f4ddfe793427c201cc8ab1f0919d302f89fe489c11f5db7ef8808d3cfa6fbcd5

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01/06/2024, 19:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-06-01_c85488ee0b88ff1e3cfc6350fa8324d1_ryuk.exe
Size 1.0MB
Sample240601-xt8nhscb2v
SHA256 f4ddfe793427c201cc8ab1f0919d302f89fe489c11f5db7ef8808d3cfa6fbcd5
MD5 c85488ee0b88ff1e3cfc6350fa8324d1
SHA1 1a98ee21937cdfb1445ec77bd96d9f305b421713
SHA512 e758b6046836d9a5dbb5101921f3df2b098a8522b6d0b8d86e89977c7375753a990d7d0de4c83146cfad53798f805291ecf16fd61cfd11faf446379cb2315ff5
SSDEEP 24576:G6V6nC/AyqGizWCaFbyTUYxH5nczaKg+aTTsdVbqd0wT:G6cNGizWCaFbsxxH5wNaTT7VT
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
4208	alg.exe
396	elevation_service.exe
700	elevation_service.exe
5064	maintenanceservice.exe
4496	OSE.EXE
2720	DiagnosticsHub.StandardCollector.Service.exe
1008	fxssvc.exe
1012	msdtc.exe
3512	PerceptionSimulationService.exe
4744	perfhost.exe
952	locator.exe
4708	SensorDataService.exe
4080	snmptrap.exe
3444	spectrum.exe
3680	ssh-agent.exe
636	TieringEngineService.exe
3128	AgentService.exe
1996	vds.exe
3356	vssvc.exe
4408	wbengine.exe
1504	WmiApSrv.exe
872	SearchIndexer.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in System32 directory 24 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2024-06-01_c85488ee0b88ff1e3cfc6350fa8324d1_ryuk.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\a1d9af8c3136770.bin	alg.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_104468\java.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	alg.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b412007c57b4da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c41fcd7c57b4da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9933 = "MPEG-4 Audio"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005a84537c57b4da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001d35647c57b4da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009d39077c57b4da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003f97667c57b4da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
396	elevation_service.exe
396	elevation_service.exe
396	elevation_service.exe
396	elevation_service.exe
396	elevation_service.exe
396	elevation_service.exe
396	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
664	Process not Found
664	Process not Found

Suspicious use of AdjustPrivilegeToken 42 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5036	2024-06-01_c85488ee0b88ff1e3cfc6350fa8324d1_ryuk.exe
Token: SeDebugPrivilege	4208	alg.exe
Token: SeDebugPrivilege	4208	alg.exe
Token: SeDebugPrivilege	4208	alg.exe
Token: SeTakeOwnershipPrivilege	396	elevation_service.exe
Token: SeAuditPrivilege	1008	fxssvc.exe
Token: SeRestorePrivilege	636	TieringEngineService.exe
Token: SeManageVolumePrivilege	636	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	3128	AgentService.exe
Token: SeBackupPrivilege	3356	vssvc.exe
Token: SeRestorePrivilege	3356	vssvc.exe
Token: SeAuditPrivilege	3356	vssvc.exe
Token: SeBackupPrivilege	4408	wbengine.exe
Token: SeRestorePrivilege	4408	wbengine.exe
Token: SeSecurityPrivilege	4408	wbengine.exe
Token: 33	872	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	872	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	872	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	872	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	872	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	872	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	872	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	872	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	872	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	872	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	872	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	872	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	872	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	872	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	872	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	872	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	872	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	872	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	872	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	872	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	872	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	872	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	872	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	872	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	872	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	872	SearchIndexer.exe
Token: SeDebugPrivilege	396	elevation_service.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 872 wrote to memory of 3748	872	SearchIndexer.exe	124
PID 872 wrote to memory of 3748	872	SearchIndexer.exe	124
PID 872 wrote to memory of 4980	872	SearchIndexer.exe	125
PID 872 wrote to memory of 4980	872	SearchIndexer.exe	125

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2024-06-01_c85488ee0b88ff1e3cfc6350fa8324d1_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-01_c85488ee0b88ff1e3cfc6350fa8324d1_ryuk.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:5036

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:4208

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:396

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:700

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5064

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4496

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:2720

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:4224

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1008

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:1012

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3512

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:4744

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:952

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4708

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:4080

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3444

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3680

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:748

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:636

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3128

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:1996

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3356

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4408

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:1504

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:872
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3748
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
  2⤵
  - Modifies data under HKEY_USERS
  PID:4980

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
Size 2.1MB
SHA256 a462407bb70bcf8f310fdf69f57acc71e4de1d16444e6c9394ebe08cee40346d
MD5 474bdbd86f8e63721366bd04cccc83b8
SHA1 b20b3ae65567cf3566c19a5c59d0bc515d7a1076
SHA512 3f39f6013b073262327c9d94abdce6335cb21bafc3129b12d4f477f3df369f564ff8a02a201f35d357bc9bfa35fe0691a90a43674235274ed8f6bbfdc6fe1b3b
SSDEEP 49152:7uYk3H5koUafTqkkYLO/W2buywzMbOX+T7z51xxH5wNaTT7VT:7CfTqi90b5XH6kP7
MD5 SHA1 SHA512 SSDEEP

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 797KB
SHA256 e5fa5eb3acf69a8b52f15bb4e545e99279a5616ea83f808836c205995ff40649
MD5 5e26e44c33febead8d29ba428913da5b
SHA1 a00c46fd4f251aba1bc3aee5a21e3cc67efe939f
SHA512 53da8b8e7fa604abda97670048f7cb538ecf34b36578ca5270c49cc33c89930346eb18e579feb74dd6ee640e862b32e17efc77bef94be31a1f1260c64ac431ac
SSDEEP 24576:/iPnBsuEeUYxH5nczaKg+aTTsdVbqd0wT:8SujxxH5wNaTT7VT
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 58d71b903acbc2df5ec1559c167bc513e6d964c6abf5bd7db3bac1c518d2310b
MD5 ac001fdd09aaeea80a25296ae29ee032
SHA1 fec0f889fc9d98ce523b2c8982d0e521360a488a
SHA512 cce07abb00d896a804f11c4d600536c038ce96c319fd13e139d3316fc391446dfb6d627e3267f13fd41ecd7fa332fda8b38c6e09739c6e9c037758d057970507
SSDEEP 24576:b+gkE1fh4CoKUYxH5nczaKg+aTTsdVbqd0wT:ygkERSIxxH5wNaTT7VT
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 63d4c3c53acf373e294cf8a2822d93039774ad4929b07345f8bea93ad1a7cc59
MD5 0154da27b93a5e415977959f8e26d48f
SHA1 4373db95cd861053a4c445c665984ec2e41e6058
SHA512 53996302975163c524e07aec0547c0a4d49b264791ea4153689925a3b0e7690e3363bf95da37c166cba59e9ec78ed9cdaaa86e46cc6fac1b5102b969f8e1fc20
SSDEEP 24576:EBpDRmi78gkPXlyo0GPjrBUYxH5nczaKg+aTTsdVbqd0wT:ANRmi78gkPX4o0GPjVxxH5wNaTT7VT
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 e094dd9ecfcdca403b5d4b85c5ab459cd24ca4a647aeedbd4a88ddb60488d695
MD5 3188a341270ddb463c5e90d949b457d3
SHA1 bd0b5761e8c105d4baf073b3a7601e08eb1478ab
SHA512 dec5d7382edabc23a7df8b5797a162b8eb7d62bce4a60515ff2620f99a633d502d06c543541bb3b9aafde26e6fa0afac5192345acbb2b11f7f38b9092075f817
SSDEEP 24576:kLOS2oPPIXVKUYxH5nczaKg+aTTsdVbqd0wT:8/PtxxH5wNaTT7VT
MD5 SHA1 SHA512 SSDEEP

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 dbe9f2e38b5f343519f9ce6004939af1b172f1c85f278f3e19af173a78aaed7d
MD5 68f4cb66f59a41111e9a900afdd7e493
SHA1 277a5adfcdd0664a4666bf1cf1303ca31a7046c0
SHA512 1bf286cf41aeae826b6393f5b4625631d9ba36bf760988155d093501ccc0e8d1e767286b930c052cd1e610e6434d8287bba828448f259b27f3e25ed0fd668331
SSDEEP 12288:PZslUYxVtECnc19+3Aq4OKFeT62T1wBSNKKv/LNsdDusb0zGq0wT:PZoUYxH5nczaKg+aTTsdVbqd0wT
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 8840bc98fd36c16ff52c96ca26901070dac4e8d9cb5fc1c2cce0d42c8fbee445
MD5 c3d118637e15fb07b96b0b8211d4e84b
SHA1 8146fe5145b19d94538cf1b2728d2730982d7958
SHA512 32e8b6f8eb57098f6b337069e483d254a24a5be646cb1ae8140d174220d60facd690fdf7fa59231d6501ef21d5e91621d452165f6db475404097f8429c747215
SSDEEP 12288:KeBNUbTVO86U5lUYxVtECnc19+3Aq4OKFeT62T1wBSNKKv/LNsdDusb0zGq0wT:KJIUHUYxH5nczaKg+aTTsdVbqd0wT
MD5 SHA1 SHA512 SSDEEP

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 d1163acb955c74e4492abaa8b9fb5c31bd820480b3872a6528583c833e4e6f52
MD5 3ada729be320469698abd0c76faaa973
SHA1 7d9b0cabadde50eb61b38eadb12c7239ca3d3b1c
SHA512 cd65847d94edf1d9ec28d16929da5e4cf7d16ff4d616c97eff25fa8d1461b2f5de1327c3f7f5af85c619bf1c4fa3b42c8bc54eec8bee7f7dec17e6bbc4a70ddd
SSDEEP 49152:JQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJR9DN5J8NRV3TH1:JQvGAdlCEL8c/RRNw5CWXH6kP7
MD5 SHA1 SHA512 SSDEEP

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 d71a6df06aed4b3ee662b94aa7fcf62f760085175e9540100fa2ae8a5d8da4e4
MD5 b0bb8a295938026d71a67ccf7b044bbb
SHA1 248bf9881b0b5b423189db9288f13d0de47630bf
SHA512 6d896e38f082f42e37ba81ed31872b13afbda6c0b333689d11e1c1966ccf3ace6f92035b284012f4450c0c7910ba374e4afbf9cdf70a9da299194cbaa30c16d7
SSDEEP 24576:ySewsAj5UYxH5nczaKg+aTTsdVbqd0wT:Nlj5xxH5wNaTT7VT
MD5 SHA1 SHA512 SSDEEP

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 9d16bd257770a648ed3b3662d88f3436322c14f57ffd0af6888275a0d8c7d1c1
MD5 cc98f4a822d9cead8f45845dbfe2dbf3
SHA1 b1d9c5ed551e765157314438872fc262bacad408
SHA512 a8c1ba2bd5c2891d20c95c0575649fcafc4383e122ba2543a992e915ed6837b4b4b81708e4a90038034cc563dadbbe4b768ae86eb04a552bf68693143e867fd2
SSDEEP 196608:+UEtQeTbvf2zlO12sJTv6Ja1cpVLyRIldPlbuJHF6G:+UEtQevvqc2W1cpV2RI32F7
MD5 SHA1 SHA512 SSDEEP

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 f3405c03ad7b1fa1a6bfc4dd7232f2d216039367f822835dd50f8211cdf83bd6
MD5 30863e045fa07e998dac7d7b1270f5a8
SHA1 ecea27fd1696cb216b2881b123c3d44086f99a06
SHA512 eb491538595c5d6c344cb084e997d936536dafd357420486b8cdfb6a348540915e34030d2fb87d5281872eea5ea0fa36a9a89510434329c31f0a3afdd2d9cfea
SSDEEP 49152:bCbRquA/m2yL5zTfFiV+XenmE3/zZxxH5wNaTT7VT:EoquVjnm6XH6kP7
MD5 SHA1 SHA512 SSDEEP

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 635bc40390c8de8da41ce3a00b198afafb3b063456a2047cad4fafd2661e1dcd
MD5 fe839aaed3d1442a9e3f12e7edbfd59c
SHA1 e9cd2a9fd6d403cd1ecf7d026d284420a9a7a55e
SHA512 80753c918823ef28145ed9b43209b3fb795125783e7999d8b60490c697d4e0b96de14716232dda16b9d07fbba7a9fafedcedf7ea49b1c5a2298e1b11e722bf4a
SSDEEP 24576:eAhGL2IFoiwtA5l7S53aUYxH5nczaKg+aTTsdVbqd0wT:eAM1Foiq5qxxH5wNaTT7VT
MD5 SHA1 SHA512 SSDEEP

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 e19644bc7548a57f3e8302ea45605ff466365b09ab13a87b56c9a414a2bb8aad
MD5 42a3c5dd94016f370d71db6779944adb
SHA1 ca099254c44aa2c4821611edb4555e22313de214
SHA512 ade93518cb0b8dc49ed060718927eb72082126442102dec2d7ee2ba4d1d85ab29e705d78ccb2e8969661328ae009cd23723aa18755a81432adb65ece8a8b47d8
SSDEEP 12288:gmw5HEjsChNSBFgl0WDm+CylUYxVtECnc19+3Aq4OKFeT62T1wBSNKKv/LNsdDuV:9wuXOWtUYxH5nczaKg+aTTsdVbqd0wT
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 510801e8efdfe1676b27280543be1f0bc1c8e493e948c013425563908ed3d681
MD5 2626ccf6314803c3eba7d713189672da
SHA1 8c328f0786ef3e4cf81e2d850b1146836d3f8382
SHA512 450c0037afc116ec2c7514050769d1c847e7c2d226a93012a4ccfe7e72613444eb18e7c99dc7b611080a84ca9becfae035ecf1568a15e499685488f78b4abeff
SSDEEP 12288:P/Z1Iy7lUYxVtECnc19+3Aq4OKFeT62T1wBSNKKv/LNsdDusb0zGq0wT:HZuEUYxH5nczaKg+aTTsdVbqd0wT
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
Size 5.4MB
SHA256 09766f0ac0472af236e7f42db0d533a6c811010b6c60e65886e3e9adc4412ca2
MD5 b4f8abc79c91ddb4514029bc567601c1
SHA1 6085120588e589b889a96f78d125ba6efd20d3a5
SHA512 15efd6ea48df4ac13bb5de711ae9f15c956df8d44e5deeda674e9546d26a56e59198135a192634db0cb84c0f0a87a2372cce17608194d7e76fd809f5488a882a
SSDEEP 49152:h0kwIi7c4xZlm5knEtw99Kn/2vim7vgv6m+yyJ/0gbvjS7yY7BHi3u7L/gBUUWLF:RwfhY7g/rLe7yYA3awr341gCXH6kP7
MD5 SHA1 SHA512 SSDEEP

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe
Size 5.4MB
SHA256 63a88805542a5253b10fb9517c714097154ff85367d12164c2cf2ce4f9911d20
MD5 00a79343fcb160969c6874e8376b1c7a
SHA1 5acfdfda88f7ac5546c3a0eca27a11e332d13aae
SHA512 ec40ef7bdaaac4050b36c0432a08cfc6d3e1eff8acb7ad00736e47fc528368554e1d7460988c026d33227abb4c6f310e7611551a90441de0e739024a8eb0243c
SSDEEP 49152:X0kwIi7c4xZlm5knEtw99Kn/2vim7vgv6m+yyJ/0gbvjS7yY7BHi3u7L/gBUUWLF:bwfhY7g/rLe7yYA3awr341gCXH6kP7
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe
Size 2.0MB
SHA256 072f7bf37903348186be648e8ba444ea2c787c614fbae8467808a903b58852a2
MD5 3ba4162131585e8f6aefdd74bb36e8f2
SHA1 c4f40afe3619690a315210aec0ee69fa00404885
SHA512 876a5143762223be6d76a9b4871e1fac8733bbaf18ca0901f1b329dbb9a3384d062b1ed1b421c682f2d830e0e978af066a648080528cce03acde37a1c56c3156
SSDEEP 24576:HcTyYv0FteQU75I2kjgD6iQacAtUYxH5nczaKg+aTTsdVbqd0wT:HuXv0FtpK5606zOtxxH5wNaTT7VT
MD5 SHA1 SHA512 SSDEEP

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
Size 2.2MB
SHA256 15e9e38c20315beb5de36b0cde927d10078683d03a27e9bbdbefad809eb6f2b3
MD5 5457a72faa7bb94d29c0ea164870500f
SHA1 c093a3d8fbbfe247064c5e9c9a16c17cf2c31aa4
SHA512 8b186da7e1548684d94454ec057c3a2858f519cf69eb28dc8ad1870a0d8b1a25baa53b569b57decf1c7c2efb7c824bbadbcb1b6bc4ff2c1c408cd074dd95dc91
SSDEEP 49152:Wy7mTd0GxN8jyynSHjXKUyn4GVcbDSKrNTx5xxH5wNaTT7VT:9mYeySHjWjMT5XH6kP7
MD5 SHA1 SHA512 SSDEEP

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe
Size 1.8MB
SHA256 876a05fac5307f985bc58d872568de854817fe9510440e6bc30e43886c49eb28
MD5 1e7f35fc118521ab5f5dfeb892a78ea2
SHA1 d09d343d23e5a1d1753976bfa5fec7dbeb240696
SHA512 cd719376f98b8c9e5103e19a10173dad479cec0825818a92cb65b73a68493fe8d25d2fc6085de532be40f5d932ceb59c9d55b73675f706b9b4b3d1b88baf4630
SSDEEP 24576:s6drZn1WEci182IEUgNbJeRgUebgW816cUYxH5nczaKg+aTTsdVbqd0wT:sWnDci18UNNUgbY1xxH5wNaTT7VT
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 1.7MB
SHA256 2f3cb685d16f654ff3b1605b418fc1f6e5dff15b49af368184e9a2ca9ec68193
MD5 2672d2ac38abae426dd0b1db1e65e6ae
SHA1 6c2cdc0f4657cf863530cbac8cbb1606b72cdd60
SHA512 6b0a69503a855cf026c11e5d509bdb7b7179c706c2f0621dfc34ccad37415791828274efadc414ed3ef2925dd7c58d96998c177a50f1ecb64c4d83dadcd9df7a
SSDEEP 24576:Qk5lHW5EzMZupOR0G2reD+melRgTTv/1nyjUYxH5nczaKg+aTTsdVbqd0wT:mizMZz0GhamSoExxH5wNaTT7VT
MD5 SHA1 SHA512 SSDEEP

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 9d1bd824dd8d32a61861048bce1b1a3f75a92c2b42d77cfae1cc94f1b0e66ad6
MD5 a664649d3d48ed29122c148c08e323c7
SHA1 3bf52b98599e861163655ef2430f4946787a7eda
SHA512 cd340df242f60358893df2b5ca1fcbefa2f80783df0c127a341c2f2dfc712b73a2840223b672387444fb5ba94710df7974e7fd49f839d0e63ae1f0d600d5e863
SSDEEP 12288:5klUYxVtECnc19+3Aq4OKFeT62T1wBSNKKv/LNsdDusb0zGq0wT:5QUYxH5nczaKg+aTTsdVbqd0wT
MD5 SHA1 SHA512 SSDEEP

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 ab73bca28ec897946d1fe62829728fe5aa6034bde625485e658622e5f996836f
MD5 2ec341cdf212222b91d1a02b063a3b08
SHA1 3619041e3c12c0d4a80fa2d797ef74c7d9a2a4e2
SHA512 a824990fa8953b7f3e6afac06b09da22f5bcdec7135e65bde9f9fa96afaebf5cb23abc86a4912de5897e2106d840bc28cfe673b77e97d7564b1a6361f54526d4
SSDEEP 12288:GnlUYxVtECnc19+3Aq4OKFeT62T1wBSNKKv/LNsdDusb0zGq0wT:GlUYxH5nczaKg+aTTsdVbqd0wT
MD5 SHA1 SHA512 SSDEEP

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 e3c85cf82cd7559e50db54fc2d77fa1dbb5829c3c2f6b0649b824daae135454a
MD5 cd3e4f9f963dd213f98595442f7ecd83
SHA1 431a0d4f5f3456bd4b0c1d9f65d69ab07b52484d
SHA512 83d698a1caa1f52741e3ae2af66fe8d4a60f9fa5943d2afd8a802ab44ee2a4312627a89d27235c7a377b7dde3cb951ff259daadb4c69f02eaf279d4ed209e4b7
SSDEEP 12288:cRlUYxVtECnc19+3Aq4OKFeT62T1wBSNKKv/LNsdDusb0zGq0wT:cvUYxH5nczaKg+aTTsdVbqd0wT
MD5 SHA1 SHA512 SSDEEP

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 d9ab13ed27aaed83e0d87f623427c8b84438223f0d01132ae698c95e6477aa9d
MD5 a2f23430264650e3f46067edba10f71b
SHA1 a4db709da21e4ea48b02aacfa2f56d6c33bf2fd6
SHA512 c87c899e33c34ef5ddfe958cc52c594b984902ff7c7164c2c37565fb2b4d6eea9ec43b641dd300fa375fc80eaf642643fe508ae5ed0b09441fc5b63e72a31652
SSDEEP 12288:vVGlUYxVtECnc19+3Aq4OKFeT62T1wBSNKKv/LNsdDusb0zGq0wT:YUYxH5nczaKg+aTTsdVbqd0wT
MD5 SHA1 SHA512 SSDEEP

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 0d3f106a5eee33b1c2c29361d3de5f78f49ec23ece9e973b8be1a42a4269afee
MD5 f226a570ef901c5dadedde8cfd9c9bb7
SHA1 a1f7228811615a184421dddfcfab4a472ed7dd92
SHA512 37fd35fdd1f659d62521404b4bbb295bd1b4d1fb000ff92aa996d94d2f0d8b49cabf5af30fe7118662080410bceecae626c9544f04573caa20fec399f5c00d35
SSDEEP 12288:WulUYxVtECnc19+3Aq4OKFeT62T1wBSNKKv/LNsdDusb0zGq0wT:WSUYxH5nczaKg+aTTsdVbqd0wT
MD5 SHA1 SHA512 SSDEEP

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 c7f1efbc867e65ab48ac270e5a33aae7be8165d842402586392417c12a26d883
MD5 fe1fdda1d1644ffb0ca018f75b46aa55
SHA1 2bdd1bf25a67f83bfd6afb1eeae66c9c62cc1b86
SHA512 61ea844c808b8abf7f64152baf35ca9fef6e42de42dc5ec4b281f8e7c9ebb011943cf51817f63123631dc5fc0479f36e857475505a6b04f273881d4dc321dcb9
SSDEEP 12288:7DlUYxVtECnc19+3Aq4OKFeT62T1wBSNKKv/LNsdDusb0zGq0wT:7BUYxH5nczaKg+aTTsdVbqd0wT
MD5 SHA1 SHA512 SSDEEP

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 71fb1605e94215690a68153e3b994612755514a9495d18e8dbaba3e0d0807a6c
MD5 b877db6fc9bbe96614372569e24d66cf
SHA1 0c886f855e387cb95dc393f27d68686a00513c5d
SHA512 fad8388ac0449c6035567d9e6e3555d23e5aa9a5450bf8db2f3501cb97ee50b8ca965b47e78b4dc2937d6fed728da0adaa782af6d98063e91d6e04081cb45cb2
SSDEEP 12288:AvlUYxVtECnc19+3Aq4OKFeT62T1wBSNKKv/LNsdDusb0zGq0wT:A9UYxH5nczaKg+aTTsdVbqd0wT
MD5 SHA1 SHA512 SSDEEP

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 f5728058c47a86be17e4c9b77798abae6f938369489054616e0287b55b7e5212
MD5 5c5c24630d72234e814f6f1c74e68df9
SHA1 470fd6cfc9a58761bf71a8b27fd565a369718bf6
SHA512 efc2ebdbdaa92b6e5ffb1b214a6a3d8fbe35c8906a391c79b1bde70f34203d43b70fa61756cc81edf9dcfc314d29985ebb5d4a4bb295896995c0f9028343fef3
SSDEEP 24576:HZMMzFVSOFUYxH5nczaKg+aTTsdVbqd0wT:HZMMzfxxxH5wNaTT7VT
MD5 SHA1 SHA512 SSDEEP

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 beb738642a48b9896a2856b3a0011630a911b66f5ab21c78fb113b305bd722ad
MD5 d5cd6ce4bb3e709509235093ce8b35b5
SHA1 99b96e54606149dd6911d48e71529ba3ce811738
SHA512 132cc141791dc535f71649d3e66897049b10f42e7c5ff317ac95a89b874301554bc15ef181afaa86700573deff9b4d00bd893a796f3ee034751f45ea01413ee0
SSDEEP 12288:SIlUYxVtECnc19+3Aq4OKFeT62T1wBSNKKv/LNsdDusb0zGq0wT:S0UYxH5nczaKg+aTTsdVbqd0wT
MD5 SHA1 SHA512 SSDEEP

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 c18abaaf00ee688de3307215c435d6a5c546d926b16ba9082dbdbfcaeb8215cb
MD5 da0a04ac9750aac3eb9039449341bda7
SHA1 f3f2eb06a83e93d5f4c81a0182f3add3b576159f
SHA512 851c17d6806dc4d17e2842ffd37e45d473ebf41a63bbee9dbc55018adad9e6b40235781f8032bc1def6f86114e2394ef306f5138f64abff63bc0c936e3df27c8
SSDEEP 12288:78lUYxVtECnc19+3Aq4OKFeT62T1wBSNKKv/LNsdDusb0zGq0wT:7YUYxH5nczaKg+aTTsdVbqd0wT
MD5 SHA1 SHA512 SSDEEP

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 68124191f7e0cedda2dfcaad7cae9985f9cdd05963ab1464c7031dffe86a490f
MD5 933bca51166f921f2aacc246493d1dc6
SHA1 fbb70ed1bc692f56f0d431e222172ee371fc456d
SHA512 e962f3e07ca39872f0d9b19fa712fe1a4e9871d1b66feb0863435d045ba3eb63d30cdc56d98c9de42882dc545276be5752601e422df028ccd90986e455b583b3
SSDEEP 12288:ayPz5L87lUYxVtECnc19+3Aq4OKFeT62T1wBSNKKv/LNsdDusb0zGq0wT:HzypUYxH5nczaKg+aTTsdVbqd0wT
MD5 SHA1 SHA512 SSDEEP

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 3dba0fbbc728d05d70eb411b84e0ac73658bf8d95120cd12a0aeef6d78625914
MD5 b51db365ab425d81499951aa446bd4f6
SHA1 1af140ca53556853e33c9c7ddc043909230260f3
SHA512 5c6eddd1e8c410a7369a5faf73b8f3d65688b9fac65c6e75846ef971e90bc3a75c9267e1bd72db9c5a4e6b384ed4b050301ba3ce80c6e3f68c663bb6ef5e529e
SSDEEP 12288:0IlUYxVtECnc19+3Aq4OKFeT62T1wBSNKKv/LNsdDusb0zGq0wT:00UYxH5nczaKg+aTTsdVbqd0wT
MD5 SHA1 SHA512 SSDEEP

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 0177750dfdbfbaf0e7bb02b067bfc85709c3efaf6609c65211bacfae7ebae024
MD5 d3d4def6e0fe3c031dedb23df152ef45
SHA1 cc504b9d8a43740a6fe0183b06027de6e76d203e
SHA512 a5076a120444d9b8f6c598d0e8aa6eaa9e9bfd49f7b2aa30d5c12033149cb61e2f9cbd9c78c5936ec8da48edc8c28dc76cda4355c8e176340f7dbc5ee95ecd98
SSDEEP 12288:JIlUYxVtECnc19+3Aq4OKFeT62T1wBSNKKv/LNsdDusb0zGq0wT:J0UYxH5nczaKg+aTTsdVbqd0wT
MD5 SHA1 SHA512 SSDEEP

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 5c3d2bb534030406eaffbaf716f15fca6e9027a3b80d370da475d89f3268518b
MD5 f87824789015b8c158ac7eac42ca303b
SHA1 36d17cca29d2f13ebfa6a41dd573045e8748eb93
SHA512 c7c0c29033233f7eacd96a9dfa2ba4784e1992c95af6aa8777136eb6edd78d4d03aa5c306d24f405d3898967e8b14463ec997788a48905e884cbe009196e3c02
SSDEEP 12288:HyPz5L87lUYxVtECnc19+3Aq4OKFeT62T1wBSNKKv/LNsdDusb0zGq0wT:qzypUYxH5nczaKg+aTTsdVbqd0wT
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 ee1253da49cd433ab4a77ac258ae0a1414650657ca78575531a3a4147b293fd2
MD5 8e57548af9bc837efae94069b5a8281d
SHA1 1a513051009a4058da35de65074868ad8eeb0316
SHA512 1c10c19c0117a0dee3b688b7b16d74d5427255a0ef1b260283e3bab5293f0f2e0589263e6593cdc233f3f89f75a40f8efb70815131079b70a45b79ae041999a0
SSDEEP 24576:aT9aLl3z0zD/UYxH5nczaKg+aTTsdVbqd0wT:aTQLljmxxH5wNaTT7VT
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 ed0d1f0d06115d0324a6f10ea6494ba4422558f338a347fb587bbde4313149ef
MD5 441aa60a15f2969334f568e9b938e48e
SHA1 3084eb0eb760741aeed4c6e9284f92c79fa9830a
SHA512 7c31794bfca6cce74c52ea55f66e379889103844c2c1f1567af0913f53612a0f9b426bee86a18420fc12433f4ae12d86bc4eadee4532e18cd8211ccdd88cc7f4
SSDEEP 24576:t3td9CHKy7GZbUYxH5nczaKg+aTTsdVbqd0wT:Ntd9CHKyaxxxH5wNaTT7VT
MD5 SHA1 SHA512 SSDEEP

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 da97a8446dfe99333a962734f5cf6cfb71bd81e69b421b7106c5054879798497
MD5 bdc65615420c9b4609644f9ab2575698
SHA1 88e52ed0dbe389a8923d9ac9b02de8c07fc9c5d0
SHA512 e341d563d3e7fc2048df963f797b36be1a1c57e7809ce00a72f6a22b5d6f0a3a352a3f6d0df4f296f2e7a28878e13288f66ecd3d2c966da74b607fa545e53b98
SSDEEP 12288:dxlUYxVtECnc19+3Aq4OKFeT62T1wBSNKKv/LNsdDusb0zGq0wT:dPUYxH5nczaKg+aTTsdVbqd0wT
MD5 SHA1 SHA512 SSDEEP

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 3cb2a1efdc99274c6a69fff239a729c149aa1668b2f255e5a9d2ffc54cb62bd7
MD5 0745571e4952c67db7564ee8b9f5870c
SHA1 6d38620de0a8417bb5bbad828b50cfb6d7e65deb
SHA512 339f792fc6dc999ead1a2e9a588fc99e378c79230963df21ad6c111be44565209abb5ab0453f44fa4a3c7c0ea74f6064c3724357128a00e9dda75c99b0a125a3
SSDEEP 12288:3blUYxVtECnc19+3Aq4OKFeT62T1wBSNKKv/LNsdDusb0zGq0wT:3JUYxH5nczaKg+aTTsdVbqd0wT
MD5 SHA1 SHA512 SSDEEP

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 9133f5c13f361b8e31997276ae811dd19ec7531d78d1ce7345b869ec3e561291
MD5 c4c73abb4fd8de51672adc04ce211e39
SHA1 ac60cd47ba79906bcbf923e349723b1f75b7d02d
SHA512 87b54caa918feaa2b81dd1ae8328fb92f50555a847a4fde2e41ccf37d925c6be1abc05c537e42b73d15b31321a99652742c5d4f73db6505970586565ef6a14bf
SSDEEP 12288:CalUYxVtECnc19+3Aq4OKFeT62T1wBSNKKv/LNsdDusb0zGq0wT:CeUYxH5nczaKg+aTTsdVbqd0wT
MD5 SHA1 SHA512 SSDEEP

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 57dfa5320e21137034f15f4c8880ddebe64ec321494c6cff306c29fdba81f1e5
MD5 069e8990d4e218bcb2ce5996d2b99f05
SHA1 1aa1a0fa143f729e8bcccf99db682fef989ca300
SHA512 8c1e7ab6ad52005a623bc857ca5c9ecabd0ab13b1902b2d76163184bef8731946b3cb68a294b8a0b9b54e18fe409cf87c1a91bcf7faeb0c94b3fab49199b3e52
SSDEEP 12288:mIlUYxVtECnc19+3Aq4OKFeT62T1wBSNKKv/LNsdDusb0zGq0wT:m0UYxH5nczaKg+aTTsdVbqd0wT
MD5 SHA1 SHA512 SSDEEP

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 e7e200d0883a81977e9ab37e706ecac2fdedd3dd81bc4067cbb3b7c6858dea01
MD5 d150d3ce9a1adabcd0f6e4345856e516
SHA1 1c305682d5f61179556cbd64d26c584f84ed2065
SHA512 4e65e606f4e474917c6e4c3124ea4198b0d1df9d2ca1dfffc639999a3b8088230de69eed1230a422b7eaadc53fafa6b2b83c4a2e587ace9c26af62690fc2b95c
SSDEEP 12288:ZxlUYxVtECnc19+3Aq4OKFeT62T1wBSNKKv/LNsdDusb0zGq0wT:ZPUYxH5nczaKg+aTTsdVbqd0wT
MD5 SHA1 SHA512 SSDEEP

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 0a2ca78c752d3b4f541de8c33e8a81ca8ee70c12d536a8f06f537675d0cc0c08
MD5 d7a8b0769d222f745adfea2ec9098be7
SHA1 2fe39b79084b965d82361d81bf5c95fa01095ba6
SHA512 73cea838e6cbe0d0a546060571554951551c9b691ce09e2aa213f9941bdd7bfa1a0a6a98afc85a11d9ce8a44b8276e281a348f23ae26cc60432f0b1e41940ca4
SSDEEP 12288:awlUYxVtECnc19+3Aq4OKFeT62T1wBSNKKv/LNsdDusb0zGq0wT:asUYxH5nczaKg+aTTsdVbqd0wT
MD5 SHA1 SHA512 SSDEEP

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 581KB
SHA256 df07397be33da71e0bddf49b13172489dce72941c3400c95b6562c31d639f371
MD5 b40b12ec772a9594483751863e4f1b95
SHA1 5a33b78489155dce21ec2c37b51db59548eff407
SHA512 2500ad303ec0e625ae23f597362e0e5676b647deca7e56ca1c46007698e9450625c4e991987a6117af8ce6ba5ec69cf2cdca0f6a11ec19bff1ab78fc978a3c48
SSDEEP 12288:GulUYxVtECnc19+3Aq4OKFeT62T1wBSNKKv/LNsdDusb0zGq0wT:GSUYxH5nczaKg+aTTsdVbqd0wT
MD5 SHA1 SHA512 SSDEEP

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 701KB
SHA256 94646ba2e795059350f199f0e8871820c66669cbc99bdf754b917dd2a5895888
MD5 1f8ebab26f193cab05ed917b6663106d
SHA1 67026a6d1ff4197476ab084c3627516a0874189f
SHA512 6c1f32346c1f9a51273bb54a54622cb2ff4c4100b95a6a7a9c3da7c98a8348ec8c2dbcd0b1fc0235ebc22e6347faf21e4839b4a2ace904e5cdecc398345bb051
SSDEEP 12288:fUFmDDLdlUYxVtECnc19+3Aq4OKFeT62T1wBSNKKv/LNsdDusb0zGq0wT:/rUYxH5nczaKg+aTTsdVbqd0wT
MD5 SHA1 SHA512 SSDEEP

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 38c446bf14a032feb8de0e5928dbb0632727be52113beeca675264e9bdcea0a7
MD5 688bdd34389ee07731189f4fa08c51f5
SHA1 c49ad8a23b7bb1ea893d441b699427784f8f8f3b
SHA512 354ea7859561dd98e1f31739ebfc31312cb7c2c86d0a21b9232aafbe6f2c063ab438b98ae65de2d42a7870e4a4d26644b2f805659de1d8c48cfbcbead124ba78
SSDEEP 12288:1ulUYxVtECnc19+3Aq4OKFeT62T1wBSNKKv/LNsdDusb0zGq0wT:1SUYxH5nczaKg+aTTsdVbqd0wT
MD5 SHA1 SHA512 SSDEEP

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 ad6ff31cbaaaa035ea8d4c5db600b6f92aa2be78a1869847cf5a09575f1eb3a5
MD5 450f5e6efbd0bbf5492b58c393aed2c4
SHA1 02771066758219ce2b697fcdf5b7b74a1e1b9415
SHA512 662469aa2c8a0d380c3b3ff874b2ee4a9767e5a92bb8fc5d4aa3671c8ae8395dad8d31875d8035f34198cc49b4bea2ebc0547ab5a25c8106e5b8aefd7ca851dc
SSDEEP 49152:ra0h2GEkuAe73q3pp46zwwQMxxH5wNaTT7VT:ra0hNYG4JwjXH6kP7
MD5 SHA1 SHA512 SSDEEP

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 659KB
SHA256 f8d2aea46556b974c4177dd016edfdecdee41d29547a295885113301ef0b6bba
MD5 180e5760c6c89599ca50fd6623b7201c
SHA1 401273399c51ea0f55d56e6bc058c1857e7dfe5f
SHA512 d5a6adf2b8e38a82d2edc3c16a45bf4b8fa5b59deb004b66451112ef7a476dcbd948db90c6e8841ad2dad8ff6c1116f85111a11be7517ea184a63f47dd2ab485
SSDEEP 12288:9hbHjfXBlUYxVtECnc19+3Aq4OKFeT62T1wBSNKKv/LNsdDusb0zGq0wT:9hbHjP/UYxH5nczaKg+aTTsdVbqd0wT
MD5 SHA1 SHA512 SSDEEP

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 0bfc7fac18e39f16ff1af022ae36727769412f85fb782dd2058ab1b87e313c25
MD5 a5b954e72b632d8d2261d20f3f08698d
SHA1 a315f9ca61576f73b1991f8f5bef627762de2bb0
SHA512 4f16e5081ee7df8de2a5d242d9ef73bffd49ab1a20fb6707ba695b36979eadc5c1ad9ff4e734db579491bb8551c760c2978e6519df4095965fa2355187096f80
SSDEEP 24576:53YgnJcRTk4yti+R5dpR/XUYxH5nczaKg+aTTsdVbqd0wT:5IgnaTk46ppR/XxxH5wNaTT7VT
MD5 SHA1 SHA512 SSDEEP

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 578KB
SHA256 394a4f8aae334e95f39387ad4ed1b776fde5bd55dc96ac553311a2a59c4de000
MD5 5caa77943a123e33ac6eb701c4fe2ec8
SHA1 58b5b14c37ae391c47ef12287353cf34f41acb42
SHA512 03a2e5e12656725967e9917181c625cc76e32e71d8b67a11be039d7bd4b8adc3643b75c1f7680f721187a73827ac29b9993bc33329bebf4f2b99fca4d98209af
SSDEEP 12288:eqlUYxVtECnc19+3Aq4OKFeT62T1wBSNKKv/LNsdDusb0zGq0wT:eOUYxH5nczaKg+aTTsdVbqd0wT
MD5 SHA1 SHA512 SSDEEP

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 940KB
SHA256 80519df03c994612adf6845de46ea2edb6081d5fb4bae11913cd3d2bd9722bf0
MD5 9d0e6b8022a4b65ba416836c7af72f0d
SHA1 3384db6a5d8f44a96a5282b8831195411e9d841b
SHA512 5bd1e3c4b00d7b95bd735bff614b9654f32840d4c4483e1aa8f4b871fc6035ccfdec44fde189b4ceb34a76cc092db3cc571992c48e2c544a1711143f6a44e202
SSDEEP 12288:JObvA4LWOsvAYFTDlUYxVtECnc19+3Aq4OKFeT62T1wBSNKKv/LNsdDusb0zGq0w:+rL3UTBUYxH5nczaKg+aTTsdVbqd0wT
MD5 SHA1 SHA512 SSDEEP

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 671KB
SHA256 c6cbfb06deadbd667cf879bf608a55ff585d26e36a0526e2878ec7a90867a9c1
MD5 cc3399d8172d9378d716aef8f2807d37
SHA1 a70f827ab753f806a37e1de120371c65da580850
SHA512 6e9f0ae6f1befce29a4e1a76462331b4419b7692604a6f15254fe77bad28c6cc94f26d2f28840d75fe4a445247de0349940946a7caf7b2cc35a85ca283c82379
SSDEEP 12288:2pFtYOPlUYxVtECnc19+3Aq4OKFeT62T1wBSNKKv/LNsdDusb0zGq0wT:NOdUYxH5nczaKg+aTTsdVbqd0wT
MD5 SHA1 SHA512 SSDEEP

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 4221480344e8c9ec7d8276e0ea9e119526fccd8febddd2579c25e11e0a5f2b34
MD5 da1b789242448c0cea0f909b76189747
SHA1 0ad230ab12ba9de52f2560c025a217159067ef9e
SHA512 0423da991e6df76c64513deb2fd35b9dedf07914aedbfc0940aef1263d882cbc709ab705f7dee1881fad4bb2d571fe2c255a842da8c758671bb73dd8389b8a13
SSDEEP 24576:97NM9YmZqmWMUkPjZM48Mv6bEhsCUYxH5nczaKg+aTTsdVbqd0wT:97cBWMpPjN8DbEhfxxH5wNaTT7VT
MD5 SHA1 SHA512 SSDEEP

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 df66c8a30913d85810c9fd87f66180db26d4c7ec85b69c4da36acd79b0411125
MD5 e66a521e3da666b5dca3da1c599ec9dd
SHA1 4b07597e573d02c51145b5b504fbbe61a0c9616a
SHA512 87bae8da02b023b6ceaca23fa74ee93639cd04a2b72c9aa524d3d2f06dba3d0e2568403596dee31b0eeadfa1418a4b1170132c30a4eac8a2fab9f46c316cf1ec
SSDEEP 49152:gF2YuHNETovcvNYf8kmixxH5wNaTT7VT:16tCf8kdXH6kP7
MD5 SHA1 SHA512 SSDEEP

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 4220a881b3cc2670ec471bfb39c95be21e3ea5bc225beb89c1740d54e103c339
MD5 177e2e452f080fcdc017963db6e88aad
SHA1 d858a1a188e2c65ede09255db50b530f152e65e2
SHA512 03e7c5ed3c6fb1765dd2df1b57a60b9a23d72b9d395b191efb9aad171664a43c62db61b75eb32a8264667f73ac43060431ca319ca2e75a4e37fe10d2ff554259
SSDEEP 24576:gAFs06+OmlfQNXEbToJUYxH5nczaKg+aTTsdVbqd0wT:1Fs060lcXusxxH5wNaTT7VT
MD5 SHA1 SHA512 SSDEEP

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 885KB
SHA256 b837d6d2d469d809306d5f02721819a084f0ff20215ecb72d63c55a5dfe0e6cf
MD5 c8b038225150cc9f0e14cb958d84b0ad
SHA1 41336903c32f6aa544599178354623afd1fedf0b
SHA512 8e864d630534c289b334d3df7048f8be0155fa4ea51cce4fd96b17caf7c72037d3bed7f451de0648aeabeeafc66a443e9066b45c0fee8c6df9a0c2b1fccfc171
SSDEEP 24576:6JnJ5D3WtsUYxH5nczaKg+aTTsdVbqd0wT:6JnJ5DGtsxxH5wNaTT7VT
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 caf4585b9eaea5977b69268eee75875ee738db99c783445f9e911f2ae079ac85
MD5 e23acf1264bcbcd5a7f48c7316e6d805
SHA1 200e24bf3d3abcf04bad3ab7f2e2f2d1c3ea071c
SHA512 5afb7f0b081d749804f852327b020e686c575ed09c350fae88e60868bd6d81479a6323c7855a973ad26308dac0d0d0819d156b86249a5a6947da0c3bb08d5c1c
SSDEEP 49152:lo06DIKdwc+eQnSt65aVWxxH5wNaTT7VT:ywXH6kP7
MD5 SHA1 SHA512 SSDEEP

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 661KB
SHA256 1df17499eb319d2aa7da4211e82b05302a23d9ce7c19b7d48ad96042e46522a8
MD5 24774063d9e300c07056d7bc65c3236d
SHA1 db4a41c31e70470ef255f8a0e2c85c5898ed21d8
SHA512 406b47d54636c9949c3e59eb7db6203dec64e852ae7ecdcde38bdf066f418b9c88f089bcbff6b1f592586cefc9e1e1dcb9299d721fe0141244e32d8d07397feb
SSDEEP 12288:dEP3RrblUYxVtECnc19+3Aq4OKFeT62T1wBSNKKv/LNsdDusb0zGq0wT:+rJUYxH5nczaKg+aTTsdVbqd0wT
MD5 SHA1 SHA512 SSDEEP

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 712KB
SHA256 d14b32716c1ce2f0a5f38a003cfa0e54b58993f996bb52d79c5e2b3ae0c974f7
MD5 794695f58e6780748b6ccfd9c9853ecf
SHA1 280996e9d28b5859a364d6ecd395a3ffb0614c09
SHA512 e3787898d17d42076d127f25be885ed225230e93e584bd8f9d8a4a5a1e2ebef598fe1915d5f290f283d6968b15dd2a641303a9d8900ce9f19c6cab46011ffacc
SSDEEP 12288:UjkyxlUYxVtECnc19+3Aq4OKFeT62T1wBSNKKv/LNsdDusb0zGq0wT:UIyPUYxH5nczaKg+aTTsdVbqd0wT
MD5 SHA1 SHA512 SSDEEP

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 584KB
SHA256 adcb50f88e9f436111851d9cebc1a2cb9408dbf9276473689bd3b3c3cbbb13f4
MD5 12b6228f87bad19b52bc5fdb700619d7
SHA1 dd17d2bbbf5fe21482ea5e030a54fb3f4ffc26dc
SHA512 9abe7e1a8427af46e9c2ad8a86a84a6b6b7f8b3c41eef4e059b509b09de8fbe14e3b9442d590c39ea6ee7f1439e929f6ec1fbb14a3a31d19ce6f871b37f0e093
SSDEEP 12288:WF/lUYxVtECnc19+3Aq4OKFeT62T1wBSNKKv/LNsdDusb0zGq0wT:UtUYxH5nczaKg+aTTsdVbqd0wT
MD5 SHA1 SHA512 SSDEEP

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 6c21f0678b34cd0dd0e25cd8da5041bb15927390ee8311091b5f5f83e12bdfde
MD5 99eddbc50295098cb729e88a27b20191
SHA1 a87f4030bab4251191727269d5c2c44d38b24e5d
SHA512 d53701880e9279e83fc4c614133f4cd89012412943ba4ed8194530e235649e8132a9df516f83950c8dd7553ceaccc744ad29d1c7901313354f877b94a20bdba9
SSDEEP 24576:JQ9MxZKdcz97w3KUYxH5nczaKg+aTTsdVbqd0wT:JVKXKxxH5wNaTT7VT
MD5 SHA1 SHA512 SSDEEP

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 772KB
SHA256 70664085520aa29baa9da46cfc73d4cdce0f4119d5eccd1d13d73a4427ecbcd3
MD5 107af29bad6d2a37564cb48082281dd8
SHA1 9ae687538a61dfc175f0ac9f08f59c266c538309
SHA512 0316d4df3be2f5ebd974447acb5a485f0294a9691c83323f9563b1ab4f2600b233485a610656473ccaa1c13d2a0242021f9d55e4f87890eafd886f0b38d1fddc
SSDEEP 24576:RyocxApLUYxH5nczaKg+aTTsdVbqd0wT:8ocxApLxxH5wNaTT7VT
MD5 SHA1 SHA512 SSDEEP

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 49cf10c06473ca6feea035a78e7c50612ab0ad92d1dc1d172b9b560e7433b094
MD5 dbf9e0f68b0a02efda8cdcc3e11f9626
SHA1 fe49235fb4f29c7dec6d972ddd04a9143a3a9971
SHA512 ba53a5038ec8b3f4d6b3f7e486725a45fcc84781bd4949a3869bbcf6bb68d795f3de41250df3796eeff96a3a971366835762d7c991c965905bf129f2c1020349
SSDEEP 49152:YWcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIKLxxH5wNaTT7VT:60zuNInXH6kP7
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/396-236-0x0000000140000000-0x000000014024B000-memory.dmp

Download

memory/396-28-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/396-37-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/396-34-0x0000000140000000-0x000000014024B000-memory.dmp

Download

memory/636-572-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/636-358-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/700-40-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/700-237-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/700-49-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/700-46-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/872-444-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/872-580-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/952-300-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/952-419-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/1008-257-0x0000000000E60000-0x0000000000EC0000-memory.dmp

Download

memory/1008-256-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/1008-269-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/1012-382-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/1012-271-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/1504-578-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/1504-420-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/1996-383-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/1996-575-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/2720-246-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/2720-252-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/2720-245-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/2720-357-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/3128-375-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/3128-384-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/3356-396-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/3356-576-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/3444-334-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/3444-567-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/3512-283-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/3512-395-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/3680-571-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/3680-346-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/4080-323-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/4080-518-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/4208-15-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/4208-24-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/4208-235-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/4208-18-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/4408-577-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4408-408-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4496-68-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/4496-240-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/4496-75-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/4496-67-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/4708-440-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4708-318-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4708-570-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4744-407-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/4744-297-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/5036-13-0x0000000140000000-0x000000014010E000-memory.dmp

Download

memory/5036-0-0x0000000140000000-0x000000014010E000-memory.dmp

Download

memory/5036-11-0x00000000021D0000-0x0000000002230000-memory.dmp

Download

memory/5036-7-0x00000000021D0000-0x0000000002230000-memory.dmp

Download

memory/5036-1-0x00000000021D0000-0x0000000002230000-memory.dmp

Download

memory/5064-74-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/5064-61-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/5064-52-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/5064-65-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/5064-60-0x0000000140000000-0x00000001400CF000-memory.dmp

Download