80a0967d47f7f4c43dfe03ece76cbc8893bb0762820291712e9956e60531ca3e

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 10:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-06-03_cfe5f37d505a035c6a38203787ec6150_ryuk.exe
Size 2.2MB
Sample240603-mpxeksch24
SHA256 80a0967d47f7f4c43dfe03ece76cbc8893bb0762820291712e9956e60531ca3e
MD5 cfe5f37d505a035c6a38203787ec6150
SHA1 20a7b8a6e479682a6f845b5c898097184adad2d1
SHA512 4692232a9b3dc1735347dc86c52535e7c831a03093d9d02ca6947dfb9b1e811b0cd95116e2756a842a65f15775570c77055d1e8737e450a4c848f9bf565f5215
SSDEEP 49152:cNl7soq7sQCc1kyG2xHywRfHIO2Ts4bvDcf9Ckt7c20+9qNxUW:ID2311kaxp9qcfEkKK90
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
2740	alg.exe
4192	elevation_service.exe
2928	elevation_service.exe
1860	maintenanceservice.exe
1052	OSE.EXE
2156	DiagnosticsHub.StandardCollector.Service.exe
4248	fxssvc.exe
4308	msdtc.exe
1880	PerceptionSimulationService.exe
2500	perfhost.exe
3632	locator.exe
2600	SensorDataService.exe
1176	snmptrap.exe
4956	spectrum.exe
3648	ssh-agent.exe
3272	TieringEngineService.exe
4680	AgentService.exe
2028	vds.exe
3488	vssvc.exe
4200	wbengine.exe
540	WmiApSrv.exe
1084	SearchIndexer.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in System32 directory 24 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2024-06-03_cfe5f37d505a035c6a38203787ec6150_ryuk.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\5adbc591e703f493.bin	alg.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateBroker.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\110.0.5481.104\chrome_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\110.0.5481.104\chrome_installer.exe	alg.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	alg.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c04b9275a2b5da01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009aae9475a2b5da01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000025fbc175a2b5da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001fa82f76a2b5da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000aac28875a2b5da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001a4ab175a2b5da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
4192	elevation_service.exe
4192	elevation_service.exe
4192	elevation_service.exe
4192	elevation_service.exe
4192	elevation_service.exe
4192	elevation_service.exe
4192	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
664	Process not Found
664	Process not Found

Suspicious use of AdjustPrivilegeToken 42 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1032	2024-06-03_cfe5f37d505a035c6a38203787ec6150_ryuk.exe
Token: SeDebugPrivilege	2740	alg.exe
Token: SeDebugPrivilege	2740	alg.exe
Token: SeDebugPrivilege	2740	alg.exe
Token: SeTakeOwnershipPrivilege	4192	elevation_service.exe
Token: SeAuditPrivilege	4248	fxssvc.exe
Token: SeRestorePrivilege	3272	TieringEngineService.exe
Token: SeManageVolumePrivilege	3272	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	4680	AgentService.exe
Token: SeBackupPrivilege	3488	vssvc.exe
Token: SeRestorePrivilege	3488	vssvc.exe
Token: SeAuditPrivilege	3488	vssvc.exe
Token: SeBackupPrivilege	4200	wbengine.exe
Token: SeRestorePrivilege	4200	wbengine.exe
Token: SeSecurityPrivilege	4200	wbengine.exe
Token: 33	1084	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1084	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1084	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1084	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1084	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1084	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1084	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1084	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1084	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1084	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1084	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1084	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1084	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1084	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1084	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1084	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1084	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1084	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1084	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1084	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1084	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1084	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1084	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1084	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1084	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1084	SearchIndexer.exe
Token: SeDebugPrivilege	4192	elevation_service.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1084 wrote to memory of 3884	1084	SearchIndexer.exe	119
PID 1084 wrote to memory of 3884	1084	SearchIndexer.exe	119
PID 1084 wrote to memory of 3916	1084	SearchIndexer.exe	120
PID 1084 wrote to memory of 3916	1084	SearchIndexer.exe	120

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2024-06-03_cfe5f37d505a035c6a38203787ec6150_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-03_cfe5f37d505a035c6a38203787ec6150_ryuk.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:1032

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:2740

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4192

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2928

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1860

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1052

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:2156

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:4088

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4248

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4308

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1880

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:2500

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:3632

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2600

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:1176

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4956

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3648

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:3452

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3272

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4680

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:2028

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3488

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4200

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:540

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1084
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3884
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
  2⤵
  - Modifies data under HKEY_USERS
  PID:3916

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
Size 2.1MB
SHA256 027601f789c059cbdb266e223ed1b9eee998d68f34c45d654d00e6abe45758ce
MD5 0d8352b5b299b6eb2523d9803d4412a9
SHA1 d9be4c479d753bb521dbc9a5fdf2831b390054ab
SHA512 5483a2cda2867dc5e1bf259ccc07c6fb986f0f4419c760a08bcdaad32819d90feba4d5a987323f54308d6a53352956fedcc64e6d508f7a624807e2013b30b72e
SSDEEP 49152:OuYk3H5koUXfTqkkYLO/W2buywzMbOX+T7z5Ff9Ckt7c20+9qNxUW:OPfTqi90bRfEkKK90
MD5 SHA1 SHA512 SSDEEP

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 50fefc984d2c1aef6dd4239bef55f1ea2fb97f21bb0705c2251c402247f2b449
MD5 a617c0f725a54707811834de7568f0be
SHA1 e4b5b5b60eb6f5c7aafe2c6ea5859c27ef98f6af
SHA512 1648d3a4d27b44472f9c5a656712aec75289043d7fe3564fe880bdfb2af13f7b557b472993451693388fa8f960743b8b2a8e5f4c2f08f7e5ae411876d81bb1c9
SSDEEP 24576:jidnBsuE0TNjx+mZCkt76f/24pN+XNqNG6hditW:eSu/f9Ckt7c20+9qNxUW
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 16aa0a8cd1408654438612bca96f26995fdc470fd3e9528f15980db8c004029b
MD5 ec455ea9f0119944d017bb6ff0f0f075
SHA1 42953a4f6cb900c3a9e98756e2970d1fd260e142
SHA512 115711df82ae2d4aa3afeca2ed162718fa4427c9c2c0011be234f1e1b8bb53497b80dbbf4c22d2342f8269dd8d7970bc6c238b50d0476e10b924cf650f214603
SSDEEP 24576:N+gkEVfh4CoITNjx+mZCkt76f/24pN+XNqNG6hditW:0gkExSSf9Ckt7c20+9qNxUW
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 14b6a234c629e0d39af8c2ae33b178afbf685b1f1b23a8dc623446f04a7b9cca
MD5 99153ec2599a791266948623485b6338
SHA1 2d5f39cdcf47cc42455560e667c42438104e159f
SHA512 16f5ae7864a532b6007c02f8d2a74e62400447436ecdf53f160a265086c08daa806eda985bdbcb287fed23189ab3045475879a045503e582644dcc31e5a3f381
SSDEEP 24576:YBpDRmi78gkPXlyo0GxjrdTNjx+mZCkt76f/24pN+XNqNG6hditW:MNRmi78gkPX4o0Gxjlf9Ckt7c20+9qNl
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 2df5eda9ac58b73f8da151ce10ba5b7f992168c81e65cf74bec574313ede0c59
MD5 cdb81ffbc267d14d44de28d3d46d1e35
SHA1 4bcbd8682b231f400a354a973dbf15480c76ceb2
SHA512 d230a6cc994e8101797fd8b94bfe991f24a02b2118006456d1874dfb40de7cf2f423113d1686cf186cd7fd4e7f005ba8f72dd50670679b211b09361d3b3454fe
SSDEEP 24576:GLOS2oyPIXVITNjx+mZCkt76f/24pN+XNqNG6hditW:2/ydf9Ckt7c20+9qNxUW
MD5 SHA1 SHA512 SSDEEP

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 67fbeb636b928e7dcdc4af85bad9243bc887360f3d1f806795cf273d2386d9ea
MD5 d9fd6b048f0b69a0ee3ecbe5c243d281
SHA1 0e67452ddfa7d0b1b2c93bbf1e1296de919fa251
SHA512 b0ecc7fdcffc455749e3127a4dbc6d976c96de963616329c56b37c9876a611ec4fbbd456d41c1efa7fa9da71f6072a8f5195bad49e6616b0aa95430503e977f1
SSDEEP 24576:9fiTNjx+mZCkt76f/24pN+XNqNG6hditW:of9Ckt7c20+9qNxUW
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 cb9f3365930e41bd62cad4ead0259c44bf9d925abc977085518b27389e1ff3ee
MD5 99cc6c349a93557386b9593bbe1731ab
SHA1 d75257fb8d6f1cc317885be993b4711af5a90ea0
SHA512 826d0d8043df96ba72c89c985a4bc554e00fb6268a2ad1e67881f113ead0346502e3d8c23079272d086117d6a36b018cf2e91dc11163438e894819ecad5e6485
SSDEEP 24576:1JIUvTNjx+mZCkt76f/24pN+XNqNG6hditW:1JIU7f9Ckt7c20+9qNxUW
MD5 SHA1 SHA512 SSDEEP

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 d4840c5cb84d6c9409baaf10365588b6a8490cc806c20992d8340b1606f2e098
MD5 109767564e869bac33197e859e30bfe6
SHA1 0fbc496ff79b1100b163069fc7140c85f6e62994
SHA512 f93db6aaa8e3af1638abf95f35a005f87ae322f7a53938948b74d07e91c3c6268e675f77687a3ce7ab0cbf13642f7c45f3205b0133d6593d84c60ad78a1da0c1
SSDEEP 49152:KQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3TH:KQvGAdlCEL8c/yRNw5C0fEkKK90
MD5 SHA1 SHA512 SSDEEP

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 1f3190d125b58a69dd272bebfb577d8bb2d208fbe99e0fca2aa8a102ab6f1684
MD5 f7f2c4b591a157c8a7b109d65414db07
SHA1 29fbe6e98977ea1dafd8e92bfea4ab4797b82f3e
SHA512 e1ab61364a04877c4ea60d87b81e573f4a2745ce926cedb3b7c19ff3a07dd19ad872bd313ff7961087308cc608591cc448d767951877503a8b0026b2862ef0a3
SSDEEP 24576:DdewsAjVTNjx+mZCkt76f/24pN+XNqNG6hditW:BljRf9Ckt7c20+9qNxUW
MD5 SHA1 SHA512 SSDEEP

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 88f3a6e7a692d27ec4c7f33c3727b7a14a7deef0eb779ebcd15b0489d226d826
MD5 969e9a2e1c6683fb67c59486a8a395f8
SHA1 a5dd07196eb7762e6c41f7ab604519013d89364d
SHA512 7e1b95f071250d8cc5a559a1e82a2ad2a71dbc8b8fcd3bf6982f5e36afabe3ae817c3123619bfa46b2e0c8627cf7849972e017e2d6fd65a82ad899e0f555cfc2
SSDEEP 196608:NUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHJ8:NUEtQevvqc2W1cpV2EI32
MD5 SHA1 SHA512 SSDEEP

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 bb2a071de484ca7ae9b6a3beeb88af5adcb9489449722eff22f26cc9786a560b
MD5 d5eff70b341b8b3b20a02082fbe84247
SHA1 8ab43e47b575ec6203f7e70bda3b4bc2db308000
SHA512 037b262b08011d58c7c5ae2d74082fd27d44ef3b278c8caeb53da0d36529580cbc7fc14e2122cc2fad19780c9895ed621d08935132986491a248f7be44a5fcf4
SSDEEP 49152:RCbRquA/m2yL5zTfFiV+XenmE3/zxf9Ckt7c20+9qNxUW:eoquVjnmQfEkKK90
MD5 SHA1 SHA512 SSDEEP

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 3735315afdb323ebafdce693e828845413b785053080a655164cc15ad661c8a9
MD5 f21919b83fd7fd327e9efde941949612
SHA1 1edd957d510fd7f44426c710f9eba33a699cb727
SHA512 e2d829b2afe25f2dad442f2b63e395d69128586cd8791142d5a50a7b70152e1e9cd0f0559e1c9de64a03de905201ae5ce72285b6caf79f88e1d9065df7cd4935
SSDEEP 24576:RAhGLJIFoiwtA5l7S534TNjx+mZCkt76f/24pN+XNqNG6hditW:RAMyFoiq5Af9Ckt7c20+9qNxUW
MD5 SHA1 SHA512 SSDEEP

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 1a5d061abeecb9aca58b1a8e04d5dca8bad87cfe2190dc8bae0edbdd489dc5da
MD5 790cf1002e87b749e131c08320216da2
SHA1 e99242a7b9b6d520ed9ece31f498791cbd9e542c
SHA512 3ce33d073da04c0b5bdadee50b743ce278a89719f9dfa5c02bb12809eab9bb2dc0bb0f4cb29e7435ef30fce8e22b86f1653e20dde436a1d477e7961f17aa6df8
SSDEEP 24576:1wuoOWBTNjx+mZCkt76f/24pN+XNqNG6hditW:1wDOMf9Ckt7c20+9qNxUW
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 4846cbb4bc43282300ac8bb0b033e2c0aae37df0590b14be7bae0dae6f26c2dd
MD5 2d9c96b3535aa394c695efb9f1329ea7
SHA1 1231787023cfa000b0ddbf269d7afab75bedaa03
SHA512 31b8f573f68c454d6e72bf734b08b85b8edd77040d3b21819fb57448886d031ef6e1ce71e131f12dcbbbfbdf4607f36f4722d75102ed86b49c77b9e98baf932b
SSDEEP 24576:JZuWTNjx+mZCkt76f/24pN+XNqNG6hditW:Tf9Ckt7c20+9qNxUW
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
Size 5.4MB
SHA256 b0fb942f0c1bc9d86084a1c481857da6a8f22cbe912aba40333d727fbc5c4f50
MD5 fda7ec07f7c331f3425b1c8296053c4d
SHA1 95f7232232bc41eb563dfac16e12d17462da961b
SHA512 8f07f86190711d8e6440ea52135dbc68f66ff5fe607d85b379156b465ddd4581c3f1253a9c4c7290b4d4458155bac7b560890212ae8524fb1d71ba7dd3c92937
SSDEEP 49152:30kwIi7c4xZlm5knEtw99Kn/2vim7vgv6m+yyJ/0gbvjR7yY7BHi3u7L/gBUUWLQ:7wfhY7g/rLd7yYA3awr341g4fEkKK90
MD5 SHA1 SHA512 SSDEEP

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe
Size 5.4MB
SHA256 edc0358496bd52b71cc470d883f0e07730b986e0ac9501557f35e4ad56de5d16
MD5 d5d33e0b4b0addddda5bc2975964d72d
SHA1 e05cdcd4a8592e362ab6a2d8cdc8f36fdaf72d18
SHA512 2a36f9157c43bbfed6fb09311af8832a38cbd1c41a03d078dbcf7eab0156738e56f649a6c486b1a3adf64d3e51b9cfda42f9d1497f9714a9c41d224050def88e
SSDEEP 49152:S0kwIi7c4xZlm5knEtw99Kn/2vim7vgv6m+yyJ/0gbvjR7yY7BHi3u7L/gBUUWLQ:kwfhY7g/rLd7yYA3awr341g4fEkKK90
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe
Size 2.0MB
SHA256 34d2052371284b1b8adcd468ccdd1b68bae8f9f4e37a80cc86098edc86ea4fba
MD5 922f12073c1d42dbb72f0a99e6833679
SHA1 62f39fca135273ff08bfbf2d377bb0c66e12d810
SHA512 835ef35eb4cc36ac86358d7f9c02dd04865dceb41a23c53fcf7f9953b977d420b7768a60ac429880a9cc318ed47b46b710196e2fd77938e63e1d1e643ef26006
SSDEEP 49152:cuXv0Ftpn5606zOdf9Ckt7c20+9qNxUW:7c56FUfEkKK90
MD5 SHA1 SHA512 SSDEEP

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
Size 2.2MB
SHA256 079fcdd82a82dc3fba5c7780793ed02e789f6683b67afb3dfec5bef8f308576e
MD5 21a74715d0e958762efc229c5c8d937e
SHA1 66d0838a58927df9a2715d28be9d0775759eca23
SHA512 c8068bb0719cce39c61490b1ccd853d1eaebe2770d55ea0f275b7065a22fd7330dd15ec00e1ff18d9a1bc948220fa19333648b8a4800b566235c2a544e5a6b56
SSDEEP 49152:Ay7mTd0GxN8jyynxHjXKUyn4GVcbDSKrNTxRf9Ckt7c20+9qNxUW:fmYeyxHjWjMTRfEkKK90
MD5 SHA1 SHA512 SSDEEP

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe
Size 1.8MB
SHA256 28d6a60c0629a352294cf79115b3570216ed227e2598cf2ee88adfa9f14e9a2f
MD5 92d2dfbb565a1e557bc406e8cb037b94
SHA1 128495e5ba825c36c99c6c06c73de0e13890fb91
SHA512 a70592b9f09aa091f6a45d4f0ae31c203932c235177ef7c619edc2684cb4559db94d245b79ec8aae2df37cd8fafb3ca0494bf166de06b3177cca89343c46e6e1
SSDEEP 49152:IWnDci18yNNUgbYFf9Ckt7c20+9qNxUW:FIqNNoFfEkKK90
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 1.7MB
SHA256 16ab51cd3e7ca1e41e229a6a8b9a53bfaae0c2542ba77cb0d2126932e257bbb9
MD5 70894bc199c9e5ba1d82c6b21419cc99
SHA1 df0843b855a9ccf3e21cf9eca53fcacd554be23d
SHA512 294c31f4ba91bc7be633ecd7d6291dcd6d642d1ff90e61f9d4e0c24168b0bc1b49760631cfc973cd283c5225413b8392737a24777a516448485c6bdc37194a3e
SSDEEP 24576:Sk5lHW5EzMZupO80G2reD+melRgTTv/1nyzTNjx+mZCkt76f/24pN+XNqNG6hdi4:8izMZm0GhamSoWf9Ckt7c20+9qNxUW
MD5 SHA1 SHA512 SSDEEP

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 cc0b56fbe377fcb839c6c7846acf5fb350e9824d0e4f35978515ac33b26f0231
MD5 7aa3eb4822e8136fe32bc5b9445e2ff8
SHA1 ec2490951da56d248406e7ca632c0e98b66026e4
SHA512 9c70a715014efd0072416c570cc4f236c0cc49cbb3d63033feb32d022956089e2c167353f77abaa7cb87a932cc5328be14593d2f6573866c35afea50067576ad
SSDEEP 24576:IqTNjx+mZCkt76f/24pN+XNqNG6hditW:Rf9Ckt7c20+9qNxUW
MD5 SHA1 SHA512 SSDEEP

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 4593911cf48a1a9b854fef99788b1f74962a05b09baf3a66671789a51cc5dc5e
MD5 916fd299066dda4e8981b0fb02d6268a
SHA1 c7b9db6f291ffd66ce9e63a7e841763dc789055e
SHA512 f5ddc7926aae0eb0e03f7ecc60d75ffbaeb055349958ce926cc648c6a03fc4c88d8884e6fec7a33558b75043f534f31bd0168267972d684d5769a2b3643c7e6a
SSDEEP 24576:jZTNjx+mZCkt76f/24pN+XNqNG6hditW:Jf9Ckt7c20+9qNxUW
MD5 SHA1 SHA512 SSDEEP

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 84e9dab6b85a0e2c99933c75bc6a27c9d0f31fd00d3bba5f5c5465048776973f
MD5 7127332172f1318911dfb5804ed6c8f1
SHA1 fb0b806dad22880343d0ac802cadc75646cbba98
SHA512 c1119beaea08930b688268a29804e93aae7df79a2318bf6fea7464b925efec356600d96952daa6fef096fe617d8e0851d710b653baa29bf6059094e80c3773db
SSDEEP 24576:J3TNjx+mZCkt76f/24pN+XNqNG6hditW:Ff9Ckt7c20+9qNxUW
MD5 SHA1 SHA512 SSDEEP

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 535dcdca0bceb960a565bf657bd8228e9d1e41ae19faf611058fea0674d5c5be
MD5 24f032ee5cfae4bd21c5e83568162c41
SHA1 30ecbddc6475466079e7be8819e029185b3c7bb5
SHA512 16bef404ed2e126b519c4afb37c1427ce81d6cc93bc7c7b10b28aeb0daa547104f656b44ff6b7bab83f4e7b50c800814a82e9601f2dca79e2eddc9a20934d3c7
SSDEEP 12288:IVYTNjYGgpK/vnRsmH5Ckt73qfKrrzD89f24pWYbCXGah2JoHq1MGJlyw9hditWT:XTNjx+mZCkt76f/24pN+XNqNG6hditW
MD5 SHA1 SHA512 SSDEEP

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 91389ed574f8fa9411ad99264f864f3f85a88c235db49d9063d40ea44788f8a2
MD5 d75b7c613c3b5a7affa0dadbafdd8f1a
SHA1 dd36569376f159ac040d58b7594c3c6e12c07c91
SHA512 101bc19336d1f69be1d5eec26f44476870cdad2ae1143444c7fb494d79c92479e5a4fb74e93791e25bb57f18b516a0f59240a8f989dd6f5c7aa3ac3a08118232
SSDEEP 24576:gwTNjx+mZCkt76f/24pN+XNqNG6hditW:Nf9Ckt7c20+9qNxUW
MD5 SHA1 SHA512 SSDEEP

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 dbe3cc175b96ff86d67b79d5fbaf9301f965c8021b3880c8b9579645f51b8e05
MD5 77895d14b54e523e49128f57b0fe85a4
SHA1 26115d5fd1a6a637bc610f26d70a425ef61e4b0b
SHA512 108d1becc851925bf1c1635f713b7d66a7089b2a66547b41f45f26150a815488e9425be740ff7205dc9899c05552cb7efaed8d18f50a0fa4d2453c6f40616452
SSDEEP 24576:GdTNjx+mZCkt76f/24pN+XNqNG6hditW:Wf9Ckt7c20+9qNxUW
MD5 SHA1 SHA512 SSDEEP

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 0499a3c8bfa6c398be8d4083987f9917508fc070f448d3920a1a1c4c61e50b69
MD5 28994855fcc5ec2ccd9fc5426f75ee4d
SHA1 1db5619d88752767621d8693932f7bffecf36a35
SHA512 470d45545f02e7b2dc7d8b90cbbbc69b9155642971440aaf50878b322f4aa07abdd69a3a6fb37691fff9f3ab1b449949b8760268432e0ea2004b72a3a37b160a
SSDEEP 24576:ixTNjx+mZCkt76f/24pN+XNqNG6hditW:of9Ckt7c20+9qNxUW
MD5 SHA1 SHA512 SSDEEP

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 e30d563c63c8e45600e2eb79caebce6506b5c7140ad614cf627171c2c133a782
MD5 934e7890b7e299a2b4f217781049a61e
SHA1 6ca9d36172c808d984c251d6b24e555006b28ca5
SHA512 38e78059b3d9253624bbcf0e603332206a3a098e797b45d428e2a768b0cd16a029eac31cdb529ffa363c23b916eac8d4f40e63808b1a9376bbdc5edb39021b78
SSDEEP 24576:DZMSzFVSO5TNjx+mZCkt76f/24pN+XNqNG6hditW:DZMSzfpf9Ckt7c20+9qNxUW
MD5 SHA1 SHA512 SSDEEP

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 e8cf536784ae7aa3d038abf2e7316bf5765cde3b5b1cb90c5153375714c7f976
MD5 3638f3c0be32265a7b79c68a6308534d
SHA1 4d27caee1ac6b6bccfa0ac4f0e964cef75960907
SHA512 c5d6a98c0dd3d92c5e522b7fe4481198b9d8765cc097f84280416405b3f309e8c59c6467525c0963cbbdde013a416e3cf2060c6a74d9104a96cfbfada32cf8d5
SSDEEP 24576:YmTNjx+mZCkt76f/24pN+XNqNG6hditW:3f9Ckt7c20+9qNxUW
MD5 SHA1 SHA512 SSDEEP

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 7db3fdbd67ba98714fcc94c779b31afce6572526cb8b48cdd51b37556924f3e4
MD5 352fc3558c415d1be589fca5c747243c
SHA1 ac36a008fb4e500dd6784f4d34ed7640f941369e
SHA512 624567c1fe84837491b25d3a86b572363ebaa08ca3ceeadeb1c16764f3aaa3888794062214d1802e054701593c64fc4c2b8bcb0a22c478d118bbed3fc3747694
SSDEEP 24576:6yTNjx+mZCkt76f/24pN+XNqNG6hditW:Vf9Ckt7c20+9qNxUW
MD5 SHA1 SHA512 SSDEEP

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 86a87c6a0dbf1f2ce9683c5b5042f6a968337ef47ad79ecc9b83263acdb85164
MD5 71155db0c6a5b0ec1dae2720f948623e
SHA1 e38c5cfd8fd8f8cf86b3bfbb80cbfdb8c5bf7455
SHA512 2706c1a0b8354d03a89924c2ba1cb4a8f2a23711e6e584ae7eb93fd2aa87d79ee03177813ce856f07d7610e253b7bc75d8382517fecc93c508d9f3a61fee5e2e
SSDEEP 24576:SzylTNjx+mZCkt76f/24pN+XNqNG6hditW:Ssf9Ckt7c20+9qNxUW
MD5 SHA1 SHA512 SSDEEP

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 0b13a4d0eb28084c470c22a75a023eb2d29d571ac58ffb32f22cff02b8304267
MD5 4f0e571bc9c2ae7ea34d5cb914f2fb2e
SHA1 879e34c80de02ce28ec3b7e183db560366288cc1
SHA512 3e13039b781e839e1dd1a74eccb343645ca9f5689cc1b1fdbc55f678ec8b18bd3ccd58822b1ed759d87d9eb2fde3b3754c29987547ed7a5314747071b86b977f
SSDEEP 24576:JmTNjx+mZCkt76f/24pN+XNqNG6hditW:cf9Ckt7c20+9qNxUW
MD5 SHA1 SHA512 SSDEEP

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 3f80b5c396cb8a1145916f7ed0a4781e7b76ab5ee3414512ca2ae1eda0753a71
MD5 27584ba3cdd53a706ed5d9a4a3d823c4
SHA1 decfd864f07d19addc52be3b80df0daa31e6c3ea
SHA512 3ea97e014afdc5b1c061ad4e2e6b34ee1cc42a83577a0410ff246e7874741ecc6df9cc5f2509ee06f07fd667637edcc9ce1775451ac5d502bf0a44fd993f9d6c
SSDEEP 24576:TmTNjx+mZCkt76f/24pN+XNqNG6hditW:af9Ckt7c20+9qNxUW
MD5 SHA1 SHA512 SSDEEP

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 013124018f88b504ede980afe38edf25769069d5b229565980f991a3fbb7b7f2
MD5 c6ce5ae72a4b6ea6e9d259f6cc8692a6
SHA1 13f90759ca5d135c7987323059e0b5bac6b22292
SHA512 662e960347177d815f68eaa60ca1de445f4e660863a99530d5aa4debc331269942b80be424e72f8b8e9bb69ece91eec2a8b31cec78625001bb120097cc4a9a86
SSDEEP 24576:CzylTNjx+mZCkt76f/24pN+XNqNG6hditW:Csf9Ckt7c20+9qNxUW
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 ed5e2f8010a53913e4f3980be5ceaa5b183db821299700501271c6b22f3111ae
MD5 933a2d2da2ed9504f601aa86f9e08382
SHA1 02864b944a8261daba1476fff715402968c370da
SHA512 481916952b5ad71a95e1f78d0479f6f2571642c95c758ed4101860d0e6b62fa4a591cda28c384424a1a9dc26b4eb48ed464deed4d8596d485a1642a62702169d
SSDEEP 24576:jTHaLl3z0zDnTNjx+mZCkt76f/24pN+XNqNG6hditW:jT6LljEf9Ckt7c20+9qNxUW
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 11d5f95ebdfd57f7bf090452d151f81c50c03249428019fe60d8542aa3a61339
MD5 359582232e5887a75a2c0f4dad49e320
SHA1 749c455c7ea1a53cd9ca045e07a0d1e5cddc30f3
SHA512 0e9f01e17ed955b13a68308e600a2f8ab9a115da45f1ec6c53bdd8eccff16c82380534c9e7f2a0b23620b69a05479890c95ed324cb3891801dde134dc1fdf2b5
SSDEEP 24576:437d9CHKy7GZrTNjx+mZCkt76f/24pN+XNqNG6hditW:C7d9CHKyapf9Ckt7c20+9qNxUW
MD5 SHA1 SHA512 SSDEEP

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 d697fad026809d672c0346b06b1181e598b10a3d7393526c313546a8137529f6
MD5 033e3a684a4cc5ad48c52a9d35590ec9
SHA1 d07a0571c16dd270a5e3f300cd506ed67befcdfd
SHA512 0f8079d932f27189251b92c0a128c444a287d8d5a287f4d5fa4da68960360444be4b8f0a475fce92a8175e8eeec78dde6349ed090e84bc9b6acfdb98e999ceca
SSDEEP 24576:sXTNjx+mZCkt76f/24pN+XNqNG6hditW:Qf9Ckt7c20+9qNxUW
MD5 SHA1 SHA512 SSDEEP

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 afe3aed4aa80355a8cf61bc200a2a21118775d8efb9a156e29bcd2861f87a628
MD5 39adb300fa419fd641ba037e1836f549
SHA1 d28d9c61b1e2e7c5f59a456759f9cbdf600def9f
SHA512 cca9d0c2d1d7f450cdee98c1275c61bcd8bfe3d1c70d4189e266f98484dcac68ccba2b0a238ff51f18c32c39cb688650b3eaa40add7cb54d243b36fccbfed93c
SSDEEP 24576:vFTNjx+mZCkt76f/24pN+XNqNG6hditW:Zf9Ckt7c20+9qNxUW
MD5 SHA1 SHA512 SSDEEP

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 a7f7649cde603956e96f0086a0d09ae213d41142804b410d74a2e938177e6063
MD5 a7ee4fb1cbd597900e1177d930c688f0
SHA1 cc301bf13aa39f5b3297d10102116555bf08614e
SHA512 08d52165caeeb8cebff718e8fc1963df008e72a1e3e462869a9666ad0d121ffd992341b0603a12bcd17c2feeddebe689942f44d3c58d5595d0ea23bf0d974a0b
SSDEEP 24576:G0TNjx+mZCkt76f/24pN+XNqNG6hditW:bf9Ckt7c20+9qNxUW
MD5 SHA1 SHA512 SSDEEP

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 60383af6a5e9c0e4f976dd628d343414bb477c2f7abf6467dc544ccaf355f9ee
MD5 cd10b6242c76d3731b1ecaa25fe991ae
SHA1 97ba96089d182a532a1de0fdaf2d6998ba28e01c
SHA512 b6b96ae01ce6891a69fe453cd0f80f5057ff2ac00aae4b6ad3032326fafa1ea81ce50fc484ace1ca3761150c9c0007bbe8fe45adf28d0a8b51f3b0b132910f0c
SSDEEP 24576:7mTNjx+mZCkt76f/24pN+XNqNG6hditW:if9Ckt7c20+9qNxUW
MD5 SHA1 SHA512 SSDEEP

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 48c5bbeed3de6aeafc723d5e36149944d23e7e3c81eb7b1fb50aa5d20abeb42b
MD5 8fbe26e1f861ef04c59e25b6084f1101
SHA1 859ceb07c1410951a013fff51c49121994b364d9
SHA512 333c8033f600682b2d21f3736b459cdbdb87a7281a32e177adb21dda398a5688724b61be8ae521baffb810c07fe77850554e8b9ec554638bf83be8efbc2b7ee5
SSDEEP 24576:NXTNjx+mZCkt76f/24pN+XNqNG6hditW:pf9Ckt7c20+9qNxUW
MD5 SHA1 SHA512 SSDEEP

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 36f3ff6282f5b19e568cc0916fc93daeb34626410c44dd81549705fd0506a071
MD5 e12c6ad1af913a6a1154729ee035dbb1
SHA1 90a76d7ee7105d7857302ef31c8757c69de4346c
SHA512 df54bd8d29fc54b13c64a2f825749ad7ecc4ba897e921ab74be809c6ea490b388193ff3f4512cdda381f33a60dae5b8ff4fcc4215bda04f075fbfbd924d53c35
SSDEEP 24576:I+TNjx+mZCkt76f/24pN+XNqNG6hditW:ff9Ckt7c20+9qNxUW
MD5 SHA1 SHA512 SSDEEP

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 c9429de1ed7b02b0f87ac7b0dfbf4d06ccad34f26767df833aa868459a68e32e
MD5 16566232c5c326751a5bbca2439445cd
SHA1 58fd61c8c9bc8a400d427721b371439cacf7d380
SHA512 e371d5c415e3ab9cf0f2406d5acec46ddb9dc375cf0333cd47b5297973426db760fb84bdf4c58d1485106221279e22ccd8e8a0697a47e3bf29a4eb2625c9ce4f
SSDEEP 24576:QwTNjx+mZCkt76f/24pN+XNqNG6hditW:9f9Ckt7c20+9qNxUW
MD5 SHA1 SHA512 SSDEEP

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 a39796c5fcf0f39aea01223a3643f1f51a17df46ebe3d271efe72331234ad1c4
MD5 eb17a40c78e1f732e21259898c3a48e2
SHA1 b0534823f2d26ed0ea2ce31b7341cc8a3ff332e8
SHA512 45660da7922757e07b5e68d95b3fec041419056cc648e5a00c40e0051b4e0ff585dd3ea1f1922a2181b8007659fbebd1ad3f9cbd2c7cf3ddb0a1cfa22bf2494d
SSDEEP 24576:5bTNjx+mZCkt76f/24pN+XNqNG6hditW:xf9Ckt7c20+9qNxUW
MD5 SHA1 SHA512 SSDEEP

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 75d9117a052e840d8b9559f76d77bcc8cd9d9bddcc5a99026f6ad2c9c212741f
MD5 5a7a40398178a2e5cc88310dbe7ad882
SHA1 ca042fe74288a1c45ed69518891b734902c9862f
SHA512 3530230af09b7148fe4226b8b48ffb78687e175d911be67ee5e32d03fcddd5900bc5ca6fb24add2202446174248173744aeb330d9872ff7386086e5f8802984b
SSDEEP 24576:GHTNjx+mZCkt76f/24pN+XNqNG6hditW:Gzf9Ckt7c20+9qNxUW
MD5 SHA1 SHA512 SSDEEP

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 7c150e58d33eb2414c72071d717008825d42d53c499dd0d4721aa56914a88a72
MD5 2cc59c82e41d99f751fb136356c706c0
SHA1 8926426f217c8d3bae227a2697eb1bb9374098b7
SHA512 bfda61d6277ac032c40d1f7551567f0094b3cd89010693440777505e2684664f5f37f6133a506d4bd31e518ad176c808a32dfe0ce3909665fc4c0c6822626f68
SSDEEP 49152:sa0h2GEkuAe73q3pp46zwwQ9f9Ckt7c20+9qNxUW:sa0hNYG4JwMfEkKK90
MD5 SHA1 SHA512 SSDEEP

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 7c5a67f925057b21d44c08457f4f63a7aef4447b33465d94ed52f447d5a9eaa1
MD5 ac2fdfcd0c0524441ee3617a0ba9529a
SHA1 7780b373b1d70b8dc8742ab3c32cc0d9cb493d2b
SHA512 01516060c2a7cf8083b033d10dd64a93475d239db262846a124fd024d79f82f8ef4ca0c5cb0e6b5da556cbf23cac0c6c9c4c380f06be07952f11542e7508bd4b
SSDEEP 24576:DhbHjPYTNjx+mZCkt76f/24pN+XNqNG6hditW:DhbHj4f9Ckt7c20+9qNxUW
MD5 SHA1 SHA512 SSDEEP

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 9e7ab980d0f5b9b8a6be5015ae2205eef2f5a39c1b7b9a447c2d25eb32b987c1
MD5 9dddb49e18779a16d6301f779ca44f37
SHA1 8dc7918024cd9dbf13149a99a3158b9a94bfa7f3
SHA512 0396af42691862b4ee41753f008fa93cbec9be8401e437930d940638b2fa0aa96643490927af2ee4ed0b083a17d5f259724eeb5add2c0e486d7518de4ff95f64
SSDEEP 24576:v3YgnJcRTk4yti+R5dpR/wTNjx+mZCkt76f/24pN+XNqNG6hditW:vIgnaTk46ppR/If9Ckt7c20+9qNxUW
MD5 SHA1 SHA512 SSDEEP

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 0fb42c9eb02e284256b44989f6747e14b5f57f29abbf4342254c1856176ac08a
MD5 ead452a56d36575a87497b5fd5aaecce
SHA1 f54e598a1122d35765d104bb253f3ee490b54241
SHA512 463a30943e0a01b1d1faf6ed91dd3509b3d518f68840e69e8f0010d78123addfdac7418ced77f18ae83b96676f74a4ab631eaf07a7028ee57a95ad5b0046ce38
SSDEEP 24576:77TNjx+mZCkt76f/24pN+XNqNG6hditW:7Hf9Ckt7c20+9qNxUW
MD5 SHA1 SHA512 SSDEEP

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.5MB
SHA256 e03dfe1450cc254b024349bc7a47757f84bb601b223cd3740cd319cdb8c54626
MD5 263cf7b95cb868a6b3003fd00e81464a
SHA1 1b4f9730ed5b143ed24bd54741214a5a72c0106e
SHA512 097bb6012bb8dab0a08ecc6ab6b03d8bf424338d43768fb7af023c09b780cf9fa8a99feef005a6630e6b00bcfd7f04c3d0f7738afa22b02177f1811490165492
SSDEEP 24576:HpL3UTqTNjx+mZCkt76f/24pN+XNqNG6hditW:HpL3Uef9Ckt7c20+9qNxUW
MD5 SHA1 SHA512 SSDEEP

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 be90720115d098d2acf36bbb0414bd75d9f17129c6f683cfbaeadc366d922f72
MD5 7f3a2cf9c31e4bed9879c495f240ecea
SHA1 a42d3771dfbaf083552131b6bcdf795a31d6b292
SHA512 21659c1f82620162a30e68a1b68dced3fea215dd6eeea0122c4272d52453f17b9d946f0015cbe4641f9693bc9e1f898ea78fa57aaa21a7732b6f5eae1e2ba5ad
SSDEEP 24576:WO+TNjx+mZCkt76f/24pN+XNqNG6hditW:WO+f9Ckt7c20+9qNxUW
MD5 SHA1 SHA512 SSDEEP

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 8411b2f5a4cfd20fc9fdf922d3fc366bf591916c3417ffb173341b0c9f7ebbf0
MD5 91d1ab34a4409696b8163f1e22ea1c74
SHA1 077e9db59142375eae023eabe699db29003ae9a7
SHA512 51174c78a35a1c3a08b038b126f299178c5b59cea672e7f5fcb73e9e09c05edf8c0b358ccd2a3a9d3e37e215ea633fade8b5fb893441838bd772a9be1777c361
SSDEEP 24576:B7NM9YmZqmWMUkPjZM48Mv6bEhsXTNjx+mZCkt76f/24pN+XNqNG6hditW:B7cBWMpPjN8DbEhwf9Ckt7c20+9qNxUW
MD5 SHA1 SHA512 SSDEEP

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 e88009cae73f00f6b73088d98458814499a8a020f8af75ff4ba345538e4f9774
MD5 70e55ee3d5250f895efe480c72aa37a0
SHA1 f9edc6869ca53c3edc6e503b53f97cfff783d5e0
SHA512 0140868a3a3f91c66b8185e008d53847d8ac26aebab08fc0790f4cf860b3b28ff0effea1d64c0baf4ceccc0a8122a1ad79d25e130714da32a3996e9ee57dd56a
SSDEEP 49152:/F2YuHNETovcvNYf8kmDf9Ckt7c20+9qNxUW:G6tCf8k+fEkKK90
MD5 SHA1 SHA512 SSDEEP

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 219c036eecaa799b48ffdbd61debb538190bea6f70dc36f1c77e7f01d2aa912f
MD5 08eb7e3e3b6d38763225db577b174fd8
SHA1 4ba425009c5791212d9a598d2b0fe64ecdd0f1c7
SHA512 e4bc428123fcee36b20c9555d28f49d68db7895e1026d23c6f118c38a9b0c383c32f524bb9547acf362c7a57fef66868e768d92db123f3b21d7b234b17da75b7
SSDEEP 24576:NAFs06+Omlf3NXEbToyTNjx+mZCkt76f/24pN+XNqNG6hditW:CFs060lVXudf9Ckt7c20+9qNxUW
MD5 SHA1 SHA512 SSDEEP

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 7b80703b37e116f1b20ac7c9e0c470f0f3d232693793fd0f653366337fb4736e
MD5 0aea833ba8e4dea8a3179001152a1dbe
SHA1 522bf1c590a746b1fe46b8c48603066f015b41e4
SHA512 2726bebc721610c14b77164a2bc135fc1c1a9fea6c39e559f224afb5e649caf4fb04fe9c048e2b1468269c7e4356fb43003ca112ce48e5305b2c81889b9ac126
SSDEEP 24576:2JnJ5D3WtBTNjx+mZCkt76f/24pN+XNqNG6hditW:2JnJ5DGtdf9Ckt7c20+9qNxUW
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 820ec3a43b30ec9bfa7418f320d0718be7118fe768066df85212580373a94521
MD5 cc1f9ea7b69c603b2ea9da76f2d2bf8c
SHA1 cfbade7882e1b4c87f271d5d00c49faca4dbdc03
SHA512 7f1dea6fd1882d92bec7ac09fcbf3cb3108dbc1351fc888b678ca6a0e8d91251e34049256e1707208974e8f4685b96880582d3dd0770017b32a5b267ca4cd8dd
SSDEEP 49152:Ho06DIKdwc+eQnSt65aVPf9Ckt7c20+9qNxUW:IJfEkKK90
MD5 SHA1 SHA512 SSDEEP

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 21cb4d69fc4c94066a38b7c740cf6885489904ddfd336441968dc8baaee7c233
MD5 2f5e3e5c121d3104c9fd9201927a9015
SHA1 8ed69214aa12bee1ac940aa007931de5410818d0
SHA512 b2dce3fc2d683a6baa4ae571b6e0e0726a5bff90a76feba2908d756d700441a8ea22ecb0a486cb992aad3a5271e48bdab6bdf5f8599b938c4ef541c8eb82fe05
SSDEEP 24576:arHTNjx+mZCkt76f/24pN+XNqNG6hditW:arzf9Ckt7c20+9qNxUW
MD5 SHA1 SHA512 SSDEEP

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.3MB
SHA256 6b368b66f37377e90004f426dfdafc12359b2b0bc0dd6734ff9a141b990e74a3
MD5 3672fb12c8a4cfaacee5356c1bb4107e
SHA1 7ff2549c6e382e5801af4ab7a614ec8cf42cc646
SHA512 28a92c900eb01a3d2dce290075b7184eea91b34ebf118023bbf5f216df6fa901632ee86983700bdc3c26a44f1262f12c6b06eeb4f361c1ab6a463eb001e92cce
SSDEEP 24576:dIyITNjx+mZCkt76f/24pN+XNqNG6hditW:dINf9Ckt7c20+9qNxUW
MD5 SHA1 SHA512 SSDEEP

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 fb1a544c6e9de1c61899f5872ab740f501afd81146d8a87fdb73389e192c84ce
MD5 88d65631572a393dff3bd35ca7dd02af
SHA1 721d70e54c09e26f2317d5861fe0de644b638a0d
SHA512 c1055530ff555d8fba01c05089ca01276e5c2b95831c2dbac99ac4ebb5a490b6d91a35a015d7ac10a500445c31209e4b470ea7b5b3afa7472855bc8c8ef237a8
SSDEEP 24576:duTNjx+mZCkt76f/24pN+XNqNG6hditW:dOf9Ckt7c20+9qNxUW
MD5 SHA1 SHA512 SSDEEP

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 673943b3936b53d0fd7e928c28532c4f3869b5d09e7cea3d4a6d391f21805326
MD5 dc7a79392783b8b68e23a61df3184026
SHA1 1a8d9b3797bc6fde5e39e7ae2fff31d0f804a2b2
SHA512 cdd4de99b0e394899c3665adf5021417160096c68543127ae15a5ab2029e7fde09b708ba2996e765dbf353fe015df606f3817213ad802c531f4b850cec799e43
SSDEEP 24576:mQ9MxZKdcz97w3/TNjx+mZCkt76f/24pN+XNqNG6hditW:mVKXrf9Ckt7c20+9qNxUW
MD5 SHA1 SHA512 SSDEEP

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 8a6633551f31cf20a8bfd5469b505022aab443a8ff6b53335b5e4c21f8442826
MD5 0e377b959d7f6bdf524a973ca96836a1
SHA1 b9d3752474ea865fcd1e5f16d6505cb840ac2f40
SHA512 ad2b08f37d5e9bcc1824f764b7575278ea3401ac3b11621adeb8c31fe794044e9f7f3553299e7993dff6d758ca67e62bcbc6d697d8bd49a30d28ed288461c5e0
SSDEEP 24576:6yocxApsTNjx+mZCkt76f/24pN+XNqNG6hditW:HocxApUf9Ckt7c20+9qNxUW
MD5 SHA1 SHA512 SSDEEP

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 a08f9d03cc6da72c71c7350524f7e3e948d4c303510fd478916bf04e92c215e2
MD5 b6f53c28666676abb170f2f4833e6c08
SHA1 691ec3159cfe6de0c37f236c5409d9b51f29bbd2
SHA512 4f77fc125c1e152fe546aa3bb549178b97688b9f52837bd2b5ebb1dc60002f01190d720992fc20bf752c961001d063fd888dd6e4b4230d3b86ae022e1b19d00e
SSDEEP 49152:5WcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIKUf9Ckt7c20+9qNxUW:h0zuNIYfEkKK90
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/540-419-0x0000000140000000-0x0000000140205000-memory.dmp

Download

memory/540-573-0x0000000140000000-0x0000000140205000-memory.dmp

Download

memory/1032-0-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/1032-10-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/1032-13-0x0000000140000000-0x0000000140247000-memory.dmp

Download

memory/1032-6-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/1032-12-0x0000000140000000-0x0000000140247000-memory.dmp

Download

memory/1052-63-0x00000000004F0000-0x0000000000550000-memory.dmp

Download

memory/1052-178-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/1052-69-0x00000000004F0000-0x0000000000550000-memory.dmp

Download

memory/1084-575-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/1084-426-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/1176-323-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/1176-559-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/1860-61-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/1860-59-0x0000000001A80000-0x0000000001AE0000-memory.dmp

Download

memory/1860-55-0x0000000001A80000-0x0000000001AE0000-memory.dmp

Download

memory/1860-49-0x0000000001A80000-0x0000000001AE0000-memory.dmp

Download

memory/1880-277-0x0000000140000000-0x00000001401EA000-memory.dmp

Download

memory/1880-389-0x0000000140000000-0x00000001401EA000-memory.dmp

Download

memory/2028-378-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/2028-570-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/2156-245-0x0000000000540000-0x00000000005A0000-memory.dmp

Download

memory/2156-239-0x0000000000540000-0x00000000005A0000-memory.dmp

Download

memory/2156-247-0x0000000140000000-0x00000001401E8000-memory.dmp

Download

memory/2156-351-0x0000000140000000-0x00000001401E8000-memory.dmp

Download

memory/2500-292-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/2600-562-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2600-305-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2600-425-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2740-21-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/2740-25-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/2740-15-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/2740-232-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/2928-43-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/2928-37-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/2928-234-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/2928-47-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/3272-352-0x0000000140000000-0x0000000140221000-memory.dmp

Download

memory/3272-567-0x0000000140000000-0x0000000140221000-memory.dmp

Download

memory/3488-390-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/3488-571-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/3632-412-0x0000000140000000-0x00000001401D4000-memory.dmp

Download

memory/3632-296-0x0000000140000000-0x00000001401D4000-memory.dmp

Download

memory/3648-348-0x0000000140000000-0x0000000140241000-memory.dmp

Download

memory/3648-566-0x0000000140000000-0x0000000140241000-memory.dmp

Download

memory/4192-46-0x0000000140000000-0x000000014024B000-memory.dmp

Download

memory/4192-233-0x0000000140000000-0x000000014024B000-memory.dmp

Download

memory/4192-33-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/4200-572-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4200-401-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4248-250-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4248-251-0x0000000000950000-0x00000000009B0000-memory.dmp

Download

memory/4248-263-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4308-265-0x0000000140000000-0x00000001401F8000-memory.dmp

Download

memory/4308-377-0x0000000140000000-0x00000001401F8000-memory.dmp

Download

memory/4680-371-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4680-375-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4956-328-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4956-563-0x0000000140000000-0x0000000140169000-memory.dmp

Download