9c1d2bc81a977a1c8214048fb5f98dcac2de921a9e726b60bd31f5311a4df2cb

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 19:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-06-03_b65c989acbb0e3d830bf96a779773265_ryuk.exe
Size 1.7MB
Sample240603-xt4dssge68
SHA256 9c1d2bc81a977a1c8214048fb5f98dcac2de921a9e726b60bd31f5311a4df2cb
MD5 b65c989acbb0e3d830bf96a779773265
SHA1 e86bbd08c11caa45fb7706b3174134c4436dac65
SHA512 17010698f1453971469ca87d5d721736aa09c2242ec6724cb89df4a9f804b4d87d16cf4e3dc80a153f851be1db6f3be86d7d8f349238a9242bccb028b49f89e4
SSDEEP 24576:Y6V6VC/AyqGizWCaFbyhc+pFB5z+//ufNRoZW:Y6cbGizWCaFbT+pFzz+/2fNR
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
4084	alg.exe
4688	elevation_service.exe
2472	elevation_service.exe
3168	maintenanceservice.exe
4856	OSE.EXE
4644	DiagnosticsHub.StandardCollector.Service.exe
3044	fxssvc.exe
2056	msdtc.exe
4528	PerceptionSimulationService.exe
4420	perfhost.exe
1732	locator.exe
1452	SensorDataService.exe
4480	snmptrap.exe
1872	spectrum.exe
3120	ssh-agent.exe
5056	TieringEngineService.exe
3668	AgentService.exe
3912	vds.exe
2464	vssvc.exe
2424	wbengine.exe
2256	WmiApSrv.exe
1180	SearchIndexer.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in System32 directory 24 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2024-06-03_b65c989acbb0e3d830bf96a779773265_ryuk.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\f949123a4a48edc7.bin	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_95203\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Install\{72342474-B513-4DE5-9360-4F37AA503DB7}\chrome_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	alg.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000040f863c9e9b5da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002a2c54c8e9b5da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bc018bc8e9b5da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000aa4129c8e9b5da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bc018bc8e9b5da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
4688	elevation_service.exe
4688	elevation_service.exe
4688	elevation_service.exe
4688	elevation_service.exe
4688	elevation_service.exe
4688	elevation_service.exe
4688	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
672	Process not Found
672	Process not Found

Suspicious use of AdjustPrivilegeToken 42 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3544	2024-06-03_b65c989acbb0e3d830bf96a779773265_ryuk.exe
Token: SeDebugPrivilege	4084	alg.exe
Token: SeDebugPrivilege	4084	alg.exe
Token: SeDebugPrivilege	4084	alg.exe
Token: SeTakeOwnershipPrivilege	4688	elevation_service.exe
Token: SeAuditPrivilege	3044	fxssvc.exe
Token: SeRestorePrivilege	5056	TieringEngineService.exe
Token: SeManageVolumePrivilege	5056	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	3668	AgentService.exe
Token: SeBackupPrivilege	2464	vssvc.exe
Token: SeRestorePrivilege	2464	vssvc.exe
Token: SeAuditPrivilege	2464	vssvc.exe
Token: SeBackupPrivilege	2424	wbengine.exe
Token: SeRestorePrivilege	2424	wbengine.exe
Token: SeSecurityPrivilege	2424	wbengine.exe
Token: 33	1180	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1180	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1180	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1180	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1180	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1180	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1180	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1180	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1180	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1180	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1180	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1180	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1180	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1180	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1180	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1180	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1180	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1180	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1180	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1180	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1180	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1180	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1180	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1180	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1180	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1180	SearchIndexer.exe
Token: SeDebugPrivilege	4688	elevation_service.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1180 wrote to memory of 3520	1180	SearchIndexer.exe	121
PID 1180 wrote to memory of 3520	1180	SearchIndexer.exe	121
PID 1180 wrote to memory of 5076	1180	SearchIndexer.exe	122
PID 1180 wrote to memory of 5076	1180	SearchIndexer.exe	122

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2024-06-03_b65c989acbb0e3d830bf96a779773265_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-03_b65c989acbb0e3d830bf96a779773265_ryuk.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:3544

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:4084

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4688

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2472

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3168

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4856

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:4644

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:3004

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3044

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:2056

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4528

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:4420

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:1732

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1452

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:4480

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1872

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3120

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:1988

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5056

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3668

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:3912

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2464

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2424

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:2256

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1180
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3520
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
  2⤵
  - Modifies data under HKEY_USERS
  PID:5076

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
Size 2.1MB
SHA256 6ff059a8c5f8506eb3dd39ea80944c2f58d0c1f775952be5be5198458f2c0c97
MD5 50e1ba6f0e9d4d01daf4eed228184ce0
SHA1 34395425ffc870c83301f0f61128f585062e8197
SHA512 45de1fceafd32dcf924ee570fc7e033fc5b0fa5380c5ddc77c255a883c7e494ca14ebef0c8de6259db9af464a52fb072e0989aefde2d8f516516462adff7cbeb
SSDEEP 49152:iuYk3H5koUXfTqkkYLO/W2buywzMbOX+T7z5E+pFzz+/2fNR:iPfTqi90bI+pFtFR
MD5 SHA1 SHA512 SSDEEP

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 9ce9dfac03d9b9a0995f7373b1a91ff7fb52f02537967b510122701248c8609f
MD5 12731746a269a759608457536a898157
SHA1 ec94448c9803fc04a03e01b7d11545f1d86053f9
SHA512 1a3315b255ec308ca1b87b3ed3bfd341595f4f94cbeb1452cb561145e56000f85daf1add175a027eb1ab532bc3039ddc511e8796d26c1e7e1b0938b09a71a44a
SSDEEP 12288:/cQiQmNJLBsunEtYlc+pFByStv9JRa//inz86NRo1qiRlUWC4kXzVC3:fidnBsuE8c+pFB5z+//ufNRoZW
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 e761647e4e49acd910467177550526c4ec0a5bdcc4f25997f000a34b6a96ce4b
MD5 19aebdcad332bbb2181b63d7c560a343
SHA1 e9b38c2faa4100d2e0e34e79ecbfa6f5822d820b
SHA512 cda898b553cbe27486304eb2fcadd38d5cc2484e285efbd2291572fa3e46da72775b6cf3dbb8b6990368b3c0f9d898d3946f3ee2d203c6117c450e0a7a1ea258
SSDEEP 12288:J7a3iwbihym2g7XO3LWUHfh4CoxYlc+pFByStv9JRa//inz86NRo1qiRlUWC4kXa:8+gkEVfh4CoAc+pFB5z+//ufNRoZW
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 a5d4a99c483d6862f323f3fbf76911c37caa8acf504c85fab2e90761e4ebc273
MD5 28a7703ff4100704622dfd4dc99eb56f
SHA1 5128d06273befac68c9dc8c0c141cc95684ea94a
SHA512 13319e8c44d1ebfc6cd9a03461dff4c3df5bb1df6acf45b9d1afedbcfe2df81c8337fdf922b0a8ddb6bde368c2e8cdffd53ba8c49a7e410f9123571709b2198d
SSDEEP 24576:lBpDRmi78gkPXlyo0Gxjrzc+pFB5z+//ufNRoZW:PNRmi78gkPX4o0Gxjk+pFzz+/2fNR
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 2c83f7031d9997295dd26f790b10c27a3db60ba35b671725137195857f239158
MD5 b942960036daad0516ded24c8211b5b9
SHA1 47dd21d831405686afc0406052025650bad82b3b
SHA512 71745b7324903ae5d93b2228244a0c100ee14a535b0be3dbe83636764bb35edf0ec2d0c24c0ded840bd990d78a14ad8a6a8fa1979cbd2851a6a4dbad6870e828
SSDEEP 12288:bfC6Aj+TN5uixZN+8rKhUdTC/wE1MD0Ca5ZIXVxYlc+pFByStv9JRa//inz86NRa:LLOS2oyPIXVAc+pFB5z+//ufNRoZW
MD5 SHA1 SHA512 SSDEEP

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 65137e54a8a9e544b2fa82a711ff4873ddc15eb53a6b1165a16a102c5da6f387
MD5 8a337b7feb522b4aa76bb6d53536dbf5
SHA1 dcf1c9e41ebf82ed738539b8df2eff811b41d4f3
SHA512 4377f3b320c1a16bbc0d5dd2831facbe1833479b01213b027aee6f40e2f74e56ff1e3c3144c8a1cac99888ea5e4ea2a56ba1b453a6c8a393ebd7444e3d28faec
SSDEEP 12288:nfzYlc+pFByStv9JRa//inz86NRo1qiRlUWC4kXzVC3:nf+c+pFB5z+//ufNRoZW
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 5c7de779aaaee9bd411d8d9cf40473654759745fc96aebe4309b3bb4f90182b1
MD5 b068e0dadb852a58fec543f352556ae8
SHA1 45e9ffc46937076126eae27cd5cc506bc5183cda
SHA512 72f565d6388545693bdc9eee8d531df740de8e04c79e4a1d9a868c407d0f67b1cf63455c13ff1759d6d9908bd055e03fbb431c805f09754f1ca55b7118a9d7bf
SSDEEP 12288:VeBNUbTVO86UAYlc+pFByStv9JRa//inz86NRo1qiRlUWC4kXzVC3:VJIURc+pFB5z+//ufNRoZW
MD5 SHA1 SHA512 SSDEEP

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 555f62caa7788f11f648967be099d73d6389a01f8fecf1f597251cea12119751
MD5 78e9d2ad7dd10640b19ddf7879ebe36d
SHA1 583eaab4de62f65e10eed80544f022a2a5502e25
SHA512 e344589cf4f310be830564929e6504d642dc9152fd67bea981d7b6cf48a6aec98a94d717a4015c632fe65fedf9f7944caf3a9473368620d2873e3a99091fb56d
SSDEEP 49152:vQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THx:vQvGAdlCEL8c/yRNw5Ch+pFtFR
MD5 SHA1 SHA512 SSDEEP

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 5be2feefe4feaeb978a9d22579a2cacaa92d98687b6c409db26e178c164617dc
MD5 b2790128668155cc75aaec65a2c0bbed
SHA1 0806cf5f7dcc7e79c67258d0258665d468de2a64
SHA512 b254d2bfa7c71f917d6378d2947279703d47ec5cbff7686b7d198d7c6f6cce48dcba90943969909cf5f605ae0d01dc5771bb7268b082f1e31d9c5d2d8c58c49f
SSDEEP 12288:GAwSfxL/2Dc34DLLmt0LDQewsAjuYlc+pFByStv9JRa//inz86NRo1qiRlUWC4kq:bdewsAj7c+pFB5z+//ufNRoZW
MD5 SHA1 SHA512 SSDEEP

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 7846ee2bbf357f9f2ee8120a8f89c24b8d3709c79eb68004042b5e5de09408f8
MD5 50778902e1bea44761307b2d51c033f4
SHA1 33c3deae3f26aaac02496304b3e19976ee4a341a
SHA512 4d5352bc7a6d70194d8bfa3a80e464fc84162fe2ba5196cd6da9afa0886b33d260f605887927c363a96c389c2ba44ad11f6a05e59b95e774b98cc3fd0b9b952f
SSDEEP 196608:DUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHl:DUEtQevvqc2W1cpV2EI32
MD5 SHA1 SHA512 SSDEEP

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 028c0e1d5f10b930d6a63f8aa02462a6ef46cc56c3953b89a3ad2fcac286ab89
MD5 157183892ff241c3f1391bec631695b2
SHA1 7440dc14f4de96baa83e7e30c7a0d6ba4123fc1e
SHA512 4ee51e6d4e3aee20174004762ded89278201da4a7b99f78d51ad7bc7b3497892bbb93f200cc72599ac10604eb7f2e7d0d56876666018dd84b62967dd73fbd3df
SSDEEP 49152:2CbRquA/m2yL5zTfFiV+XenmE3/zo+pFzz+/2fNR:7oquVjnmF+pFtFR
MD5 SHA1 SHA512 SSDEEP

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 14ecdb9d232f70d870d35ec6d1e420cf3eb32ee7930844a70e5aed7559e5b452
MD5 3b104f881459ede46ff65844861179ea
SHA1 085b7cd0b3ff5cdb3fb996e674acbef9b2cacd2b
SHA512 2776175f13ccd334d5ba25201222b0a97b7137982b544bbac26c5565ff94cf0b54953bc335cf5107dca9aa1e21d372d1ffae5edfe8e9f28c57dedd975682171c
SSDEEP 24576:CAhGLJIFoiwtA5l7S53wc+pFB5z+//ufNRoZW:CAMyFoiq51+pFzz+/2fNR
MD5 SHA1 SHA512 SSDEEP

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 0edfa79fa2e1c41d4749e2841e2ba6e6d4f5c6c04631fbfeb153af262a4daecd
MD5 3dcb2dd054bf188a9cc3dd427527c264
SHA1 9ed0dd13dd49d1cdee50e22997362f57318fbf9b
SHA512 37dd4df865a19c45ad509f5977f12d4a2848d43df0475bc26e02cb48dd6136aaead1c1d336d5aed8897d23e7848257a3da86963a6dd29070e9cdf8900689529d
SSDEEP 12288:umw5HEjsChNVBFgl0WDm+ClYlc+pFByStv9JRa//inz86NRo1qiRlUWC4kXzVC3:nwuoOWHc+pFB5z+//ufNRoZW
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 59379f8050ae9944e02e1cf869487af2dd778959629d888f45f1751d60f5f9b7
MD5 96ae6af5de8bacd7ee046bdff51c0416
SHA1 e47b03c18784bd4033b997087566d3c4a818bbab
SHA512 67cda7cac1473ec4c6a9430653459afef657334ce5bf6fab377dd99fefcd309164ccdeab1919d02e3c29dd02fdbb4e24a29502a201aae5314e0b0d3695dc0cbc
SSDEEP 12288:kBZ1IyeYlc+pFByStv9JRa//inz86NRo1qiRlUWC4kXzVC3:CZuCc+pFB5z+//ufNRoZW
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
Size 5.4MB
SHA256 a853dc21396deea086a03258c499fca6c15500f6347ffe0634bee56cab1b4da9
MD5 6c37a795bc61613ef80b19f07487854e
SHA1 da3fbd8620d8e35908e927faa18f8677510559ec
SHA512 9309960fc9db476a456b33aa2060f47134a7055abaac1359a640b3a6c087a16c3331e03b6b34ea01b8cef6b5e74584a7d9a23bb62f7f4ec3209dcf190c8f06c1
SSDEEP 49152:o0kwIi7c4xZlm5knEtw99Kn/2vim7vgv6m+yyJ/0gbvjR7yY7BHi3u7L/gBUUWLB:OwfhY7g/rLd7yYA3awr341gN+pFtFR
MD5 SHA1 SHA512 SSDEEP

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe
Size 5.4MB
SHA256 5fcfd139c1b95047b97d2a50dd2c95dca3d32a8877271c29db841b8d119f027d
MD5 33fa440553359eb6054e173a69255b5e
SHA1 5cd7fa994ac3b02cdaa765b7c4d32ff905b91c5f
SHA512 6378eb62cb22b5ea711af36a8a7a33a960db9eae9f1a64375a3d7e76860f5b205618ae74d3dfb93b2dd4502dfb2e0ab20d589bd1056f0aa4a66ad22fa2d774ac
SSDEEP 49152:i0kwIi7c4xZlm5knEtw99Kn/2vim7vgv6m+yyJ/0gbvjR7yY7BHi3u7L/gBUUWLB:UwfhY7g/rLd7yYA3awr341gN+pFtFR
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe
Size 2.0MB
SHA256 a952eb98671f314084e14c038f751be62b7a98e9466e894d94e5e42a915f8e4b
MD5 80eafc300e738a56d05972c4b545bf75
SHA1 1f2968a6689b6e127ded039d3e2deafa5672c021
SHA512 bf21614984910a0448095b8ba9f24e1d2cc4e14309b17d72b8c04456923a68e91c0ae38afdded6ebd84b7096237b06885d1a33bfcb12de612ffee8e95b451e38
SSDEEP 24576:YcTyYv0FteQU+5I2kjgD6iQacAHc+pFB5z+//ufNRoZW:YuXv0Ftpn5606zO8+pFzz+/2fNR
MD5 SHA1 SHA512 SSDEEP

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
Size 2.2MB
SHA256 2788dd8fdde6cc290718f433897e3f0ed8bb149d107480bcf2dbf6cd2c093cc0
MD5 2ef0e78a25071b76b4625aa19f8c8df5
SHA1 a11ca5da0872891f0dfe0c0a0e7ee22b27a6bcd9
SHA512 46bfc6e6b7a83ab2f406f7cc751cb67dbe5c03e2610ce1f2e82620b88d68fe6ae4096b12a0d0108781d1bd3a5030dada94fdcef2cc4d3981da4b6cad5bfeb6b1
SSDEEP 49152:Vy7mTd0GxN8jyynxHjXKUyn4GVcbDSKrNTxI+pFzz+/2fNR:wmYeyxHjWjMTI+pFtFR
MD5 SHA1 SHA512 SSDEEP

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe
Size 1.8MB
SHA256 7f9cd387d7e6532b9b8df9aa054337929a503a2154fc3f7cfc2b8e9399a5e1f1
MD5 1ff128c395f88215f33bb6936c601f0e
SHA1 cec346f21fac218ba00f182950aaa3e40c5c5c40
SHA512 24fb4137738706d075be737427b7178ba8afa94ad3bc213c618f9d4a0d7d8439dd9e10ae4cb1ee28d1fa8f12934092a858ff920291581341097ff9b150a19404
SSDEEP 24576:n6drZn1WEci182IEUeNbJeRgUebgW816qc+pFB5z+//ufNRoZW:nWnDci18yNNUgbYE+pFzz+/2fNR
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 1.7MB
SHA256 d2f990b1d46b259c7bef4e4a6a97cbda8c485748f951f18c17457991da3a45f5
MD5 2d92536d55526fb507eaa7faa94dfdc4
SHA1 87719e71e2bece0e5d6baf5004ffab1e7644f670
SHA512 19f12e8a74ce6292672ba2cdcd9d2cf176893cb43d647fcf7ad865ae26a7483745994e7ec09da95dbb6ed614e68b8b977a2dca7af1a7bd1ca486cd88ac49887e
SSDEEP 24576:Fk5lHW5EzMZupO80G2reD+melRgTTv/1nyVc+pFB5z+//ufNRoZW:hizMZm0GhamSo3+pFzz+/2fNR
MD5 SHA1 SHA512 SSDEEP

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 676f113b9bdd21392e99e49ffa9294547eade22b167625a5c18ab8d6c700c8c5
MD5 bfc1870eadc4b482a8697c0f81db7ec8
SHA1 cfc3ab8799c9445ead182f45feb25b2d91423c51
SHA512 82e4b131824b94acbfd79752a45e4c6890032bcdc417d40005394f5947bd30ea2e0f6b47f3707fe40ad65eae9a6748a373bae2a40ae1365060d24cebe3d915c0
SSDEEP 12288:gLYlc+pFByStv9JRa//inz86NRo1qiRlUWC4kXzVC3:gWc+pFB5z+//ufNRoZW
MD5 SHA1 SHA512 SSDEEP

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 971e62697a87d39c9ad436e9efd3126c3831a7fd30de37d2b828266e6f435c61
MD5 f4c9c6f66d47b5918c5652875a26acbd
SHA1 8fb6f6aa6b1147ab4fdea7d4042e3be1fbf7c49f
SHA512 bfc78460d6ae8baef862f4fc0fe1c5ef2019cded233d0a7f38c633411d8f8c93455d37949abf922b13bcf6a2e38d37be0065b357217d34cdf2d8dc47e84b2663
SSDEEP 12288:pCYlc+pFByStv9JRa//inz86NRo1qiRlUWC4kXzVC3:pPc+pFB5z+//ufNRoZW
MD5 SHA1 SHA512 SSDEEP

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 be5017568ce12a1dddadbb959a1ef4f9b48d1c0ad54e6e563fff273e2405556f
MD5 37ce3ceb9ddc5f2cb0a3e205cddef4d7
SHA1 2a369bb3a87b7c5e115fe62d29d7a6dd031d7c5e
SHA512 123cb0591c3092bf0e1f05d5f55e1133ac6215e4d82afb1e080453a5fbf413242b647413dd9afe6b6d9cd3d2eb8cc2d5da5d192ac2a7c49b6fbb3f5ee6514b2b
SSDEEP 12288:J4Ylc+pFByStv9JRa//inz86NRo1qiRlUWC4kXzVC3:JJc+pFB5z+//ufNRoZW
MD5 SHA1 SHA512 SSDEEP

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 f5921bfc7b295db3a68fd436f3b8e490f4ade3d49dc011e814fde797d996b75e
MD5 078f1941b31e0de88b0f00860c4c1649
SHA1 1aac701a37d99c2e2920fd05d3ebc36ee0d972e7
SHA512 76b0c501225a4b0e485684024a9508a86c66f31ae1a8a47a7952a146d58c06c599933dae412c8324472a6db0834e52e75130c38f4cad87d9aef7d73193eee2ac
SSDEEP 12288:HVhYlc+pFByStv9JRa//inz86NRo1qiRlUWC4kXzVC3:mc+pFB5z+//ufNRoZW
MD5 SHA1 SHA512 SSDEEP

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 9eee527b91d944a6966b733231650e809e2c18c0b27eab67035d70731748d6fc
MD5 111649a781433709c36b5890f431b276
SHA1 7039a625684283e11e618e09b87fecdab6abb4c9
SHA512 61e52b11b28fbd7550d720f325a4b13c1189fd59df9a9e0481bbd2a0f047cc5853ca4911e7dee9c3c7ca1ff7f507c62a9bb8abee54627f75581180473cd5cdc9
SSDEEP 12288:AJYlc+pFByStv9JRa//inz86NRo1qiRlUWC4kXzVC3:AYc+pFB5z+//ufNRoZW
MD5 SHA1 SHA512 SSDEEP

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 670e99e91227e800a90f41d00d7ed247751cb5c24ee9f5ca814d11e2c7522643
MD5 4a70edf5948b8e7f2ea6a7e2de4550c5
SHA1 7a8a344efca429c724a7775613ed0050b31bcf18
SHA512 d3ee8234d80e5cd5351cd414d657363e9b2f5cbbdb51c8f01cf73aaa5b0ea3c5dd03a4f841106314acca32aa644016dbcf4b1bc57d04490e62d8f6cc630c8f72
SSDEEP 12288:nGYlc+pFByStv9JRa//inz86NRo1qiRlUWC4kXzVC3:nzc+pFB5z+//ufNRoZW
MD5 SHA1 SHA512 SSDEEP

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 b8016a58683bb483976d73a672800936f43cd853d128e793e8b81088bea19a40
MD5 9306cf9f8c3d4257f1cdf4ec40771383
SHA1 05be2d1adee1f2793a88292bd66e8a906756c483
SHA512 64196478daa5bc19fc66d7cdb27eaee782e617370a43e384da576ac54bb9282cff1b1a89aa5192a99a7fd35e7ea324003174bc2e2d7fab38ce76eb82ca67d651
SSDEEP 12288:tKYlc+pFByStv9JRa//inz86NRo1qiRlUWC4kXzVC3:t3c+pFB5z+//ufNRoZW
MD5 SHA1 SHA512 SSDEEP

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 5900755adc6384b79133af613c5b9da0a6a3678139f5adbe6465ce9e7906ac76
MD5 c350c2a3416dc45320a7691dae826fd8
SHA1 c26163899cde145afda4801b53bcec11b2f9e882
SHA512 2e46721c8869627647bfb1715f11287d1cb6dc013393289987c5355724861f23bf70a42124c50aea259be2e52715316a4b691b780371e69cfd4f3929e5ce00cb
SSDEEP 12288:hiZwb6zzFEoS2cPvyiYlc+pFByStv9JRa//inz86NRo1qiRlUWC4kXzVC3:kZMSzFVSOvc+pFB5z+//ufNRoZW
MD5 SHA1 SHA512 SSDEEP

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 8ea769cec062d88a59198948c48737cb52fde03ab7e65a07164f451950aa56c5
MD5 587574bee217d8ff9466141335b0ea6b
SHA1 18f8de7ede963e0cf4dca46a5c9fd66c7f49a5c4
SHA512 a00f573d48aeda82b3383a9bb168c407ca22f7b762f2fe6a6ba2cfa15d2d7367f65bdd9e48e78a47e09a05f40e5fa9ee9c783e4991129749baf6e9e7a82f5dd3
SSDEEP 12288:cHYlc+pFByStv9JRa//inz86NRo1qiRlUWC4kXzVC3:cSc+pFB5z+//ufNRoZW
MD5 SHA1 SHA512 SSDEEP

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 6371d64e697763635624a1a6e6df031ebfa4713aef23b3057212dd5aa83f0d0a
MD5 8af590953cf2168e4ff1a6c1ce19efb9
SHA1 198067b464f53b385ad585546568a6264e0c6ce9
SHA512 035121b72e58f4eaf14914d4c22948e58cda341451ff5a6702757519ec66fd19de95dad451c96ce89ed365ce1702faca2bc9ec9b038091f6d4edce3d5e41a2a1
SSDEEP 12288:7jYlc+pFByStv9JRa//inz86NRo1qiRlUWC4kXzVC3:7Oc+pFB5z+//ufNRoZW
MD5 SHA1 SHA512 SSDEEP

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 2f292c86ef6e7e8610ddc596b945f5270c2e03e2e4d443277e10634b96f71aa5
MD5 3248aac24f1cebb767ed5399f5a8d2bb
SHA1 cd9ad0e6bbb0f963a2036bc0abdec0c32a86e473
SHA512 e86f65101d6b01191606f4219c7776fe0a0e82a26838afcd0313e2b32335df86ab86791610a790b8dc8643c427781bf6ef979669e239110e93bd4dec00308932
SSDEEP 12288:eyPz5L8eYlc+pFByStv9JRa//inz86NRo1qiRlUWC4kXzVC3:DzyLc+pFB5z+//ufNRoZW
MD5 SHA1 SHA512 SSDEEP

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 e83ce89c2f9890da1f33c7a25b4062940d702cde91a44fa8b766b179ec84fd48
MD5 1bedbc63ea8f83224d62281b62243035
SHA1 21b5a694096a07d561ae18da72833d725e89f260
SHA512 27be66343b420ce8a8a5e0fb4ba4bc6d0bb3c7c8385c18db18eda1758b3eafb9485ca73b0cb9ce876a8c985a42d94181388e354883d31cecacab0ce86648a568
SSDEEP 12288:MHYlc+pFByStv9JRa//inz86NRo1qiRlUWC4kXzVC3:MSc+pFB5z+//ufNRoZW
MD5 SHA1 SHA512 SSDEEP

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 00a30c1d36655da9c0be15c02f2a6388791abe0b509c6f2611ebcd341a795478
MD5 80e621a4265f79d9c5f5212d7e254160
SHA1 a7c0854a0947ef1ed5e2966621246457f90e2544
SHA512 a5219233c3e5ae262f14884afbb93796bf9f18019af27e32e9bf157c05e474f4ca25c18325cd445bdc080fa4322281b4c5bd11ce31c3067d5e98c8af57188eb6
SSDEEP 12288:EHYlc+pFByStv9JRa//inz86NRo1qiRlUWC4kXzVC3:ESc+pFB5z+//ufNRoZW
MD5 SHA1 SHA512 SSDEEP

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 4f9dc7e5c3c56cd2e6d96908e2e3f65f0e0f0fd17067226e53b5e6d38c372966
MD5 e09061f9951c3d1e9f5600fcf9021305
SHA1 ed80c6a541ddb390c01daae6dec864c1650ad587
SHA512 8afeb2dc043ca5ff05ddd0da13848116e1ffaf4ac5e86feee77d72b8bd3ff0baf04255fd118f1d4e074893b510b82aae0d5b212dd0f1c9774c7a7826e1d94d72
SSDEEP 12288:AyPz5L8eYlc+pFByStv9JRa//inz86NRo1qiRlUWC4kXzVC3:xzyLc+pFB5z+//ufNRoZW
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 16bfd6a47dec87a6b2635ce9cfb289dd5b96798f49025110448f4512e961402f
MD5 b87b1c484931551e2e3054c78100a856
SHA1 65508b0c48e56ed14531662ca948424defd7e604
SHA512 35acacf3143d70cd21e48803083f8dc4addc20a2a92a25139c6c7409f54deafae9e80fe4e5efe1ccd290cf5d06c560a9d783d46cd0e4e8a0c4e364b6a6c6d1ec
SSDEEP 12288:QCd9eWYoaLHF3z0z04PDvhIYlc+pFByStv9JRa//inz86NRo1qiRlUWC4kXzVC3:JTHaLl3z0zD5c+pFB5z+//ufNRoZW
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 82df71ec4fc78f752ff47b515371d6a9071aa775b107fd5c569f2c20d6eff291
MD5 7b8f765c6ca34abf482c0c8d0f179c7b
SHA1 27fbe99291b3a90c52e239bde2e83f094be623e7
SHA512 6f2c89863cf16af6b5b0ddafed78e553f7b96d702766b211ff73c40a1c13e88297f8fca806eb4811f38d5ed21c501e034a2383963ca6605e1139088f84af7a17
SSDEEP 12288:ui4e7+RdTfgwCHKy7GLbbdIvtYlc+pFByStv9JRa//inz86NRo1qiRlUWC4kXzVI:u37d9CHKy7GZ9c+pFB5z+//ufNRoZW
MD5 SHA1 SHA512 SSDEEP

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 13efb0ef084bbe5471bf965136fdb4cd1d7612c6685819a1c3f16fe42caaf086
MD5 1bc0dcea47fa526418d26903071453da
SHA1 9ea6afd93383171f6527ac43b036b97089cf67e3
SHA512 f4da12c66499d1741c34c44ac25609d74bab6f24645e8a6ee458794a923570dcd839b5a3e24a5291b1275d8e9467574b8b0d461818cd4f90bdaadb73f55c1769
SSDEEP 12288:CYYlc+pFByStv9JRa//inz86NRo1qiRlUWC4kXzVC3:Cpc+pFB5z+//ufNRoZW
MD5 SHA1 SHA512 SSDEEP

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 8198d788386cfe5788e8366967cf5adbbe47a7b931a1712f539692be5c65647d
MD5 77e87fb858096e18ec9adf9a9e5ee041
SHA1 97e659289e7c51c6878c11e8fc5b198f7dc1642b
SHA512 5b7e7c938d61126fe08ab2378979b5d5aee0aa3749ba27abc2a7073aa37633b87f35803b5bed4baf2e0f9835aa53623133b0329ff1a3a16e7e635d4aea46486c
SSDEEP 12288:K+Ylc+pFByStv9JRa//inz86NRo1qiRlUWC4kXzVC3:Krc+pFB5z+//ufNRoZW
MD5 SHA1 SHA512 SSDEEP

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 d434df364ae7c786f6847f0a7f6c75a1f89c0f1ea34b0bc73a386542ee15bdfa
MD5 d26460db86cabee9f41b35bc094a40e7
SHA1 db9c44a4d0b2a635c39ce663c1f16e8093aadf49
SHA512 382d437a6ed3a840f3eac3fbb094652d463283bab612cf7940880684ff2ba93f4d2792c264359ad1e779ed30971d9eb8ff9f9cad2009f71a0e73eee101d5c25c
SSDEEP 12288:QtYlc+pFByStv9JRa//inz86NRo1qiRlUWC4kXzVC3:Q8c+pFB5z+//ufNRoZW
MD5 SHA1 SHA512 SSDEEP

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 6ead3cdfe4c6a04f16e74021c05e23484c452c963a7eb2e5b947fe3fd56abf0f
MD5 1dd890c8d1e61a01c12837fbf8456349
SHA1 d9f0a6862b876d81a7f35db6df7505f018f58961
SHA512 7820128ff43ed3fdd8bac9e3897f6c7d92f909970c45b22db62a6953ed6f214b8b9924738a67ec92b110ee9724760dd9057605542e7c6e250805842603b77af7
SSDEEP 12288:cHYlc+pFByStv9JRa//inz86NRo1qiRlUWC4kXzVC3:cSc+pFB5z+//ufNRoZW
MD5 SHA1 SHA512 SSDEEP

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 af4dc3353f506d83e6c294806df52cac6a0aec026dedaeb6ca858a9ccd0c1d65
MD5 0c1dfcd9fffa276941d30fee3f0663c8
SHA1 26986819bf7676c80ed8b7b52cb28c0e1513e70b
SHA512 8de2864e72070cddaaa1dbbb8bd6d7a555f197887b8a04fe6a17dc41cded0cd7ce4c469367e27d7154bbb56ca972d14b652032c0f038926a6bf1d40dbea2e16d
SSDEEP 12288:6YYlc+pFByStv9JRa//inz86NRo1qiRlUWC4kXzVC3:6pc+pFB5z+//ufNRoZW
MD5 SHA1 SHA512 SSDEEP

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 6d3c5c004197a3232ff8f831fbc3deca145124b1c44d9887c5b113c54108cb3a
MD5 15facad189245ad79530e07cbcad79bb
SHA1 13dcbbcbef1fa9a9bc056f05f225dabebd543dca
SHA512 b63658c9f22883f288db2f5fd65694c20d235cfdee1d0752f2b3a8b26f16f3d3d04846f988cea8dd2b69004ad85330c76f7b7b341e7e1f081c20a94ab5490b46
SSDEEP 12288:yvYlc+pFByStv9JRa//inz86NRo1qiRlUWC4kXzVC3:yac+pFB5z+//ufNRoZW
MD5 SHA1 SHA512 SSDEEP

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 4e9406994e045478d03a08cc3b985b1b8e96b1f7a82d6cf8af262d1a13a6b266
MD5 bd9d48cb393b23fd46a8c79e86ad1e15
SHA1 34e7f6cc54fbf4d4172fc57bda3448d20a74747a
SHA512 3524889fafb22a548d4e7a9eb36daf6b8a7be6aca14d1e091a4b93a33b5e9fad8332718a40955d7e2a58c21922eeb6210ff496d9ae2e46364d16078714f7851a
SSDEEP 12288:lJYlc+pFByStv9JRa//inz86NRo1qiRlUWC4kXzVC3:lYc+pFB5z+//ufNRoZW
MD5 SHA1 SHA512 SSDEEP

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 a26837679614bf284e8e60b83673cb07bfc32bafdc59285899b7b5d55ad7c418
MD5 70343947c1f842d3776b85c2d7578876
SHA1 456a944bc308bb4a4d0e9c053d0429b687bc3eb7
SHA512 3be32c3fa634d0477dcf9061751c66070e874c09011354f7c1ca1a765ffaa1c9d0cc150f63adac20874f655b7dd145762977a8bd178ac533bf1abd58b7233815
SSDEEP 12288:8UFmDDL8Ylc+pFByStv9JRa//inz86NRo1qiRlUWC4kXzVC3:etc+pFB5z+//ufNRoZW
MD5 SHA1 SHA512 SSDEEP

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 5f9bace486c7ab6865644045059e35798ff3ee026fa2f279f9ce568455872048
MD5 70e1a502e333c8c268af3a3b0c395572
SHA1 3571fcb2e5391ed5eaf689266891f8afc10d1dea
SHA512 312bbcb036f2bf42a56c7b4062573d712f5e5dbed153bdc933354230fcdea189799bbf3e953fade97b823e273107ee39e3fd9a5a97fccaf28473f9f74e52dc9c
SSDEEP 12288:6GYlc+pFByStv9JRa//inz86NRo1qiRlUWC4kXzVC3:6zc+pFB5z+//ufNRoZW
MD5 SHA1 SHA512 SSDEEP

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 2ce6994bba6faabe79db4b38a68e897eba40f3ec9628052890fdfdc1285e9891
MD5 8440ccec5da758d959ddae0159f329cf
SHA1 343182056b4ebe98860a980f600de01515c35d6a
SHA512 c30908fbbc88ac50f28766b2115a299ff13c289a60cc39405a59696322f19469ec2f70de19d60b17bad5d3980b1820a213089949c686fea1e6cf5bf518da68a0
SSDEEP 49152:Da0h2GEkuAe73q3pp46zwwQ++pFzz+/2fNR:Da0hNYG4JwP+pFtFR
MD5 SHA1 SHA512 SSDEEP

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 a8944d211918545c9e772b929f7ffcfe4677449ffdd3e6a8bb071ad9b0fc0a1f
MD5 fcb73a9ff13f27a26bd9ce10b5f528c5
SHA1 fd6c2acc6d809f2a364acc5418de1f51f81af65c
SHA512 32a35ea5a8675fe336631a1c50ecd8cafa61d8d8be74baf866797668c9d4c1a9eda433ae8c1efc6d7c327ce2dce57c207464198a5a54568cb4801f0e961684d7
SSDEEP 12288:1hbHjfXjYlc+pFByStv9JRa//inz86NRo1qiRlUWC4kXzVC3:1hbHjPOc+pFB5z+//ufNRoZW
MD5 SHA1 SHA512 SSDEEP

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 2115aa35a3739fd9156e2626c917392f0b32922727e03491a3b1b0b85c0bf736
MD5 16625b1d747d29e4cdeb4e0c5485149f
SHA1 96aa2da4dad36c5d714ce9741faa4bf04352c7a0
SHA512 d0885d0b568a3c1153a6f584c2da40ce164ddde0f52e16bea7025e5376f305133dde82a482cd1c30fcbe3622712ae7ea7e6ed72266cc54fcefa3c5a84edff6a6
SSDEEP 24576:83YgnJcRTk4yti+R5dpR/mc+pFB5z+//ufNRoZW:8IgnaTk46ppR/D+pFzz+/2fNR
MD5 SHA1 SHA512 SSDEEP

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 414e3cd955c1a336bfebedff46e6a04f5a4c62d41bcb49eeff151ecf089d22b1
MD5 8a0bcb3a72a553f2efec57b417baa75c
SHA1 98729dfc485ce3a946976d9bf0c5c30cdb59bcc4
SHA512 499e17208f03af162a9154aa772f0da57c7190960bd9f5617b10e3d0e4ce97200eae92806cfc3ed38407d9b4e2f509801dfa04d7f81174f17a4a7ae10d5d6308
SSDEEP 12288:UqYlc+pFByStv9JRa//inz86NRo1qiRlUWC4kXzVC3:UXc+pFB5z+//ufNRoZW
MD5 SHA1 SHA512 SSDEEP

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.5MB
SHA256 27721424d6925107b0e195d2ab4cb86850a4daa60b6b1affd2d7dae0f0dce9ce
MD5 995672c8b9727b8a560b7db8d1da2f6f
SHA1 f6c10eea225e728b3feb994c0cb0595b4c019bc7
SHA512 5fc2d0ec254c81ee58f308204f0ca2ec826c6ee26ec0349ea04fc0013b411e8c66bb0095946033b7c20483e043d4c5e3abc5f0da7bb74db1640181117032ac0b
SSDEEP 12288:1Ob9A4LWOsvAYFT1Ylc+pFByStv9JRa//inz86NRo1qiRlUWC4kXzVC3:ypL3UTEc+pFB5z+//ufNRoZW
MD5 SHA1 SHA512 SSDEEP

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 ef57956601c064adf4bb78ca5295ce797839b86c152b938d08c7b7984cff0b2f
MD5 e2a87d320c26c233f9cf24aa9ef52f97
SHA1 f73d824edbaa9a4fb1558b1134724fd77cb73bee
SHA512 7b9d5b90b57072143084c889a8e82ab476f9adf69272ddb7279fadab80595b54c2b4a8b5cc39d3cc90b2620ff9d3ad3bf4745af9ec37a3379f2ef20e5880f1ed
SSDEEP 12288:SpFtpOZYlc+pFByStv9JRa//inz86NRo1qiRlUWC4kXzVC3:AOIc+pFB5z+//ufNRoZW
MD5 SHA1 SHA512 SSDEEP

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 b83f10adffc7f68ce66166eb11bb6386b12044734c71fc6b16d883b37a546aaf
MD5 ae3ac6a448061a5b000b3cf35bd1e862
SHA1 f88a631cb1c73f6bc302f395711560b696f3a392
SHA512 2431c56179e62e176e0236dbc8f5a61f3445129b859611d07f38b1ee0b907d28ce5d77be8f4413c8bcbf470b755448435f1461479d72bbd05a92385f7e82ae02
SSDEEP 24576:57NM9YmZqmWMUkPjZM48Mv6bEhsjc+pFB5z+//ufNRoZW:57cBWMpPjN8DbEhb+pFzz+/2fNR
MD5 SHA1 SHA512 SSDEEP

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 423524d9a05d8fea63a7a373be9c926f31435b21bec763b61512d3634c985e4e
MD5 c41a575c9ede3b413099751afd765d9a
SHA1 f5470b8cc5a958510acddaa1950adf9125d33bbf
SHA512 54eecc01eb8842c486c4ab62d04dd072c6aa0684c869f3cc55e3a23ff1c7ec5f739fd430742a84e50f496f1ab838a64e4647f7374f0282990a157c30686a0252
SSDEEP 24576:0W6BApg2YuyuNDYTabvcRvNYf8km1Vc+pFB5z+//ufNRoZW:0F2YuHNETovcvNYf8kmA+pFzz+/2fNR
MD5 SHA1 SHA512 SSDEEP

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 0d8f62f1ff90fe6f4a4dff09ec9f38e63b6f9454c177bd5a47837d5a14400527
MD5 cd7d25d2fb3926d5fba1c1e2104e6ce4
SHA1 0a6526900d628b313e99e19b7a53794fcd821776
SHA512 8010b2442126def2a20738355f0c073f567c2f6a41152c29a9d18eaaba1a7ffc78abf8ed3d7b8b2bd33e2bedd181c302bbb02485c727699a8d91808fb7fee168
SSDEEP 24576:vAFs06+Omlf3NXEbToMc+pFB5z+//ufNRoZW:4Fs060lVXue+pFzz+/2fNR
MD5 SHA1 SHA512 SSDEEP

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 da73e93e6caba0106f4c2f343fb68fb98588e178c23f364338c0240be26f932c
MD5 295de86a7491abb0f6545cf7d75f527e
SHA1 662b2ef41c59afb71f470bfa0de97d2506909a88
SHA512 b7cfe6171e4083f5f4ba840844c33e40a81249c6fb86aa3aad5e89bae9cc81db987239df6a4aa58bf7ac87148be99a102884cb4636dd2fbc2d1e56b686e8b2d8
SSDEEP 12288:dCJnJ5D3Vkrlzx2Ylc+pFByStv9JRa//inz86NRo1qiRlUWC4kXzVC3:0JnJ5D3Wt5c+pFB5z+//ufNRoZW
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 ccf26748e5512728e9ef886a6b56b29b32dd4dbe9fec9659cdbf45eac8f28405
MD5 ed0a50bcfbd9ed74a93d34d3dfae466e
SHA1 14745bee7840330b53f88d55178bb103f333f203
SHA512 75a001679334f16d01a88755748ff1b6976a3b835bdf571d58bc0f725e55429cf2315dbf2171439ebc888eec8e723eb8477e1504853767d6f48d35e55158267b
SSDEEP 49152:ro06DIKdwc+eQnSt65aVk+pFzz+/2fNR:ky+pFtFR
MD5 SHA1 SHA512 SSDEEP

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 17936b41f6dcbcdcc33a571c1f600ddc85b712af85629f0df5f0d2e2bb067f9f
MD5 9c7e05c7e89c4a4397c7d43ade61d1e8
SHA1 0ad915adafefca6aa0db738ad355eeb2cc8a3482
SHA512 23d1f356a856acde502cf69a57156cec4c930af231a2e8a12e52abbc2ff9b7d93ddbff284bd05cb0ee21934aed726e6e57e02296ba538a153a8a9955467e4fdd
SSDEEP 12288:PEP3RrrYlc+pFByStv9JRa//inz86NRo1qiRlUWC4kXzVC3:Ur2c+pFB5z+//ufNRoZW
MD5 SHA1 SHA512 SSDEEP

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.3MB
SHA256 15a5b416f2356322f048166265e4efceb886a7ab6f5aba2bd7a7dec2080b2646
MD5 c02a64fd0fae6da7cceeb898e698478c
SHA1 fde5e26dc5c18b0bf8736fdbafb6003d595eb74f
SHA512 bb4cbd35d4bed970fc70d807d9a3b251c4bb1a130e9128a8e9e2eefee2061e0fb534ed5ebfb2f98758e5dce50742ad4c9cf726005fd5e10c32a6be02980a88fb
SSDEEP 12288:djkyTYlc+pFByStv9JRa//inz86NRo1qiRlUWC4kXzVC3:dIyec+pFB5z+//ufNRoZW
MD5 SHA1 SHA512 SSDEEP

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 a215247d56a085eef768d2288bc3c9235887e80b8a37583eff2bb9c1e5a30504
MD5 50edcc08d590f14773e6612fe643d516
SHA1 cdfac322ca21fb117f8117278506f0c441c82dde
SHA512 d1ed593623e05a94e913c5a51c97710f83cf16785dcc0d9da14c51325e8178dd8b2f94c04e56e1045f852bef4b1267439957b1865f646dc530076ec1080d1538
SSDEEP 12288:+FJYlc+pFByStv9JRa//inz86NRo1qiRlUWC4kXzVC3:sYc+pFB5z+//ufNRoZW
MD5 SHA1 SHA512 SSDEEP

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 2f7f6443b4f21f0de31b2e199028f0ff8b97b4bf1e8928c91fbd5dd201374282
MD5 6f664b4214e188fc7e5f4be0735c514f
SHA1 9234f31dc5b6b197f23ca1910e10aed949af360c
SHA512 5ac132b72e229434b187d649f924c76373fe500adf6d4a1a592b1964061eb4c3bcba2b16ee828c06188fd857737083ce9fe6aa1e7611e804945abbc491bcdbab
SSDEEP 24576:2Q9MxZKdcz97w3rc+pFB5z+//ufNRoZW:2VKXY+pFzz+/2fNR
MD5 SHA1 SHA512 SSDEEP

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 f6ed5e5b864527d6e13f5e0ac7f4f0026c76d7ae622b150addbc10fa035d2cf3
MD5 797b3514581d9173b6c2826ae4bed9ed
SHA1 7f0d4a06bfa91016f42307784a77faf239f47b02
SHA512 d24cf9fd7466f4fbd6b1dcdc130593b2634e3fe7b519cf875482fc229d668e2592010c6acb8293fe817cddfc4e9180ce1b9221a8355706d9e2a4ea6224afd7a5
SSDEEP 12288:FyoKo2HRple9pHYlc+pFByStv9JRa//inz86NRo1qiRlUWC4kXzVC3:FyocxApSc+pFB5z+//ufNRoZW
MD5 SHA1 SHA512 SSDEEP

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 c1c94dc64d0c1293466cac7f9df1095bb5e7338dae12e9679ffd17418e9293f2
MD5 ffd6f398ba8d4e866c6efe28bcab361f
SHA1 d2174816a93a7a7d320b76847c8a34613d507e74
SHA512 f71ea6222612b9dcc156b77558517644767408fb897d6f27be7645291021edccf0c543a5a578ad4accf330da0597e1c28bcc3770fc47675b4ef9848658b25b55
SSDEEP 49152:ZWcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIKn+pFzz+/2fNR:B0zuNIz+pFtFR
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1180-614-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/1180-441-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/1452-311-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/1452-438-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/1452-604-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/1732-419-0x0000000140000000-0x00000001401D4000-memory.dmp

Download

memory/1732-308-0x0000000140000000-0x00000001401D4000-memory.dmp

Download

memory/1872-334-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/1872-601-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/2056-383-0x0000000140000000-0x00000001401F8000-memory.dmp

Download

memory/2056-268-0x0000000140000000-0x00000001401F8000-memory.dmp

Download

memory/2256-420-0x0000000140000000-0x0000000140205000-memory.dmp

Download

memory/2256-612-0x0000000140000000-0x0000000140205000-memory.dmp

Download

memory/2424-611-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/2424-408-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/2464-610-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/2464-396-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/2472-237-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/2472-41-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/2472-49-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/2472-47-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/3044-257-0x0000000000EA0000-0x0000000000F00000-memory.dmp

Download

memory/3044-271-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/3044-256-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/3120-605-0x0000000140000000-0x0000000140241000-memory.dmp

Download

memory/3120-354-0x0000000140000000-0x0000000140241000-memory.dmp

Download

memory/3168-61-0x0000000001A70000-0x0000000001AD0000-memory.dmp

Download

memory/3168-75-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/3168-60-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/3168-64-0x0000000001A70000-0x0000000001AD0000-memory.dmp

Download

memory/3168-52-0x0000000001A70000-0x0000000001AD0000-memory.dmp

Download

memory/3544-0-0x0000000140000000-0x000000014024D000-memory.dmp

Download

memory/3544-12-0x00000000020B0000-0x0000000002110000-memory.dmp

Download

memory/3544-1-0x00000000020B0000-0x0000000002110000-memory.dmp

Download

memory/3544-14-0x0000000140000000-0x000000014024D000-memory.dmp

Download

memory/3544-9-0x00000000020B0000-0x0000000002110000-memory.dmp

Download

memory/3668-381-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/3668-369-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/3912-384-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/3912-609-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4084-235-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/4084-16-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/4084-24-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/4084-25-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/4420-297-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/4420-407-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/4480-534-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/4480-331-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/4528-395-0x0000000140000000-0x00000001401EA000-memory.dmp

Download

memory/4528-294-0x0000000140000000-0x00000001401EA000-memory.dmp

Download

memory/4644-253-0x0000000140000000-0x00000001401E8000-memory.dmp

Download

memory/4644-357-0x0000000140000000-0x00000001401E8000-memory.dmp

Download

memory/4644-245-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/4644-251-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/4688-35-0x0000000140000000-0x000000014024B000-memory.dmp

Download

memory/4688-29-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/4688-36-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/4688-37-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/4688-236-0x0000000140000000-0x000000014024B000-memory.dmp

Download

memory/4856-76-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/4856-73-0x00000000004F0000-0x0000000000550000-memory.dmp

Download

memory/4856-67-0x00000000004F0000-0x0000000000550000-memory.dmp

Download

memory/4856-240-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/5056-606-0x0000000140000000-0x0000000140221000-memory.dmp

Download

memory/5056-358-0x0000000140000000-0x0000000140221000-memory.dmp

Download