bdd8ab448bc038303ab2216a8d7d3cab402099af3a6206becb2fdb66abe37381

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
04/04/2024, 11:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-04-04_65830db3f437fceb0d89c0e39c14ee5f_ryuk.exe
Size 2.1MB
Sample240404-nfkvvsea74
SHA256 bdd8ab448bc038303ab2216a8d7d3cab402099af3a6206becb2fdb66abe37381
MD5 65830db3f437fceb0d89c0e39c14ee5f
SHA1 992255ea3985780d989e6d514ff086f161ea3bb4
SHA512 ec5eb5ca2e5321577bf645695a2f6402c62efc959e3c78b4f2cdbdd75c5545c039b9bda0aa312fede35e07a11b90fc3544b01aa1bb6782eebc9227af92383ddc
SSDEEP 49152:SjFX33t4INlfTqkUMLu/52bulcI1wXZTBz5KgDUYmvFur31yAipQCtXxc0H:S7fTqmeX12U7dG1yfpVBlH
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
4004	alg.exe
4912	elevation_service.exe
2468	elevation_service.exe
1680	maintenanceservice.exe
3164	OSE.EXE
3012	DiagnosticsHub.StandardCollector.Service.exe
4192	fxssvc.exe
3644	msdtc.exe
3632	PerceptionSimulationService.exe
4588	perfhost.exe
3448	locator.exe
992	SensorDataService.exe
2708	snmptrap.exe
2176	spectrum.exe
3368	ssh-agent.exe
2464	TieringEngineService.exe
4956	AgentService.exe
3672	vds.exe
4744	vssvc.exe
4472	wbengine.exe
4408	WmiApSrv.exe
4020	SearchIndexer.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in System32 directory 24 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2024-04-04_65830db3f437fceb0d89c0e39c14ee5f_ryuk.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\46e4db4946f975ab.bin	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Install\{6A1BB60F-884E-44C2-837C-FAE44753B873}\chrome_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_79656\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\106.0.5249.119\chrome_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	alg.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000060aaeb498286da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006502c74a8286da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003d7393498286da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000029e6e6498286da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9923 = "Windows Media playlist"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000021bfdf498286da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000066d4b4498286da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000db71b2498286da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
4912	elevation_service.exe
4912	elevation_service.exe
4912	elevation_service.exe
4912	elevation_service.exe
4912	elevation_service.exe
4912	elevation_service.exe
4912	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
656	Process not Found
656	Process not Found

Suspicious use of AdjustPrivilegeToken 42 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3624	2024-04-04_65830db3f437fceb0d89c0e39c14ee5f_ryuk.exe
Token: SeDebugPrivilege	4004	alg.exe
Token: SeDebugPrivilege	4004	alg.exe
Token: SeDebugPrivilege	4004	alg.exe
Token: SeTakeOwnershipPrivilege	4912	elevation_service.exe
Token: SeAuditPrivilege	4192	fxssvc.exe
Token: SeRestorePrivilege	2464	TieringEngineService.exe
Token: SeManageVolumePrivilege	2464	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	4956	AgentService.exe
Token: SeBackupPrivilege	4744	vssvc.exe
Token: SeRestorePrivilege	4744	vssvc.exe
Token: SeAuditPrivilege	4744	vssvc.exe
Token: SeBackupPrivilege	4472	wbengine.exe
Token: SeRestorePrivilege	4472	wbengine.exe
Token: SeSecurityPrivilege	4472	wbengine.exe
Token: 33	4020	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4020	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4020	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4020	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4020	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4020	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4020	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4020	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4020	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4020	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4020	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4020	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4020	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4020	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4020	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4020	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4020	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4020	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4020	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4020	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4020	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4020	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4020	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4020	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4020	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4020	SearchIndexer.exe
Token: SeDebugPrivilege	4912	elevation_service.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4020 wrote to memory of 3904	4020	SearchIndexer.exe	121
PID 4020 wrote to memory of 3904	4020	SearchIndexer.exe	121
PID 4020 wrote to memory of 5092	4020	SearchIndexer.exe	122
PID 4020 wrote to memory of 5092	4020	SearchIndexer.exe	122

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2024-04-04_65830db3f437fceb0d89c0e39c14ee5f_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-04_65830db3f437fceb0d89c0e39c14ee5f_ryuk.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:3624

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:4004

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4912

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2468

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:1680

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3164

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:3012

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:1612

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4192

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:3644

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3632

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:4588

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:3448

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:992

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:2708

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2176

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3368

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:628

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2464

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4956

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:3672

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4744

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4472

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:4408

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4020
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3904
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
  2⤵
  - Modifies data under HKEY_USERS
  PID:5092

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
Size 2.1MB
SHA256 76497e0d4e361381b2cc0770a4ff3ad29c7eb922c32dff195182e34ea89f92ee
MD5 c970b4dd97a846edebb4335ff2193055
SHA1 a3cb2ce1c7f8ea2affdcfc8cb3bee7a449a117b8
SHA512 5aed0ae435964957d237681aa132cfd394a058d578b09a6bbaae22dbf189ec86b74cc920060a4a13be3c774e8b2a89d2e4b715f5acf7ef9e47016b0e78826d87
SSDEEP 49152:1uYk3H5koUXfTqkkYLO/W2buywzMbOX+T7z5+gDUYmvFur31yAipQCtXxc0H:1PfTqi90bPU7dG1yfpVBlH
MD5 SHA1 SHA512 SSDEEP

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 781KB
SHA256 7f1049c8af9e9b4e82a895a2eeb5904ab347ad38a12b95635de933307114431e
MD5 77c5314da0a209ea0fe37d6dd69430b5
SHA1 1c3cc5fc1f4af5be5105552b4ab2b82233000be4
SHA512 6aedb0c707017def0838b138fb3034805d9e3e7397c34e7c0227cdaf57deb206ce13cf52b79379668aed2019f7189467e1c097e06296ff1b21abd4d60d6488e2
SSDEEP 24576:fPsJcuiT8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:fwcuagDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 d7c83adb5bd3c393d7eaed95db29185e3e43852fbad7d0204f68d8acbeaf9a1f
MD5 6097cba132389e5ffce19c9ea2cf8aeb
SHA1 a7df1c2d9d04ce11ced7764c5a2a1e14cb8ddf69
SHA512 3dc0891c20690f4d7504e2af45a2bf426670dc2e0cd085fa243430a94f1be4f937a3c6c4ec92211e919609dada2037118d5dc0e2e0a96799ec77e63b4f0e5d61
SSDEEP 24576:N+gkEVfh4CoH8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:0gkExSJgDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 d8d5ace64ebabdd6bb3b449da7f3948654ef9363e1db7a4004452309d103f554
MD5 29108edcbc188da50dee70ad38c5ddd5
SHA1 47df8e13375bf5339ee16d798b68612fd58191be
SHA512 a7db82b22ed2644b7dca198a2540a30bd7cf47a1c903ec3ede2ebea47ac69c0a539e49cd2ed49ed46d89a077eb52e1ee1275ed57bb757eeb5f23570ff4e0ab42
SSDEEP 24576:FBpDRmi78gkPXlyo0Gxjri8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:vNRmi78gkPX4o0GxjegDUYmvFur31yA6
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 c0cf95c1c182d7dfc760e18cdec51bbbe6d54129009d1ab1b149b63d37ffa2bc
MD5 c49cef881a4010320ae6b6870d3b57bb
SHA1 cd4ae180458471a09bf5bfed49aaba0f2443d614
SHA512 1f7f09212239de1fb5cbcf1d5833b3f1758abf17e5f1a5c11828369d9fb3faa15e443f6b45f44288fd0c0337829400b1671bbcf91c9b0df31ea1d4de185e66cd
SSDEEP 24576:VLOS2oyPIXVH8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H://y2gDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 8a28c14d71c00b06873130591ec4618ab13c0e756783e266270a57f535ae5537
MD5 a155681c61fd2b1ad2cfdd295ec5c6a3
SHA1 fc050cf3463b50d6b6a112e2907337724fdbede0
SHA512 823c7693d30ff9c1935b2c0e05fb1786c670307d9587213e464f3f6c94800c1fb78f3c1a4415971d2dda93ba6a53fe4466497ffb804c9288536728db901acd70
SSDEEP 12288:1fpFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:1fp8NDFKYmKOF0zr31JwAlcR3QC0OXxx
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 fbdfa677db7326ce3d387651c3f055e78c01d7f704bc7d3979d6293dd45bc5a8
MD5 1824f291547dd5d35dd3239a682c5d22
SHA1 d4337261da7814850e1be4d13467568b47b64035
SHA512 1d9988e77a98f58d254b7596ee28940950f8685b3b92b1a22c810c9ccf2dbf2134737925e4510c81c293502f8ae80d6fb6fe5f11589e33f21746b22787f1c305
SSDEEP 24576:aJIUc8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:aJIUcgDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 e8a2483fd8ab8ed28f266c579b4aa8c5bd4db5c66e55def1506c4d0727efbe5d
MD5 6c587b9323c0163ed61bdbe4858d881e
SHA1 4e1e2f8fd06a13cba2ba3292a540200ccacb629f
SHA512 6c0953710b0ce4689d1fd96b5421a7d14704e2dcb74636f2066b9dc3f089f85ec5b46a7ae1cad216bf90130c3ea52ad2e3a5f9662e19abb0a98a34eff421cb3c
SSDEEP 98304:mQvGAdlCEL8c/yRNw5CeU7dG1yfpVBlH:nvyEYc/y3w8eUoiPBx
MD5 SHA1 SHA512 SSDEEP

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 88b9c38003e328776833d9846e4f58d23facc99361fba65bef40d87b88abf477
MD5 868ce504f7cf163630919a38b4a78fac
SHA1 d7204c9d59399d19d054fc0f0c0f1e79b6b33672
SHA512 8fd8a60c03402b3cd5901ca44733bc9bfac5c769be1f805279b1fa89693b167f21cbbe13aea83ebc4127d39d05fdd4c643b4a3f6ec875f5354e78661eed20669
SSDEEP 24576:IdewsAja8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:IljagDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 c7c86e7dba8b9953380e4422837c2bbbc2674bec641430a2b5e22da38d45fdf4
MD5 7b1454f24c912c4e4e7bf3a04ad32b5f
SHA1 720a4f1cda6f86a0da2d66f648349429eeb9e5ef
SHA512 0bcc35bc8c65ffa1231109204ef7473e332a4ee9575f3ff3af0f07d44fd7a3ada1ba1c00a38226204f56f2ea268bae502398e58a68de1d3435e6af7dcd1dc7ad
SSDEEP 196608:DUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHnUoiPBx:DUEtQevvqc2W1cpV2EI32n
MD5 SHA1 SHA512 SSDEEP

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 92d1bf15698c0bf91d0d73595599b70e9613c0d71530140c0f94c8d104926438
MD5 c6af43dd550dfc05c3380d14c726c27e
SHA1 783726456f9c4523a21831cba5e9a4c47b278f98
SHA512 08a330eacf1afa6e604235b7cce781a047eb26ba02d51a07db6b540e2c509564defaffaf4f5e2b7d55dfbe9185a0db7af3be25eb5b9c2904fdc9bcf6e0cb987c
SSDEEP 49152:6CbRquA/m2yL5zifFiV+XenmE3/z6gDUYmvFur31yAipQCtXxc0H:PoqHVjnmiU7dG1yfpVBlH
MD5 SHA1 SHA512 SSDEEP

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 27230faf4669f51ab45186881c720ba2164f89d468cfb53067f12f3a6c53516a
MD5 cd0255a110deba2ab9b8185d84a91bf4
SHA1 67d82a68d327a6c900c3edddef65811524494206
SHA512 4e9e805dff692714e71c7706d2cc47d99118c431d8aa15f20d1cd66e5d81c7a4c76b698619bc2afdd519dd84e27bb5e0eeba4308d4232bee688858925edd5f72
SSDEEP 24576:bAhGLJIFoiwtA5l7S53X8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:bAMyFoiq5ngDUYmvFur31yAipQCtXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 275220b57d2eb8893c1968a207a553da7b5636d771aca4616b0232f49e45c425
MD5 def4f990766b2065690590b345d4460c
SHA1 cf1962a578d0546cd566ececcb9acd5ab4d54d5a
SHA512 cfcc9b13d83b7da53117c77c22a1f58e24c3fab7c1443069f7af09ec6dc5f9e5323456ee7391b04138841661eb8b768a93ee8466aeb4bcd2cd63fc3926dcb78e
SSDEEP 24576:vwuoOW28NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:vwDOzgDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 639b99782b7924e62e36bec1e1f2a786f19833a952f5c8b03314b1a6e3b86be2
MD5 8bd7e0296600289572aeb98059d70b00
SHA1 8a4527c8f81b4e7306febdabfb7000b93b1fe19d
SHA512 9b4baf3bdfc0f59f1c37a726ae6a4cb1e90a3e51b71a61475a9015930d1e991a6b5e67ce754e470e47450177cc41f6c8989f4cbe3d3b9c0153e14efe92e2957d
SSDEEP 12288:hBZ1IyKFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:PZu98NDFKYmKOF0zr31JwAlcR3QC0OXn
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe
Size 4.8MB
SHA256 0e8dcd1179adaf42fc6bd1473d9a4d8975e598f6552e4762b7e5291b23849a19
MD5 b0dec8284b124399a9da4646689bad05
SHA1 57bb5f2a90c032861298a2f57afff1bfbb9683c0
SHA512 428a617700dd089c474c00fcf1ef95b234fd58ee433bdbf86cbc01d18debaf2051ab0ad6f140193dc0d13382b491104fa27eaf6e56acc11da0f0c4c2758af8dd
SSDEEP 98304:XrZ4K5M+XDfiIewG+x6xZ141U7dG1yfpVBlH:7Z4K5M6qIzv+Z1aUoiPBx
MD5 SHA1 SHA512 SSDEEP

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe
Size 4.8MB
SHA256 b64a4404e24fc9012cbd7a80a74ab2012a948bcfbf16563490f0f1a939577acf
MD5 f283f746b597626a9229eba2c87d7a27
SHA1 c7a158a5abb176b886526a1d6432b5ed2a8002c9
SHA512 a736e12de08aa3a93726c2d89073568c9d4df54c665d7aec05049553373b16324af47f9adab00c4e05cda19a732083d6515ca18c069cfcfbf4941384650e140e
SSDEEP 98304:XrZ4K5M+XDfiIewG+x6xZ141U7dG1yfpVBlH:7Z4K5M6qIzv+Z1aUoiPBx
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe
Size 2.2MB
SHA256 63cb2843f676feac11fc6821df45f6a6e90d237fc27f31f8e83e65148ed05039
MD5 724d45d18917ff3646c388758eb8477d
SHA1 3340f52f1b8562a82908b8024e27114f39a1c079
SHA512 11699166366a930fc53022bf9fd670274366bc4305d53b6315c81d79e58cf177f12689308311979500c19be04027c36756f05fffc447b378a4e21be7f57c8d8d
SSDEEP 49152:nfzabJ8llj+SWWi2mkx+X+diXgDUYmvFur31yAipQCtXxc0H:cui2BU7dG1yfpVBlH
MD5 SHA1 SHA512 SSDEEP

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
Size 2.1MB
SHA256 309ec176caccafe226fce2f51a12ea157e31a28d3a018fc4fce72f4e4f0c01ee
MD5 b0577191777629bb94ec585dafc76317
SHA1 816c5daf0721b3404a5b2faf7774de26a63ee6b1
SHA512 5ece589da79e343b2ad6e7cde20c6e0c0e227d5975c217ddce763e696aa11d0d880e7508eedbd22fa03a2177fe130084513389b15b6caf2846d8a36f3059adc8
SSDEEP 49152:la/3xXBSZ4K5MJ1LvTMxbfsYBYSgxu9+fw4TUgDUYmvFur31yAipQCtXxc0H:9Z4K5MJabfsYNmU7dG1yfpVBlH
MD5 SHA1 SHA512 SSDEEP

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe
Size 1.8MB
SHA256 1fa9f8291e478b9c3fbb0995fafd42cd4d0edfb54d7013dfc04066abc7921020
MD5 cdc70306fdfb9accb8ed1308f03ffd1d
SHA1 37b3d3f75b027052a0f30ebab7c3b780ac90f77b
SHA512 7e0e7d748e52e1f3cba5969d28b5f8817d5339a9ec7ff221a0de1a4551e95985823178e1ae181bff68d91f4cc72e01c0fa4fa14494f071b7dd58ce775100e949
SSDEEP 49152:LgNJtUzDu/9gKPxHC4GgDUYmvFur31yAipQCtXxc0H:wPx9U7dG1yfpVBlH
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 1.5MB
SHA256 5fdbe4025ca332ed042225fdc94573b0b4f166d2e1e528c44414a3384ad4a519
MD5 ed9e1f2d72622824c860a503470c36ba
SHA1 290313e807f35bdd58f7ad9f4dc158481db7b39b
SHA512 d105c8d4e9b8da5009c10f0f7db5a8f761abb6c5c02f0bdbfd9cbb2b82b402610a01fe76b5ddf98360bac61642379af3fec9d0890bc824946ae18c2e5a68b9a9
SSDEEP 49152:zOBynH1wM+v6UJxLQd7BHjdfMgDUYmvFur31yAipQCtXxc0H:ln4LQd7L1U7dG1yfpVBlH
MD5 SHA1 SHA512 SSDEEP

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 522fb2cbb0b851dc7f387fdbc3e404916343cc35933996ddfe3bc606dd8e61d3
MD5 5bac959246010f20280d0ea97e034cf4
SHA1 595f2f2a52e6c8b8cb898a958e1924abdfc0fb73
SHA512 63ab11e273973339796093f10a794fc6b13740e147f53940d5ec3e6c561b1adfa4e7a93b1d024f0519bb17307271141ebfbd22fd7e1ad8a6c4ddb0bc04d1cb4a
SSDEEP 12288:+RFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:+R8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 8188a3e12e5d63e3f8fa5ae7063f22963d1f82699188d62f7dbc56f7aba6b94b
MD5 46ddb2de7bbd2b86e0eb26513da0b108
SHA1 fb8cbcd75ede60eb00026055cd99cdea0acb949a
SHA512 a1001bdff7429feeff64d902503635e7370965f0717a2a4ab941cb0e0dd85dc828b73291dd957d579f5a1360339f94625429b1a7b51fba4423d793420a882a32
SSDEEP 12288:UuFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:Uu8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 d8b2671951e0cb32c23b9945b533809762fdaf3fb85a0f6edce421f40aecf152
MD5 9ae66b825bbeac21e0ae4d32749cf577
SHA1 9b44a8aac9788d30034a3a6795ccbd34967007e5
SHA512 cb86ead9434ca8de049b60c659652e4e1d6999d63e10b6ee1fc1ac829091f0b58304c2c3afdb8de059906be03406c51723b9ab78bc7b2fc7a14a460eaf619bdd
SSDEEP 12288:JEFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:JE8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 c296ca653760bcfd5837e715630fd6e4a9520c45bc5288e63c999a56c69d22e1
MD5 96372aa7a31160bb58265b104c8e0d49
SHA1 8f35e1e313e2a6457117984b5ed8ad5d73a1d258
SHA512 fe285ce9b75146adf1b72a54976b3a1e70721931d70f9830f1e4cce0dc07a4f7f105d3ed576b97ac470702f317c2f67687271832a0e0be2445ff8b581862f9e5
SSDEEP 12288:4V3FCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:08NDFKYmKOF0zr31JwAlcR3QC0OXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 7dd67f5083a53c745b3d512296717285c67ea5c5ce57389ffc0f6cdec500fd28
MD5 5e7e2a7855509a5dfef6b5d396fdd295
SHA1 b1f964c639e6c35cce74c9f9d82e0f9729d54702
SHA512 fda59d5e867d018566ef955c4a50fd74063657af5d5d1fa93da9c16f7e59ce7f7a32edce0b52fc5d5eaf920f7312e63ea8c00c8cb89dcd250648b2b3222234e1
SSDEEP 12288:dPFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:dP8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 8b0a2b2a794d7efea3318a376fe61a7e9f5690e45bebe453ad5c94b61ea28001
MD5 8451e3107ae8b8a243870ef88b232fdf
SHA1 c2f0b0b3e56d53ad1a535ef32249dfb774a53eab
SHA512 f5259cb78002258f356fd891c378d65c2f62af5eb66ceb3191baf2d59ab8e315eba17eae771f7c4c86f0f82636ce591db455321c6f4824864a66894116fe07f6
SSDEEP 12288:hiFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:hi8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 1145e8e73eedb2e81946008f8c2b9adb8ea4ce96d3201ea463c6324f021755f3
MD5 6612262bd1095115f57abcf08eaef936
SHA1 4f611fcb6f9f6dfae7e027c0c3d4e53775d907a2
SHA512 2df432e0afcc51430aac68d419424051339dfed2e4c83583b85507f175b1204994755f8ade3ebabf507775499a90106528f5023cb349bde67ae15c0478f92929
SSDEEP 12288:pGFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:pG8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 6c8aab5ad65f4f102ef0603b1e6ba51383deb82c731c44c81940e8d94767479d
MD5 d50fc4ad6f4ae4b32fa41ab584248713
SHA1 0e8ce9a96680472076eafaf9d89624370bcea5f4
SHA512 2fc6f04bf8bab0b0d0e617454bb0520aa56e7982020c6f2167c996c751246a7330701a77212c0f4035305f8b4f1412fbbbd95907bf9fe9eee1c2030f489b1881
SSDEEP 24576:fZMSzFVSOO8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:fZMSzfSgDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 c258bc9ca8964cf6015b54dbd6ca48d7b55a99ad114a058b6b09181d031dd4b3
MD5 5c276dd3022a62cd4518cab23789b72f
SHA1 4e1a391bbe0fe37e5e33f38736ba13c9acdac713
SHA512 60ccc0fe0fb7db9a432bad50056f2082e863cb3a897d8de2a8d2eeaecb3a567f29ae785e8e082b0845b2492b584c8bd5a1e6006a160cafd590b85db18e29ba38
SSDEEP 12288:mtFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:mt8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 5a4c72cc100726de869af8ce7a6d77396d88768efc6bbfb6caeb16bb5518ea5e
MD5 50db784a4b960b8e2ebf8d5d4e04fa15
SHA1 8419976b14632b00ba07c1aa12540c787e6e83f6
SHA512 ccf09f74f97f34671153f94c47fa502b21deb89524107c4acba46a57748f9cf5a1eb99f77ab06821746ad5f4599c0fae3506b0f92a221379f12d698e56a25ac6
SSDEEP 12288:VZFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:VZ8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 5f0e40a6de3483af23bbedfae0c5cb12733a56a35add583844be470b880ca25f
MD5 fec8ea28d4ace088447f036171d20e24
SHA1 a6dc817f0473f1a691f8f19155774e884820d0ba
SHA512 7cabf16be4b3bf77cc9c79651cc7afcc2f1ee37f8cf0f0fe4fa8e38ebf43bbf8ee3ec6ad1e5d66a6bed8b9766982064ba83693f8dd11cdd309d2b3772b21e325
SSDEEP 12288:ntFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:nt8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 cd968111d2ca48ce394db3c624bde93303901e29c10e9dd075eb86ce307ccddd
MD5 b37c7614357f946e1b0307302a8cdbab
SHA1 8d7692efdd444b389e4ac78d2b9f84cf13b2c7d9
SHA512 c7773b01294959600a276f20a2ad9f0ec98d3e30c37e6f6fcbeea11cf2ffa993c7883bfeaa11e83189fa056aa2ce9d90ab2429e2ec7fd234068f998099cc8045
SSDEEP 12288:qtFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:qt8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 f0eeacdb3f723194e5ec2794a6f5dc877ed5ac7dbcb1d438b06aa7f9c25dbfa8
MD5 b1d08490350b2de5b4f0b153c366eac0
SHA1 d9d7208346b10ac1b36eaca30f3515b22398d172
SHA512 4055dfa69caa9fcfe76ad3c9410697358d7a004e0f70af39a5aae9c9e55c90822d76ed0c059122339a3f8b2e601b921a5667b852bb78ea57c9670ccf3011477c
SSDEEP 12288:FyPz5L8KFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:MzyK8NDFKYmKOF0zr31JwAlcR3QC0OXn
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 789c1503e79852b0fac54c8b2dd92bc70cffdfcf529569d6ff9ffab0ffce0f9f
MD5 d54849187c5d530b26ec74875dd54e6c
SHA1 e8d40ffd83449982aac2f347f7a4441b8ce8583d
SHA512 fd09b3d3beabac31d1a3cae17d30a4f4519e4c5250b2874b172de144dc6d541f73aadc260a95d1e2792de8442b3c2f8510ab89b7e15303a5d480e1346cae0697
SSDEEP 24576:ATHaLl3z0zDU8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:AT6LljrgDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 ccdc6e53a9451583c82fb2472183456d822f8717f9f242f5fd307fa6980b89bf
MD5 07018509d40e10b8623fc333be37e89b
SHA1 6b918391cc2ce23ff163d80553b089254543f962
SHA512 68b99c48f3b42462e0064ebbc4fc85836f0c8faa39dd241e623eecf3641b1438a431a7a1a2cb9ab19923fa6b9ee310021e199c54fc32c93be7f111e1437b28e0
SSDEEP 24576:a37d9CHKy7GZ48NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:87d9CHKyaSgDUYmvFur31yAipQCtXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 2b0fc61b2cc6a4a60c2fcd6a0f602557160637687a47d194270af0d698aeea87
MD5 fc3ec75b34d470356b895b71a856de90
SHA1 b8d28a8116340c77d7cd116ccda8d65efc5eb8ef
SHA512 1e989078042548e6d9a0e037bb2ca7895cf0966708dacd0e63883f093da62851e6d84b5ed615759215b6662bd8a12fbe8c206e024e904172ef32b3f1b859fd4d
SSDEEP 12288:xkFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:xk8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 adde676fd7cea11cea4f6bfdd25383c615ec6d6ae10017a983600227370dc10c
MD5 8999bdb0c4dbcfc5a1ad2686ed883240
SHA1 a5c5c1db621fc2acd7a00c6cd89b292d1c703865
SHA512 cf71f1631e3b92f684d02e68d2200516666ff2f1f7f7978ac0cf215ec9afdb24458809844b036d56a6111dba2b7ff163935f125787c0b6c6b8a2e046662941db
SSDEEP 12288:NqFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:Nq8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 834f3e9461457ccc9744faf58d4c5200137d3d92a2bd3364c85f4ccaa289fc02
MD5 d162c82cf2e90629bbadb002f52b3033
SHA1 7594f12145df8b5579fa54dd637d87d466dd046f
SHA512 2f5a4e77a0018b3b2c3ba93e6315301bdf82b737177c4b2b719d6da02598f1aded447a8ac906854bbdba268a2adcf2370dd77af376fe090f4cc00d0f75192111
SSDEEP 12288:KDFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:KD8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 fc925370c1d3923202313c308600332362602455b498629239333dfa749d083c
MD5 de6ecd433184076de1438b1cd6f8f5a9
SHA1 247ad08ce418d776e4d667e9ca8dcfbd1b5f1d74
SHA512 0fc9417ecfb37982fc6d986bb80bd7358ba397f695367ffd1ee432f4fe796dc94a042f3c634d30d9c31b3470e34d9666632d4309f8e99007216d8caa3170cd28
SSDEEP 12288:WtFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:Wt8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 fa3696c18a20546bc40f120fff2e3a23f24dc253b52fcaaefbfb819359119058
MD5 953ceec866c1753a348b618bbd305464
SHA1 94e768f9427f5bd14427c390cba5edd2be5b8c4d
SHA512 cb9849d59889a94a01a0ec575c379463a9d7b4a9c3124d0f18c0f83600f4304460f682b034b281d99ac32572178a56a70db1ff6fe52e854482b238f3e78aa5ce
SSDEEP 12288:jkFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:jk8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 57ad60c7799ef43f2af02cc1e2ce4294a7f6eca791ddb959ac7e628033aa0e61
MD5 408887bc602f2ae06f843dea1bf0f83d
SHA1 cb20db97056ff7e5c1e6331f306ddfee1ac84218
SHA512 4738c281eac01b8d6e6f9e2870ec3190450765412ede437fe1515783da93be47c3b725af51e2c7e250f956b93cac8e214720ebee29775b6842c0f919ac403537
SSDEEP 12288:IlFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:Il8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 696KB
SHA256 2efeb5edaf3138ab641d8f47bcbdf3b6bf4b386de06a48f7e507b18cdae74eee
MD5 14ba4c136f78715f745bb37a50d60cbd
SHA1 9bf757c032dd64805cb0253f5c84c25fa94ad339
SHA512 cb5ef1da9763fec2dfe8896e37e73de2f7fb3e6d001b979b65000f97842a6368c6138f653a9995c7af90e8797d85a10e35faa793e62f543c82440bebfceb3929
SSDEEP 12288:9FYq0SyFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:9gSy8NDFKYmKOF0zr31JwAlcR3QC0OXn
MD5 SHA1 SHA512 SSDEEP

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 093678f365f0658bafc43ab4ea81250ba207044294c14f076132464d818ee777
MD5 bfb988d84306866d6548feb48ef6b7b3
SHA1 89449ed8be286d6f1c92ca4f712bf435b0e6725c
SHA512 744c552e3656e3655ef91f6429ffd168b6a376263a0b338d8cbc63df2f50debe08fcc274778db0a64623d3d527193389aa29721066a7d5ef49f0cf970298bb1e
SSDEEP 12288:kIFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:kI8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 09872d60bc9e5e7b0f70827b72506e0eded14c28ea093c34003a263c80458691
MD5 edfb8f320e828bf51808db606a4cf313
SHA1 941f1667659221be3ed8954a4a1fdba6d76deaca
SHA512 f779345e97dfc23c1861010880a0bb258e4f6848a75853949d7b88f530e8dab4fa9f71963a27c237381fa34011b3400bc3e8b54a3c47a7e0af6c95acb19522e8
SSDEEP 49152:pa0h2GEkuAe73q3pp46zwwQOgDUYmvFur31yAipQCtXxc0H:pa0hNYG4JwqU7dG1yfpVBlH
MD5 SHA1 SHA512 SSDEEP

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 659KB
SHA256 7a7d21017b54d90072cf2d96a0329474d67e4ebdb2a69f77acccaecbdbd3bdd8
MD5 9e1c87236122634d0ef5a50c6405c52e
SHA1 aa87550246553dfd7fe01584b7d7b1a02428df63
SHA512 256b957db929fbf68337c14e4ef5e31902c2f6c30c4b2a6d3be7c2f13147cad44028ea73e6259c3cc826a8d154b253dcf9c334ca35b56fc0cf07f3581eba0f3e
SSDEEP 12288:5hbHjfXjFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:5hbHjPj8NDFKYmKOF0zr31JwAlcR3QCx
MD5 SHA1 SHA512 SSDEEP

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 4ea68c0657a81a63c615aeecc395c98c920dc7da808e7d575e27c403aff28ac1
MD5 d37ae74156c011db4b6c3bf498bf8dbc
SHA1 e1707e2293797dcaf7cdb01740be4754efa9f8b0
SHA512 1c074bb7f696fec91576f399a236db62cb24435797babb5ab2c7a2c8df48f078561ceba4306f5eefdcecee34a89dee3a9a48f97977944a81b2f8f9b0f5a15380
SSDEEP 24576:k3YgnJcRTk4yti+R5dpR/L8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:kIgnaTk46ppR/LgDUYmvFur31yAipQCx
MD5 SHA1 SHA512 SSDEEP

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 578KB
SHA256 92a420eb567a90a20b8f5cb6cac97db2810d38168f873e75505f975edda5bec4
MD5 90c09540f4ebf25f8c2489a9d015457a
SHA1 9f4a589332e5ef343419f220619e970ad3ed92f7
SHA512 dd57850baa110a3afa9d74ec43de1a7b0bc3e148300020334464156f7d33f57a41ef04cf5e8ff885982d6cc5d4a5ac60b0faf3c218e832399039456ed78c3234
SSDEEP 12288:l8FCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:l88NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 940KB
SHA256 4157a3c06d7f5b2cf773c34fde1e0d15fa6b3536ed8e8f2b6a58d4fc8fce4912
MD5 06df3948739ef0bf8051abd7e1d8f9b5
SHA1 a5be3fd72d6e2df345f67a55c85835f269b6a06f
SHA512 d1dd15bfa42d8647448591cc570e02d1a5d8bac58bdf8119df8a2c98f98a998420b19aab369cc9ba18456d3a5bc2aca61fd07460a33b4c6ef28a4ddc18fe5914
SSDEEP 24576:CpL3UTp8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:CpL3UdgDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 671KB
SHA256 304d70afead0aa8b9de6f43ecd4bd3f34530463007342d690d68ac0514a0afc0
MD5 e1281ebc1ec29149e288d5ee7cb21faf
SHA1 6443db219afc49dbce595c08ced7360f84004ac8
SHA512 4396917b3515f3c76cacb60c400339db49af2d3f42a1459e457b180e70702cb37d7ddfc233adb883733c2035a801ef0f0089054428934672893b1ecd94323423
SSDEEP 12288:LpFtpO9FCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:XO98NDFKYmKOF0zr31JwAlcR3QC0OXxx
MD5 SHA1 SHA512 SSDEEP

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 ca2bdf1f09ee59869a524d47a1f92977c6fcacf0182e4d73daa1d1cbd7f7a319
MD5 54e56cebd55899693661f55bfc0f39ce
SHA1 7f8139cee050d8bee89f9a5b7adca5d5fa32e9ef
SHA512 8a02769680dfee7f186f1291987fe8cd8d5e74cd873d35fe8c49f5719d5a1196cb5084353c44b82ce4a5d1fce3959c10d2a33a32af948bf74a730b7583c23926
SSDEEP 24576:C7NM9YmZqmWMUkPjZM48Mv6bEhs48NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:C7cBWMpPjN8DbEhDgDUYmvFur31yAipZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 974ae12dff10eb6f5ee9ee2b51e412d849a47306b8c12d4c1aadc0c8f0578294
MD5 1fcd79403e5c0bcdaf43921d95107080
SHA1 0b8a88ddc3f22ee60f809928c87047d15178b472
SHA512 2599377b098468f5d4743be7776cc23008e267ac621bc57882e376f5082900b8089d311db269142bfb6a2fcd51515803233c9cea503c4a8f0dd5b8b3e73cc4ce
SSDEEP 49152:YF2YuHNETovcvNYf8kmYgDUYmvFur31yAipQCtXxc0H:d6tCf8ksU7dG1yfpVBlH
MD5 SHA1 SHA512 SSDEEP

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 1454b95d5ceb34224f678c7f0582d76425ed15dffe57e34ecbe59da40d1e8b8a
MD5 0cc43fe0f55d1fc0747363267581e760
SHA1 da17e9a9708efd7034e05c65591d001e1dd43dc4
SHA512 0c962f786eaae63d8fe21ce2516127017884f544972d2274ad9cd8070068c55e0b4be459e685da2e1e05130a0cd9766636f949ae07b3afa3f098be8fd8f9d2a6
SSDEEP 24576:1AFs06+Omlf3NXEbToB8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:6Fs060lVXuugDUYmvFur31yAipQCtXxx
MD5 SHA1 SHA512 SSDEEP

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 885KB
SHA256 eb09f43add5b32c070dcc2e851f743a4c4bffd4af9193b12ca9578ff22a10943
MD5 fc5029c8f4673314e4143674759b9c9f
SHA1 23b21329a424186d603a0b21bfa26fc3ed088ad2
SHA512 9fd335ac256033b63c353b5c7154092de3d7ad9cf39fe05d607f483c45dfb1f0722556b6ec510b7f6464ccce34cfc29e80c9ca8c2ec92a368e2429074a7876fa
SSDEEP 24576:zJnJ5D3Wtu8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:zJnJ5DGtugDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 e1107ec2d65d2566b8a1d575d7773d702ec900826b2c620f06d509cb06c3adb9
MD5 406c841407762cbe9d39d6c2be1a77a9
SHA1 5b235b3d255ffb13c5c6816a96b5c395b7e02153
SHA512 92a31ce121f427971ae6038c90d645992cb5de5cfeae36a98155cf508283920b14742fb9c0934d2ef35971d46c3033aae6890335eabbef472743522414c11e54
SSDEEP 49152:Ko06DIKdwc+eQnSt65aV0gDUYmvFur31yAipQCtXxc0H:r/U7dG1yfpVBlH
MD5 SHA1 SHA512 SSDEEP

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 661KB
SHA256 af2492d66c23ba459e2784a7c2ba87b32d18a109a4f7cc271500e88414f742d3
MD5 7037672be94a247b501dc9e039f9e06f
SHA1 084fcc41430685fd1362d543626047f9a4eff1a1
SHA512 e3ff07a8e35f0c41d52122b0d34b30746354d1bed8410a39b8de5d600a4dec804d55d5f7adcd1a4cea1977e0b875aecb43579d0aa2d2995dae17b10570eb8098
SSDEEP 12288:YEP3RrXFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:zrX8NDFKYmKOF0zr31JwAlcR3QC0OXxx
MD5 SHA1 SHA512 SSDEEP

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 712KB
SHA256 8b6cabe2ca4dbd819cca8b8ff86ccf4466c5639b74734b7d4d1e062d004ef0e8
MD5 bedb2c11cb13e3c3d21ac1b5d22f8d13
SHA1 1bf29cb909fca878d85353039640d808ed4e13c8
SHA512 d7a3abcc3c73a8ff46c8785bd0cc8497d74c92f6531830b6b18be5cf9899ff11adce719607e691a664c152d00023627aa996a24235f59731c918cd22cf82452b
SSDEEP 12288:ljkyzFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:lIyz8NDFKYmKOF0zr31JwAlcR3QC0OXn
MD5 SHA1 SHA512 SSDEEP

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 584KB
SHA256 f09648e48555a0c32b8a627648fb99aa02536edb7167a389e8f3bd097e0106a4
MD5 1019cb36bb21df29f8782d3434cc5479
SHA1 4074196e4b9f08993a1e1606f98fa38350057eb2
SHA512 84b1390515ce2432468ca506f0f48d416e550418fa1a0ee0981a3353fa4278971618f19b47c15f2f30b5d81d0b64e9cc2e42618954cfbc78f1e44e6c30fb853c
SSDEEP 12288:LFNFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:JN8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 f99dad118182ca1fae6137bcabf5f3bea00bd31d67cc22f5f827382715b3477a
MD5 f0f56b0db6a968174c3b2cfa8bc5230b
SHA1 c0382d26f748e46d8b4e740ddd5584331283ba17
SHA512 16e5b0ac2efc3ae7498510112340a510084d9fae3620ca239b1211ffa6797b6639d7f70b86e084f9e02b9a536837fe43e4b77b373c78d192e951fca353fee189
SSDEEP 24576:SQ9MxZKdcz97w3Q8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:SVKXQgDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 772KB
SHA256 0dc6135c4fd6b2b213b512d8e737cbd8b13021d7b18900cd53a725765751a44c
MD5 915448de0c2331fa1b76b24dadbad6d7
SHA1 41204021151521095b1f2c905f4a7ed631d5ab60
SHA512 66d01a0a000d2e26ef6a912eeecdb8769ff05cdda8defdd2f74ec5703aec41beb85817c152c26aa35abe8890661c933da850d0c4f116950ef19a800bc026c8c2
SSDEEP 24576:VyocxAp38NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:oocxAp3gDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 f0adc5d94eae01720b00bb402f4f71c9cc027d7ad1a5ffe626e5f924bcea5109
MD5 f869e888bf9fc408293c3d67e44904aa
SHA1 2f6bfd70429ddbd8bc14a32bcb68a3e9e6b52d42
SHA512 d2db907b129534acaae0557c20d593e52694610612e98715e9deb3735a6d45c6049cb5895983589f5af53a8a6598bcc701fb8041fa79710ee5930ccd19c82346
SSDEEP 49152:xWcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIK3gDUYmvFur31yAipQCtXxc0H:p0zuNIeU7dG1yfpVBlH
MD5 SHA1 SHA512 SSDEEP

Submit Download

office2016setup.exe

Path C:\odt\office2016setup.exe
Size 5.6MB
SHA256 17ab7770b178a544cccf35f09294e4d4a52123cb1bc4e8c1a0852e41ec141139
MD5 e30b8dab38f5d46cbc07d67f5b42cb0d
SHA1 19e21144ec29a53560ba735a44c1b14e05928399
SHA512 1fde68bc55f64c304bdced002e82ae4f5918b14f5a0ce9854592be4ac78ed0d26e584f5664aa265dcd918d11cb5fa0b27f1b8c6560d2f108b9aeebcdfb386840
SSDEEP 98304:Y7M701RgX4iuSl1DtlEq81xZPGnzURnBh6gGL/QmvD/cTwY2h3FDU7dG1yfpVBlH:SM7pTXexZPGzURnBh6gGLF+W3NUoiPBx
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/992-333-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/992-325-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/992-391-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/1680-57-0x00000000016E0000-0x0000000001740000-memory.dmp

Download

memory/1680-50-0x00000000016E0000-0x0000000001740000-memory.dmp

Download

memory/1680-65-0x0000000140000000-0x00000001400CA000-memory.dmp

Download

memory/1680-61-0x00000000016E0000-0x0000000001740000-memory.dmp

Download

memory/1680-51-0x0000000140000000-0x00000001400CA000-memory.dmp

Download

memory/2176-351-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/2176-421-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/2176-359-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/2464-447-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/2464-380-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/2464-387-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/2468-236-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/2468-45-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/2468-46-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/2468-40-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/2708-339-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/2708-408-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/2708-346-0x0000000000600000-0x0000000000660000-memory.dmp

Download

memory/3012-251-0x0000000000540000-0x00000000005A0000-memory.dmp

Download

memory/3012-245-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/3012-311-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/3012-244-0x0000000000540000-0x00000000005A0000-memory.dmp

Download

memory/3164-239-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/3164-66-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/3164-67-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/3164-73-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/3368-365-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/3368-434-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/3368-375-0x0000000000E60000-0x0000000000EC0000-memory.dmp

Download

memory/3448-378-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/3448-312-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/3448-321-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/3624-13-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/3624-0-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/3624-11-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/3624-7-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/3624-2-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/3632-285-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/3632-297-0x00000000004F0000-0x0000000000550000-memory.dmp

Download

memory/3632-350-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/3644-272-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/3644-337-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/3644-281-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3672-409-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/3672-418-0x0000000000AE0000-0x0000000000B40000-memory.dmp

Download

memory/3672-549-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4004-15-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/4004-16-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/4004-231-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/4004-22-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/4020-470-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4020-461-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4192-271-0x0000000000520000-0x0000000000580000-memory.dmp

Download

memory/4192-256-0x0000000000520000-0x0000000000580000-memory.dmp

Download

memory/4192-255-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4192-265-0x0000000000520000-0x0000000000580000-memory.dmp

Download

memory/4192-269-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4408-448-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/4408-457-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/4472-444-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4472-435-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4588-363-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/4588-374-0x0000000000750000-0x00000000007B7000-memory.dmp

Download

memory/4588-306-0x0000000000750000-0x00000000007B7000-memory.dmp

Download

memory/4588-300-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/4744-429-0x0000000000610000-0x0000000000670000-memory.dmp

Download

memory/4744-424-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/4912-28-0x0000000140000000-0x0000000140237000-memory.dmp

Download

memory/4912-27-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/4912-34-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/4912-235-0x0000000140000000-0x0000000140237000-memory.dmp

Download

memory/4956-405-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4956-401-0x0000000000680000-0x00000000006E0000-memory.dmp

Download

memory/4956-407-0x0000000000680000-0x00000000006E0000-memory.dmp

Download

memory/4956-392-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/5092-550-0x000001E5F1410000-0x000001E5F1420000-memory.dmp

Download