19f8b6afd690f191cae03cd959f4160bb723d23b4f4e92557ff1652c9d0d4e38

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
04/04/2024, 11:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-04-04_9d7a7882fdef34a3e60fb7cdfcc8bd2c_ryuk.exe
Size 1.7MB
Sample240404-nhxmfaeb53
SHA256 19f8b6afd690f191cae03cd959f4160bb723d23b4f4e92557ff1652c9d0d4e38
MD5 9d7a7882fdef34a3e60fb7cdfcc8bd2c
SHA1 85117bea5ebaa8140f70501b39999f4accf40764
SHA512 b607a81643c2e26e2d754455418184d629d1f15e2036b467851569c2d0ab7837cf746e894faa865004f8c6415ec34623718424c93270fbac6a7a71eb491d4af9
SSDEEP 24576:D6V6fC/AyqGizWCaFbykXN4qLqEIH7sTrvIr:D6cVGizWCaFbVd5/IbsT0
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
4600	alg.exe
4368	elevation_service.exe
3464	elevation_service.exe
2820	maintenanceservice.exe
2224	OSE.EXE
1388	DiagnosticsHub.StandardCollector.Service.exe
2768	fxssvc.exe
4156	msdtc.exe
2748	PerceptionSimulationService.exe
2212	perfhost.exe
4440	locator.exe
3636	SensorDataService.exe
4964	snmptrap.exe
4428	spectrum.exe
4424	ssh-agent.exe
4780	TieringEngineService.exe
2036	AgentService.exe
4632	vds.exe
2760	vssvc.exe
4332	wbengine.exe
4656	WmiApSrv.exe
2244	SearchIndexer.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in System32 directory 24 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\f905dfb7205991d4.bin	alg.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2024-04-04_9d7a7882fdef34a3e60fb7cdfcc8bd2c_ryuk.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdate.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_77375\javaws.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_77375\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateSetup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	alg.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9933 = "MPEG-4 Audio"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002ac405db8286da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003ec7c7da8286da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000429cada8286da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ed4b2edb8286da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9923 = "Windows Media playlist"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
4368	elevation_service.exe
4368	elevation_service.exe
4368	elevation_service.exe
4368	elevation_service.exe
4368	elevation_service.exe
4368	elevation_service.exe
4368	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
660	Process not Found
660	Process not Found

Suspicious use of AdjustPrivilegeToken 42 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3696	2024-04-04_9d7a7882fdef34a3e60fb7cdfcc8bd2c_ryuk.exe
Token: SeDebugPrivilege	4600	alg.exe
Token: SeDebugPrivilege	4600	alg.exe
Token: SeDebugPrivilege	4600	alg.exe
Token: SeTakeOwnershipPrivilege	4368	elevation_service.exe
Token: SeAuditPrivilege	2768	fxssvc.exe
Token: SeRestorePrivilege	4780	TieringEngineService.exe
Token: SeManageVolumePrivilege	4780	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	2036	AgentService.exe
Token: SeBackupPrivilege	2760	vssvc.exe
Token: SeRestorePrivilege	2760	vssvc.exe
Token: SeAuditPrivilege	2760	vssvc.exe
Token: SeBackupPrivilege	4332	wbengine.exe
Token: SeRestorePrivilege	4332	wbengine.exe
Token: SeSecurityPrivilege	4332	wbengine.exe
Token: 33	2244	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2244	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2244	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2244	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2244	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2244	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2244	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2244	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2244	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2244	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2244	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2244	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2244	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2244	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2244	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2244	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2244	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2244	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2244	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2244	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2244	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2244	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2244	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2244	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2244	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2244	SearchIndexer.exe
Token: SeDebugPrivilege	4368	elevation_service.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2244 wrote to memory of 4444	2244	SearchIndexer.exe	121
PID 2244 wrote to memory of 4444	2244	SearchIndexer.exe	121
PID 2244 wrote to memory of 4500	2244	SearchIndexer.exe	122
PID 2244 wrote to memory of 4500	2244	SearchIndexer.exe	122

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2024-04-04_9d7a7882fdef34a3e60fb7cdfcc8bd2c_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-04_9d7a7882fdef34a3e60fb7cdfcc8bd2c_ryuk.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:3696

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:4600

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4368

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3464

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2820

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2224

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:1388

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:1924

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2768

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4156

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2748

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:2212

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4440

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3636

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:4964

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4428

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4424

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:3952

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4780

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2036

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:4632

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2760

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4332

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:4656

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2244
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4444
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
  2⤵
  - Modifies data under HKEY_USERS
  PID:4500

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
Size 2.1MB
SHA256 67ad2dca4eea747350bb2e75a180192fd7d2466cb4ed7c46aab63ba0e2f768bd
MD5 46d014ae39f923b1b91345e036d96223
SHA1 7fcb16619f38d7dec8af7018443a8098d8d9f082
SHA512 5b768958f8680c01a0f7196ec48726a285500ede40ee2fbb53c3893fa04e59d457064fe63fce89223b30ca4750ab72dff086abbb5ea591d5844305030bab7b11
SSDEEP 49152:6uYk3H5koUXfTqkkYLO/W2buywzMbOX+T7z5Wd5/IbsT0:6PfTqi90by0bs
MD5 SHA1 SHA512 SSDEEP

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 1b7d770c0738fe43d79acf843aa5fbecddb71394d27591368a062e894ba1058f
MD5 1d055b8e85269f9abcd037e1937c2871
SHA1 88c8a8b3bde3dc9e1c9c67b59a33e116350c60ed
SHA512 06baa4a0ccef49aaecd2f38c491732a6b5719f39e7c9e0ec68203a113a85fc45633e9dda72a06584a34882a1e1223d5dcce4f1c24a50f0ce0c528d3ee9f72f27
SSDEEP 12288:wCiP9Q/JcuiIcZRXPiqwIkFPqQKj8DkBIHCP2sEMLRv1vIVq+:CPsJcui7XN4qLqEIH7sTrvIr
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 10082329930d9c0d3831c9070020ad3c48038df475b05a3db950a06ce56624e1
MD5 62de7445e75c91c0cb8759b91a0ca868
SHA1 d5f386284f6203c51dc274d34979de1b6cbda9ac
SHA512 0add86138eea41ba49a2429d29aff4abcdae2957ac3a1069b9edae56ba7a541bd48a48144ff3e4fe40bf72e83737522ba4cf5031c59749e2d0b66f6982cc6a34
SSDEEP 12288:47a3iwbihym2g7XO3LWURfh4CoUcZRXPiqwIkFPqQKj8DkBIHCP2sEMLRv1vIVq+:1+gkEjfh4Co/XN4qLqEIH7sTrvIr
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 15e1e1d874c0bad41516ece9afcde7435e6c6a1d2ef3dcde174866015aa72408
MD5 d7f3c05034320f3e0928e8b4be48348a
SHA1 224a9c0953df87966f63238e11fcdf5587588162
SHA512 48fbabc49188ca90c72291a845263fd2fbff825191d22aabd37624a80e5a70a8fc93346d908adc07e6983939015a18f43861a248a03b01f4bc934e0bc131c793
SSDEEP 24576:BBpDRmi78gkPXlyo0GxjrqXN4qLqEIH7sTrvIr:TNRmi78gkPX4o0Gxj2d5/IbsT0
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 071a3f49cb7200b3337e2273de3fb8a171b97350de19a6b8e85c0bdfb6428de8
MD5 2c5e783ebbc11aea81f42769377d6923
SHA1 fe050c28bdd2baf1cd58ff062807592c9547dd5a
SHA512 9ed25780f4e0342990444e1cf3c63b0e108933da729752a79f5d99a7c311e3057693b34a680266c0cd5ee8ee7ac8a6145ed5dd78f276e2974afe6ba9f7cfc3d4
SSDEEP 12288:sfC6Aj+TN5uixZN+8rKhUdTC/wE1MD0Ca5ZIXVUcZRXPiqwIkFPqQKj8DkBIHCPQ:ALOS2oyPIXV/XN4qLqEIH7sTrvIr
MD5 SHA1 SHA512 SSDEEP

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 ad1eb680cf3f6f3d3a42e47a520b88f975d44f8a69e388e3971a9c000c67b37a
MD5 573427113a81693b6f566fb972888c90
SHA1 f9d2cd938a07d1fb27dec52dd4c644d524e6be57
SHA512 09b595773d3b11101b64fdac17139006cacbf0f2fa368b569fcde6aa0a48bcf5f37ac287a36280a528c7e6770807e65bf131043cb8902e0b21b889a9a7559340
SSDEEP 12288:2xicZRXPiqwIkFPqQKj8DkBIHCP2sEMLRv1vIVq+:2xJXN4qLqEIH7sTrvIr
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 4f38d9695f03fd43a47529a67365ebedecd91f70d36259e2e704e3df8ea78d2b
MD5 2aee06d90a0d5fd84e6b85266ea7fd83
SHA1 6bc1a9a100e2cbf475350515a58bde3b6b3fc657
SHA512 73dc5cf54ee50dd6e5c0ff104c5b1635a0ae5124328edab9a09e572b5db7e453b2707a4de14e7e3c936a0e5129da1b8a73fe18e21452c4fc0b669834aaeadaad
SSDEEP 12288:seBNUbTVO86UxcZRXPiqwIkFPqQKj8DkBIHCP2sEMLRv1vIVq+:sJIUEXN4qLqEIH7sTrvIr
MD5 SHA1 SHA512 SSDEEP

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 ee2d952e0990f81fa499dee9eb4ea4b4962b25e01efe8c4209b84e01f090b217
MD5 61b0ed3852d9c154727e9779caf41ff0
SHA1 7a2768573036462e3ec4b01488441ccaa1a45f92
SHA512 fe672ccb90f529a1f568f2633951fc2a99398cb87844e71a3e357395e9c1874b6f03a2c7aed439e6fa571ffb36e75d66a54db279a80b5b1954d8c1c836fa71bd
SSDEEP 49152:SQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THZ:SQvGAdlCEL8c/yRNw5CT0bs
MD5 SHA1 SHA512 SSDEEP

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 3220bf24d3af5a316b83b0910ccaf72a86a0e1fc535b0a1cb9ffbe96d9f445b7
MD5 da16a06d6b041f375550582856af3760
SHA1 234d794e2aa7d5a2d5dff94d4425b84f873436f0
SHA512 3afee5fe4c94a32d480b58a6224435324d7caea57dabf9ffc212f078c71fb3282d209e4611601d9f2261b6a2012b629e46a3ab1d735594056c619cef857e12f2
SSDEEP 12288:+AwSfxL/2Dc3ODLLmt0LDQewsAjLcZRXPiqwIkFPqQKj8DkBIHCP2sEMLRv1vIVZ:jHewsAjyXN4qLqEIH7sTrvIr
MD5 SHA1 SHA512 SSDEEP

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 d06efc3f0b737d00c57b381cd91406db3fb956a08c8b22463a0d39d6d19d05f0
MD5 5ffbe79cc5afd10106b1ff7fb91c79e7
SHA1 f5d73a2b6c298a2151e89a0b958b891d6abbd001
SHA512 d20621d05b89ec7f366388949a848a2b3f314185e6258be56a6b2f3f867f4daa9a6662e7434976ddf80aa55988c81b8d5d4dffc58fc2a4d05b3be782e902544f
SSDEEP 196608:7UEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJH6:7UEtQevvqc2W1cpV2EI326
MD5 SHA1 SHA512 SSDEEP

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 64c7fe833a5b5d82a7aef3f25e61371a15ff8688812c24133228bed8b8b20f1f
MD5 bdb99438842e331e6f688a495980cf5e
SHA1 1e52d6c23b2df869d25342f87e110b738431f9b9
SHA512 fc04f806c92bdc3548a0d21869de70dcdb7128a4a544f6ffd1b2244dcea5760afa9743e8347d76ec5c2ddebeeafdb2c352f622c502f26d85b40daad272870b49
SSDEEP 49152:oCbRquA/m2yL5zTfFiV+XenmE3/zSd5/IbsT0:BoquVjnmv0bs
MD5 SHA1 SHA512 SSDEEP

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 d1dff893908d834681d835c3b466bb312d58579cac29462a57b6297e5efe7fd9
MD5 b649e7407d308a75bb0542b25bead020
SHA1 edd2ce6eba14c27bf9f1a8654f6548f4ccfd2e89
SHA512 d2c46caf520b99d6062a1f339e6f251c650fa3d9a031ceada0255d54c2191d2bfff3c15bab6cf4073d5e802c1252b6d38c02e40b7896e0b7b4b4214608e3e932
SSDEEP 24576:5AhGLJIFoiwtA5l7S53PXN4qLqEIH7sTrvIr:5AMyFoiq5fd5/IbsT0
MD5 SHA1 SHA512 SSDEEP

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 3af61f1179964a59ac1ba64d0e9c85194a0fb94f870a7391f7491c2a11be4a23
MD5 2d107dcdd1ded87a8e098b6107bfd174
SHA1 bb62ddd1f96d0563bcbc3219e184189877c9bea6
SHA512 c64db7ebf0401669801421b144ccac1bfeb132a1bf70af6689bc17993db5bd7e83f427404b51a293a28b2f6122d26bc83b495c070a87b038f91cf266c745a9ac
SSDEEP 12288:5mw5HEjsChNnBFgl0WDm+CgcZRXPiqwIkFPqQKj8DkBIHCP2sEMLRv1vIVq+:Uwu+OWeXN4qLqEIH7sTrvIr
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 fe49fa71840972f0d05e861f5150b0193fb81f2232447398eecc456e47b0830c
MD5 6892f05c3c222886233560115e62d69c
SHA1 2db764e6fb09b8f0ce60855f663906fb344b7853
SHA512 79f657393f0b655a73cb289bcd1d83122147e487a58ca2782b8b271d9072411abcb803b3c644b2bd8f09f8a9456b1faa576c95d43d01382c3bc9bea103b698df
SSDEEP 12288:S3Z1IybcZRXPiqwIkFPqQKj8DkBIHCP2sEMLRv1vIVq+:KZuNXN4qLqEIH7sTrvIr
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe
Size 4.8MB
SHA256 4a38ddc64f5e98f34c3d508c1b578cc006f3dbc39bc53b15d0031d2aba2f0778
MD5 091494d414cdd355290b0ba83f3f28b5
SHA1 9784a0155f1d7c5dd3bcfbd29c3ec51c81b521d6
SHA512 0aecd8172c363338f5df0e0b5f985b2ff4805b8a4fe9db8131cb349c9cf928ceefae60919f7a165bc0b37b558f748fa7e292c3906dad09f6bc29d5542665693c
SSDEEP 49152:Gj8f3jtqiCLg9LK2hIOR+k9jdAsizqxSiZ4K5MZqkL92c6nkdmbDfiIerM1R6ZPY:xrZ4K5M+XDfiIewG+x6xZ14s0bs
MD5 SHA1 SHA512 SSDEEP

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe
Size 4.8MB
SHA256 adb4183ed45cf0c8b10c2b99960b47da9ea8e6ef1dc26a5c9b3b141238a3cfc0
MD5 e5b5ed3cf92d61d2a424a900694d9ff3
SHA1 ebe43940fa16d5187cd4a39708e565fa5d95dd5b
SHA512 a6889c4141b8bc51179309cbcf64a1643430f7152987717fd4ebeee9baa4a150d88493b08975c31bbe38dffe1799d21d03f4184785be1ed8f6ad478a5700d39a
SSDEEP 49152:Kj8f3jtqiCLg9LK2hIOR+k9jdAsizqxSiZ4K5MZqkL92c6nkdmbDfiIerM1R6ZPY:VrZ4K5M+XDfiIewG+x6xZ14s0bs
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe
Size 2.2MB
SHA256 ae16fa72682f1cc710d0596642c8f089fee13ebbb71ad3e3395872c88133789f
MD5 2ba8033b7d0328f578110b4e67e42339
SHA1 d9e816132df38202049661628933dd75c2f19ff2
SHA512 d6e00048c2d6194dd7d31c1686694f6de6fa62dc7406927d2d038bf5edc71bc3c116a615425f771dd7bcefd2dc40fa2dac55738cb43ed620a92a8f278101016d
SSDEEP 49152:wfzabJ8llj+SWWi2mkx+X+diPd5/IbsT0:xui2A0bs
MD5 SHA1 SHA512 SSDEEP

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
Size 2.1MB
SHA256 a483ff12bdc45f4517f6cde9f15e20176d5f89ada08fd6d35a39368b65353051
MD5 e2b2e382e57a22546b919df0103b4a95
SHA1 1df8adcf6ccd252cd29ba5c4448f10e58063d3d4
SHA512 b6375452516b2ba32aed3b788b7934e083d9cf7653c123859a13c126eccb696355d24ced03150ab058b025f57f684c65ae13a9d472f7d857b90fb1136cfdf163
SSDEEP 49152:Za/3xXBSZ4K5MJ1LvTMxbfsYBYSgxu9+fw4TMd5/IbsT0:pZ4K5MJabfsYNr0bs
MD5 SHA1 SHA512 SSDEEP

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe
Size 1.8MB
SHA256 ac36e3e3bfa06c0f18c62356469c898a94222077ef87a4698f32c0004ba4f068
MD5 eb133ace92ef2eb4f34836440b6e6df0
SHA1 eae921ef3dc9bf2c02f5ac742675003eeabbdd19
SHA512 611b49d2f4a98b04dbb0381bed6258a45d9f05a2b427e6ec21e6ec196da6301994a969ca90d5702d06f5b5e75401149eaa5e6f6bc91077d2f547bd9252a75109
SSDEEP 24576:HgNJw85yUKzDu/9gKPlfLO8C49BgKQXN4qLqEIH7sTrvIr:HgNJtUzDu/9gKPxHC4ud5/IbsT0
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 1.5MB
SHA256 e20d30136eca29ff517d18eaed07a8e04de0df1f9ba11d802bfc2742cd669426
MD5 92392daef9f1e704b39a63a9a76dbc74
SHA1 b1905f0e315425dd3cd06d3b7c25d0cf85ecde8e
SHA512 acf3a9d6a0f03ae95dcc95b31fdab31390614b247b389798423f3e0b0d3c5e84bed5ce2db7df7daf8fc255b07b2f2e92b082a08a5b1e9cf07a06640ba832bac5
SSDEEP 49152:gOBynH1wM+v6UJxLQd7BHjdf0d5/IbsT0:kn4LQd7Ls0bs
MD5 SHA1 SHA512 SSDEEP

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 05e97553a5e09c6a5e8582cee43f3715e0d71c94e4de581f1fafee28a3d73586
MD5 edaeb21922f6799d9cf83954fb61f93b
SHA1 e29f7441c5f2e58309e1c44e1e477b93c073afc8
SHA512 83c30747b3d3f80530719a5d5ad0820b97f8c5ae8c28186b511dd247c20abf85692d8b3d0954066bca761aba9c8afb7cc9ec1e171b95d4fdc616e85b6f892cfd
SSDEEP 12288:lqcZRXPiqwIkFPqQKj8DkBIHCP2sEMLRv1vIVq+:lhXN4qLqEIH7sTrvIr
MD5 SHA1 SHA512 SSDEEP

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 95e24b79a09e43d76392832cefcd019aaf3cdf9be8b4c57965c66a47ac125d93
MD5 bf82b82417ceee563f17f234b572ae78
SHA1 b56d7593682ff3d90897af81447bfb2ecd555e78
SHA512 07572bec1f4a8418144a6da3a27fc476d0695daa81bb765fb6ae518854c247615293394b9714e50916c365a058ad10b50792ba62d922b01357ffcce036c21351
SSDEEP 12288:0ncZRXPiqwIkFPqQKj8DkBIHCP2sEMLRv1vIVq+:0GXN4qLqEIH7sTrvIr
MD5 SHA1 SHA512 SSDEEP

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 3f5ca0c1da99063d00392823da53eaccf7144ff83a05d6b5b295947032f2d32d
MD5 5cb5518b19abd4adaa0c1df4aa5bfe86
SHA1 34b093f65a9f6135594d730223db57215026c3aa
SHA512 625e153ee55f26e5b16bf1957feddd36b39fdc1b7f2a1376ffb51865aef974365d2d2f115916fc6e17a81937de76f2a723fa06dfedfd61e0704b0a927991a429
SSDEEP 12288:FZcZRXPiqwIkFPqQKj8DkBIHCP2sEMLRv1vIVq+:F8XN4qLqEIH7sTrvIr
MD5 SHA1 SHA512 SSDEEP

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 a6773c766c74c945ca1d1092d5f3f53ecaa3a9649a31eb40cc3f1896ad373a7f
MD5 3ec5bb4e04ad9455b998eb691cbdc7e4
SHA1 73bbf3d9ce9397daa273de703e28def8c3a041ec
SHA512 67d689227ee82f1f9ba15f7faa6754c3526e261d96a4752a917ca47b845267210ef6e89307465e09e75401b39a0e575abb2768f7ff2280084b9da32a6a18e9ae
SSDEEP 12288:hVkcZRXPiqwIkFPqQKj8DkBIHCP2sEMLRv1vIVq+:zXN4qLqEIH7sTrvIr
MD5 SHA1 SHA512 SSDEEP

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 b4ae7110db0c7f5d30f41aec5b17db7cdc654b421dc7c99e504f7ff04e4f49c5
MD5 c00f5d9c22512be7c69bb10ad07209db
SHA1 b55190a44de151e096f735318737ae8ce45b62a9
SHA512 4f5b8729505a0cf6ceeee50556ee4eb493f344f6ca411464cc6c30d6a4e7161d74ac5214067de851d2428ec5cb5f74883ed6ab96062a90bc2abd6f7c694604f0
SSDEEP 12288:lccZRXPiqwIkFPqQKj8DkBIHCP2sEMLRv1vIVq+:l3XN4qLqEIH7sTrvIr
MD5 SHA1 SHA512 SSDEEP

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 9d733d026f2a369bae7f381ed6a930bb536c8c1e0bbbe72482e7e78e27318223
MD5 65d43c8e5bc0b68fe75619aa78251dfa
SHA1 61770c41f831e4c6babf94b64ae387f9618af809
SHA512 91140c64f2790f094bac509b66d431bd56f3954fd47bfcbd3626b90373ef4abfda51c5b7d100cbd6e13ca8be611185bf92f55d9c58ab2ed6140f5b0bc0ec9301
SSDEEP 12288:czcZRXPiqwIkFPqQKj8DkBIHCP2sEMLRv1vIVq+:cqXN4qLqEIH7sTrvIr
MD5 SHA1 SHA512 SSDEEP

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 c92a6e8ec9dfcd6df9d983936d5880497ba3b0499a8a369e356e704bc6f76b12
MD5 81b3b028eb8f92e6903a65d5b508fe5f
SHA1 3148d7d1a97c8ddcfcef12d3ffa7fa4da6564fbf
SHA512 91bdf0993de97e3f018eb824e24fac71d6939fb9ee1095ff2a5d2dc62dd4f06483432c489f304108b29898cb0b6086e905bfb6aee98450902bb3bf6181b73ecf
SSDEEP 12288:z/cZRXPiqwIkFPqQKj8DkBIHCP2sEMLRv1vIVq+:zuXN4qLqEIH7sTrvIr
MD5 SHA1 SHA512 SSDEEP

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 b7ab0fc9e0196b371184f01aa4b769bb9d95f4186b61a12894b5a81e42b74479
MD5 c4d3b9d6a2d62220ed9541f5d3e21e14
SHA1 25517e10c8cf8a57af41500a4054b99282a0e626
SHA512 3f7061f57f24a2308bad7d3b1fe1ca1581537ce9ece492f2686ab61472d3819cfffeb77f4b1ddd742df6d47be970df94b38373e435fd22479905f0af750d9778
SSDEEP 12288:eiZwbwzzFEoS2cPvyHcZRXPiqwIkFPqQKj8DkBIHCP2sEMLRv1vIVq+:BZMYzFVSOmXN4qLqEIH7sTrvIr
MD5 SHA1 SHA512 SSDEEP

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 ab2445d69faa9c03cad836abe14a7ab87ccd561a53ea0e1f184707c7c0c13a0f
MD5 e2d980f17ca87fe1d9ab6c932142cba2
SHA1 eab9fd6cfb4fe782812fe7c22416886202a9d363
SHA512 264600f1acf068dc1bd38f85f6542271de10eaae223563344084e407778eb19fa43d55f8b8e9d0c9d9f8bdb57b8d6bee99c0f3b29e16dbfb2116d4c4f27b5fde
SSDEEP 12288:q+cZRXPiqwIkFPqQKj8DkBIHCP2sEMLRv1vIVq+:q9XN4qLqEIH7sTrvIr
MD5 SHA1 SHA512 SSDEEP

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 244fc389a3998382e5ee1c7f9c10a287c23f7f2e1ac28ab2918a00a1efa17530
MD5 750c36021fcb031d0d9653e5c3d992ce
SHA1 d1d3f90ab80cde6d9f9d8a904dad72d1604180f6
SHA512 29abce8fb1cadf40657048177575cdc59fae07a7cc8fc960993d2efcb728708acbfba9baa43c7e008b97c113d3d813ad5338345736268e06fd53265f7c124188
SSDEEP 12288:EycZRXPiqwIkFPqQKj8DkBIHCP2sEMLRv1vIVq+:E5XN4qLqEIH7sTrvIr
MD5 SHA1 SHA512 SSDEEP

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 74ec5167176cae28ad61839d87559a1257e3713f0cd2ef6dd9c8ac9998de2609
MD5 956845c9763d97b3eeb1730a176884a5
SHA1 323171260939626cbe9e2684445c9a5af8a4d529
SHA512 d4543440eaa5a54a4260692710dca5d76e48386d3cff6c879b26b9c9925200f7b03d4d2de9923720247e8cec9de7db9ecc90821aad5b528a71dd608752f95920
SSDEEP 12288:qyPz5L8bcZRXPiqwIkFPqQKj8DkBIHCP2sEMLRv1vIVq+:3zyiXN4qLqEIH7sTrvIr
MD5 SHA1 SHA512 SSDEEP

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 38b70004752a95b3a7755d751e7ef8efc6074b1ee9b100314ab82075cf8a55b1
MD5 755469ef997a73930f2d82b552869146
SHA1 b313571f7ca029c195133b040398a4935ac63c1a
SHA512 f416bb352d6720dfc2d13add6f39b474d56316843ebd02d9699f0dc21b9998fe3119b10f1107a27f97c1efbccd60d7eb6f43a588f8777d0d5f9ad38ff9e9e5f1
SSDEEP 12288:r+cZRXPiqwIkFPqQKj8DkBIHCP2sEMLRv1vIVq+:r9XN4qLqEIH7sTrvIr
MD5 SHA1 SHA512 SSDEEP

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 b842d3d013237d9d176186d1b4547d24420da750b604c078abfc1ed82672c421
MD5 9a3e43a0dcb7f6dbe21e64da0e542ef5
SHA1 45bc1bcf6132e24cfc1b0544fe3ccaf66ea75130
SHA512 c891d476cef5bc715d30ab4faeaf903faf10243388bac5f9fd12e9b8c49e1e39c07fab4b8cf34746e5ed1eeb9e24f04c97724f7410c1d245084c98f63d736c22
SSDEEP 12288:Z+cZRXPiqwIkFPqQKj8DkBIHCP2sEMLRv1vIVq+:Z9XN4qLqEIH7sTrvIr
MD5 SHA1 SHA512 SSDEEP

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 0c3f4a56fa5c5cfeb39983bf2cef3af401958232c759d6ad191ffa91ac7c53a6
MD5 25d523454a3974c755522453a1c0cf8b
SHA1 517f21ce682be0e748583572ee9a3635054cb602
SHA512 1232862ac874a05fae1a1098945202e8dd2a8210cf09a56df5162656197c70dcf579bcdf8764847778628ce4717f16f61b10b3f9f4de409888a9da9daf18efc1
SSDEEP 12288:EyPz5L8bcZRXPiqwIkFPqQKj8DkBIHCP2sEMLRv1vIVq+:dzyiXN4qLqEIH7sTrvIr
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 57b699492992bee80467563dce59c4e48cd7e74283c98ff8c11be7a894eb8003
MD5 1ecd12aa354ea2f5bf9770ffa118b2f0
SHA1 c4e124c87b77b2c5ff2a6173e9c70d2127471860
SHA512 6826e92f4b1a42d0df4d996c539e422619b4c1f44866aca054b8ffe6acfb559d479fc7f7a5b07daff00844bccc7f514cd829409e056c22e3f50e941038b30b97
SSDEEP 12288:tCd9QWYoaLHF3z0z04PDvhJcZRXPiqwIkFPqQKj8DkBIHCP2sEMLRv1vIVq+:4TJaLl3z0zDMXN4qLqEIH7sTrvIr
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 f22c57f0ae5855ae21b8ce8fb2fe19869fc2c4cbd3734a149127d6e6495b3534
MD5 3b41eed321cba172016db1d0550fb034
SHA1 f61409cd5ed5e90cbfcf7029550bba4014bce958
SHA512 0b300e1cb65b2268a3ea9ba502ffa34c2c80de1aef24017b780ee0a890bffd07a6fc0d6bccc860f0c0fb5cc9600a7a54efec63a70dd9b0dfc51c1b549f1da62b
SSDEEP 12288:Ui4e7MRdTfgwCHKy7GLbbdIvYcZRXPiqwIkFPqQKj8DkBIHCP2sEMLRv1vIVq+:U3Vd9CHKy7GZQXN4qLqEIH7sTrvIr
MD5 SHA1 SHA512 SSDEEP

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 b2038e7127e718960ff8bf76cb9719b22b2a5d0f32f1d5ed4608862b17101128
MD5 163969568c3dd163f0191d9cac7bbc95
SHA1 de5cd4d1a73a33d06ea50e3f5e77a7710b327f05
SHA512 cfa0b6045f87b3579aa2197157a245fc0de3d21f69fbd4acdcad043027f192a5b8e9fd1caccb3cf1c133fb5aa0d6f2c71693d8a8add59df14f7b0e7f65465c44
SSDEEP 12288:Y5cZRXPiqwIkFPqQKj8DkBIHCP2sEMLRv1vIVq+:YcXN4qLqEIH7sTrvIr
MD5 SHA1 SHA512 SSDEEP

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 974a0a937ff02b0b4e2a43cca825ebd1186bd6ea663e7ac08ab7641d5979ff89
MD5 548dafd6c8260851eb2c772ad2228b05
SHA1 b3b6768c6ae1e2f9d6e84d0723d5e4488db0615e
SHA512 1bfd0c4a88fa0909d8e22d017809568a12b66583a6fc7f3180ef70e2acc8aa8f26f12356c8097b4c0b9460922adb19de6d117e5337a69d6d6c11a7b57dd1958a
SSDEEP 12288:X7cZRXPiqwIkFPqQKj8DkBIHCP2sEMLRv1vIVq+:XCXN4qLqEIH7sTrvIr
MD5 SHA1 SHA512 SSDEEP

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 dd3ed58f2fa21989fc17d823415019d29c92ea80022ca34d33e00d68bae07694
MD5 ef2e7297650a540cc40fee0b3053ec65
SHA1 5ce8f6b9540458ea4bddab1fef4ae9966bda6f2e
SHA512 d9d45c81148b045bd1b0331b870254ff9f46edb865ea50e89bc833e89fe44a1d9a56f5a71cf6196cf97a569a14ac706609f0bf8109e0e1aaaa0c30b97531be0d
SSDEEP 12288:eYcZRXPiqwIkFPqQKj8DkBIHCP2sEMLRv1vIVq+:erXN4qLqEIH7sTrvIr
MD5 SHA1 SHA512 SSDEEP

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 4fc940f65cc681af7e004d810695fb1ee01ab5065c1da43a393b021ed22acf38
MD5 05d0db79838cbbcb6305d242365a3a1d
SHA1 7a16367d7a07c0275a5197b258cc4d60881562ce
SHA512 a4a94f692de91b5479635d111eec0be578f4e96451fedda393cf8e0528fd724c74bee78e88704c987a75e7a594c948b8f96add7f6d6a5942c4891f329cffcc9f
SSDEEP 12288:t+cZRXPiqwIkFPqQKj8DkBIHCP2sEMLRv1vIVq+:t9XN4qLqEIH7sTrvIr
MD5 SHA1 SHA512 SSDEEP

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 7541ac86a897ff307db67466b6c35818e50d71ed7bfe1d78a17efd732fe125b9
MD5 4634c80ab3eded653f938bb4a70b2d27
SHA1 a23fefba03dc071469b909f142fdbff3f49581ed
SHA512 64fead251387cd6925a296045333876acd1b128e675f9fbe2b3996dd8b56111c875324c933479bd4eb1176fa3b46b1c911060232b59d9ac7fa3b2f87c39dba08
SSDEEP 12288:D5cZRXPiqwIkFPqQKj8DkBIHCP2sEMLRv1vIVq+:DcXN4qLqEIH7sTrvIr
MD5 SHA1 SHA512 SSDEEP

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 28dfa355682abcbe87373312381431e43774e985a843cef5b3d80f2e768a991e
MD5 52a80c0737b53b56596340359c0e1085
SHA1 4792fc3ea464b6d2b655930de586d1688ae1afc5
SHA512 0e647ba5cb44497fef1c9cbf268d761e25300918973989132c828f2c0bbd8cd7c18be1579989934750390157df77c4fce7a31238670a106748abe9475515520c
SSDEEP 12288:PWcZRXPiqwIkFPqQKj8DkBIHCP2sEMLRv1vIVq+:PFXN4qLqEIH7sTrvIr
MD5 SHA1 SHA512 SSDEEP

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 a27865c5d08fc63604ad23d6b0a42c8c1ac613456eb5c0d032bbce308bb9a678
MD5 12bcdd84002b9cac77833a479c3e1200
SHA1 56d36c8abda7df3dcc6bf23e77d74f44fe12645d
SHA512 fcb07cf1a41e03b997680bfecd9bc019d3595f01f919c75a8435c38d8d3e3670abec0bdba7962b3acd347ceee68dc8c700794efe899e770dfc6579f9a9eb44db
SSDEEP 12288:YFiq0SjcZRXPiqwIkFPqQKj8DkBIHCP2sEMLRv1vIVq+:YaS6XN4qLqEIH7sTrvIr
MD5 SHA1 SHA512 SSDEEP

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 f50341e9d3ba8998bcbe570211851a682de439c356d3542b70a114b0218fd369
MD5 fc8ff2820f67ab6bd6c99b3158bba694
SHA1 5e7e4bbc980e354a113655b5385950ff022514cc
SHA512 88e8830f6a528640ad65ab04fb9aacdda57994fe1ceebcae31ce23a7b20577d2184cbb6dde49bb8de1e57f692b404639f88856b4663fa745513d4c1ecefaf6f9
SSDEEP 12288:PHcZRXPiqwIkFPqQKj8DkBIHCP2sEMLRv1vIVq+:PmXN4qLqEIH7sTrvIr
MD5 SHA1 SHA512 SSDEEP

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 e8c081477654d9e91be59298a8ba84faefcf94c733f9e8783c0512a914dbf2da
MD5 ebcf89de3ac1876aa31c38262544ff00
SHA1 7bfbf6c5056de8fe4b794490cf389467a1d0d3ce
SHA512 31a186d96ed272f3431d8757f504ebd7f3a31bdc5d3f70ee1e41fd6086e43eb74031f00b7c07ea95bcc25268a3dd9ba9eab3347e5ac06da0b499ff0fd8ac6869
SSDEEP 49152:ga0h2GEkuAe73q3pp46zwwQQd5/IbsT0:ga0hNYG4JwZ0bs
MD5 SHA1 SHA512 SSDEEP

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 71bb2aacd058382457437ae40f213ad15a370f05a581011b2bbc1e27cdd059a2
MD5 74c5b09185e6d9285c154caebd4ef27a
SHA1 3f989d6b8f29007cb4fd1e6dbb018c85103f6868
SHA512 3719456a4b0f466f785dcc0c8689c725f48b462c1dc8714b33b6bce006360bfedeb615690a07dd2811f3df7d0396283f7fcf17e91cf29ac79ae98122ad7facec
SSDEEP 12288:ohbHjfX+cZRXPiqwIkFPqQKj8DkBIHCP2sEMLRv1vIVq+:ohbHjP9XN4qLqEIH7sTrvIr
MD5 SHA1 SHA512 SSDEEP

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 d42c0453bf6540f02d5b114d0f9804647ac9312bd092fff55f26c9b57a72fc3c
MD5 fd6cab4f5a1fc8e226dae53a82fcd200
SHA1 593ecb9d1c437fd7639deb269f4ee7e66bc1fea0
SHA512 ad51e80da14463382c3e7c77a07a5074b63a84585a512886be4bfa0e485f134806f21b3a62fc94c5386186ac7e72dc447c00a36e61b856e8d60e0023a15ee520
SSDEEP 24576:V3YgnJcRTk4yti+R5dpR/1XN4qLqEIH7sTrvIr:VIgnaTk46ppR/1d5/IbsT0
MD5 SHA1 SHA512 SSDEEP

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 698b8edbe468c2cc7d4f9b4b4860a0636b822f46443be1025eab22b8f0814281
MD5 1ff61d5352029d846b7b358b1929ad50
SHA1 c17695b32ad9dcfbebd85c491a0bea21b0928a42
SHA512 edefb9e52d8f3e3051b3d8dd12f21b665a4f00a03d22b9035560e24d32c9172b57c39484fe799589c8bc2d95ba0797e944bb8f051aee4a3aee62cc8f89ac8ea6
SSDEEP 12288:4jcZRXPiqwIkFPqQKj8DkBIHCP2sEMLRv1vIVq+:46XN4qLqEIH7sTrvIr
MD5 SHA1 SHA512 SSDEEP

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.5MB
SHA256 66f3936df18bab6c51e1d100c09972e40f9ec0c79939fe9cd308e9c816ce444d
MD5 591b02bf5bcba98ec0673102e250661c
SHA1 1992e3afb157aca6ed58bf939fd705aed9659919
SHA512 2ff3f901d22aed6f9711b985e84c6eee965db6adf7c09442cfa65ee749b53027bc6a68683290fbd5329425fc826d15b170030d670e16f290ca15cefa5d82e68b
SSDEEP 12288:BObXA4LWOsvAYFTUcZRXPiqwIkFPqQKj8DkBIHCP2sEMLRv1vIVq+:2zL3UT/XN4qLqEIH7sTrvIr
MD5 SHA1 SHA512 SSDEEP

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 0843cda6ef0f29fdf563362c974cfab04c2495a466b05665268a6179c513ed8d
MD5 0ef63798583b58de584fbe52b652a069
SHA1 9e2f19dbfda96baea0b8ceefadf098823cc03a2d
SHA512 df4f8afabd17604ec514c7cfec378d04549a25124d9f7a2fe41340fea903dffea4214bceb6c0cc66ef3d2378bc2d307d71e4aa5d999301663cc1645f94c37cfb
SSDEEP 12288:gpFtTOwcZRXPiqwIkFPqQKj8DkBIHCP2sEMLRv1vIVq+:MOzXN4qLqEIH7sTrvIr
MD5 SHA1 SHA512 SSDEEP

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 e0f071317b186b6a05418a1fcf1b7de8760817fd123a9e5f93863ad3b6bd575c
MD5 81aa5d35dd8ab83bd25da4b766e4469d
SHA1 db4b5870a38881bb86357fd6ae677d207a094f60
SHA512 238be64b49ae2cf45e514d07155f9f17ead0e057b89354188e986d8ba5c04edc6c8bf2890409c89166d6b36caa440a2746597e2516ecc5c7aaa4a312c48dd6e6
SSDEEP 24576:/7NM9YmZqmWMUkPjZM48Mv6bEhs2XN4qLqEIH7sTrvIr:/7cBWMpPjN8DbEhdd5/IbsT0
MD5 SHA1 SHA512 SSDEEP

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 5351b7a20b3b63fb1e0af2c8ac7ad085abd66c635f06109fe5eaff0cf23abc56
MD5 b891ccc89313d1132509be6c3c7e1713
SHA1 aeed9d100f7056bd67067888ba2bb23b231fd0b2
SHA512 a92f3ab1cadd6d4a263a087835a407dd1cb8286dc42bf7dd15ef1ffd600a7bf16b7094f5f2149caf45803206917ae6dcaf9056d3e4614a64e65e065d5b3bc799
SSDEEP 24576:NW6BApg2YuyuNDYTabvcRvNYf8km1cXN4qLqEIH7sTrvIr:NF2YuHNETovcvNYf8kmWd5/IbsT0
MD5 SHA1 SHA512 SSDEEP

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 46a929e1c60d75999f61180f148d1c3ab48cc9b1bce6a765ac6d7d2e8686565f
MD5 fba24141a53d5b057d778e606d2c7bf1
SHA1 c286114499158f391bda585cfc301268277cea3c
SHA512 d010f1943169c847baa6cdd5751626b667d0bb8af59e5ed3ded6126d60b1c63a9d13314ead8991040660483fe5bfd8d68ee75b8e0149b84acfee87c50241a7e4
SSDEEP 24576:xAFs06+Omlf3NXEbToHXN4qLqEIH7sTrvIr:GFs060lVXuwd5/IbsT0
MD5 SHA1 SHA512 SSDEEP

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 9010af803338053f0f8162437de19fae2410c8c8ef8002b102d213dce607d0fd
MD5 db6f39bbc9c6c6bf6ee419cb371a6d01
SHA1 4ea42dbd2f3ec530a5eac2d9e030854256bd1d4f
SHA512 bca7e45789cf49c5cb6a3aef8447820b9664dfff57a98d1cad96525b321e2ae82bb22857d257ce63d21565d6d74787f577cbe277cd05b2f0d016304ad8689eca
SSDEEP 12288:7CJnJ5D3VkrjzxXcZRXPiqwIkFPqQKj8DkBIHCP2sEMLRv1vIVq+:2JnJ5D3W3wXN4qLqEIH7sTrvIr
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 97f460147d8a9f32c65d67d781323be08d2deebe631a6a59fd2f583d56b2879c
MD5 4f305099d7b6d09995d2f75159dae74f
SHA1 2135402ce7ecae81f3ff829eacee2753e1e048e2
SHA512 7402d6864d725b372a6717bb8be8e0def3983022c9adac299a421a1f048cc9d637373188bafff0bb02084087ffba1b31f7622245ae6d0291fb33f2a1c1273aed
SSDEEP 24576:yEPohm6/7IIXdwcXrif7qQncjlP65i3Vu1XN4qLqEIH7sTrvIr:Fo06DIKdwc+eQnSt65aVCd5/IbsT0
MD5 SHA1 SHA512 SSDEEP

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 2611e9d3a51a4b4dc72fc8c4bf4e2e80381e38d6c83370a552bb2fbce9813d86
MD5 6b5ed7b77d51ccef19618d01cba0deac
SHA1 da35ea1a2eadcb1ab26c1d49b9549121cf3e749e
SHA512 cf108dd419377910c0e92d81260265676fed0e062c9f8bc79cbb97b66151e384793fe5f1631e6c985c6feaae4472619a26aa5ea7b18b7f614be2bff9ea2ade0f
SSDEEP 12288:sEP3RFMcZRXPiqwIkFPqQKj8DkBIHCP2sEMLRv1vIVq+:nFHXN4qLqEIH7sTrvIr
MD5 SHA1 SHA512 SSDEEP

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.3MB
SHA256 daa27487d9b4fe048d3ed1eecc1a5b25b6823a654ddc9ac8c83ed288cdb7a13d
MD5 ce7e92e18d32e83b9f1d02f897e3601a
SHA1 72e09fa1fc979cf2b503f2e69447ae21400b4fd1
SHA512 2079755ee2734b8a3988af7597ee2a5e9d25112cb696eba78426f8dc0fa3b6d8f292984e234ecd841dc43e11694c9e787f32a16d45ac5713d2ebf9ac1cf74f09
SSDEEP 12288:EjkyOcZRXPiqwIkFPqQKj8DkBIHCP2sEMLRv1vIVq+:EIytXN4qLqEIH7sTrvIr
MD5 SHA1 SHA512 SSDEEP

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 5013f0075505a31a725d468f2940c45e72faac54f02bd59c13d2961b06ce9907
MD5 7273ad17acc14b4b35be262f43fc0998
SHA1 9006e958ae77e3d1063502175aabf089a64c2260
SHA512 39591259cc71016b2b51c6096ec09d7fde20c7fb1f436486e779ddce07a87cc0161bada7d7f29e28194efaac4d91e073a78b01349d134aa4edea94944d289ac8
SSDEEP 12288:JnAcZRXPiqwIkFPqQKj8DkBIHCP2sEMLRv1vIVq+:NjXN4qLqEIH7sTrvIr
MD5 SHA1 SHA512 SSDEEP

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 5e804a906ce2021d1e0184d0dde17a68f4d4541d815ffd8fd3d16a69232c1bf7
MD5 a123ec72ea4df0c4b7645b8ab03d27bd
SHA1 57e8fc4bac01bd2e27cf90b06995e39c02ac727b
SHA512 20bfac45547ad96aa4c0ab8fd338229f2c6edd5facbe49feec620a320dca631a29d463373efa66c5da26be6156bbb46755cfc6929cfd1151174e83ac7c8d2e42
SSDEEP 12288:KLQZb3C97GYnZMv5zBcKY97MD3PcZRXPiqwIkFPqQKj8DkBIHCP2sEMLRv1vIVq+:8Q9MxZKdcz97w3eXN4qLqEIH7sTrvIr
MD5 SHA1 SHA512 SSDEEP

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 10de4b485e3cba10e5c536e661b6334e3eba2c759061d5dfe9fd7f78be34a6ff
MD5 3ff286072e7984cc0726a65a03b672f6
SHA1 b8377e71d6a02068954f1ed236f76d16224b84f0
SHA512 8cd2b15be0f8cc54650d791f37a98bf7d6842a5d0725c86b96fbccd186e2bd7d150bf94ffaec20385b5154e52ac9418bdfc03233254e7ba569b353f82aed7c75
SSDEEP 12288:myoKo2dRple9pKcZRXPiqwIkFPqQKj8DkBIHCP2sEMLRv1vIVq+:myoc/ApBXN4qLqEIH7sTrvIr
MD5 SHA1 SHA512 SSDEEP

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 b14d86dba30d58de8befb7c2a3912f63fd54274d4a3d67d599315cebf832034a
MD5 91c52d29bdbb58cec9173556a262c2c6
SHA1 d94fc9064fc4c1721250905b66d0181dcd039628
SHA512 0ddbb529de4f423ca4e428cb52a3963c5af77d4ee0c2927b4c10b10af54ec348cf7ad8a0bff9f1c4ad391ed201bb9cd8d11ecfb1e376fd7c01696eff6a619c3c
SSDEEP 49152:yWcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIKBd5/IbsT0:k0zuNIl0bs
MD5 SHA1 SHA512 SSDEEP

Submit Download

office2016setup.exe

Path C:\odt\office2016setup.exe
Size 5.6MB
SHA256 147511b38eb7faa3b93111dc8d72bac8d0a69e1f98d7cb1700880886ac83873f
MD5 b20b401ebca6670fcf3e01909d40dab0
SHA1 210d52a9253c35031cd0b37f54522e352e0e5775
SHA512 29cd44104cc8aa31ecb66b8162aace7ce7db9397e05d87334f1d41f2bb4b881fb77cae134afa0c37b6c9fea9c8c0f0562862082904fe6307dc384ebc9a31fa09
SSDEEP 98304:D7M701RgX4iuSl1DtlEq81xZPGnzURnBh6gGL/QmvD/cTwY2h3F+0bs:XM7pTXexZPGzURnBh6gGLF+W30
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1388-250-0x0000000000680000-0x00000000006E0000-memory.dmp

Download

memory/1388-244-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/1388-310-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/1388-243-0x0000000000680000-0x00000000006E0000-memory.dmp

Download

memory/2036-396-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/2036-392-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/2036-397-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/2036-383-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/2212-363-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/2212-299-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/2224-238-0x0000000140000000-0x0000000140170000-memory.dmp

Download

memory/2224-72-0x00000000004F0000-0x0000000000550000-memory.dmp

Download

memory/2224-67-0x0000000140000000-0x0000000140170000-memory.dmp

Download

memory/2224-65-0x00000000004F0000-0x0000000000550000-memory.dmp

Download

memory/2244-472-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/2244-453-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/2748-295-0x0000000000B60000-0x0000000000BC0000-memory.dmp

Download

memory/2748-286-0x0000000140000000-0x000000014014B000-memory.dmp

Download

memory/2748-350-0x0000000140000000-0x000000014014B000-memory.dmp

Download

memory/2760-413-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/2760-421-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/2768-254-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/2768-255-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/2768-265-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/2768-269-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/2768-270-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/2820-49-0x0000000140000000-0x000000014016B000-memory.dmp

Download

memory/2820-50-0x0000000001A40000-0x0000000001AA0000-memory.dmp

Download

memory/2820-63-0x0000000140000000-0x000000014016B000-memory.dmp

Download

memory/2820-60-0x0000000001A40000-0x0000000001AA0000-memory.dmp

Download

memory/2820-57-0x0000000001A40000-0x0000000001AA0000-memory.dmp

Download

memory/3464-235-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/3464-39-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/3464-38-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/3464-45-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/3636-315-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3636-322-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3636-389-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3636-381-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3696-11-0x00000000020B0000-0x0000000002110000-memory.dmp

Download

memory/3696-13-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/3696-0-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/3696-7-0x00000000020B0000-0x0000000002110000-memory.dmp

Download

memory/3696-1-0x00000000020B0000-0x0000000002110000-memory.dmp

Download

memory/4156-336-0x0000000140000000-0x0000000140159000-memory.dmp

Download

memory/4156-279-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/4156-271-0x0000000140000000-0x0000000140159000-memory.dmp

Download

memory/4332-426-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4332-434-0x0000000000C10000-0x0000000000C70000-memory.dmp

Download

memory/4368-234-0x0000000140000000-0x0000000140237000-memory.dmp

Download

memory/4368-27-0x0000000000440000-0x00000000004A0000-memory.dmp

Download

memory/4368-28-0x0000000140000000-0x0000000140237000-memory.dmp

Download

memory/4368-34-0x0000000000440000-0x00000000004A0000-memory.dmp

Download

memory/4424-364-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/4424-356-0x0000000140000000-0x00000001401A3000-memory.dmp

Download

memory/4424-425-0x0000000140000000-0x00000001401A3000-memory.dmp

Download

memory/4428-412-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4428-341-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4428-351-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/4440-302-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4440-312-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/4440-368-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4500-549-0x0000018BB1830000-0x0000018BB1840000-memory.dmp

Download

memory/4500-548-0x0000018BB1820000-0x0000018BB1830000-memory.dmp

Download

memory/4600-16-0x0000000140000000-0x000000014014A000-memory.dmp

Download

memory/4600-229-0x0000000140000000-0x000000014014A000-memory.dmp

Download

memory/4600-15-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/4600-22-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/4632-547-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4632-408-0x0000000000A70000-0x0000000000AD0000-memory.dmp

Download

memory/4632-402-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4656-440-0x0000000140000000-0x0000000140166000-memory.dmp

Download

memory/4656-449-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/4780-448-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/4780-438-0x0000000140000000-0x0000000140182000-memory.dmp

Download

memory/4780-371-0x0000000140000000-0x0000000140182000-memory.dmp

Download

memory/4780-377-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/4964-338-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/4964-328-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/4964-399-0x0000000140000000-0x0000000140136000-memory.dmp

Download