694851766ca57d44707714e337d28f4453712a5a1488efb551d8fd1495cf8dbb

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
27/05/2024, 17:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-05-27_10e862d66437af0f48184e3486b918f1_ryuk.exe
Size 2.2MB
Sample240527-wdnsqsdb47
SHA256 694851766ca57d44707714e337d28f4453712a5a1488efb551d8fd1495cf8dbb
MD5 10e862d66437af0f48184e3486b918f1
SHA1 6e90b924a62ca3403d2666ab4ee8f1536259adf5
SHA512 a196a95c03f3b560881557c53c16625f1fe1be31443e9b1b279a6a921481c505760d85fb85b688472468a3251e511b2c20d45a7bb2e9c66fa9f915608b3aeb07
SSDEEP 49152:SNl7soq7sQCr1kyG2xHywRfHIO2Ts4bvD8Dv66mG:WD23S1kaxp9q8Dv6V
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
2444	alg.exe
2940	elevation_service.exe
2040	elevation_service.exe
4884	maintenanceservice.exe
1052	OSE.EXE
3740	DiagnosticsHub.StandardCollector.Service.exe
548	fxssvc.exe
2884	msdtc.exe
704	PerceptionSimulationService.exe
2356	perfhost.exe
3212	locator.exe
3992	SensorDataService.exe
1940	snmptrap.exe
1964	spectrum.exe
3804	ssh-agent.exe
3784	TieringEngineService.exe
3340	AgentService.exe
1392	vds.exe
4476	vssvc.exe
4944	wbengine.exe
2392	WmiApSrv.exe
2492	SearchIndexer.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in System32 directory 24 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\fbc3379dc3136770.bin	alg.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2024-05-27_10e862d66437af0f48184e3486b918f1_ryuk.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_104468\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateSetup.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_104468\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	alg.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001a8bcb4c5eb0da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ac16b64c5eb0da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e558bc4d5eb0da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002088094d5eb0da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000453a1a4d5eb0da01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c42d124e5eb0da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000feb0104d5eb0da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003bda7f4e5eb0da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
2940	elevation_service.exe
2940	elevation_service.exe
2940	elevation_service.exe
2940	elevation_service.exe
2940	elevation_service.exe
2940	elevation_service.exe
2940	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
668	Process not Found
668	Process not Found

Suspicious use of AdjustPrivilegeToken 42 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4520	2024-05-27_10e862d66437af0f48184e3486b918f1_ryuk.exe
Token: SeDebugPrivilege	2444	alg.exe
Token: SeDebugPrivilege	2444	alg.exe
Token: SeDebugPrivilege	2444	alg.exe
Token: SeTakeOwnershipPrivilege	2940	elevation_service.exe
Token: SeAuditPrivilege	548	fxssvc.exe
Token: SeRestorePrivilege	3784	TieringEngineService.exe
Token: SeManageVolumePrivilege	3784	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	3340	AgentService.exe
Token: SeBackupPrivilege	4476	vssvc.exe
Token: SeRestorePrivilege	4476	vssvc.exe
Token: SeAuditPrivilege	4476	vssvc.exe
Token: SeBackupPrivilege	4944	wbengine.exe
Token: SeRestorePrivilege	4944	wbengine.exe
Token: SeSecurityPrivilege	4944	wbengine.exe
Token: 33	2492	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2492	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2492	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2492	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2492	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2492	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2492	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2492	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2492	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2492	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2492	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2492	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2492	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2492	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2492	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2492	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2492	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2492	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2492	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2492	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2492	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2492	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2492	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2492	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2492	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2492	SearchIndexer.exe
Token: SeDebugPrivilege	2940	elevation_service.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2492 wrote to memory of 1596	2492	SearchIndexer.exe	126
PID 2492 wrote to memory of 1596	2492	SearchIndexer.exe	126
PID 2492 wrote to memory of 4680	2492	SearchIndexer.exe	127
PID 2492 wrote to memory of 4680	2492	SearchIndexer.exe	127

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2024-05-27_10e862d66437af0f48184e3486b918f1_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-27_10e862d66437af0f48184e3486b918f1_ryuk.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:4520

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:2444

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2940

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2040

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4884

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1052

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:3740

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:3008

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:548

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:2884

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:704

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:2356

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:3212

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3992

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:1940

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1964

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3804

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:4844

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3784

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3340

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:1392

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4476

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4944

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:2392

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2492
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1596
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
  2⤵
  - Modifies data under HKEY_USERS
  PID:4680

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
Size 2.1MB
SHA256 6d0f27215e94c9437e6492f9f815df505d0b8d6746543afed1b32abea20c2ed6
MD5 fbc8189cd04f75bbf6d94c824b635707
SHA1 ba263f64f65b1bfa1248e8f1f7286c2f82eb8e0c
SHA512 f210091a14e3b9e72dbcd1072f98fd9fada9c8e0feb8b3074fb60dbd6a7e558a8fbd0296d983c5d23d39244f5d18887fd7e18cc86fff93a0255e73044a0701f0
SSDEEP 49152:nuYk3H5koUzfTqkkYLO/W2buywzMbOX+T7z5gDv66mG:n7fTqi90b0Dv6V
MD5 SHA1 SHA512 SSDEEP

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 52787499a95d2bc59d60ad28b80641c1ffa986bcb5a64cfa400145b2d3c9e044
MD5 10581f66212591c4c016ad6256a3ffb9
SHA1 ca94ac7b85d4ac2c5168630d51246133fc34d58b
SHA512 7682d523b5af5ba1d3a120d6c522867dadbd2b6ff6a5c3e91054879d842337ecc33cbc71da93d31ff116cf6765479d0f5eb6f46cbffa3270b094a08948fe8c4c
SSDEEP 12288:LcQismNJLBsunEJXI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:ziRnBsuEi743TvRk6NwG
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 aed5b657886397fddba2962e439792a151b1291bc32b9b84fecb740787385daa
MD5 2b19ec84806a59ed70d3e4c1cdc00d0d
SHA1 c34fab8ebde3ac7a3e80645d5ef3151591162a53
SHA512 a90a8da60e0252e01287dac0c6961df717b028a91a5d4073eccb6c8a9f3ccb327ab92578a6d776c37b76e3e584f376d1f3d3c33420b685f726592ffdbe1d79da
SSDEEP 12288:87a3iwbihym2g7XO3LWUifh4CotXI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0Vq:R+gkEUfh4Co2743TvRk6NwG
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 b72d39361750ab965ddeffd9e9688899d1d5cc1c2213427fececb987f6dfde36
MD5 70adabb49e9e98a103e6815b900eae18
SHA1 b148d02c070be4500affced3fb1d12b706ed1484
SHA512 f329470e4ab7f9c3cd01fdbc1b02d52ea7bac58ab1dcea5c3b4a09a4ff1da1560e10678f6f07d388d97d23c826b3e349dbaa3b9d5857e8d176d47929ba64feb3
SSDEEP 24576:5BpDRmi78gkPXlyo0GtjrP743TvRk6NwG:7NRmi78gkPX4o0GtjADv66mG
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 ef1da7417ed5da528c6d4a6c82f133ce271108946798b72825922ef8c10949c6
MD5 7a16fcc3cac6783c2b338a6ea8e51fd3
SHA1 1414884a74f0c5f046ac95ef38f04aa8cd7a7fa5
SHA512 7ca6cfdc912f233979b10f577eb4a396bc052b911fe8ad449d917f95b258d142808e8849d7521f0413d0c1b457b2b95911168533905938b4339a26bfd0ee632f
SSDEEP 12288:5fC6Aj+TN5uixZN+8rKhUdTC/wE1rD0Ca5ZIXVtXI7vgbrWVQhTCYHvRktx/aIC4:ZLOS2oTPIXV2743TvRk6NwG
MD5 SHA1 SHA512 SSDEEP

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 02d59048c8299443f8290b2d794e3c1aa6173e8dfb5769c8986a0bbdc82bebfa
MD5 35e8aaab078d2995e906510c65fcf463
SHA1 89d8b4c9a5633fea7399ca3f9a8b8cdcc63ca352
SHA512 4841c9d6fad61b30e2cdfb41a054f6401999fd6ceefa35dc1e7e00dab1a02906ee5ebdd363314b49f4972d6c1d800ea0c47ef425deb21160a988426612a57c63
SSDEEP 12288:BvHXI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:Bv4743TvRk6NwG
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 e1994d4e4f2d43bb2d5c652535eaf08d1928353af4a007bd4bd9ad6c294c14fe
MD5 b6e5a0b0d9ecba38fa6d6a90a999c552
SHA1 cec0e05ac09e0a02334e47173d1d852f6042637e
SHA512 898d23a8494722722afb2a7f20e82e039e5d55e328003d56382dfbf3a1873e3b4111fa69d8a574127d9dff4eee265b15777da3b5269bfffecfb9ea89eff0b759
SSDEEP 12288:ReBNUbTVO86UuXI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:RJIU5743TvRk6NwG
MD5 SHA1 SHA512 SSDEEP

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 ec45f1ba0fe6049c87ff89f8c4916e415eac4b814ace6952c0bc4cea593f88fa
MD5 6ab209fac3825e4df8e1bfa259aa3af0
SHA1 f67013605f7c129e9d39666d7b4d26ddf810fbfd
SHA512 93ddbbc870cd61096e34c427821461db4bcc5fb3c3cc51015f26061fd7ef82e82a35fa405608e44debf63667fce40005e957f7f93a3924083c95ccfee6c7f01d
SSDEEP 49152:CQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THe:CQvGAdlCEL8c/DRNw5CzDv6V
MD5 SHA1 SHA512 SSDEEP

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 90257a03ac0f61761a821685ab86f72f93efef317e6f4a84498fa7a0f1d5d982
MD5 cc92f6bff1c84940d25ccde8c8cd5657
SHA1 ed1ed6ef3e358e6aa986576ba8325d45fc6b276f
SHA512 b0b911b29d54fe772367c2b4851c56e97c887bae0daf5fb5f69b801219437dfc4697c858bab9fdf2db53bf4ffc15351a2225f8618760ce3ec8e1d0151628f738
SSDEEP 12288:HAwSfxL/2Dc3cDLLmt0LDQewsAjsXI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0Q:gxewsAjn743TvRk6NwG
MD5 SHA1 SHA512 SSDEEP

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 837ad8271beaee5fcacbebc7ca4df701848dd1ca8cabbc0c18dc6de34ea12693
MD5 463be140a86cdcca5490564a82d79c2f
SHA1 60e30a1a86174244cd0ab6ce029e4279c30c3cc9
SHA512 d72876a87248c8db71c851afc51f3a3e7699827542a78b48e0347dc5f569b589b088f12f4ddce22542f86216b5507e6167df5556a2893fbd8c4d660b05ed47b4
SSDEEP 196608:LUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHsD6:LUEtQevvqc2W1cpV2tI32
MD5 SHA1 SHA512 SSDEEP

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 4dd74b3423a5deba9761dd3af2916d7a4fd53d9ccb29132dfe905a3222d110c1
MD5 44c96a8be7b8a2517204cd1d9bed5372
SHA1 4eeee8112f94c46849bb748c2b54cfaf54c5a017
SHA512 79f35d170e73d4e44c7befe982ff50a91f7c2cfd5729db6ad066a6141ab603c2c1b972d5b3fd8ed8b58e802f4d44b811c8ad50008076d2ff26f34fa4f16df388
SSDEEP 49152:gCbRquA/m2yL5zifFiV+XenmE3/zUDv66mG:poqHVjnmnDv6V
MD5 SHA1 SHA512 SSDEEP

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 72384d1ea66b5194a61ec4790551819addf30dbe137e64202055c7bc42631d6f
MD5 c1ba6e67a728d40c346c9067ffc06ae3
SHA1 629ceb4ae1520a93865e515c700ffedecda8a205
SHA512 725106ead42b892f7ad6383a40641c99f17232bbab86711217afd2066eae2b22c40c8e7a90db376ed4a9196451fd2a57a536c00cdbfb954b29adf29fd1b03bb3
SSDEEP 12288:JAZ/GL3IFoiwtA5qy97S9uaYFLq3OqXI7vgbrWVQhTCYHvRktx/aICF9flefuKaM:JAhGL3IFoiwtA5l7S53G743TvRk6NwG
MD5 SHA1 SHA512 SSDEEP

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 32e9084ce09bedde48a0e32b37f04caeff4a6fc80081f63e1f7c88c5ee11d4b2
MD5 853637a5a43e41817d4fd0fcfb7536bc
SHA1 4fd8a5572e351a73fb264b7a209b1ca39b00deeb
SHA512 6e15381b919fcef809e8f4435e7854edac65485c10dc43cc0cd1eded7442d9623b7213f303ba1f3b886e75c9869efae983fc89d10b976d53f3e98ab05c93ec13
SSDEEP 12288:0mw5HEjsChNMBFgl0WDm+CBXI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:xwutOWD743TvRk6NwG
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 5127193da232f9cc274539335f4de6f298e01233db8aeb2d0600788a25ae97db
MD5 a7b1555e9d8244d480a9d520bb8f06c1
SHA1 b4c90881ad1ba7a9b0d3f4e43b48d1b660d76099
SHA512 6aea3e8ccd01cb181d3454bb4fecd4687735a1042712de4278b8c0649e235e0fd7eb02f1dd765a84e442671760b7c85bece300702faefc5dfebe6308e8411abd
SSDEEP 12288:wQZ1Iy8XI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:XZuM743TvRk6NwG
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
Size 5.4MB
SHA256 f0b00ad16e2ad7df725365cf405e07181ab33523185159fa665a08660a2be254
MD5 5e8899e535efc3666abf7e58a6b9a70e
SHA1 819a3a34d7e12fc1cbaee684f22c0ca0533abe55
SHA512 850820dce4203b616fe6b4b6e9ca4fc8b8efccc4e46ff2fbe5b1f5d5588ac6b1c22756221300342b0b54fff4e411082e200aadecbc965440ec360766e8ad236e
SSDEEP 49152:H0kwIi7c4xZlm5knEtw99Kn/2vim7vgv6m+yyJ/0gbvjy7yY7BHi3u7L/gBUUWLO:rwfhY7g/rLO7yYA3awr341gPDv6V
MD5 SHA1 SHA512 SSDEEP

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe
Size 5.4MB
SHA256 5beda31f9bd158c5317c0b2e1c936c76748ac0c53cb782530f31aace804d3df3
MD5 970f32f06f1d8aaabb2bd998a911cf90
SHA1 d3984e1395d824a515948057e1b3b8b97fe25951
SHA512 095fd0671874a6cd38a4f59e1eca81fe64d7989a9d0bdc9c11ad7384e61fdfa0137900625fd9785d56c4405b13cb7fb4cedfc9d7f776d59b7c8746a2017769ee
SSDEEP 49152:N0kwIi7c4xZlm5knEtw99Kn/2vim7vgv6m+yyJ/0gbvjy7yY7BHi3u7L/gBUUWLO:1wfhY7g/rLO7yYA3awr341gPDv6V
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe
Size 2.0MB
SHA256 9ba2e8400c1e8a87e69c339059d594065f5ba30825bef3448c07adb1a7108808
MD5 708fa8e5ac7a23725e927f522367df6f
SHA1 ea501669b4f9fd81bdb9220a713c378b99b2ee60
SHA512 eeb4366abcc029d09c83f284f6e0c3c89bc940b051e8393f01b77f35978122e6afae3c0e66544f09129f5e2bdbc5892292621e2a60e2d8dfcf07aedff11f0c19
SSDEEP 24576:FcTyYv0FteQUd5I2kjgD6iQacAD743TvRk6NwG:FuXv0FtpU5606zO4Dv66mG
MD5 SHA1 SHA512 SSDEEP

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
Size 2.2MB
SHA256 0263012014400bec5157b96ca92c44de51619b72c3cfafbbf58f0651451c2284
MD5 8f0b4005b6390daa79edbac79c05b867
SHA1 2c4e911d44e43347665e065c74154dc18e027143
SHA512 6d7cdd9cc510b715a1adcbbaf4e8502af00fce30f7dd0fbe7591bf369778e57e7da273f91df87a404bcb32ce091b0a50f8e49d456da3ed2ef0dbcf8a48c55498
SSDEEP 49152:zy7mTd0GxN8jyyncHjXKUyn4GVcbDSKrNTx0Dv66mG:OmYeycHjWjMT0Dv6V
MD5 SHA1 SHA512 SSDEEP

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe
Size 1.8MB
SHA256 f04b30b2189aab65dc83343787d024bdaf9189e43b0b8d2737bda932822898fb
MD5 3f1e06e17d7a3e51cb0f61f48cee14cc
SHA1 39eda1709207a96dde291e0b4d549346b25f3f5d
SHA512 78d13f0dc5ac9a747503b437645b87151072502c26a98d126fc197f3800eb88c7712093467d905337cd5d21e6324a3f4de4e32e28108e3db86f19de98d8a5b24
SSDEEP 24576:h6drZn1WEci182IEUZNbJeRgUebgW816E743TvRk6NwG:hWnDci18NNNUgbYgDv66mG
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 1.7MB
SHA256 2b20281897422554380464e4533a7157aacc04229b49a2c86ffe9fe3ff859539
MD5 43a369f1e72bf6587aae242333d70419
SHA1 1bc1ff77d5c69376a89dd422f84a931e4ea77619
SHA512 7bc774cb2a6b64dfac80a7cd210e7355e162463f82c3e4bf6c967347907d9660df63a4c605a420f9f2518ebdb8eca1d5e920316ce4b69140b7f1a5b1ca1ff1df
SSDEEP 24576:4k5lHW5EzMZupOG0G2reD+melRgTTv/1nyd743TvRk6NwG:eizMZw0GhamSoBDv66mG
MD5 SHA1 SHA512 SSDEEP

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 b6db6b7777636b2bc44956bf83e1a71cc2cba4669381467c79b133568b476b57
MD5 23c3bdfbef98b3813ae437c620d9e77e
SHA1 f1fa1ed3381a0adc0826360a9382c53d98cee6c5
SHA512 ee8e0f59bb6cdf06f589780a46f9688ca98089ce4eaa5e8d4d890771b1ba864b370e2f2001907cf45b5380c8502c79b8f7a9e83d25dbbe1bb757475de1f08986
SSDEEP 12288:LfXI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:LA743TvRk6NwG
MD5 SHA1 SHA512 SSDEEP

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 3f9848494026e609820f59379c607034953e1e1ca1b252ac0b872986cca5a0b4
MD5 efc78d7bea641c9be797b715fc873f9c
SHA1 12d5c8df5a66ade7e8118a16e75fea0d6b063657
SHA512 00eca3201bc232f72f4eaafe012f19934913a970937b7a44fa0c3139d8278194d102d1ea869705472100f6b9d99b3ed7527a778f4676d8f535a4bb88628facd9
SSDEEP 12288:jAXI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:jb743TvRk6NwG
MD5 SHA1 SHA512 SSDEEP

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 e3372632ae6ac7b5caaea40f36359f28a92dfe1f6b49586e7c365c7cfa07733b
MD5 e55fe9155ffcec6ae7888e7fbb3c64dd
SHA1 ddd5d2efd046dd6b39515e35bf7cf8f2743648f2
SHA512 352ea2a73b624021be763b273edb17c17ae94a7d2b0570aa1f32d6696c1b8193b9accc9e3455bd11221176bed159773b7eae2d8bb9265759803d1b458cad2238
SSDEEP 12288:tmXI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:th743TvRk6NwG
MD5 SHA1 SHA512 SSDEEP

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 1f28a0c8ae83883d66b1f9caeef3d6e06eb3226f8725f2c53f596cd53a230239
MD5 d7357e7342b4158cb4ba17d6a621a0ba
SHA1 305ca4756f50e835e1904c1094be82a255890adb
SHA512 b156618893241a8fe08512991dee33ebaf78944341cb30e41f8852174810d1623da1508270e5f3067244c876a78f561a087ef94aaf9e20043bbb67716f3c691e
SSDEEP 12288:IV9XI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:B743TvRk6NwG
MD5 SHA1 SHA512 SSDEEP

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 be6f721d011d6d1678eb91c13ad50b27df4d74dc26d90de371588f4919a0d855
MD5 b716adf2097b677950535c8167312c99
SHA1 2d0c87e15ce98bd440c12c95f4faf4478cf68155
SHA512 449a67dd084f94b0464c0a4ff3eb413c8d16836448ff5ad3dddb89165ba3181f65d84b7d99002b4d119e65ec186c69a4ed009108809f26d37162c0d4b6549090
SSDEEP 12288:iFXI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:i+743TvRk6NwG
MD5 SHA1 SHA512 SSDEEP

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 a8f94b119bf17c27fc2133c938fd277729bfc9364da754783cf722572527058a
MD5 d8058e07bd5bd7b4ecf9db47af2bd867
SHA1 9c4e5394d255654a760827bfd506a9c190529ba0
SHA512 2daf0260a6e24f3e16117cf1b1c1dfef15897bbb77d548c3929e334b735acf8791e86d43cce306cc902803bb7a0a16fcbc1deac1fe953b59cf2e73e38df3f5c6
SSDEEP 12288:XkXI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:XP743TvRk6NwG
MD5 SHA1 SHA512 SSDEEP

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 15a5890e91676f0341c534e83f53726968785004b042719451063cd6a393e055
MD5 9c35d8d253664a777330ef9543d53f18
SHA1 9a758294fea4b89ab60cf1460fbdfdb39de5c1f7
SHA512 9f9cf64d32d3a79ece708afc8dd0dca345312c68a6052544aad9ccceca8e762cca94039cb6b26dfdca4a50483aaecc5da5635bc4fe871fbe347857d6b2eadc4d
SSDEEP 12288:6oXI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:6T743TvRk6NwG
MD5 SHA1 SHA512 SSDEEP

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 9101b3d4116a67abee6b85f929d4e47db7e68ceac399dbd168ee988c51de6ecf
MD5 b7684e2083c5dcccd637bf6bda45070a
SHA1 84ba222b1ef4879aaf86abb3dd7b5452ac9122e8
SHA512 5abe90fba62286ee425634bd8cb8963093eb2cf39297637a2ca5c4938c0365b719ebd70f049b3be195fa95e0c59b85810dbe51d35ffb15ea5feaa03878a781d5
SSDEEP 12288:ViZwbkzzFEoS2cPvygXI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:YZM0zFVSO7743TvRk6NwG
MD5 SHA1 SHA512 SSDEEP

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 061aea0cdcee55e868abbba84f3e3b25567197fc32420223fc30c80056d3db67
MD5 c83e77dd2d714f9797db251c27df79e9
SHA1 2783f49d046c80f127ca8105eb13779765b8d9b7
SHA512 74c589eddb3ccc38053a4e06306b23a9f51439309d1735fd0762a010b57ed00f481b067331a78d29bd15460fbda1e20787921ec7608ba14211b1df37c1bf954f
SSDEEP 12288:yLXI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:y8743TvRk6NwG
MD5 SHA1 SHA512 SSDEEP

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 324184d1c64c703b74b144833099b8a91af5be9eaf9816ac30b4e0a893d31b8a
MD5 bf921c1efc894f51c8352a921f844427
SHA1 21855ba67637d78da993c878b8e1f3fbb919f008
SHA512 a3f0eee449e573111da8116332af860eeac80bad55ac7c96136b424a56319cff6b460c9f7d2494e049ad4e46a12eeda27557063147a8aee0a821cc9cf1a73d9d
SSDEEP 12288:WXXI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:Wo743TvRk6NwG
MD5 SHA1 SHA512 SSDEEP

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 5acdb546e473d6a36ff84cd3513b8839af57173c6acb56e812ae0f96b5c0784b
MD5 c85cf69f201e4045e57e7196d290d0ab
SHA1 c7a2fb77f27df4d92070ee2e6d6dd04671b060c4
SHA512 3c3f91903069985b972dc716dd2f94586aee58de28d0c319505217615faeb17be03174d75a1e0b8cc33c8e97e3507aac9595adbf181a7640d8c4806dcc89d1ac
SSDEEP 12288:7yPz5L88XI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:2zyX743TvRk6NwG
MD5 SHA1 SHA512 SSDEEP

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 e3f988e19eec40f5465f108d0659750aae7846eb604ec1f645f7b8e48c6dc09b
MD5 b874e1a3e8d379e6af62d2e58299054b
SHA1 f5b01fb32ad34d95d35e5c9cdb66661291322376
SHA512 f2bc3267ab2100f3409a1b062a428866ffa57a7e4b1156c3a2a7e2bee0dae604720125ba5f2071382fa4d7b4a61a2f1fe8a790f9bf0a0c2d65fb5e82b4ce561b
SSDEEP 12288:kLXI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:k8743TvRk6NwG
MD5 SHA1 SHA512 SSDEEP

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 0479f7aaea06df01ae6f96edf8fd3f35115071b18792b516da077c4e16eb58c5
MD5 59ebaea94dd7d1c513e44378d5dfc678
SHA1 a6f161f298c180c38f8ac93fa413bd23daa4e6c3
SHA512 0a877751d632ffd4bab6cf8b8109f0454f90af6d9ed355c06b3aecf83403816e32c4b38425a5e22b802257e52557e789ae9199e7cc395a56d031b56bcec45e82
SSDEEP 12288:uLXI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:u8743TvRk6NwG
MD5 SHA1 SHA512 SSDEEP

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 e73f01d7babd15dec78a4e167edbf2ce4faebcbba171ae1d733ba11c1ca947d9
MD5 ba8fe6a3895397b0166e2adaa0d691f9
SHA1 a7be4a26b522e3052e21bfe04861eb1565a3a9e4
SHA512 faa9413a26e61ec7488600b1b0071c7f1c64fd2c1eec5001658ce56ca7949eab1f19549500f54fff38a62889d4082591c7c1af06ba0e975b5cbf2dc97767846f
SSDEEP 12288:+yPz5L88XI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:jzyX743TvRk6NwG
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 31f4f65aab2faf6252ceae81521bac35d80129944e30658227966921dd125bcd
MD5 074a496d6e458749f538518d04c3b4f7
SHA1 5bec3ffbc588b037d62b7f6937f5fb70556f874b
SHA512 942d36802b1457310b56f1edf5f3d431b737d8c6494daa6230ea324fc7b700db128f86dd05b7bfa3612d40d3ac10e8ee8028f7da44cc940eb58812f98aec7179
SSDEEP 12288:vCd9DWYoaLHF3z0z04PDvhWXI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:6TSaLl3z0zDx743TvRk6NwG
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 724995837c336f57402ca7ac2d8bfba1bc970f26a20f66ba617fd7c845f6eadc
MD5 35fc2ff715c0850624a098a863f407a0
SHA1 9cb4248504719d600af0ebe75ba83146f6c2b271
SHA512 50d772634cb4c6dcd30accd21c31c4399344cabba9ad514aa29d1cbf47deac84b04faff796510ec1b4282e9f9e1300689a8263c4a53f1df10111adafd085013a
SSDEEP 12288:yi4e7wRdTfgwCHKy7GLbbdIvJXI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:y3Vd9CHKy7GZV743TvRk6NwG
MD5 SHA1 SHA512 SSDEEP

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 7ce61827d6c5e1bd0e231e78ed5e727c98e486a7fc93d1967c092bb8d8093867
MD5 0f5bd973e1aafd320ffedbce761e9759
SHA1 0e1cf383233305b448c3c2bb80fad27efde7adae
SHA512 72e070bcc1682a90940d33391ce863ac36281ce5f9ba25de5c16ab839e323eb5cc5409c0e4dfcb23cf36e25c301225a4bbf2adca602a3069aa13ef644630cb6c
SSDEEP 12288:iGXI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:iB743TvRk6NwG
MD5 SHA1 SHA512 SSDEEP

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 5fdd41ef8da2ef324dfee7e7bc0c14263dac564d9bdee899119b2515a5cc49cd
MD5 19b4ad32bf8bd4724ac419b103161fe7
SHA1 42c22aa242e34a6710f321ae50c018c69ce773b9
SHA512 efb7f660c9597de24f82aa16c177111d81567dc6b515cc935565bf676334f99061bd3652bf2c176643bfac9126e6314a7a97f0cdd21f99ab593f4e7e59f87185
SSDEEP 12288:mcXI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:m3743TvRk6NwG
MD5 SHA1 SHA512 SSDEEP

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 9f5b9df928a19c991891668229292609178d2f5c75dce8abe757ae1904814e41
MD5 ad396ffd14c0c45d450d00cbabccd8b4
SHA1 6fff01dd109e68a50d0c8fefa2f4b6b13c844762
SHA512 ebee8cf6c22d5ad2b120d59bfae1b18ede30bf83b3f98334962fda028eeead3b85f38cdebecdc88620f50fdba40695e858224d241d6cd84f5b16186f146080c4
SSDEEP 12288:gJXI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:gi743TvRk6NwG
MD5 SHA1 SHA512 SSDEEP

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 151ee5d2a61fb7d3d4092bd4138b957bbde4588b99f9f34568e1c7eed9678790
MD5 f4c568e6287854e00da40db35d17f8da
SHA1 59477790716b81c17e1ce3b40e1da93677e1b9e4
SHA512 c410b2658d949283039d18dd426871d298678fd6051d2ea7c4522262dff8fdd552706d5f4992db69f874164170717d300d3fbed90c80889c72ad9df8cdce1a94
SSDEEP 12288:bLXI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:b8743TvRk6NwG
MD5 SHA1 SHA512 SSDEEP

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 437862210a35a6cf5b20d629a7cf0ecb94d16789fb9f679aa738d46e096e8620
MD5 860f69364c6306515c8029711d1c4ae5
SHA1 bc9a7aa89dd467ec6c4e667cff1cd67529069417
SHA512 aafd6081abff2bae7832e55385237af6dc5d06497fd972926233cbca3c70482ff364960212e17c9b10d4dedf403500c57d28c5c956d653acddedfaf4ad91bf0a
SSDEEP 12288:IGXI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:IB743TvRk6NwG
MD5 SHA1 SHA512 SSDEEP

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 8de396fc91883dbfd10d1e92f82504d83100d41b94c424721e7148606c12a668
MD5 0e9f01abbd712ba9dd36bb3257e0db14
SHA1 4a097d21019230c00e18a3dc23f7d5435defbb81
SHA512 cfd1f70ef45d7cf012adf913e9a1a012ac7ff2ad600a24a81855d6093ef15a98fcefd5630b10c390129dcdb16ccc23c5134b5561cd9e3dcd1c78daa2f99c39bf
SSDEEP 12288:hzXI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:hU743TvRk6NwG
MD5 SHA1 SHA512 SSDEEP

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 17223d19e28b18ca1a375f22e3561efd07a94f73bd3ae032378c8dbe4780a3d3
MD5 48aa30eabc51f06ab09dbab84b2263ce
SHA1 785daa4d0fbc17020bd38d6aa1121afabc771862
SHA512 ef5a39febce196d7f27c13daa319797f57b846ccccdcc0ce521d78bc0f7f8c0b2414f36f93738b410910ee4b3f8c15615f36ba96e2c8dc73f0ff3a78ba01d382
SSDEEP 12288:vFXI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:v+743TvRk6NwG
MD5 SHA1 SHA512 SSDEEP

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 1ad663b560f5e2b63c7d23f5646e9bdd1fdf179096202991b0600d2207334bc7
MD5 4607760bf0e1f20195cc5aaea9a9e629
SHA1 468027376371f844027e7540fe7f91e0a25d7fe9
SHA512 811c1f0536c996b691a570311dabf10305d35fe40a04c91c100fb2c24e8b259012bdbd9b104769a0aabed243e86436a49ae4bf196f7ef4b38560f39ed8f6e76a
SSDEEP 12288:TUFmDDLKXI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:bl743TvRk6NwG
MD5 SHA1 SHA512 SSDEEP

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 5491f27d60bb9ea4dc88ea96ad38be6b95c19b256d454e39845a5f7411c8a83f
MD5 0d7a63c05af11d2ff579460c25df2137
SHA1 c891f6cec0669070d2d6af09f60950f1f0ccb90a
SHA512 3e5b3644df368f081fbfd71f6d65071861f240d330e015848561d10c8159eb350a7e294af04f10d85ce34e3f7b88443d543253e6d5c7f7ef9263025f56c49f69
SSDEEP 12288:4ZXI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:4S743TvRk6NwG
MD5 SHA1 SHA512 SSDEEP

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 7d29ed6fcb054e446d768d696e10c6089ba98dc2dd920b35c8c3a1c4bd0b0270
MD5 8dc9c5eacfa08eaaba9828cb3bb42793
SHA1 9213d82b4410573591df17f4d56c51db1301df80
SHA512 9e9347ec5ebbd5086273b53e25cd62bbb8f56f187ebb0d2dbc24e8eb933f0255f0edb81dfcac28aa099d437d5fb08ed4d01776eb2fd159dad0c3dbbc5163be8f
SSDEEP 24576:5oiQ0h2Hm7EkuAK3xV3tk3tLjN2VMbxR86mHx/YY/izSI2sBq9EzwwXg/bE743T3:5a0h2GEkuAe73q3pp46zwwQNDv66mG
MD5 SHA1 SHA512 SSDEEP

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 fc4b3977a50112e9d8a4ad7648a892ebfb84907a325b15346a9cfa38a5c27c86
MD5 97e344e636d1b08943a1ef3ed98e91a9
SHA1 ae72b5678b3146e45c0c392c8fe37d09ca03cba6
SHA512 ad2701b44908969900eac10c8138f6214ef7dbec26b4c50d3f3a944bc96483bd09db0d71668946b3b699e8319d8b8bcb888332ff43e328d72ef953651ac39887
SSDEEP 12288:AhbHjfXuXI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:AhbHjP5743TvRk6NwG
MD5 SHA1 SHA512 SSDEEP

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 4bb5b17ab6e0e7da39d2af81602b936e18c26ec5f85e5cdba6fc079e99581e0b
MD5 36336c36da00d1a6c039824e6ddc9d61
SHA1 037bcc10602c9c1cb749bd99e9898bc96d2e200a
SHA512 1321825cc6ae3f121cce59762917fe15af6328ec7c677577af896642bc6de15dace1af803edd9990033e69995c23988aa654a1f7cfd75bebc8a37db2c86481f6
SSDEEP 24576:73YgnJcRTk4yti+R5dpR/x743TvRk6NwG:7IgnaTk46ppR/aDv66mG
MD5 SHA1 SHA512 SSDEEP

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 bd76e08c188f9075411bead7a657736a81b9b92ea3fd62326ae996bb2920b9c4
MD5 e64fcac15907c7d232ae6ef2505d677a
SHA1 7adf4386f96c8e0ed10bc2ed9e39f361e0456022
SHA512 8aa3ac0ae1220dd85194dc1e776a1fba3ae0a192527a0a44b0c37e99a8b6f1dece6651f4311768b727ff8809c53e743f26c6f39ec2e0471addc4e4e9d27c8997
SSDEEP 12288:09XI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:0m743TvRk6NwG
MD5 SHA1 SHA512 SSDEEP

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.6MB
SHA256 eb9b3683fca02057799480aa7de45d290c393a913295d603fc0cd13fc27ac1fe
MD5 85134450fef9d0309f2031cf6ff7b882
SHA1 c021600143fdc8ffbc9f9b641db6aa596583f5e4
SHA512 d7f55124615358f351ab3fea3eb3188350edf721b3c80fa306bf74734a8a3357a22074702dbeaa0c440f4a025a747fc568ba7f6ce941aa93e956e609a9db9831
SSDEEP 12288:6ObyA4LWOsvAYFTsXI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:raL3UTn743TvRk6NwG
MD5 SHA1 SHA512 SSDEEP

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 30eb6814c5d60e94707d3c88503837d234a668ecb3a3cff25bbc78cdd021de31
MD5 85aa915625a5c45ade98cae8367dbfd6
SHA1 61aa4b77afe1ac3ad00ba380678fae80012ef11c
SHA512 337bc9e66ede109d7d434f82b7db6fdccf1f8adff2b141f9d01e770e06b8a13cfcd911dc5aeac7cf3a2ee7e0b1039e4bd7256928fbb071baf5a128b8dd5d7443
SSDEEP 12288:IpFtvOwXI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:0Or743TvRk6NwG
MD5 SHA1 SHA512 SSDEEP

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 fff37582c7d74e28bf70a901dd0896f0a77e5094e44678a1e698a6c7c97e3351
MD5 37f27d0bdc79b11351382a0ded68fb51
SHA1 4d7fab04ff5293e6359cec767a79234d089d7d20
SHA512 66d453e2bd7b78078d952fa87d7edab07eaa61e9ce08afbe6b2cfc2daa256bd39589367f59989f6a430ee5d8800d42203e5a475dda811609aa9cac09ce992715
SSDEEP 24576:j7NM9YmZqmWMUkPjZM48Mv6bEhsi743TvRk6NwG:j7cBWMpPjN8DbEhiDv66mG
MD5 SHA1 SHA512 SSDEEP

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 9dcdb3513c9ef1d644cb1d2f3e940506d758c7ed336cadcdc9dc540f40983b5c
MD5 e50610a6f80921cc70c79a5bca0943dd
SHA1 d7855759765422e02f65938bf4fa122692d6fc17
SHA512 47fb4777c17bf8192a9709b53711f13c3f8e069f681370ad233e792e2fdf8191c3659e0cc568253133cfa6480b3b9139bb4436a9388e59f8d6bd52dcb285656f
SSDEEP 24576:7W6BApg2YuyuNDYTabvcRvNYf8km1c743TvRk6NwG:7F2YuHNETovcvNYf8kmbDv66mG
MD5 SHA1 SHA512 SSDEEP

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 43c3dce084f97c2bce7a658dc6beda3e4d2396dd17110bfe23bca4a93da9d614
MD5 baab698180e1387f0ef9e3570ade9fde
SHA1 92939625bcc69ffc28758d84bb7de678a8a072dc
SHA512 629bad0ef1df35fa07b6cc6870e293f5fa098b1e1530ce0f9226a76916903df76a1ffab52dabce8cd1badbd1c350325e79f988de9cf1f7d6233b09b3ab28ce48
SSDEEP 12288:LhOAY2KY6065+AhS6CVlWwNSNXEbZjtotiXI7vgbrWVQhTCYHvRktx/aICF9fleh:cAFs06+OmlfkNXEbToP743TvRk6NwG
MD5 SHA1 SHA512 SSDEEP

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 8331ad08103f1ba43e9605f66ab409611b4defc6cbedc5aeb302ea3916a85f0b
MD5 bdb16f438295ebb37406d9f759b97514
SHA1 8a2d03079c03a4ec1dd177b8578a7b7904721dde
SHA512 fd07cd722516a5da55978a130437fbece70acd9460a54648888753e78fa3415d72b509add6c2f716ac3a2d690ff0dffac75fed16b612ac1da59f4bfc6f4bbaa2
SSDEEP 12288:DCJnJ5D3VkrqzxpXI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:eJnJ5D3WaQ743TvRk6NwG
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 c107f51c8ab5ace01a38e4055e14213f0577bb3d1a41f5a42857939ff07838bb
MD5 d084c0c7619adb88bab7941cfadbf2bd
SHA1 232ad4337c9e450d13e76e76992857b2e3828a3f
SHA512 f903e6f6a5b9269c42e264fc26ece4cdc77f4893195b8baa7ce26484a8f7110e48fd5c2a34bb4d42f6b7a2e1d82f64f41c287c12ee7c1e72b8f73707bf7b373b
SSDEEP 24576:tEPohm6/7IIXdwcXrif7qQncjlP65i3Vux743TvRk6NwG:ao06DIKdwc+eQnSt65aVPDv66mG
MD5 SHA1 SHA512 SSDEEP

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 017b09de942da30b5a77c15da750e649518104d261b5f5264be7236cb46233b5
MD5 2aad52ea32be9d3ba60987c87f4200a7
SHA1 2e416ecab0ae2fbfe22befebfb10cf3818b6262b
SHA512 7c69026c57c1f1659718ab155614e0b415fb71c2dfd01b413498fb9d7dd0c2fdb185cad7b93faa518f927f5342bb0ea33b5ce7aff19289cdd6e544982e5738a8
SSDEEP 12288:4EP3RsXXI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:Tso743TvRk6NwG
MD5 SHA1 SHA512 SSDEEP

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.4MB
SHA256 4645c89e92b9edaa0c757fc9a6e82986453042fa8ed6244ab664be1215b12c44
MD5 734bba2f07d57b218d6ee1e831022f69
SHA1 9df6b4b5d86331575dfeecf9afcb001090606da9
SHA512 bec9acde33bd0b38957d077450eff56dbf411a20a0207aa4e3cbaac86ef63a52b574294229007858063852b93d8866d28560f0829a326cf58d2607f349edb6b7
SSDEEP 12288:ojky+XI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:oIyp743TvRk6NwG
MD5 SHA1 SHA512 SSDEEP

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 3ce4da32663e4b77663c490c71aa5030c14644e07b46fe978609eee087d74a8a
MD5 b0b22d670ddcdeb648a1f32ba55148c9
SHA1 6b0b98100baa8c1df861e8f5ea74762a000ebe41
SHA512 83b41dc8ad7b66580dcb370eb2f6c14986194b12fce0002340d58e9df51f439e186a00f152e7811ab34bffd102735658515c7057adc37b16d99ccb2d68bc48da
SSDEEP 12288:GHAXI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:Ob743TvRk6NwG
MD5 SHA1 SHA512 SSDEEP

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 ae8972dfba22195a74c773707f220336ace3e17df604133227c95e28af4a17c8
MD5 702cdefbfa0af0529ee82d63901db4a4
SHA1 0bb458ab4eb61b871922db3202afd908b4a5159e
SHA512 4d1dd4ab4d8c85d7acda407fc47f84c9b81466cae9efaa7b980ace3f72032b97d90c7a8cab2d47d7cf2c08dd29cf6f2d21bf7e2bbf5a1deaf297e31e31a51236
SSDEEP 12288:sLQZb3C97GYnZMv5zBcKY97MD3hXI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0Vq:6Q9MxZKdcz97w3q743TvRk6NwG
MD5 SHA1 SHA512 SSDEEP

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 9772e46272f62d0ad958c39ae5cef1fda7b41e5b9c9dcf99b35d4df5a6239e9c
MD5 222d6f872578aa5db482ce0992e27027
SHA1 ecb4e88320e0769d0e797fa6498e792d551014b5
SHA512 d3a41dfec69bb0e183c4c6992f396abb299ba4e989e1d4e9b8a9215e07fd0a8963f54258ee56268bec50e576e2f5727378c030d9c3475efd51538f40c4ad831b
SSDEEP 12288:SyoKo2cRple9pCXI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:SyocaApt743TvRk6NwG
MD5 SHA1 SHA512 SSDEEP

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 93ac1c41951af7e093198b8c404bd9fe8b41973b9d9b43c0dedb4d762bce0d16
MD5 15039b026e28bd2aca1a5fd0543d7b4a
SHA1 acd37141b177ebc4db2fbbbf65b8cccaced23990
SHA512 8e0421a66e30472e8edcd8965611ff61c85bad3066bc7e24cd04df9da25af34e0198e91bb85abcfe98e4d8ebf5da12197450a231bc170e10dcf04d29a1e3a3b0
SSDEEP 49152:nWcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIKuDv66mG:f0zuNIKDv6V
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/548-254-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/548-255-0x0000000000E60000-0x0000000000EC0000-memory.dmp

Download

memory/548-267-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/704-284-0x0000000140000000-0x0000000140155000-memory.dmp

Download

memory/704-405-0x0000000140000000-0x0000000140155000-memory.dmp

Download

memory/1052-238-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/1052-71-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/1052-80-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/1052-65-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/1392-645-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/1392-397-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/1940-522-0x0000000140000000-0x0000000140140000-memory.dmp

Download

memory/1940-328-0x0000000140000000-0x0000000140140000-memory.dmp

Download

memory/1964-339-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/1964-558-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/2040-47-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/2040-48-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/2040-39-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/2040-234-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/2356-295-0x0000000000400000-0x0000000000541000-memory.dmp

Download

memory/2356-411-0x0000000000400000-0x0000000000541000-memory.dmp

Download

memory/2392-433-0x0000000140000000-0x0000000140170000-memory.dmp

Download

memory/2392-648-0x0000000140000000-0x0000000140170000-memory.dmp

Download

memory/2444-15-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/2444-23-0x0000000140000000-0x0000000140154000-memory.dmp

Download

memory/2444-232-0x0000000140000000-0x0000000140154000-memory.dmp

Download

memory/2444-24-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/2492-452-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/2492-650-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/2884-396-0x0000000140000000-0x0000000140163000-memory.dmp

Download

memory/2884-269-0x0000000140000000-0x0000000140163000-memory.dmp

Download

memory/2940-34-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/2940-36-0x0000000140000000-0x000000014024B000-memory.dmp

Download

memory/2940-28-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/2940-233-0x0000000140000000-0x000000014024B000-memory.dmp

Download

memory/3212-432-0x0000000140000000-0x000000014013F000-memory.dmp

Download

memory/3212-305-0x0000000140000000-0x000000014013F000-memory.dmp

Download

memory/3340-395-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/3340-379-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/3740-249-0x0000000000700000-0x0000000000760000-memory.dmp

Download

memory/3740-251-0x0000000140000000-0x0000000140153000-memory.dmp

Download

memory/3740-243-0x0000000000700000-0x0000000000760000-memory.dmp

Download

memory/3784-370-0x0000000140000000-0x000000014018C000-memory.dmp

Download

memory/3784-642-0x0000000140000000-0x000000014018C000-memory.dmp

Download

memory/3804-358-0x0000000140000000-0x00000001401AC000-memory.dmp

Download

memory/3804-639-0x0000000140000000-0x00000001401AC000-memory.dmp

Download

memory/3992-322-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3992-451-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3992-541-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4476-646-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/4476-406-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/4520-8-0x0000000140000000-0x0000000140247000-memory.dmp

Download

memory/4520-0-0x00000000020A0000-0x0000000002100000-memory.dmp

Download

memory/4520-11-0x00000000020A0000-0x0000000002100000-memory.dmp

Download

memory/4520-13-0x0000000140000000-0x0000000140247000-memory.dmp

Download

memory/4520-6-0x00000000020A0000-0x0000000002100000-memory.dmp

Download

memory/4884-57-0x0000000001A50000-0x0000000001AB0000-memory.dmp

Download

memory/4884-62-0x0000000001A50000-0x0000000001AB0000-memory.dmp

Download

memory/4884-59-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4884-51-0x0000000001A50000-0x0000000001AB0000-memory.dmp

Download

memory/4884-237-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4944-412-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4944-647-0x0000000140000000-0x0000000140216000-memory.dmp

Download