1b5c
SHA512 d27f5cf5102c3f3955373aebedc51f5510ba6c9db1e5749e63edfe08234f00bfdc1fd5a8010e3f7e2f0fd721513865ed43ac4930c6887336be016990c65afb41
SSDEEP 12288:gp6JvY67VMBNO/aXpXI22+VufvdIOKek1h4TA8bXQJYe:gp6J17W8CX32+KJNA80T
MD5 SHA1 SHA512 SSDEEP

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 065f73749450cf5765a429197a920bcd4a5781b99c9bafd834c990dabada4df4
MD5 cebfcbeb02412f56caf01e737993ff64
SHA1 5f7e77e3674311c0fd9aa1bc4b96a04c559083c6
SHA512 cf7c468c08229143b5d2ec9a2d3d1729f4247d7842f4f80fc0a9d909787b524cc79b94a1cc36be030d1bc8d12d6cc22691d451aa6887c41004d60d7d717f0bab
SSDEEP 12288:ZVe6JvY67VMBNO/aXpXI22+VufvdIOKek1h4TA8bXQJYe:q6J17W8CX32+KJNA80T
MD5 SHA1 SHA512 SSDEEP

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 103c295550cd1196a3f7ae5114e53e82c1be0507e2213d83bcd12207fe0d3d3a
MD5 e487e23f7d362a7e977c3f238e24ff75
SHA1 1a163ca399dd579c8fd9e0c676f6000d83f42cd3
SHA512 ed416b4fb145b83bd6229aa6333d39466d5e36623c732b3405324342660e0465276b5cf785729dac98dcacb337ebcc9fec6540bb857dcf0c7622a9e4deaf675d
SSDEEP 12288:Um6JvY67VMBNO/aXpXI22+VufvdIOKek1h4TA8bXQJYe:Um6J17W8CX32+KJNA80T
MD5 SHA1 SHA512 SSDEEP

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 d13c5d413f135062e560aa933269c4e63ec833a9b454d7d2f224b503b9a7f427
MD5 d71ae4f09a1a71c1dfcc2411b586f363
SHA1 26a48318b2f79d15960c93428115b63ce10a23f3
SHA512 d9fb4413d3d85b5ac7c446459408014ecbd977889b324fd5114e0cce248f6f91a20e340510c6bbe72c8e6f68c560c1e10bb2747681a6e0f1355e307e80a657ac
SSDEEP 12288:uT6JvY67VMBNO/aXpXI22+VufvdIOKek1h4TA8bXQJYe:uT6J17W8CX32+KJNA80T
MD5 SHA1 SHA512 SSDEEP

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 3c2b2002d4d4fa7d929622d0a4f7e8750824c3d6becd215b44252811bda140ea
MD5 4b5303423d16b018c16538aceb1fab75
SHA1 ef9ac33e45e42b911f967d418de1b052f3931c1b
SHA512 71e5f9642b84de85403fa22c273545ef99d2e4a3b3d512ccaf6b114cb80be566a53b5333a7ca0a68db0c54608250112a48c685b7df83f3c0f961c4e9ec62c808
SSDEEP 12288:e36JvY67VMBNO/aXpXI22+VufvdIOKek1h4TA8bXQJYe:e36J17W8CX32+KJNA80T
MD5 SHA1 SHA512 SSDEEP

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 939dea521fb7c751ef9a6c5c5e4737dd1ebd896a6c5bafd38e1a63f12c1e4a51
MD5 c454f40d116a81421b844e85f65b39ef
SHA1 249bb03c131440f05d4200ce261569e543b89d3a
SHA512 8577d83492eb2ef5797af1e30f1de245529522d1fbdce65a8227dcc9ad1613c4a5c796200b242f5f7afeec5c175ba5da5b28e0e8abbf67010476640e25cc52ec
SSDEEP 12288:oiZwb6zzFEoS2cPvyP6JvY67VMBNO/aXpXI22+VufvdIOKek1h4TA8bXQJYe:rZMSzFVSOP6J17W8CX32+KJNA80T
MD5 SHA1 SHA512 SSDEEP

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 fcf941665a52995eb4f5696bce37957a5568ae1b808500e1581bc41deccdb113
MD5 6fcdad68f44e16f7aeff73d102892382
SHA1 872a1a3afc1d34af422c3693f33168aed5557996
SHA512 66c72ea2bee6253e78533873b20a0ab2602ed95144e83198919372e6bf0d7468ab51989da17e656251999edc4c283a9abb640b51d65eb3124d10b2158427aa99
SSDEEP 12288:LI6JvY67VMBNO/aXpXI22+VufvdIOKek1h4TA8bXQJYe:LI6J17W8CX32+KJNA80T
MD5 SHA1 SHA512 SSDEEP

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 deb1c559e62bbab08cc1d24e215b4084d7c50ba2c964b2b1bf5fe7d1d6512d8f
MD5 686af8fea6f29343d50ad87369f66cee
SHA1 efd9db3585e569d2661ca7ece7226cfbb428cce9
SHA512 a7496dec86e7b99c3725c7bf0b0d424ac554e80b66ae16afbcd6383a03226691d2f13b02e093f0351157af053b74270eabce582c1979774f5547757ac6685534
SSDEEP 12288:Ek6JvY67VMBNO/aXpXI22+VufvdIOKek1h4TA8bXQJYe:Ek6J17W8CX32+KJNA80T
MD5 SHA1 SHA512 SSDEEP

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 08dab3c49f4426ec07398ed2839b78b9022585443f1a0c4836b962735c3cf605
MD5 9e5b83ad158b264ed80a05e945280332
SHA1 658468044c7066ccc15dedeabc460b65f57c1df9
SHA512 47f9076e8f2f193d3386bf2d2724845e8b3d666715e65a3ffd948bc29ce85bc34971f879b4526ebaf532f49e4dc80877fa899ee69af01dce3bdec32de40f0c6b
SSDEEP 12288:VyPz5L8r6JvY67VMBNO/aXpXI22+VufvdIOKek1h4TA8bXQJYe:8zyr6J17W8CX32+KJNA80T
MD5 SHA1 SHA512 SSDEEP

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 6000b0d47f1697a3957651478638824be59c09b47b73766e559dc52de719c69c
MD5 92edda392a2165be9a5c9647e18eafa7
SHA1 75b58f1143a73ed56e5c4752e6939219c45e907a
SHA512 02af239350f3792f2d6b8606a628fbf7681680766cdbc30092e423e499fdeb7b828ce4427639392479818c6d3da08cad8033f37a8cad5485f0bc6fbad14249ec
SSDEEP 12288:gI6JvY67VMBNO/aXpXI22+VufvdIOKek1h4TA8bXQJYe:gI6J17W8CX32+KJNA80T
MD5 SHA1 SHA512 SSDEEP

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 c0b4d09a65b6bf620140c441a5e039f2351b72e6f1d4810c0b016224d63e0ba3
MD5 244ca0fa38f1de54ab867d9a845d7bdf
SHA1 3e62890e07a1f94aba7f5ec12f5b6ebee39d339b
SHA512 64c0712b6434d6575b7e4b888bbfe6dcafc2bb6e1e05f42523533b24fe262038a5a3e695cc18b81b5e525e30c3b6d822cc765c42e3bc6dcd482a0b9e6fe53b5e
SSDEEP 12288:4I6JvY67VMBNO/aXpXI22+VufvdIOKek1h4TA8bXQJYe:4I6J17W8CX32+KJNA80T
MD5 SHA1 SHA512 SSDEEP

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 e57372b703528ec2462d3beda84195f8d0ab0e007ebcd7b329bab1d4f3e885ea
MD5 ab68090edd124e8523883002eb313018
SHA1 2ec9ea66d46b0f91e30406e247f5dbeec306b306
SHA512 fc77e322f44e922de599d95b04ef103b419bb78fde9b8e1f419f75cf2084a59dad591e2d93384e59b2621d93e6e5d166a6aaac3def289a50b8f6f80b520a6a58
SSDEEP 12288:ZyPz5L8r6JvY67VMBNO/aXpXI22+VufvdIOKek1h4TA8bXQJYe:Yzyr6J17W8CX32+KJNA80T
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 5b2e36e637370d51243c7d1c231691e2a4fb10da7b49a58b1081487c8b3db28a
MD5 a067bee5872992ff8df26d89696eff71
SHA1 b2bd2ce459154c1396493aee0200268f0ca0bce0
SHA512 09f9f223d52281cda7c0383dcd8019dd6077416d0d2c53d0d375ee59c6068fd177e850d8f5ea88233988f1431638f80c9cab9cfc9ab8b6b45d1d26e6cf8c1fd3
SSDEEP 12288:eCd9eWYoaLHF3z0z04PDvhZ6JvY67VMBNO/aXpXI22+VufvdIOKek1h4TA8bXQJF:PTHaLl3z0zDZ6J17W8CX32+KJNA80T
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 622fdc568f39db664acb955ef0b7c8fa3e630bac6897c44f1c6d3bebe27de851
MD5 a3c798d46514d42c8cfcbba4e494b767
SHA1 5038513740b474a06baaa9000457f7bc71359399
SHA512 ad6e1555f138e5e0b18a1f056107d7eb9b3e7fe6d00635e2e45c0eddd23e95139fe6a58661bf45fa07cef6b9b897bbd1ef732541823d661c53c0b318e78a1538
SSDEEP 12288:Zi4e7+RdTfgwCHKy7GLbbdIvK6JvY67VMBNO/aXpXI22+VufvdIOKek1h4TA8bXY:Z37d9CHKy7GZd6J17W8CX32+KJNA80T
MD5 SHA1 SHA512 SSDEEP

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 0da04a91b644a05c2ad921440b5133647e9c2185676ef0f3411e809c5d8673d5
MD5 1033b4b3f972aac220cddfa4da99976b
SHA1 c27de200a899da2f98e132cc6e34c2adeb1edeca
SHA512 7e4b48980787c57bb044455e2bc84c8509aa10d33ddccff7f1e825d624f1db9f24c0a5a9755e8a44dc199d4a2196031e627a11b724d8e650d9f47f312b351702
SSDEEP 12288:HJ6JvY67VMBNO/aXpXI22+VufvdIOKek1h4TA8bXQJYe:HJ6J17W8CX32+KJNA80T
MD5 SHA1 SHA512 SSDEEP

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 aef253fb5688c29ce36942a5d37671a18ad72520809e24f3fb47ddbf0be2a767
MD5 3b2f3e312ec6d00d3ac029534c50fcaf
SHA1 0dee92b83605baca400b4718ca7e2ebf1aeddcbf
SHA512 7ace750007081e340aa59b2b3f22987224a3a37d54ae27663901082edddf92351239d4a0bfaad8c58952b0c256bbf61e867d7b270bb576f0773338fd4fe17991
SSDEEP 12288:lL6JvY67VMBNO/aXpXI22+VufvdIOKek1h4TA8bXQJYe:lL6J17W8CX32+KJNA80T
MD5 SHA1 SHA512 SSDEEP

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 912cf51fc50d78a03a25fa61146a0557d2e8680c8c8d8421c9a3da62ec265ba8
MD5 66a61b1e9dcc10bd099e9f0adee0ba68
SHA1 d4b2c83763a327e7fc300c0d4972a2664acba1ce
SHA512 6dbd227954a4dab72eff2dcd0873a8be980fbe2c86fac28adbf6598570193dd27523a7decdd80b8f6455240e66cb002e4ca4a294c0da5678eff656a63de33c1a
SSDEEP 12288:mK6JvY67VMBNO/aXpXI22+VufvdIOKek1h4TA8bXQJYe:mK6J17W8CX32+KJNA80T
MD5 SHA1 SHA512 SSDEEP

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 2b22f000b5c168291921318d9ba973cf8099e554eee077b9a2a94b5985bc1fb5
MD5 945e01045d903b900e48a6e5a8e9f03c
SHA1 4b8a38f36d7fc5918cc6d1176bd604c32acdb25e
SHA512 ad828efbe4143c13a9147bf02c4b260e4bc16c72da53b410d5637de78f6ec3a97df82fe3adc7184043c05ff545ca836101b6896b615881addbe3aab06a24631d
SSDEEP 12288:6I6JvY67VMBNO/aXpXI22+VufvdIOKek1h4TA8bXQJYe:6I6J17W8CX32+KJNA80T
MD5 SHA1 SHA512 SSDEEP

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 411b5061dad422a99c07b2246667633d633b33e9119d915f912265f138b7dec4
MD5 5938c2b68bb6b4b541fb161c476e3e9b
SHA1 64390b63d7fde9feb057d1a9ba170287b8948035
SHA512 344dac850320406ea78b16c994d8be93efb25f619cc09f3bb05c781a1d960103326249599c21b4329f050040e9bae949019bfa2183865853b0cfa9647f769330
SSDEEP 12288:zJ6JvY67VMBNO/aXpXI22+VufvdIOKek1h4TA8bXQJYe:zJ6J17W8CX32+KJNA80T
MD5 SHA1 SHA512 SSDEEP

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 23f008366ad74370a82db1e29219cbc9e5ab35d3da7a75d88698fc8fceacc6c3
MD5 77abfaa062518a75196918c7c2f0904b
SHA1 c96849cef7cae019e7ef54c646c216ee41d0a229
SHA512 2abd46549042eba5351d19bf9e4def955cb4f81be58d136f83d8677392c6a8d9dfad3a20de563cc3089e903718c9b512cbb51a5fc30c5abe2b9a05cca146a676
SSDEEP 12288:gQ6JvY67VMBNO/aXpXI22+VufvdIOKek1h4TA8bXQJYe:gQ6J17W8CX32+KJNA80T
MD5 SHA1 SHA512 SSDEEP

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 696KB
SHA256 1d3d7b2457ee1b44af8db52d1c0e172b1cbcd8c5a62d9ac086ffd497a31bec40
MD5 c1296d2115aa1c9adc65b4637f8735e1
SHA1 23ecaac04d330649159aae993292361b9de115cf
SHA512 f4a16984633a012e8b3fa46ad59d31f71caf52d93ec04d0322f53ececdd5a1cfb6f83ef596f2aadfb01de1442e51064bdbd58b2fb78dcce2a818e1f0b406ab06
SSDEEP 12288:yFYq0SD6JvY67VMBNO/aXpXI22+VufvdIOKek1h4TA8bXQJYe:ygSD6J17W8CX32+KJNA80T
MD5 SHA1 SHA512 SSDEEP

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 85de35791a07b3793b5f1f1b2b9cbe4a3e201dfddd03559a8ba4664de2820d50
MD5 0985e2f71114b24ef3f8bcf2cfdc1557
SHA1 b58dd7e40c999a4d204042260866a43df0ca04e6
SHA512 b9c8d7130d6413c24ef5320b597683d9225f8a111c631f73347259e26a7866dcea657fbce630ba62e06314c7ad1ec5b59983f7a69b75075e59c806e6726a37f6
SSDEEP 12288:M36JvY67VMBNO/aXpXI22+VufvdIOKek1h4TA8bXQJYe:M36J17W8CX32+KJNA80T
MD5 SHA1 SHA512 SSDEEP

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 cc158a584a22de1d5e972000b9438092f9890606b3e162ec411e0f345e0ad03f
MD5 b8176bfcc8a7825ebbada269c65b48a7
SHA1 d91ee7e892a5b060ffffa400809189d97c2afafe
SHA512 d14501fa3bc777b6bd7152a2ddca97d796df378f957f67940d851d5efffe5e2e99fe62e425167c8ae980dd349f2db84d293824299e6dbe418414c5e8cb2ba017
SSDEEP 24576:UoiQ0h2Hm7EkuAK3xV3tk3tLjN2VMbxR86mHx/YY/izSI2sBq9EzwwXg/bZ6J17g:Ua0h2GEkuAe73q3pp46zwwQQcW+S8
MD5 SHA1 SHA512 SSDEEP

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 659KB
SHA256 fdc3fcca547523a5d1a751a2dc6243967152849be26f6852f2576a4f673f7ff8
MD5 81786573464cf77ac6393cda2a48bbb2
SHA1 222d915e96ae131514cc94c04d92a11b3b0e576a
SHA512 b51a54e857c74ccd13f60120f18fa437c094cb5485078e204bd40429e3d85bbecd005c8263fdf7069b805d081995deeb41baa3f54ebc159645a3081804adc3ca
SSDEEP 12288:mhbHjfXk6JvY67VMBNO/aXpXI22+VufvdIOKek1h4TA8bXQJYe:mhbHjPk6J17W8CX32+KJNA80T
MD5 SHA1 SHA512 SSDEEP

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 25c7e1ed07e7bf08d090019a1bbb489dd88a2ff3b56bf7990069da418704b119
MD5 ad90b8b5e57c06fcf4725e88250e2b90
SHA1 89251f46e6390ecb39144909fea5527241181e42
SHA512 5fe2631bfbe9e6ee4dfe6ceb8063aad51ef1edf821f796a7747c7a0496268d35d85f00ee6fd61c16420b532d4427c136d3718eedecea224b2988f5613bdca2ba
SSDEEP 24576:p3YgnJcRTk4yti+R5dpR/86J17W8CX32+KJNA80T:pIgnaTk46ppR/VcW+S8
MD5 SHA1 SHA512 SSDEEP

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 578KB
SHA256 c2e6b2e18655352def35c06a3538b0d4ba23c3ac2221de41dec2a5e18a5cd7f7
MD5 f40cc71efdfe0141e55065a79b9a9fdd
SHA1 5e3098ea98f8393f14c9e94f2fb59acb18a10e43
SHA512 f85ff626492fce39610b0fa584516080f264418811abaeeb0da8f448819542b09f7cc0cae2f47fcf9d23e184cd64dfccde6ab025d2c2ae13acd64c764c94820f
SSDEEP 12288:tT6JvY67VMBNO/aXpXI22+VufvdIOKek1h4TA8bXQJYe:tT6J17W8CX32+KJNA80T
MD5 SHA1 SHA512 SSDEEP

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 940KB
SHA256 abcc049b73ac4282947bb5914d79965d69f018486cf5e51ec9e187cbf2c167bb
MD5 8a9013d896f202bd8e5904347fffec00
SHA1 116e258b8eccafe6de99ea02c447a802af218163
SHA512 1cdd919602f56cc4f02837752059aacae78094e9ee23d4553f00bd6240cf6ecd4d13da5e4238d11a3e18fe47f155584d9ff41ef70e3bb8094816743d2e45881e
SSDEEP 12288:kOb9A4LWOsvAYFTK6JvY67VMBNO/aXpXI22+VufvdIOKek1h4TA8bXQJYe:JpL3UTK6J17W8CX32+KJNA80T
MD5 SHA1 SHA512 SSDEEP

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 671KB
SHA256 f10f3a21bf6e360e93fef0b1e6d737043ee6c62a7e185d4fc6d8715372731a9b
MD5 343bfc1636894c4ab2312307729142fa
SHA1 a7ec751507711386737220b20ef896f5d0ed5c81
SHA512 35548ab30f4e82c7edb18b99b634e5cde9438f6275de14a0399763c49e2d6325c0d4263bb0ec8ed8f76ba27b36b2d80ab929a503c8201f0627a09becf11be5d4
SSDEEP 12288:1pFtpOG6JvY67VMBNO/aXpXI22+VufvdIOKek1h4TA8bXQJYe:dOG6J17W8CX32+KJNA80T
MD5 SHA1 SHA512 SSDEEP

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 fad227eb926455260c8f669082e4530f6779f243e1cf39299b3b26da5b1e480a
MD5 4dba58278e37361172c8853af2d3c693
SHA1 dfadbc6c215e48bc76e736b10920f051fe41ca95
SHA512 2e0bb1fb2c209578b51dfb280a49886ceeb36c1b121d503c60637ce734b97a7b109b06aeb8d229914f8fd42c65838e2c42d49bcd4242830d40a623bdb10571bb
SSDEEP 24576:A7NM9YmZqmWMUkPjZM48Mv6bEhsH6J17W8CX32+KJNA80T:A7cBWMpPjN8DbEh9cW+S8
MD5 SHA1 SHA512 SSDEEP

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 93de1ba5ae3a90efb58226f53e4111f523907f871f46e71908ab9760edc5f09f
MD5 929b1131046379e1f9c363d28bfd2548
SHA1 068828f5c5bd497da3e5006d4feacde07d43b915
SHA512 468e2df9b84f463298fbef11cda4bd7594d0106827ec86051e2069171f52747bf33a0d316a5e751e1831319ed8c00cdb3f7914c0801260c5c1ec12f932b782ef
SSDEEP 24576:XW6BApg2YuyuNDYTabvcRvNYf8km1R6J17W8CX32+KJNA80T:XF2YuHNETovcvNYf8km6cW+S8
MD5 SHA1 SHA512 SSDEEP

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 1fcf6a33807353d456efa1bbf3bec183b3430dd20e39ae34709afb8c6c8fcdcb
MD5 a3eada5a7c84b94c8ba9fa485c7d5776
SHA1 cb6861c7389254f4f14ed65a68e140675fc30279
SHA512 ec2bc665a3e7d59dd14c2409972b523e84a3df4adf6c20f66b3ff0a551e4b162c0bdb349a0e534f7136ed8fb8c22e0181ff9b517009d15b64b47a36a9283e9ee
SSDEEP 24576:KAFs06+Omlf3NXEbToS6J17W8CX32+KJNA80T:TFs060lVXuwcW+S8
MD5 SHA1 SHA512 SSDEEP

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 885KB
SHA256 a6ee664ae93b122c9bc131064148c953b32bf0c9a6653bafeeecc68b0a31222e
MD5 f2c662494b2d232fb5b59faf265ca071
SHA1 af9d8f727956d308e4cc3f55422a290aba5082e1
SHA512 327134273f4a69c8d2ba2acbc0d3112090d94bcbe2238d2610c93ea93b613e9ccf72c66e88d7e0caf593223e5e86df726d5509791652d6f1c59f50ec355fe5c2
SSDEEP 12288:CCJnJ5D3Vkrlzxn6JvY67VMBNO/aXpXI22+VufvdIOKek1h4TA8bXQJYe:DJnJ5D3Wtd6J17W8CX32+KJNA80T
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 3aa7d8138b51e51de1cc2866b35cdf07b8210953db1657177d72783ba21fdf77
MD5 c63901e31fe67d14e7e62071b47bbffd
SHA1 039d5bc2fd662f07f60c40e4c743c4e71edc372e
SHA512 9ca0eef807958549d4cd4d9ec19583a30e9c676ef2c81d0ffc755aa0482ebbb3a712c0f277b50851633923debe0a83879dc8308bd2a6676c97152b5ccd0180e9
SSDEEP 24576:REPohm6/7IIXdwcXrif7qQncjlP65i3Vu86J17W8CX32+KJNA80T:Wo06DIKdwc+eQnSt65aVucW+S8
MD5 SHA1 SHA512 SSDEEP

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 661KB
SHA256 2b16a03ce31bdf1632011a3daf4a66f982242031faf8eb93ec4dc221d11c2941
MD5 b4cf5fcf2320bfee3d26e8251e05d59c
SHA1 5ca58fca15404ba3ac7d9ca054966f24c5517469
SHA512 b1f57092eb72fc7a4bf241f2fc4241342eceb1356d0fb96d13d4b4e67f3384f1b714d31a23b590591adf475329c6919e31e88e3b162f5ce53a843c38b04d8b59
SSDEEP 12288:QEP3RrV6JvY67VMBNO/aXpXI22+VufvdIOKek1h4TA8bXQJYe:rrV6J17W8CX32+KJNA80T
MD5 SHA1 SHA512 SSDEEP

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 712KB
SHA256 835106d5abfa5f434131b4d07ec909cbbf01ed89fed42c161cc06cad1306b50b
MD5 e2e2967e56b32f57e084f73b99690d86
SHA1 871645fdd76487bee5b097514b271e04262662bc
SHA512 094f8a5cc317d25fdfd3e6fede7e99eff77c7264c0d6e30d7e3bfc216922029324fd10616df01ad49bc8b925adb674fd187f9c38090dba8cd059a3dc1f79587b
SSDEEP 12288:1jkyU6JvY67VMBNO/aXpXI22+VufvdIOKek1h4TA8bXQJYe:1IyU6J17W8CX32+KJNA80T
MD5 SHA1 SHA512 SSDEEP

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 584KB
SHA256 8e9870b32669e39416dc6e12050e58a0285c06a1181c93a326bc93dcab4ae171
MD5 d3d4b67e1ed12cf42b9549344af0c455
SHA1 012530bbd54a7db95100b250e290d7054f3bc0f0
SHA512 a5cc41c4c28e435decb294482e01b53682ce60fa86f5b7fc83b21bb75ed6a3b1fa68c8ae5515af1e08133b4f4d0851fb6d5c4e1d47cf6037cc21b325dae0573b
SSDEEP 12288:yF26JvY67VMBNO/aXpXI22+VufvdIOKek1h4TA8bXQJYe:g26J17W8CX32+KJNA80T
MD5 SHA1 SHA512 SSDEEP

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 9dcee555bd554c3cc09942b8c463780e0bc1699cf8730c95a7dac72295a4503d
MD5 4f550ace5c5d4190fc1f5274cf9208d7
SHA1 1035997bfcae6e5a2b2e736d8679e450fd7259a8
SHA512 cb3219a4eaa1aada5ed0df149ea5df5ccac3e65fb2e95c612c9c72e1eb9c5ea621e1a1d5ccf6e3080060e72faeb918425d3465245fa6c6b7d7124b9aab323ea3
SSDEEP 24576:QQ9MxZKdcz97w3v6J17W8CX32+KJNA80T:QVKXCcW+S8
MD5 SHA1 SHA512 SSDEEP

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 772KB
SHA256 ca2cdae4026311c3b6f5a71c68010c7155f6bdd8bcf215c04580360a6da95471
MD5 db24488f207a594816c8ec6de1d05518
SHA1 585e57e9b3dfd282f45c209eb0f6facd61dac0ef
SHA512 61875d465d4fc3eaf1c6b6a95d2b9ba6b46765b4cf5577e5e6c775297811e8e3059d08ffdb8bd3a3d689859b7f0ba47e0836736920cccb04d5e14b533bb2c05b
SSDEEP 12288:XyoKo2HRple9pQ6JvY67VMBNO/aXpXI22+VufvdIOKek1h4TA8bXQJYe:XyocxApQ6J17W8CX32+KJNA80T
MD5 SHA1 SHA512 SSDEEP

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 001793b6fd99bf7672740be22b07c83d275ee188c885d7db00320ee2961ef76f
MD5 81da752154eb175b9ea8193362b5adf1
SHA1 effa18b8845759e4796dd8cae6efde2a87b8ecef
SHA512 4dde7eefc49ed3bd54af2caac12830f8ed69f3e9777a72492472a6b69398f30cbee16f6a29da6b8315d4387a57eeb2309ff6f6ab3540ebc722b67e6d62b8c2ca
SSDEEP 49152:yWcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIKJcW+S8:k0zuNIF8
MD5 SHA1 SHA512 SSDEEP

Submit Download

office2016setup.exe

Path C:\odt\office2016setup.exe
Size 5.6MB
SHA256 4a91008e91f6d81ca63beb86e0cefcac00ba6ae60724d63d8fab483dde12c955
MD5 b9ed3a645ce79dad3fab13b52e95c254
SHA1 9c151f886df0718f5b14e90ad794902ea1a5af79
SHA512 ccfd46bf11a913df67a8fd6e187f8826eb0288e2d50ed277d09b9e3c44754046c03f1929e4184ef2d21f13794b7d0003774f2960bde0bac00462e69b16ae8f23
SSDEEP 98304:A7M701RgX4iuSl1DtlEq81xZPGnzURnBh6gGL/QmvD/cTwY2h3FQ8:aM7pTXexZPGzURnBh6gGLF+W3W8
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/220-366-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/220-435-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/220-375-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Download

memory/1160-0-0x0000000001FE0000-0x0000000002040000-memory.dmp

Download

memory/1160-1-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/1160-7-0x0000000001FE0000-0x0000000002040000-memory.dmp

Download

memory/1160-12-0x0000000001FE0000-0x0000000002040000-memory.dmp

Download

memory/1160-13-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/1220-273-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/1220-282-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/1220-339-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/1608-431-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/1608-423-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/1616-422-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/1616-360-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/1616-352-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/2348-245-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/2348-246-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/2348-312-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/2348-252-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/2376-61-0x0000000002240000-0x00000000022A0000-memory.dmp

Download

memory/2376-52-0x0000000140000000-0x00000001400CA000-memory.dmp

Download

memory/2376-65-0x0000000140000000-0x00000001400CA000-memory.dmp

Download

memory/2376-51-0x0000000002240000-0x00000000022A0000-memory.dmp

Download

memory/2376-58-0x0000000002240000-0x00000000022A0000-memory.dmp

Download

memory/2400-409-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/2400-341-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/2400-347-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/2560-309-0x0000000000620000-0x0000000000687000-memory.dmp

Download

memory/2560-301-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/2560-365-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/2868-471-0x0000000000850000-0x00000000008B0000-memory.dmp

Download

memory/2868-462-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/3080-437-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/3080-444-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/3496-325-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3496-333-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/3496-391-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3496-399-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/3580-271-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/3580-257-0x0000000000E80000-0x0000000000EE0000-memory.dmp

Download

memory/3580-256-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/3580-265-0x0000000000E80000-0x0000000000EE0000-memory.dmp

Download

memory/3580-274-0x0000000000E80000-0x0000000000EE0000-memory.dmp

Download

memory/3820-74-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/3820-66-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/3820-67-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/3820-240-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/3828-418-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/3828-410-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/3904-448-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/3904-380-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/3904-387-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/4076-237-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/4076-40-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/4076-39-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/4076-47-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/4076-46-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/4344-295-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/4344-286-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/4344-351-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/4428-393-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4428-406-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4428-407-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/4428-402-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/4528-15-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/4528-16-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/4528-232-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/4528-22-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/4656-322-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/4656-378-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/4656-313-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/4960-458-0x00000000005F0000-0x0000000000650000-memory.dmp

Download

memory/4960-450-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/4980-27-0x0000000000440000-0x00000000004A0000-memory.dmp

Download

memory/4980-28-0x0000000140000000-0x0000000140237000-memory.dmp

Download

memory/4980-35-0x0000000000440000-0x00000000004A0000-memory.dmp

Download

memory/4980-34-0x0000000000440000-0x00000000004A0000-memory.dmp

Download

memory/4980-236-0x0000000140000000-0x0000000140237000-memory.dmp

Download