87a1e705fa60ba06487ce4f60dcfc01c8757810738748ab9d3d0f4fa87e0242e

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 19:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-06-03_8d4d5ab05b4a22ba826e0464865bd72e_ryuk.exe
Size 1.0MB
Sample240603-xp6clafc3y
SHA256 87a1e705fa60ba06487ce4f60dcfc01c8757810738748ab9d3d0f4fa87e0242e
MD5 8d4d5ab05b4a22ba826e0464865bd72e
SHA1 34498e45cf13b5d4b828c2bd8990260e8a686dbe
SHA512 b0ca08f627a57614d40321b13e434759d778b3a99b086ca1e875ec97373094fb452c74f444888537eec5bedb71b12e652801c3df7911449bb5239a079aa043b5
SSDEEP 24576:/6V6FC/AyqGizWCaFbyKoxFyXZtGm4JFpOXjq/PJh01RkfF:/6crGizWCaFbXTZgmGLOgPJh0QF
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
928	alg.exe
4832	elevation_service.exe
3952	elevation_service.exe
3196	maintenanceservice.exe
4160	OSE.EXE
3188	DiagnosticsHub.StandardCollector.Service.exe
4488	fxssvc.exe
2856	msdtc.exe
5112	PerceptionSimulationService.exe
5096	perfhost.exe
1548	locator.exe
652	SensorDataService.exe
2496	snmptrap.exe
4248	spectrum.exe
3292	ssh-agent.exe
2444	TieringEngineService.exe
1140	AgentService.exe
2500	vds.exe
4912	vssvc.exe
4592	wbengine.exe
4696	WmiApSrv.exe
1192	SearchIndexer.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in System32 directory 24 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\e37b352cb4b1389a.bin	alg.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\alg.exe	2024-06-03_8d4d5ab05b4a22ba826e0464865bd72e_ryuk.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateSetup.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\minidump-analyzer.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ef57a7d0e8b5da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e1bd6bd0e8b5da01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000bbc8ad0e8b5da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000498270d0e8b5da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000855304d1e8b5da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d87faed0e8b5da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
4832	elevation_service.exe
4832	elevation_service.exe
4832	elevation_service.exe
4832	elevation_service.exe
4832	elevation_service.exe
4832	elevation_service.exe
4832	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
656	Process not Found
656	Process not Found

Suspicious use of AdjustPrivilegeToken 42 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4816	2024-06-03_8d4d5ab05b4a22ba826e0464865bd72e_ryuk.exe
Token: SeDebugPrivilege	928	alg.exe
Token: SeDebugPrivilege	928	alg.exe
Token: SeDebugPrivilege	928	alg.exe
Token: SeTakeOwnershipPrivilege	4832	elevation_service.exe
Token: SeAuditPrivilege	4488	fxssvc.exe
Token: SeRestorePrivilege	2444	TieringEngineService.exe
Token: SeManageVolumePrivilege	2444	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	1140	AgentService.exe
Token: SeBackupPrivilege	4912	vssvc.exe
Token: SeRestorePrivilege	4912	vssvc.exe
Token: SeAuditPrivilege	4912	vssvc.exe
Token: SeBackupPrivilege	4592	wbengine.exe
Token: SeRestorePrivilege	4592	wbengine.exe
Token: SeSecurityPrivilege	4592	wbengine.exe
Token: 33	1192	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1192	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1192	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1192	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1192	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1192	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1192	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1192	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1192	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1192	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1192	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1192	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1192	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1192	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1192	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1192	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1192	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1192	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1192	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1192	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1192	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1192	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1192	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1192	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1192	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1192	SearchIndexer.exe
Token: SeDebugPrivilege	4832	elevation_service.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1192 wrote to memory of 4276	1192	SearchIndexer.exe	123
PID 1192 wrote to memory of 4276	1192	SearchIndexer.exe	123
PID 1192 wrote to memory of 404	1192	SearchIndexer.exe	124
PID 1192 wrote to memory of 404	1192	SearchIndexer.exe	124

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2024-06-03_8d4d5ab05b4a22ba826e0464865bd72e_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-03_8d4d5ab05b4a22ba826e0464865bd72e_ryuk.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:4816

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:928

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4832

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3952

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3196

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4160

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:3188

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:2884

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4488

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:2856

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5112

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:5096

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:1548

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:652

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:2496

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4248

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3292

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:1016

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2444

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1140

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:2500

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4912

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4592

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:4696

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1192
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4276
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
  2⤵
  - Modifies data under HKEY_USERS
  PID:404

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
Size 2.1MB
SHA256 a61d3fe966bd803292cf04e6d7bc059936c8ece1104d2ed27cf10d8b2ffe58d8
MD5 93d298899a31107d439900b1c1522abc
SHA1 dafbe8e2b5d88a2192782f1e5367a785732c10ba
SHA512 2cdeb67e98705e671ccbdba5711c2c56abbe993ff291e1cb3491cc00e1badb2a6adb6fb54718e57f2f81fb1a087aa08a57c5379da5319cac51bc52c27f03085e
SSDEEP 49152:luYk3H5koUUfTqkkYLO/W2buywzMbOX+T7z5nTZgmGLOgPJh0Q:l8fTqi90bKxKgPJh0Q
MD5 SHA1 SHA512 SSDEEP

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 797KB
SHA256 685358904bb48c1a3ab63c66553f57715750d8d72bd673b80f78c7bf9241ab95
MD5 b2ab7c1285692a38df1b4fb3c2a2fefb
SHA1 1c3374d6aa6995750f6692372a39f00f426f05c1
SHA512 3223898ff4eee8e6bdb0eaf77300f33b1083407c460d040050172c4b90cbed0ea0e71f521e26bd3f930ae0981e34966257675f83ae402714f0cc3de3b9090764
SSDEEP 24576:1ionBsuEWoxFyXZtGm4JFpOXjq/PJh01Rkf:1SupTZgmGLOgPJh0Q
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 27345aa96affa4e0c717b86bacac612b273943b9fd6ff864c2dc5554742a3190
MD5 4ee03c61a69619a2a74c99e3baf61a59
SHA1 63073f19c239834b07b9502fd0a36a1500776924
SHA512 ea0c9394fb8039cfa5f9a9a33240d8ad9c7da173f3101f9ea0d56eec47eded3e24247fdc982596118b17bddb516bee0557b0fb68afc2925f4b7cfa9c25c24f6c
SSDEEP 24576:G+gkEdfh4CoqoxFyXZtGm4JFpOXjq/PJh01Rkf:7gkE5S8TZgmGLOgPJh0Q
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 4a7f992496c5864be560d32ffc9d708d67cdefd611f371bc7d1017eb70bc3ea1
MD5 8dbf133b6427e2c8a7a7eb5f31e907d5
SHA1 28ce68dad45b96ee90b90c4f0776f2d015cf4e1f
SHA512 076709ed15e36284d38afb0f345cca4b54a97e67d63bcf9a4e28c18508ffdc6d2bc2ba4763197c5e593da2cce303fb763661d19046deba709e0a4f20f06648b5
SSDEEP 24576:nBpDRmi78gkPXlyo0GhjrroxFyXZtGm4JFpOXjq/PJh01Rkf:BNRmi78gkPX4o0GhjHTZgmGLOgPJh0Q
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 5a1a7ad1d59bb4eaeaa272caf9629125189cf43f5ffdae822fe6c1a99eaca1c0
MD5 b167e85d5aad6c63d7a06fc981b11d9f
SHA1 5d0b12332c311edf26ab11902e87fc87331edb87
SHA512 8ccdf645f980b4651d328503aa18b097ca2aef8cadea21d12431898f9e15c74de06b5ffb319979ebf3e0b8b1e75b82ba19ac74106f8945c78c1db9564c8d3708
SSDEEP 24576:JLOS2oPPIXVqoxFyXZtGm4JFpOXjq/PJh01Rkf:T/PvTZgmGLOgPJh0Q
MD5 SHA1 SHA512 SSDEEP

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 cb80f976fa13979afa6a1d9d4720eecdf806199c64e62d4983d9ece755bda6c9
MD5 5df2f80d35e0fca2d6528b16bf408bff
SHA1 8cd74d04b6bd47cb8b81d816e0b44182ba2d2e27
SHA512 8e8f91fc49e77ceb0b1249ebcb37b946ccba3a6f88e9ffb5fc075681340e34615ca9809077410e5f84ca334e4d217cbeebd627db7538bade72e2ab1114d701bf
SSDEEP 12288:1Ycc9vZiG+/zjZ+EGd4OfJFpOXjNSN/VtXd7zhNS1RUrfY:1YcoxFyXZtGm4JFpOXjq/PJh01Rkf
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 7a213f6576ba2749e904829ff633bbbfd5ace66be7037a172cfee134b71d57cc
MD5 9cc0a0364268d625f0d43d7bcfbad0bf
SHA1 07d1baf27e3a97f4fd43c083681b64dbfbc48235
SHA512 0d163c75df01eb8b81844c8ffe5c35f74d1ce44298f06fbd93db17d535b055d18d18b3b137c23e5b3e8d14436e557e2e5f9bfdbbfef7fab1cbf0c4ef4ac6ea08
SSDEEP 12288:YeBNUbTVO86U1c9vZiG+/zjZ+EGd4OfJFpOXjNSN/VtXd7zhNS1RUrfY:YJIU1oxFyXZtGm4JFpOXjq/PJh01Rkf
MD5 SHA1 SHA512 SSDEEP

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 89e2260e9e94778d4921358080469dd0f8e549d4d6d50a09176c136d291b695a
MD5 f97f6197e9bbf3d925865d4353eec3b8
SHA1 23c15a86fe6dd9201cdc7641ab5a7644b8ee57d5
SHA512 52d4f7355cffb3aaf86978058da933c0c098f835ae8590db9e4fe38907428f197ba5efa68e2df608b70e7e265b1dbb76ff52e7beb609bc792edc430b7f22cab9
SSDEEP 49152:SQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THM:SQvGAdlCEL8c/WRNw5CdxKgPJh0Q
MD5 SHA1 SHA512 SSDEEP

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 9225f8ef4e1424710636f5c6b21ca0ebaef60767f50fcc208cb96a8e99ee9d62
MD5 0a20270ff8b0741f7b3005899742d596
SHA1 6d21e428c99ca38aaff9a8ff76ab18ce07b3ff1f
SHA512 2ff0ffb64ee88ecf9f51fe1a6fc8598a1327fa930b5267ddac39f979e61130ea0c6ee3dfccff1ff30628e5f7f947a2325308a9c55afd8b22795ac6978a673e3f
SSDEEP 24576:PfewsAjzoxFyXZtGm4JFpOXjq/PJh01Rkf:XljzTZgmGLOgPJh0Q
MD5 SHA1 SHA512 SSDEEP

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 088dd595fc0d4ef51572efcd30dea465e642f9a5120e589017098b45372d3a9d
MD5 03d52242af4575647ee1b508f4464efc
SHA1 74f65dad015916def950d4e2030fe91d59999492
SHA512 0e94b141af4384d819ddf51efce11f1f0a8e0b72332eb682df4e215242252e7060c94cd60cab0040ac4aefe88040942f10fce76c41840d729ed29781c78a60ff
SSDEEP 196608:uUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHoKso:uUEtQevvqc2W1cpV20I32
MD5 SHA1 SHA512 SSDEEP

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 76d0c18efe0d83d5c0e096984812a9d51a8dda3b7ded8824f159b794b7d82512
MD5 644eec553c0da765eab93e7b9392fc08
SHA1 6fa521579abcac1f23f0bb22c7ef58b2369b735b
SHA512 14f6ed7f08cfcba31e07f9b445718ebe61084deb7d8f7c0db1c453ba0f1c65fd5f7acabf3486f9dbca8372b9182a0edbf7ffb27d994fcd6c8f8726e485ea26d4
SSDEEP 49152:WCbRquA/m2yL5zTfFiV+XenmE3/zTTZgmGLOgPJh0Q:boquVjnm5xKgPJh0Q
MD5 SHA1 SHA512 SSDEEP

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 8d6321daee181e8787b91c4ebea75fb867bd7f72c3c440da1e384348224783e4
MD5 659e51a5f57c859b92fb0b5b6b8f60b5
SHA1 555cb822b7ffb0aa9ff78f0e5e82eabafb35e9e7
SHA512 c47349dfad99256de12be77feb63a9b0c3fa7b0a1c392ae1658b89f3365f85c6ac05601fc984c3adbad6ec240065a291b8e6d0ffdee219b022421a5df0c2eba6
SSDEEP 24576:+AhGL6IFoiwtA5l7S53aoxFyXZtGm4JFpOXjq/PJh01Rkf:+AM5Foiq5KTZgmGLOgPJh0Q
MD5 SHA1 SHA512 SSDEEP

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 f640d2668105be4c9664e4bba9e7e096d8901ffbf79b03ae2450f525f0be9e79
MD5 edb6e52c78f2be9710c4d3e7ab1b031e
SHA1 707309a8a76b7ae547c3655d0f4c3103ae5f8218
SHA512 7d1ef906d272658371e581b8d4168040995aca96faa84575376da2e8fcdd863d5d6d68722c6635a34de906f8ca2b6eaaf26df6c2e230425a12d3b60241d20652
SSDEEP 24576:JwuROWvoxFyXZtGm4JFpOXjq/PJh01Rkf:JwSOmTZgmGLOgPJh0Q
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 38ccb057e98f5d21dbaeaf44b4df22b94f2a653a91719e75e922040bb98a53b0
MD5 4d79f5dbb4e4630343344da39c3fd2d7
SHA1 3a9a660443579cd1a92f0ee381dcfcf7bdf791ca
SHA512 eb5f0e0b2f40dd01cb01271403859836ba973d6e95cd0da053d83666c8182ddf47c1c74be8699e96da76d7df23f2903d409870da554782372f7a099a5f7cc732
SSDEEP 12288:ZyZ1IyDc9vZiG+/zjZ+EGd4OfJFpOXjNSN/VtXd7zhNS1RUrfY:QZuwoxFyXZtGm4JFpOXjq/PJh01Rkf
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
Size 5.4MB
SHA256 6a721cc1744d452cd24541d48c6d492ca4967a78c8b1f310ce1399376946641a
MD5 cc21f5c810e3565e68cfe531e92889e7
SHA1 4a1ada4191fab81ac8766084c753afe25fc19d0b
SHA512 a20aff0a6c86a22d98aa0ec945ba9d5f1484542d68636a022d341a2b73f6b20adde788378a6e6cefe944061c88bd1aa526bc3cca6059545e8e4f17bf475031e1
SSDEEP 98304:2wfhY7g/rL+7yYA3awr341gRxKgPJh0Q:G7/yhbKso
MD5 SHA1 SHA512 SSDEEP

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe
Size 5.4MB
SHA256 80c72900592f0247de465bd95919d01bd91b4650734da5dab8bcdf6495ee433f
MD5 e7ac43027e0244cb1f22502816e6c1fa
SHA1 50f651a481cef262f568276e7757c5a55f318d89
SHA512 40c0ead36828ce9d248f2f66ace282d26f319e4556ddc071ab92fde715b0fcd92a3e9d3728ac117a4e205e650e8b39cd080ce93e33da3140d371d7a37d5e437b
SSDEEP 98304:kwfhY7g/rL+7yYA3awr341gRxKgPJh0Q:Q7/yhbKso
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe
Size 2.0MB
SHA256 f2d8ba11adf72050dd9063ea9df749a75b8dcde15a42467a7b23e91ddf74241c
MD5 40246d55db5be49adeec8d0e235b1e99
SHA1 b14f35ebde7fb84ad4e94013dc9febb192d6281d
SHA512 29e9ccd2c4ae3b482ee7fd510c228887c2e049d74da55f62163f570bf026451c6e99302df6c451ed29f058179fb989ab8f3d6d2314875a814f4e9d8e80b0b815
SSDEEP 24576:pcTyYv0FteQUk5I2kjgD6iQacAvoxFyXZtGm4JFpOXjq/PJh01Rkf:puXv0Ftpp5606zOvTZgmGLOgPJh0Q
MD5 SHA1 SHA512 SSDEEP

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
Size 2.2MB
SHA256 92f9c25ccc2ba196b9ab627ab53de58a7b8052c446489e498aecd096c7c0d64f
MD5 8b608fcb2ace5b85c965df7e3d24bad1
SHA1 b27c157107a157acdce51afe66293f6b6a29cca8
SHA512 d1f0f06e79fe9897b00d43146ad96ae15d9618c95df0f13232ce69b7a65be2ead44c23a60ef865ba77ebee7c95ce6fce6c6cb7001435996ad964b4d47c93327e
SSDEEP 49152:xy7mTd0GxN8jyynzHjXKUyn4GVcbDSKrNTxzTZgmGLOgPJh0Q:MmYeyzHjWjMTKxKgPJh0Q
MD5 SHA1 SHA512 SSDEEP

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe
Size 1.8MB
SHA256 c6d95ba67dc4118d8e8001f1fe3d8f694ad4eac2f10b4f767db04bf7f2cfbb63
MD5 8eb69cbe865b7deab0f65b889b2c3ace
SHA1 4704eee1f29dad720a7d982f24c68ed19b015346
SHA512 bc741d0e382dc9701ee38d2cfbd158bc492b63188d6fd720dc9d79ec07245bb9ad07ede3dce8d2af5df4cdc5c9f385bc7cd9d6db1cd54d3a95f32ea215fb8a15
SSDEEP 24576:66drZn1WEci182IEUINbJeRgUebgW816YoxFyXZtGm4JFpOXjq/PJh01Rkf:6WnDci18cNNUgbYnTZgmGLOgPJh0Q
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 1.7MB
SHA256 92cabbbad908a33e7eee6916d78016d28cf2fb52a8441a73716a7475ed7abc1b
MD5 20932d5efaa6df619a4d111a6ff7d564
SHA1 0a0df40a13e1059bdc31f7bb04588cbaad080028
SHA512 70d45b13328f6bb6909379dd27fb26423e53339b713e57fe7a780923a98e3ac0a64079ff99b3f6b8e2fa85ddf53584a5800aee32b210780d0dde8d9e421becbe
SSDEEP 24576:9k5lHW5EzMZupOM0G2reD+melRgTTv/1nypoxFyXZtGm4JFpOXjq/PJh01Rkf:pizMZO0GhamSowTZgmGLOgPJh0Q
MD5 SHA1 SHA512 SSDEEP

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 3ed90d1cad535b6065fa135d7741c204ae40142a59a31a5fd3d9a6a101da3e21
MD5 fc0a63fb8b1e0e484ee16619fa4291e8
SHA1 dd5571df533041495ecfd4edbb19aba359d55ba0
SHA512 480d5b7ac4c4979898a07909203383572bacc0095fe03c8a9f707fd36b8e084ac157f86d3ed193db4a9ebef913177e61a43ce98a3ae781ae8286aa1604f4071a
SSDEEP 12288:0Uc9vZiG+/zjZ+EGd4OfJFpOXjNSN/VtXd7zhNS1RUrfY:0UoxFyXZtGm4JFpOXjq/PJh01Rkf
MD5 SHA1 SHA512 SSDEEP

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 380dc9ee680cb0db2dbf14117f03fc7ce36a2e24e237ee6950996c8697dd0360
MD5 9794250d63e30e0e0c5bf2d3b62071e2
SHA1 a609aaf46ecebb543e7b17af50ca978f37e34412
SHA512 3de02518c86d87ce2c8a113e4757780be5aef46ede8577c116b1f0c969b00663e8ca4f60bf24ffd49ce48b331af1b045caa1dac8019d5102bacde14c0cd28827
SSDEEP 12288:23c9vZiG+/zjZ+EGd4OfJFpOXjNSN/VtXd7zhNS1RUrfY:23oxFyXZtGm4JFpOXjq/PJh01Rkf
MD5 SHA1 SHA512 SSDEEP

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 110c59d1550c3933bb2b221dd5e676cab253131286d3d8603f79039c31b88a75
MD5 07755b35ea9ce913ed5538ed5b16a19a
SHA1 e1bde03584fb185a8af87eaf4482f48b4b2c913e
SHA512 d06de3abde99038b4b7bf65f5d0a185a5734d8e02d6159b537428e841b366e62fc2b142f8778e4740ed06fc99c7bd2a644856082b040bdc7e8d6dd2e296e3f30
SSDEEP 12288:htc9vZiG+/zjZ+EGd4OfJFpOXjNSN/VtXd7zhNS1RUrfY:htoxFyXZtGm4JFpOXjq/PJh01Rkf
MD5 SHA1 SHA512 SSDEEP

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 147147d896ca68309e5a0fc950d1e80dbb3af035280024afc34bfb0f347a5c37
MD5 f7f514f7579ca534435a64f03aecd52b
SHA1 3ee198d6929cd7e9c0f7abae3de882dd75ead500
SHA512 f5211fd424a01ed1913a24759af17fdd15abe7bff45e61905d55efab27e43302c5bfde165ec0c751aa4c72e89b7a01aa382af64dbd89907ce1f284c85a177514
SSDEEP 12288:wV6c9vZiG+/zjZ+EGd4OfJFpOXjNSN/VtXd7zhNS1RUrfY:1oxFyXZtGm4JFpOXjq/PJh01Rkf
MD5 SHA1 SHA512 SSDEEP

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 80d987f77408721ac45c8c37dcc72881a2641d571f2dc29e831da5fb506f283e
MD5 dabd0ca085626d9d1b9ef26793d6becd
SHA1 8538dad161680935524ed1e36512b83f0720a6c7
SHA512 0c34be3bd7a59bf013de39c7da35a9d34fd1216d4e8ada36c23623c65c51242b2d858fb1c12cd6b0033f19adbc3665b732753532d1770f2d8a307a8010ef22bf
SSDEEP 12288:3Cc9vZiG+/zjZ+EGd4OfJFpOXjNSN/VtXd7zhNS1RUrfY:3CoxFyXZtGm4JFpOXjq/PJh01Rkf
MD5 SHA1 SHA512 SSDEEP

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 0cd698ce695af8987fd5b312281b5a8df371c51516575e7c047de5f42b3ff853
MD5 da8d5f15cfeae34734dd50520a2dfb80
SHA1 84e252c0a0011900a12977796cc41bc263e0b5ed
SHA512 3e27f60ab85a67e9db4c6a8eb325765fde4771f2d544b4891184e093c5a6f71bb320c6172063a1552a85a432e13f6b164193330862c2a95c8cc2071f4a1c73c6
SSDEEP 12288:6rc9vZiG+/zjZ+EGd4OfJFpOXjNSN/VtXd7zhNS1RUrfY:6roxFyXZtGm4JFpOXjq/PJh01Rkf
MD5 SHA1 SHA512 SSDEEP

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 1f1f76b7265050b5f22297f6bd2cb19aa5126859e8a431d2a0f8cef3011acfa1
MD5 e22b45563f245ca98191c58d84d56635
SHA1 f5d074a2b638c2cbfdafe321cdb404fdf4e700c4
SHA512 3862965900579dbdf23af94a0a3a627bb4d163767991b3dc2c5e4f4aee94bc79a822ba6ed9cd01c4e99e120edb437f583151bb2e35868b2971f3a123095076a9
SSDEEP 12288:6fc9vZiG+/zjZ+EGd4OfJFpOXjNSN/VtXd7zhNS1RUrfY:6foxFyXZtGm4JFpOXjq/PJh01Rkf
MD5 SHA1 SHA512 SSDEEP

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 49df883e43c04b203b409b4dbfda1b95292a72d225228b775808a8c51a7b2391
MD5 ae9c09eed156a61583bee62b00fb8c02
SHA1 e783c9b0cb23a1071fe6c3778c252c0316ac3369
SHA512 7f7f6be2fa379885c8d8487a4765e4e440d5c2a8514f543964f5141cec7c72482175d6ada243d07db880f5b351cd2fbad0eadf076ae7715e5d5b812059d23717
SSDEEP 24576:2ZM3zFVSOXoxFyXZtGm4JFpOXjq/PJh01Rkf:2ZM3zf7TZgmGLOgPJh0Q
MD5 SHA1 SHA512 SSDEEP

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 b64261b676342874413b76b5a0aa5058f3b0e4ea2bce7e6cd1e984fb40cf7369
MD5 59d5ee0b3abb12279f4b4e64d269f078
SHA1 694a124ff780f95603b54a6f9bc3cd1a3ee77b3a
SHA512 b499dae593e2ea591c911dc2c10e2831f95f44c998723e5e81460ac06e86832c2e2acd45ba66a924fc9851290f09f8e269f2cd4116ff4804a5153e7293424848
SSDEEP 12288:pAc9vZiG+/zjZ+EGd4OfJFpOXjNSN/VtXd7zhNS1RUrfY:pAoxFyXZtGm4JFpOXjq/PJh01Rkf
MD5 SHA1 SHA512 SSDEEP

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 64bcfe36a449d1ee6b9d0dbdb961dc303874db31604ff5c9d0f3c75936e64d1d
MD5 d026e55e4333b13dec79b522c50794d5
SHA1 6d53d9cd3159ae9e299742e12330da8034767e38
SHA512 3f8c08a57ed4b8626868d0c7da94172e73991da42911b3bab9f4f4a927a46054d21d2343a9053b07223ff2e7fd6b9ebbd5ccc20e53b64e438f6683a1c59858ec
SSDEEP 12288:Psc9vZiG+/zjZ+EGd4OfJFpOXjNSN/VtXd7zhNS1RUrfY:PsoxFyXZtGm4JFpOXjq/PJh01Rkf
MD5 SHA1 SHA512 SSDEEP

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 34c5615b703e1ecb71ec6ac131d5ee42c180d577a72bfaec46e8ddd66e9b94a4
MD5 91b6dab6d03c47f0ca319226e7857bbf
SHA1 b0fa5994c4ace9d039d2b9cb11d5ad9a2ecca2aa
SHA512 90fce8d87c5be881f5cd411ce433605b1f36c5b941f98cabaad095c31bfe59569bd2ea870735b5f6bd51a9d3a52b0dcd5db2e9e455929528303efdfe0d43c272
SSDEEP 12288:oAc9vZiG+/zjZ+EGd4OfJFpOXjNSN/VtXd7zhNS1RUrfY:oAoxFyXZtGm4JFpOXjq/PJh01Rkf
MD5 SHA1 SHA512 SSDEEP

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 c5c4e615d69c9c848e3101048b3ef6be2109777aede1fb4b480493ea172bc120
MD5 406cc6e8102dcc6b13f7add77c21d2fe
SHA1 da0535aed31f10364219685b5e313f546d0a73e0
SHA512 7d9b636bce28087f28892144dad73fe41dcac207d9d3788a66fd14765d2715cfc1fe9a5dc747f52b0acd7c1c0c9558e1c6daa3d65205670d648713422a240b55
SSDEEP 12288:fAc9vZiG+/zjZ+EGd4OfJFpOXjNSN/VtXd7zhNS1RUrfY:fAoxFyXZtGm4JFpOXjq/PJh01Rkf
MD5 SHA1 SHA512 SSDEEP

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 1dc19b13813b3e30fd3e6c33566cf91f1210c485a1bda85a1803e94e99fe3852
MD5 2bdab24c3f54bd63c609a1b1ad96e1ca
SHA1 a6c73be1fec29dc3b3704e4ccf23e7db0cc2aff6
SHA512 b3b8498a6b91a03feaf3cbc906d388e2284b436787c80648ac06d71884a3a44e94d52ffdb2aec9c51409d1c40a4123e42c8f20b6fca0e1bfceb841748b695f92
SSDEEP 12288:nyPz5L8Dc9vZiG+/zjZ+EGd4OfJFpOXjNSN/VtXd7zhNS1RUrfY:KzyDoxFyXZtGm4JFpOXjq/PJh01Rkf
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 9cd0fedfaa927fd9c04d881635470eaeda47f9b834032c1997dab8b23a329a13
MD5 d060ddf05450f185ebc95f3e0ebd919d
SHA1 8b619ab64cd8ada3eb8fe972004411129f3db6fa
SHA512 0f61b16e2be4308c6bd34d5a99e9bb1ecee8bfaeece38cf50a3531dbd1363283626bdfff4941963e8d44be2c41a313c221c931fa83df8f6338d2ead1a1e41326
SSDEEP 24576:7T8aLl3z0zDdoxFyXZtGm4JFpOXjq/PJh01Rkf:7T7LljOTZgmGLOgPJh0Q
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 8cf1298c4fd71ad884c723f944ed164fbfc47cf8e9c423dc95e18ef05bfca632
MD5 cd163c3dfcd1e54fc34b00e08f3c9aeb
SHA1 e83e044650b5fd048e574d3a512c78f78f85fc14
SHA512 60dc03e8fbaf6c9051242264833a12a0effc06a63398fefba84b504eecd8f139bcdcf17d848cf7d07d97bc62de151adbb68e1c05af75e7e0c36d093a7475b040
SSDEEP 24576:A3rd9CHKy7GZRoxFyXZtGm4JFpOXjq/PJh01Rkf:Krd9CHKya7TZgmGLOgPJh0Q
MD5 SHA1 SHA512 SSDEEP

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 6e3fa4ccce58f10ac8652721a4f34dce6fe7915ce75ae2182e08a6b26dca1835
MD5 82ed8da6454b012a75b57bc6c616dd09
SHA1 ce7f128c5e6d3b73ec549f8b0394da4d014e1334
SHA512 d0a90669b46bf97dcbcd59f2f7343454c7af80dae5ebcd351d15587e1555d925712b7d9c2a43d2a9db7129ed3cefd0e821a6d8188cc9a2c3993cd8802e2067a5
SSDEEP 12288:CNc9vZiG+/zjZ+EGd4OfJFpOXjNSN/VtXd7zhNS1RUrfY:CNoxFyXZtGm4JFpOXjq/PJh01Rkf
MD5 SHA1 SHA512 SSDEEP

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 4df4dff64b63d0ad0e4cf13cc5dfd0afb14dfaa3ad3f7fae0c4e4b295ebc372d
MD5 ad3fc5d863e705da943ea3dfe267c3ff
SHA1 37afd1cee1efc82295a96995661d2d5020718928
SHA512 30ac4cfc91bc716bd30f645a0d92b9c422f6634896e16eda32e6a491be152dfd4b1b5cb2d4dd4d2c5da19118c91747473ea3bf6d29419c8092a159ac897cd123
SSDEEP 12288:cjc9vZiG+/zjZ+EGd4OfJFpOXjNSN/VtXd7zhNS1RUrfY:cjoxFyXZtGm4JFpOXjq/PJh01Rkf
MD5 SHA1 SHA512 SSDEEP

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 d0490d879b78c1eb3ae1e77f46d75a7e0284d948dd845c852f40da41a5d742cd
MD5 b65d09f2249ebcaa5ad466976c1b89c4
SHA1 a8d6ad350dd79c1089d9ad5c2cd817f707858fef
SHA512 5f0686bc3f8cd141aeb3fcd851224c296b5cf6a4c792addfd98f6054de24683aca9457150715cfbd2649e2630fe062f981effa836a045d7b91258ec1782f780e
SSDEEP 12288:FWc9vZiG+/zjZ+EGd4OfJFpOXjNSN/VtXd7zhNS1RUrfY:FWoxFyXZtGm4JFpOXjq/PJh01Rkf
MD5 SHA1 SHA512 SSDEEP

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 75bd2680dcdf8edd6421d4275709d811c732e5b28fb7e5f9473a4cce8e3ab8a4
MD5 676b3fb08e88419905da86703bda1a32
SHA1 c909dd83c5c6f6abba605796ce07c0b053e25a71
SHA512 ede4695198d2ef4fddf0d04564653c2e60a5fd472952f0fe89bee095ebad8a51d97edd36b1304b923d93f887bfe53b0d068e7e6d471f9facb3c11ba665992a44
SSDEEP 12288:JAc9vZiG+/zjZ+EGd4OfJFpOXjNSN/VtXd7zhNS1RUrfY:JAoxFyXZtGm4JFpOXjq/PJh01Rkf
MD5 SHA1 SHA512 SSDEEP

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 107a5861d5311799022384713ddb18bde5ddff7bcc69eaf8f6cd1d627aaf4b87
MD5 c9131a578b75a8230c802a7e18eb52ce
SHA1 38a41cd3f306088e63e5fb473508d6ca4ba07cc1
SHA512 dc6d0efb190d69286dbee03cf96a99a1fe31801aad25c8289e254d596339225634df2a22f74d0ca473d473a7f0efbce6adaa3316cbfa46811f3ba9e71912a133
SSDEEP 12288:mNc9vZiG+/zjZ+EGd4OfJFpOXjNSN/VtXd7zhNS1RUrfY:mNoxFyXZtGm4JFpOXjq/PJh01Rkf
MD5 SHA1 SHA512 SSDEEP

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 002d0bd2c7ab6b7e788cedc155b100c28cf21ff9a598cf4d02dcff0f4a522353
MD5 9b6be26e15ad9f3b8b9727d36023e0ea
SHA1 14444af860023d296b000d31e1cf1cefe3222fe9
SHA512 20d2271d020cbd26bf38d2995f57aaece01850edab3ca3445febf2a9cd7ed0d43c45eddb592d1d65a5a5779e4a3a4ded5ab0ece0aec6711e715d3422822b9eaf
SSDEEP 12288:/Ic9vZiG+/zjZ+EGd4OfJFpOXjNSN/VtXd7zhNS1RUrfY:/IoxFyXZtGm4JFpOXjq/PJh01Rkf
MD5 SHA1 SHA512 SSDEEP

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 581KB
SHA256 bc6412c72e3f0ed6cea098b01ba173485ef081364096e6206a84f1b8108b2a0e
MD5 b760f10d907a4257174cccff4b4b02ae
SHA1 5538ae00f21954bdaa19567d857d61417f3bc203
SHA512 2e8fd15343d89310ddcdae43a25e524f31400956b6803be49d1a5dd821b84f724b809f3a7ad3c02993d792ac56c9f0b36043dd8599af607908a35300e76b785c
SSDEEP 12288:WCc9vZiG+/zjZ+EGd4OfJFpOXjNSN/VtXd7zhNS1RUrfY:WCoxFyXZtGm4JFpOXjq/PJh01Rkf
MD5 SHA1 SHA512 SSDEEP

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 701KB
SHA256 8c7242051057c826f5bbf9b117bc1ceb1ab696d04c198a6bf12fb532bd30f7fc
MD5 412566f9d5714d1e2cbd3a3ed1471a5b
SHA1 f86ba9b987420765fa1f73fd9ace38f5f9cc751e
SHA512 26e07b76105b9d8d35b0ae451724a397690866e773c3f9a79879b15dc560b912d787e3f009b92a626eeadcfc07d5268d0043d86ed6415a15f657cc8ec86d9439
SSDEEP 12288:iUFmDDLBc9vZiG+/zjZ+EGd4OfJFpOXjNSN/VtXd7zhNS1RUrfY:wBoxFyXZtGm4JFpOXjq/PJh01Rkf
MD5 SHA1 SHA512 SSDEEP

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 039215e0142863d194254c2074f6d95c95222c2944a3a3896fe96fcbc9e813fe
MD5 634b814e985bbd47e7df3d89afd26478
SHA1 1af055081f2c23a11968791f6cb9c499e033270e
SHA512 eb5cd798cede71eb6dd6d90fbbc2395b5430c2049d9ef7b220342778257bb089246a503d05478496f80fb0088dc328f4ad541b29214d75d29b202b9f1d0689c5
SSDEEP 12288:zhc9vZiG+/zjZ+EGd4OfJFpOXjNSN/VtXd7zhNS1RUrfY:zhoxFyXZtGm4JFpOXjq/PJh01Rkf
MD5 SHA1 SHA512 SSDEEP

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 3b9f7d5cc65795e8ff5e07b0bee88684e6db9ce7817f6be599b2f06add1ff989
MD5 444a5333d1c341ece76877fcb5c2220c
SHA1 5af08d60bae1b5a44bbdb1b658662bd800144cf4
SHA512 cc4a7107ab434b39dad718f043cfea52ec9ef17abef7a483ed38b1e40af77cebe424b0da9d8116e7739a37f01865777c9da6679562106a2ddc0b76c746c8e7da
SSDEEP 49152:5a0h2GEkuAe73q3pp46zwwQPTZgmGLOgPJh0Q:5a0hNYG4Jw1xKgPJh0Q
MD5 SHA1 SHA512 SSDEEP

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 659KB
SHA256 5144661ccb6adc9d432607ea30278ef26422123f94c02157d403b9aac966c88f
MD5 19fe7b9935a450e422594672ac9bcc5f
SHA1 5863391528c61c3b08476ab5a69c89c0d6073e8e
SHA512 5b5e0c116959e49ff9c53a1761b9c7e3d694237b8ba1ae3cd49534681cb77652175463119780d2a40b15e917d6656152a1c07da40811a63f256bccd79bf739fa
SSDEEP 12288:ChbHjfXqc9vZiG+/zjZ+EGd4OfJFpOXjNSN/VtXd7zhNS1RUrfY:ChbHjPqoxFyXZtGm4JFpOXjq/PJh01Rk
MD5 SHA1 SHA512 SSDEEP

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 1a6ff983d9ee7eab51b5cb69c3f7b3fbd8f8620aa10f84f53dfce1e52a3ec3d1
MD5 9dec274cd0363ce226e90307142db0ee
SHA1 e34102c16fc8600d5d61299ac2e0e99ed90b6e8e
SHA512 09eb7acf7eb21fba9ce931a3ab9adda8c9525120c95abfe024b08e72ffea51c663b809ccde098d81753c2682321730ccf07e7bc065705c2bae9ac2558a9cae29
SSDEEP 24576:O3YgnJcRTk4yti+R5dpR/ioxFyXZtGm4JFpOXjq/PJh01Rkf:OIgnaTk46ppR/iTZgmGLOgPJh0Q
MD5 SHA1 SHA512 SSDEEP

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 578KB
SHA256 188778700f08de273edf3ac6bb5166b274f1b9abe845a6b23020ffe954bd0b5b
MD5 e8f6bdcae564ebc6e9f8cd82d77772f6
SHA1 3a7eaf08bcb9e145269dfe95d8cc3be1b0836685
SHA512 cf517dd9e4093484d62ad4f15f8c0f58b964b755f607271fcbe45754eaae8df4197d5944bf9334ef64f72ba392a09dbb6ea5d90298aa21039dd0e182fbf960a7
SSDEEP 12288:XFc9vZiG+/zjZ+EGd4OfJFpOXjNSN/VtXd7zhNS1RUrfY:XFoxFyXZtGm4JFpOXjq/PJh01Rkf
MD5 SHA1 SHA512 SSDEEP

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 940KB
SHA256 271ebac86a6268f2ddcb34753261d0d53c49a5579fb526a2b1676e9e95fc2c3c
MD5 d96bde6545c1f80c17eb39f11d4b0458
SHA1 2a2a5579e099322eb8b3e8dd33450c9e7bfd6bbd
SHA512 ab02a6b632c87b06b8e071ec9fd083256026ad9c224be7904c502765152610e4477a35d24a01f70046d354e155d1667a49daa11045ea6cabb5318f491031e03d
SSDEEP 24576:jAL3UTAoxFyXZtGm4JFpOXjq/PJh01Rkf:jAL3U0TZgmGLOgPJh0Q
MD5 SHA1 SHA512 SSDEEP

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 671KB
SHA256 1f8e99e7d9c2d8a855c512effa6f5e3c88494e5937925a8e844878a525439b46
MD5 4814693f71dafde1fb4ae2596e248ca3
SHA1 0512e71bee56b9ea54937312fa00e888322d3e2f
SHA512 5d090ac8d2a6702af11ec2e117b94a6fd8b783f8cee5f005ea8091599ec01b4d15465cdabfee9f2a47b0a83b1d4b9e29f07fbb3e97c25117e08075f03215ac6e
SSDEEP 12288:RpFtvOUc9vZiG+/zjZ+EGd4OfJFpOXjNSN/VtXd7zhNS1RUrfY:HOUoxFyXZtGm4JFpOXjq/PJh01Rkf
MD5 SHA1 SHA512 SSDEEP

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 86141df006d3d165892f7f2c6cc220a10b7c86c0691af3e006e561b4edc8f471
MD5 44efdead4078786725998aa3d9bd8176
SHA1 35ef90af5ce3c1d88f33be6a617e13486a4da847
SHA512 663b5a74db153c966d2283131c37786ac4cc932a558d69704a25f8c4b0c21b3f79fecceea8a4b4f8f8a350989925b0175b9b9f2ba1d8b04ec9a4e313631579a9
SSDEEP 24576:+7NM9YmZqmWMUkPjZM48Mv6bEhsRoxFyXZtGm4JFpOXjq/PJh01Rkf:+7cBWMpPjN8DbEhKTZgmGLOgPJh0Q
MD5 SHA1 SHA512 SSDEEP

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 8f7f2cc1d6da4c734782ba70a6abd91a865b40080dcf1a85b04e8999bd08c5b8
MD5 2411eac37d94e0da6c65645ca6c5dd8d
SHA1 fb1e68ec277d5e676a56c7b6ba19e4d3c6f852a3
SHA512 f16e7d5c619557bfc17c81a5f91625d829ddc9bac8cd6f35cf8c255fc8be6128e11963fd182b8614dac4c91b454a9d405f668febae8d6f76d6d7b32170c5ce22
SSDEEP 49152:8F2YuHNETovcvNYf8kmxTZgmGLOgPJh0Q:Z6tCf8kfxKgPJh0Q
MD5 SHA1 SHA512 SSDEEP

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 3de7c8f989a8dc7e8a517590dbba884ca6e9fcdb4f1a7bb067957facc46bef87
MD5 38c49b31187d629b5ba9758eb444ff00
SHA1 d18300b5f1439a52d3ee6c05c423eb5385a9bc79
SHA512 bd7b706912385b834f81f1459ff7b08c6fb027f020090c42dda97b1a0940ec61306c0d61427efc1b143cdc740a4cf8db93b9b78a3959dd4411cce5c45ff4dbdc
SSDEEP 24576:6AFs06+Omlf8NXEbToooxFyXZtGm4JFpOXjq/PJh01Rkf:DFs060loXuvTZgmGLOgPJh0Q
MD5 SHA1 SHA512 SSDEEP

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 885KB
SHA256 1eaea75bc406f4fb70813e2cddd6813c95db4098512191f53ca8509aa62e80f4
MD5 9c6f871dde67c09e207439b7ff009518
SHA1 8c0c0805ee7d92c31d4866cd60c39ba06df21681
SHA512 77279953d0f20e7aa8df163bbdab67c35ab0b8e2f0d6c82c658f183c6efefa2b01dc5709f2ec76328abaf4cff79212ed1eb2213bb827bea9b0a9e4448c57cf86
SSDEEP 24576:CJnJ5D3WtvoxFyXZtGm4JFpOXjq/PJh01Rkf:CJnJ5DGtvTZgmGLOgPJh0Q
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 14a7791e4312847f8255d38f8b829df5e89a229c95122d4cbe7936bd143aab03
MD5 73b4d377480c5f7f453b707e52e10921
SHA1 67ea16f535bc44acacffa8f83b42d253924fee6b
SHA512 84a69d1add74dc75514709b9a5765559c8c49ce401a9f46f42a7c1372f2b879296ca03a2393f237c1a062488a47b30fa93371da2c55526eca8d42a4b58224106
SSDEEP 49152:Io06DIKdwc+eQnSt65aVtTZgmGLOgPJh0Q:VCxKgPJh0Q
MD5 SHA1 SHA512 SSDEEP

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 661KB
SHA256 244de9c5425e3c1a4d273349f527ea6f9738d6bec2e975c7cec82ca2530a1b44
MD5 1f6145bc334264dda8bd8ba0052390d0
SHA1 f6aad62a61d4a2fa50bdf4d97d882c53b540213a
SHA512 5e749f78a634bf647f54053b8de03197848273daabba25c3095a00ed546e5d1f07abe79cb53a38df444ae447baf32cf8d795ef2720fb23a6b53bec9841d7a56c
SSDEEP 12288:aEP3RrRc9vZiG+/zjZ+EGd4OfJFpOXjNSN/VtXd7zhNS1RUrfY:5rRoxFyXZtGm4JFpOXjq/PJh01Rkf
MD5 SHA1 SHA512 SSDEEP

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 712KB
SHA256 f9dd5411eb2bbb6186229057ca0ab7c4c7b9ace1c849cd114e40d2256b1b2728
MD5 ed3a9e4393aa95ebf1751357034158f1
SHA1 2af4a4f12d8d2ac4c36d5ee354a26851162ec360
SHA512 bf8eb95a5705086a770122a619b0b9873d4a3dd901dab2b90f4e4aad675dc8581fe989cd9c3a712a6dff7d0cd583a9b271fc67c398093ef92c79db2ea1314130
SSDEEP 12288:8jky6c9vZiG+/zjZ+EGd4OfJFpOXjNSN/VtXd7zhNS1RUrfY:8Iy6oxFyXZtGm4JFpOXjq/PJh01Rkf
MD5 SHA1 SHA512 SSDEEP

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 584KB
SHA256 67ff7a287f73a6fcc8981ec06cd1332771fd94323b4f194e7157bb4b33b1f7eb
MD5 84807768e7c9e0df1b9fccebae7c0635
SHA1 b2d217145f01dbd1e4d1ef358adcf32f17e157c7
SHA512 671bc29a1902fe0d49bbb2537822d97b19e07875754a4fa23287d7fb6b7674856c7f5bd66070e62f00face9d5c0c0ec839f15dfe34449c7d246122b41147120a
SSDEEP 12288:bFkc9vZiG+/zjZ+EGd4OfJFpOXjNSN/VtXd7zhNS1RUrfY:ZkoxFyXZtGm4JFpOXjq/PJh01Rkf
MD5 SHA1 SHA512 SSDEEP

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 d846c6f46679aff626aa9b7332badb58306ac24c7e7e3642260d89a5a372be92
MD5 fa52ab866bf2af40f594ee470e3f55cd
SHA1 0431569d9766a55d1e57cfc0997def4105d457ff
SHA512 da41f74073db6576715427a06e35911904efe499c7b4340f56a64dc9fd1ed1f4cd9df2ad7224f14d784db6116489cf99ba0e161847a06d0518832329b9a25aae
SSDEEP 24576:lQ9MxZKdcz97w3ZoxFyXZtGm4JFpOXjq/PJh01Rkf:lVKXZTZgmGLOgPJh0Q
MD5 SHA1 SHA512 SSDEEP

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 772KB
SHA256 24873a61641bdc920f6278aaa4b82cb6e6f45a5bdb44fab1b872bafa360e322e
MD5 078d38c3ab971fa1439a8452d26daf77
SHA1 dadce7d8e65e544f7bdcb1ea12ef7e60f9f64113
SHA512 aa2cd3573fd72fcb72458b7c61e2399975f6b33435fc980aef6b2d0ff9904d5eab1b5502bc1eab296723e4da77de9aad2e8217c1bd1e688c17b285858a1d79ad
SSDEEP 24576:KyocxApeoxFyXZtGm4JFpOXjq/PJh01Rkf:XocxApeTZgmGLOgPJh0Q
MD5 SHA1 SHA512 SSDEEP

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 e8a5f3dcd2ee47ff6704c543c1373d29567c5703d148b9d9213d8883e6adfc84
MD5 6768f53a05250cc17051c19d9e202b88
SHA1 2846bdf1f886a833f65e189bcea2b5b4bb495819
SHA512 683a4dc3fc90239b169f642afae4c6e7a53edadfd16eea090b39f41a650afea620afa1b9e1782a7d589e1b42c1705851800e768b111550f64faee5114a9c4c72
SSDEEP 49152:xWcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIKeTZgmGLOgPJh0Q:p0zuNIxxKgPJh0Q
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/652-307-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/652-616-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/652-428-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/928-24-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/928-23-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/928-15-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/928-232-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/1140-365-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/1140-377-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/1192-429-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/1192-626-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/1548-296-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/1548-415-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/2444-354-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/2444-618-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/2496-319-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/2496-612-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/2500-380-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/2500-621-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/2856-267-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/2856-379-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/3188-353-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/3188-241-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/3188-242-0x0000000000680000-0x00000000006E0000-memory.dmp

Download

memory/3188-248-0x0000000000680000-0x00000000006E0000-memory.dmp

Download

memory/3196-51-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/3196-61-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/3196-57-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/3196-63-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/3292-617-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/3292-342-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/3952-39-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/3952-47-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/3952-236-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/3952-48-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/4160-112-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/4160-65-0x00000000004F0000-0x0000000000550000-memory.dmp

Download

memory/4160-71-0x00000000004F0000-0x0000000000550000-memory.dmp

Download

memory/4248-613-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4248-330-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4488-252-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4488-253-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/4488-265-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4592-404-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4592-623-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4696-624-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/4696-416-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/4816-0-0x0000000140000000-0x000000014010E000-memory.dmp

Download

memory/4816-7-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/4816-13-0x0000000140000000-0x000000014010E000-memory.dmp

Download

memory/4816-11-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/4816-1-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/4832-35-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/4832-29-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/4832-28-0x0000000140000000-0x000000014024B000-memory.dmp

Download

memory/4832-235-0x0000000140000000-0x000000014024B000-memory.dmp

Download

memory/4912-622-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/4912-392-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/5096-293-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/5096-403-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/5112-279-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/5112-391-0x0000000140000000-0x00000001400AB000-memory.dmp

Download