d62a4ec03fc2dda1c106b3eb964388efd0eb2668773a701a12bf84359826e6d6

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
12/06/2024, 16:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-06-12_f8b67db99ffe833bbd30813d2766db3d_ryuk.exe
Size 2.0MB
Sample240612-tlb3ssvdrm
SHA256 d62a4ec03fc2dda1c106b3eb964388efd0eb2668773a701a12bf84359826e6d6
MD5 f8b67db99ffe833bbd30813d2766db3d
SHA1 8a5e9e72b0abbfab5bfcd3c66793c45ee63765d0
SHA512 55a7d82e28f1a79cc682c5afd32031c17cf37243fac548ca0da0620e02ecf24d0ecba4d09aafeb2ca7e1743c4808f6651d0c36da1549d9a8f9d546d832436e7c
SSDEEP 24576:+6V6mC/AyqGizWCaFbymEpwsQNgcdAFeK+yI47Ga:+6cQGizWCaFbFEysEVAFeVyd
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
4672	alg.exe
1436	elevation_service.exe
4616	elevation_service.exe
2336	maintenanceservice.exe
1600	OSE.EXE
1188	DiagnosticsHub.StandardCollector.Service.exe
2568	fxssvc.exe
4008	msdtc.exe
4756	PerceptionSimulationService.exe
2104	perfhost.exe
3328	locator.exe
4864	SensorDataService.exe
2928	snmptrap.exe
1236	spectrum.exe
4464	ssh-agent.exe
4064	TieringEngineService.exe
3688	AgentService.exe
1860	vds.exe
3440	vssvc.exe
812	wbengine.exe
3028	WmiApSrv.exe
3516	SearchIndexer.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in System32 directory 24 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\50335cec3a5208d.bin	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2024-06-12_f8b67db99ffe833bbd30813d2766db3d_ryuk.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateSetup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateBroker.exe	alg.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\minidump-analyzer.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	alg.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f3412df1e2bcda01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f6dc68f1e2bcda01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9923 = "Windows Media playlist"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000058430ef1e2bcda01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000016e10bf1e2bcda01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b68b98f1e2bcda01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000317d28f1e2bcda01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b7509df1e2bcda01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d1d503f2e2bcda01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000082affcf1e2bcda01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
1436	elevation_service.exe
1436	elevation_service.exe
1436	elevation_service.exe
1436	elevation_service.exe
1436	elevation_service.exe
1436	elevation_service.exe
1436	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
644	Process not Found
644	Process not Found

Suspicious use of AdjustPrivilegeToken 42 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4024	2024-06-12_f8b67db99ffe833bbd30813d2766db3d_ryuk.exe
Token: SeDebugPrivilege	4672	alg.exe
Token: SeDebugPrivilege	4672	alg.exe
Token: SeDebugPrivilege	4672	alg.exe
Token: SeTakeOwnershipPrivilege	1436	elevation_service.exe
Token: SeAuditPrivilege	2568	fxssvc.exe
Token: SeRestorePrivilege	4064	TieringEngineService.exe
Token: SeManageVolumePrivilege	4064	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	3688	AgentService.exe
Token: SeBackupPrivilege	3440	vssvc.exe
Token: SeRestorePrivilege	3440	vssvc.exe
Token: SeAuditPrivilege	3440	vssvc.exe
Token: SeBackupPrivilege	812	wbengine.exe
Token: SeRestorePrivilege	812	wbengine.exe
Token: SeSecurityPrivilege	812	wbengine.exe
Token: 33	3516	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3516	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3516	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3516	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3516	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3516	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3516	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3516	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3516	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3516	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3516	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3516	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3516	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3516	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3516	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3516	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3516	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3516	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3516	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3516	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3516	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3516	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3516	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3516	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3516	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3516	SearchIndexer.exe
Token: SeDebugPrivilege	1436	elevation_service.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3516 wrote to memory of 2296	3516	SearchIndexer.exe	127
PID 3516 wrote to memory of 2296	3516	SearchIndexer.exe	127
PID 3516 wrote to memory of 2068	3516	SearchIndexer.exe	128
PID 3516 wrote to memory of 2068	3516	SearchIndexer.exe	128

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2024-06-12_f8b67db99ffe833bbd30813d2766db3d_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-12_f8b67db99ffe833bbd30813d2766db3d_ryuk.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:4024

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:4672

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1436

C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4616

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2336

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1600

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3980,i,13281073920029625837,8253721632651544158,262144 --variations-seed-version --mojo-platform-channel-handle=4488 /prefetch:8
1⤵
PID:2136

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:1188

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:4676

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2568

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4008

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4756

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:2104

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:3328

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4864

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:2928

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1236

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4464

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:1552

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4064

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3688

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:1860

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3440

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:812

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:3028

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3516
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2296
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
  2⤵
  - Modifies data under HKEY_USERS
  PID:2068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\elevation_service.exe
Size 2.3MB
SHA256 cd5436d71e4e19ef6eba0b3aa5220c038ede93c26f8b1d06446ceea0d281fca5
MD5 b7d74311345ab261ef6bf2a6b4060b4f
SHA1 96343f46c4c1b63e45fc100e0250bc027d9fe119
SHA512 8592faa4c11ca7a9c898aeeac267d8bcdd0d3f08325af5d059720e58882219da7d440ca2f58f5e6c61b1c1c5793b330c9d69487357ca74ece4d307df56b5e91e
SSDEEP 49152:q5Y3YNoN9iWHMokhQ7c49W/ZEysEVAFeVyd:8Y3goN93CaNM0d
MD5 SHA1 SHA512 SSDEEP

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 19b7f391cf6e35eb8a61e269004ae2753d40845632066946da265276c5167230
MD5 a2f5dd4c617b28e95ff9e5a484946e7c
SHA1 0bc695ad9ab25e34126a56173903eed8fd93f8c9
SHA512 0b96ab23eb0c803d82eca42ab93d735581c99f068767cce9be0c5895f004773cfbf3d009d6b36208657b94722bba6105266bc0f4f76112d5e688d7958fafb3b0
SSDEEP 12288:rcQixmNJLBsunEO0EpwfVqIjngMN0s8Jco9QzQ/b+Ka7zPKv2yI1677qasLkVI:TiQnBsuE9EpwsQNgcdAFeK+yI47Ga
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 d1904997351ea9d17b932607e9d2b976fd429fbeb6d22cb14b6d341283153f62
MD5 69e8f6af765408e8c85e1e8608c1ab5e
SHA1 7870601431b0579179d36462851298b14dda180a
SHA512 aa69ff75962d2cb02273f1fa6f914b55ff03b8f8dc5e15ea7c8f86b3319e9deb3af961776469c6020b5a84a2c2cfd12dcc8c1e26f749ff8268a86445284f2ff5
SSDEEP 24576:z+gkEEfh4CoZEpwsQNgcdAFeK+yI47Ga:KgkEcS3EysEVAFeVyd
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 afe8a70e418af918be2433d9b10b3790abc942390645c401d296f9c981f995c4
MD5 31000a851d43c5b1de97b4a2733c8dea
SHA1 40db9eb1b9d0b1a5796eeaa7d550c4ad34d0d98b
SHA512 8931659544e6764416e646408cde4dd38c17948a48c9229f39736c8353acaee73d669f3952f203e952fabf18fbe94abaddb623fe906806dc44014a290469e230
SSDEEP 24576:JBpDRmi78gkPXlyo0GxjrOEpwsQNgcdAFeK+yI47Ga:rNRmi78gkPX4o0GxjSEysEVAFeVyd
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 2cdb728776e8ba55f7feda86e2517188c9f44fe0b7d23adcd90e4f19883ecdb2
MD5 6260c66aa9472dc5027776211768411f
SHA1 f742cb4f154610a56e08cbe016a7e2904eb1f6f2
SHA512 da1344dae399263577c0717d70ba9a518b814f9be758d5b99acc25094d1096fa549d298c429dd323f2a8cbe5c43715b4d0807f4ccc632aba52fe84aa6e5d1ee0
SSDEEP 24576:pLOS2oyPIXVZEpwsQNgcdAFeK+yI47Ga:z/yaEysEVAFeVyd
MD5 SHA1 SHA512 SSDEEP

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.5MB
SHA256 07429bbb84d1209d56c43bbc24ae875626f0789253be483aa58b0231715ddfcd
MD5 3f507a407ddb022228f6fb638cc6237d
SHA1 a757c22f2964c594d3442a364d1ff2c1f3e4e815
SHA512 d8a0f79eeb496683f399b1cbf3034dd8470c61068777adf05cb165eff55f984c7d949ac32b0922c9585d46716a01681426a930ff93969fcd992951fa1694c1b3
SSDEEP 12288:gic0EpwfVqIjngMN0s8Jco9QzQ/b+Ka7zPKv2yI1677qasLkVI:giXEpwsQNgcdAFeK+yI47Ga
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.8MB
SHA256 033e1b7e6f1aeb3f1ccdc23eee4c8f0e42035a645f34a79790cd0fa583043988
MD5 fcec4592776e4fbb8a5e4974b7033a03
SHA1 85a88acba8eff30c330951b02f5b3179cddb807c
SHA512 b982e9edad807724a9cd4a7fb3f8a9ae90da9166189bd2560b650b1052f67c0842d364bae8ff438a2d3c2788adb384c882dd4d7e8d849074d05ba8561fef1eb5
SSDEEP 12288:8eBNUbTVO86Uv0EpwfVqIjngMN0s8Jco9QzQ/b+Ka7zPKv2yI1677qasLkVI:8JIUsEpwsQNgcdAFeK+yI47Ga
MD5 SHA1 SHA512 SSDEEP

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 d3a0962aa39cf625871a8367027d3083c5cf8bb3e07b358d419e9199c67a2b50
MD5 5a173840fe5380b5010a2b412b50da92
SHA1 a95e70f0d358d0edee7463bed10952b6f6d34e11
SHA512 fc45562a92041d611bdc5e71a62091805fa5603c4b6c8938174db347c72075d4525524557c919b72642e397dbb1ad23e2a5f906e0c787470e145ddc7c9f63319
SSDEEP 49152:SQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THT:SQvGAdlCEL8c/yRNw5CeNM0d
MD5 SHA1 SHA512 SSDEEP

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 907869bff727c0dd95839ecec244ab7a879496a14da513438e9d03f40b813c3c
MD5 5f2c4085580bdfff7073edba8ae1bb36
SHA1 e1d86fcb96f9415528d0d3f5d90a6014bcef65fc
SHA512 7ecb470209cb47ab672995710cee155ade43d4d799c16a8a5437dff4c9739a5b560d6fa58f194b2ebf762febacb90902bddeba1adfc025452ba715cf46c9278d
SSDEEP 12288:zAwSfxL/2Dc3xDLLmt0LDQewsAj10EpwfVqIjngMN0s8Jco9QzQ/b+Ka7zPKv2yE:s0ewsAjWEpwsQNgcdAFeK+yI47Ga
MD5 SHA1 SHA512 SSDEEP

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 fef5716c86538a261c9ca63dcf42390ab6be68473c8fccdda87763b6b5bec7d7
MD5 4378a5f8ec0241f1629b85d87349e6a6
SHA1 3e7108a873eb5e789d42dfbfd96067baf2e5e237
SHA512 c59a17ad79c9d5626445a2d165b30f90c35a9ab0073f482d663a6f688432e70c7e4a7fb883df79fca840d90362df674d389f62701e1f19ff7f8fafcb63ef5a4c
SSDEEP 196608:uUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHJNM:uUEtQevvqc2W1cpV2EI32PM
MD5 SHA1 SHA512 SSDEEP

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 0dd3fd7ee4a3e4c08b3aaa01d0fb2cd54c9e1331616da8310806b44459d976a3
MD5 f1c1d9d5acc07b28a8afd3618b7453a5
SHA1 5dcc6531780305354339d0807fb666f075b25fed
SHA512 7c3b4223da131fb462930893be2e8863025cf87893132828fef394391cac130fd8b2d92f2ebede6b472b5b95260c5eedf5ddda53922b0951e9505d5fc6665840
SSDEEP 49152:ECbRquA/m2yL5zifFiV+XenmE3/z2EysEVAFeVyd:NoqHVjnmqNM0d
MD5 SHA1 SHA512 SSDEEP

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 4078bbeb983973db6c6e85ccce1be74e905e871cfd27dada54af49f10a2fd7b1
MD5 6464f2acddc02d02fcce8b28f05a5b08
SHA1 e75e3d6d28b241e084689419b31bdf13e18cba89
SHA512 c146e0e7840367b0cb6a9567a2ae40bc435c5e2f930fc6fac5f9742628e01e58ebf19242e2aa03e4a1957097fd6e4cb3ea2e9be63132bbd4b8f85656920b1cc0
SSDEEP 24576:jAhGLJIFoiwtA5l7S53JEpwsQNgcdAFeK+yI47Ga:jAMyFoiq55EysEVAFeVyd
MD5 SHA1 SHA512 SSDEEP

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 cb7afa5c67faf8a60d81450ec9f72af0584d93d450a116f1029142df9a908519
MD5 cdc381cd996d0eee8bf41311046714f8
SHA1 da0e4131ecc45afdea9e541b84ff13ca071a77a0
SHA512 e5861400f67b1c075dc4bcaa234750907dfe8ffcff9d6f72095c6dbb9869e472214437fff7eb3e89d3fb7d7291c53df641c1e5a245839558da6360361a82b954
SSDEEP 12288:ymw5HEjsChNCBFgl0WDm+C20EpwfVqIjngMN0s8Jco9QzQ/b+Ka7zPKv2yI1677i:rwubOWaEpwsQNgcdAFeK+yI47Ga
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.6MB
SHA256 c1669d96401eff6852af9c0e56b3b4d3db31ba4adcc9ff312b24f1c9d16dfb83
MD5 fef470b2db10c426b68acd5702083c84
SHA1 d6d3316f22685136a11b4ec04f5ebacb9473b172
SHA512 57e193fcf31059add37af3734b1aa2b652e28bd6c213b78d35429dc1f25e943d9d7a42f29d58d4548ee64122090dc0bb29d7c414208124057531c4f508c4d4e1
SSDEEP 12288:7SZ1IyF0EpwfVqIjngMN0s8Jco9QzQ/b+Ka7zPKv2yI1677qasLkVI:GZuzEpwsQNgcdAFeK+yI47Ga
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
Size 5.4MB
SHA256 de96fc750b484300da3c4b110ed701339672f9c9d42a937e7f0b2221a8d9b81a
MD5 79ee6d4405471f35cd867b0853148237
SHA1 b7ced2eb1d49b7be83e8550f63e0f233a3d8051b
SHA512 832c0606c1943e4a665d8140f2a5439e93def4df6cdf58166a0c06d1ca8434d4af80bd41b161dd17bb064b9a044bc6a23305b6cbb41237c3babd15ea4a74b94f
SSDEEP 49152:Z0kwIi7c4xZlm5knEtw99Kn/2vim7vgv6m+yyJ/0gbvjR7yY7BHi3u7L/gBUUWLj:pwfhY7g/rLd7yYA3awr341gyNM0d
MD5 SHA1 SHA512 SSDEEP

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe
Size 5.4MB
SHA256 962839ffa351d052c73f10733aadca3e1938c04c831650331dcf5158f845dbd9
MD5 46e5b0eff8499797dda4e58224ba49c6
SHA1 b7bfb2075c4affb4cf02953ef394cb0e11a5b942
SHA512 df794e552f93907a571a31ffeb60ed58174a119d3326ee303427eb266a7430fc61a695fb2dac7a8fde68390100f0a4fbc4d62db68fe227a53b6765248bf5fb63
SSDEEP 49152:z0kwIi7c4xZlm5knEtw99Kn/2vim7vgv6m+yyJ/0gbvjR7yY7BHi3u7L/gBUUWLj:fwfhY7g/rLd7yYA3awr341gyNM0d
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe
Size 2.0MB
SHA256 4bcce1d5ef87c248ef3588f37371b38887b1ff53161d6dc905cbb559ec4fb500
MD5 6f687974195a1e5fdd1b68dd2e92346c
SHA1 98d1761f86f632c009d41104b5466f868774963b
SHA512 82a0dfafaba0e28c2127df27148b754c7eb9b56791075f749260d4ea97232253edc1feafac21b1591eab1269be59d72123b9ea8c8cc9b09ad84a790ca391f2c8
SSDEEP 24576:rcTyYv0FteQU+5I2kjgD6iQacAaEpwsQNgcdAFeK+yI47Ga:ruXv0Ftpn5606zOaEysEVAFeVyd
MD5 SHA1 SHA512 SSDEEP

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
Size 2.2MB
SHA256 55e213edfe8cd99aaf5fef760a2603b9167a03d27dca103540c0792a8d593ee6
MD5 df011efaf5194f516ef15999c590ecdb
SHA1 c0c01069fd7b4fffef98280b343dfa32dd559d71
SHA512 d0e7f1e8f1ec51c5833bf8a2deb21f06f5f197f9ce1ed34a61c566081f6219a25901c98dee0072ddc5ef75aa5279c37483bf035b52356fc4d0317a38d9b46df4
SSDEEP 49152:Iy7mTd0GxN8jyynxHjXKUyn4GVcbDSKrNTxWEysEVAFeVyd:3mYeyxHjWjMTxNM0d
MD5 SHA1 SHA512 SSDEEP

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe
Size 1.8MB
SHA256 11e006e9dec6730ed474adab5891e3c38bb0d8ffa75becfa5a7d20f2cb16264f
MD5 b9803cdfe8645f65d90de9f1811b1c66
SHA1 f346ec9437b981482f2fa42b042eca428aca0290
SHA512 adcb147dd72cef4e2fd00b8b299e21d0073a56626545bb43f85e5cea5b567fec2b2406f5b29a25eb42262cf7ce4025532f736f8158dcf344b3fd90470a9563e2
SSDEEP 24576:a6drZn1WEci182IEUeNbJeRgUebgW8167EpwsQNgcdAFeK+yI47Ga:aWnDci18yNNUgbYyEysEVAFeVyd
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 1.7MB
SHA256 fa1591f41628457b4883b74f3b9c429657bc0ddfc4d8f5ac7930effa772eb3c6
MD5 6beef7a2d8302b702fe8f0db981d9f3e
SHA1 17da3876dce3211d91a7a0538765e77bd090cd75
SHA512 6818252f6765e106eec5eb96b4d61db94533b97ddc80d32a9a0136a01f9320ec42da41becc00cd29702574dfd5bddcc376e06573ea225343f579053f209db339
SSDEEP 24576:Dk5lHW5EzMZupO80G2reD+melRgTTv/1nyYEpwsQNgcdAFeK+yI47Ga:zizMZm0GhamSozEysEVAFeVyd
MD5 SHA1 SHA512 SSDEEP

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.5MB
SHA256 d44b352616af5ef6cadced3bf575af47cefe2b81c797ca7c9390e8c40d0435cc
MD5 0d978fbfced7e8df63b72e80b8ce2025
SHA1 42892ff4f126b4f43e45dbc296caef099147bb6d
SHA512 d4741324378e640f6ed033aca5f3a7ba27df1865042e987728a1417ca0b09c31b5cb09d31af719d578f4efad45eca58f12f93411975c93b869e63f9f1875bd7c
SSDEEP 12288:Bk0EpwfVqIjngMN0s8Jco9QzQ/b+Ka7zPKv2yI1677qasLkVI:BvEpwsQNgcdAFeK+yI47Ga
MD5 SHA1 SHA512 SSDEEP

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.5MB
SHA256 eb675a0a6961bd8a32311936c6ef5662f4b4ab1cb6bf831d7de2d783f5073167
MD5 ecc3babad6afd1e1edd585ded495088c
SHA1 db448d25e3b15e5a7442dca6b4bfb81c851238ec
SHA512 1d810178e6fe1a1e3bcf8cadc277758f31cd8838e025b392ae27d8bb452b71a00cedf8fa327fc5b0e039df34b2c682a20f9f9462ab7f4c871d68444a51f9db66
SSDEEP 12288:XJ0EpwfVqIjngMN0s8Jco9QzQ/b+Ka7zPKv2yI1677qasLkVI:XCEpwsQNgcdAFeK+yI47Ga
MD5 SHA1 SHA512 SSDEEP

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.5MB
SHA256 be036ae0acbc6170d7240f19503302a71d356fec7dcf9599716d50dbc82aec51
MD5 75ca9c5024702aa2daa67ab22e9d4063
SHA1 982685e3b90c801a3b35f9e4cc30f2804fa2e76d
SHA512 55d9b1f63b4f0b3a1604afcc5f2fa653a7646558d8d43b4a00d7e58dfb391ae267d9e9e93f969afbf33323e32d5848dd005b296abf4337f9836815ffb0893c2a
SSDEEP 12288:y30EpwfVqIjngMN0s8Jco9QzQ/b+Ka7zPKv2yI1677qasLkVI:yEEpwsQNgcdAFeK+yI47Ga
MD5 SHA1 SHA512 SSDEEP

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 e87d245580688819ffda0f4246a3a64b0c6f62533d46da18e956affde1caff56
MD5 ed4e1df09ec0c5e1b23f93b279485874
SHA1 5dd16f3e76557642460fd4635e01dd4adb268d66
SHA512 681df90d7dd924c387bbbff532e7d0569af87fd7372895dd025edc4b217181bc50b60a567e348dd7be8472a6f767a48cc088ca1ff77a5542076fe59300ae8ff6
SSDEEP 12288:uVy0EpwfVqIjngMN0s8Jco9QzQ/b+Ka7zPKv2yI1677qasLkVI:WEpwsQNgcdAFeK+yI47Ga
MD5 SHA1 SHA512 SSDEEP

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.5MB
SHA256 1e7e4356348b23c77e5155175fd6109bea54aa7d62c60f417574404dfbda0915
MD5 481e5eaa4912810e68978afc1cbc5c8a
SHA1 9a37544ed627dbb23d50ddcdc44955e5bbef2c23
SHA512 601ed0f88671d58f8f5dce8dfb4bd512f5218b035872c026b53bd6737f1b28fcb8e9d9c87a07cd6d993e41ac182553fae18844a27750d533cd3d6302c1ee85d9
SSDEEP 12288:8K0EpwfVqIjngMN0s8Jco9QzQ/b+Ka7zPKv2yI1677qasLkVI:8REpwsQNgcdAFeK+yI47Ga
MD5 SHA1 SHA512 SSDEEP

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.5MB
SHA256 68940a01795250f5e8901445b1771a0a5d3668acef4edd1b1c0ca47c60c8afe0
MD5 229a01cf7540e99313cb070f003b443e
SHA1 19b2f973454817851165363b4a7a28f29d01dac8
SHA512 1eb6a6fc28dba4847a9dc9f8e99da96928afee76650e76f98f8c3e2954e0dea6570acce5940b52e84dde3d89d765a58e001041af44d27e61e219848fdb5e0c1d
SSDEEP 12288:S90EpwfVqIjngMN0s8Jco9QzQ/b+Ka7zPKv2yI1677qasLkVI:SOEpwsQNgcdAFeK+yI47Ga
MD5 SHA1 SHA512 SSDEEP

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.5MB
SHA256 2040ea500e4f95cf3ee09725f03b3748f306851fd456a4afb1d30a5d8b7c6903
MD5 bae94e095aa4add2162916d5096954f9
SHA1 b4a275636357b32e8f1ccbdafe6e90dcd346d271
SHA512 515ca49af138b93943b39a4f58d173670edaed48e8aaaa109c363ab7627ab538983edae441cf89fa12c05a44299a1543bfc9fbcf3d0e22d56eaad8457f6f5541
SSDEEP 12288:vB0EpwfVqIjngMN0s8Jco9QzQ/b+Ka7zPKv2yI1677qasLkVI:vKEpwsQNgcdAFeK+yI47Ga
MD5 SHA1 SHA512 SSDEEP

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.8MB
SHA256 d4438ebfcbeefbd63e2c5d901167bf72931702e923184f1e6e22b64b7aaf428a
MD5 b8c3a0a2a4d5c0aef85779c1782bdfc7
SHA1 fe4eeaff91a1cf183a26bba39466fe470191af3b
SHA512 c49acdf4b350b278ae59b0b522eecb04930be031d084bff3552295ddf91798effde1f64bb0745207f2372be766315381ed214f0124b166cf59c3699d67daf9d1
SSDEEP 12288:9iZwb3zzFEoS2cPvyp0EpwfVqIjngMN0s8Jco9QzQ/b+Ka7zPKv2yI1677qasLk2:AZMDzFVSOiEpwsQNgcdAFeK+yI47Ga
MD5 SHA1 SHA512 SSDEEP

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.5MB
SHA256 883ce64d8947760a71eacf05c58fe05628d86d7b5b29c98202e2bf7906b7408c
MD5 99f340fd547eab98da40cfc681dc8fc0
SHA1 5146a0280461bd283aa2aff70d8405eaa83a2612
SHA512 4bde02852a9ad9cb42fa513db0994eb7bfaea5ba9d51242c0009dcde4cf17ba800b8a9ec33c0a37401acf4267f5da14e9936c75f4b509646c2c20dab95d36e28
SSDEEP 12288:nA0EpwfVqIjngMN0s8Jco9QzQ/b+Ka7zPKv2yI1677qasLkVI:nDEpwsQNgcdAFeK+yI47Ga
MD5 SHA1 SHA512 SSDEEP

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.5MB
SHA256 15400e36a169cc0fb9b7130db3a12788724c3b6b566df0b20e67211affb09227
MD5 54a22e4c45724091702fe05eca250e72
SHA1 aa3f85dd2283a4e1b5252ce0b6fc20fcc34c1b4d
SHA512 1ebe4c5c71c537281f6c8b8da04a8e0a9a0978f466661e700a99629d58b3d5237fbe6f2e172e5bd332829831ae441062474c410cb5f989527c5139ae876434e9
SSDEEP 12288:Ms0EpwfVqIjngMN0s8Jco9QzQ/b+Ka7zPKv2yI1677qasLkVI:MnEpwsQNgcdAFeK+yI47Ga
MD5 SHA1 SHA512 SSDEEP

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 0a4ed8656f7308f96cb1674b632b45d85648ef9ba159bddf530f2e489cc64e90
MD5 856a5f2ea0c1a82fd6cbabc5d7e587ad
SHA1 8e02101f093555012464f9c1e2533d676da64315
SHA512 eeec591f4c55d25d0e913122c919f2ee2b649a30b3241268c1d7360462a309031af5522725a6f8887af95009b6a440aacc8aa353e0c92b8032eab61bd70cad87
SSDEEP 12288:IyPz5L8F0EpwfVqIjngMN0s8Jco9QzQ/b+Ka7zPKv2yI1677qasLkVI:JzymEpwsQNgcdAFeK+yI47Ga
MD5 SHA1 SHA512 SSDEEP

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.5MB
SHA256 a5248c524294b487f58297f187e1fac8ad6d85cb361bd6b61185be4b54637e1d
MD5 380080d8ab18d6a3a51a9985c2d9e517
SHA1 8a73eabce77ab1cbb32f95e7b502fc7eccab2b19
SHA512 7906a9b07f7c1e6e7f1c2dcf81071afdc15d54cfd7236218c92ee771b39ac8d14a7ee1876a07cc8ca4a0b95714af7465aacd5a29fe7e570a39045f7d9fc053e5
SSDEEP 12288:qA0EpwfVqIjngMN0s8Jco9QzQ/b+Ka7zPKv2yI1677qasLkVI:qDEpwsQNgcdAFeK+yI47Ga
MD5 SHA1 SHA512 SSDEEP

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.5MB
SHA256 be19f1470de07f5535931645f4a1fbd1910f7cedfcc8c8d850922abaf8f58393
MD5 990c7301d9a6112088eb78693a764c05
SHA1 e92acbf298b50cc40baf08d23699aa3d882363a3
SHA512 3a997babd64d1de0fa0c4199677d2d6abfa30eb508b165d9e9acadb2270ad051ff16d6b0a4b627bf13d8bcb122b5a7f50084fc56f96370c84166aef4a2075ee7
SSDEEP 12288:LA0EpwfVqIjngMN0s8Jco9QzQ/b+Ka7zPKv2yI1677qasLkVI:LDEpwsQNgcdAFeK+yI47Ga
MD5 SHA1 SHA512 SSDEEP

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 ec121d3c74612cc9b477023f5586893fe917cf402185bde1e980436a4057f46f
MD5 ffeaa4a847d4bcfe9988614cdf25f911
SHA1 4ce56d0bca4115598ebc9b3980ec09c3ca27851e
SHA512 5c0e0da569e2d8b7d82741b99e160189c83693a344c6489c34039736a4981fb9d6ff4b844d699dfb4f1784232cc67e81ceff81a54679523b514f0ffa7800cd17
SSDEEP 12288:lyPz5L8F0EpwfVqIjngMN0s8Jco9QzQ/b+Ka7zPKv2yI1677qasLkVI:szymEpwsQNgcdAFeK+yI47Ga
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.8MB
SHA256 e7b5a462c86ed4ce4b5339a9b310ceece7db3f86b5530e8ff35572f54ded31d2
MD5 bc252de0d7cbc4c7a131f9f26ba3148f
SHA1 a78a512dca0925adaa3827cc84c85795939a0038
SHA512 ebfcf8898728e469a13556c3dad607f8f4822bcea17acef70054415642e1ca7960c21d4a58d3cf0b79caac1a96dcc352262bd6aca5aeb0caa6705e400cadd30c
SSDEEP 24576:AT4aLl3z0zD0EpwsQNgcdAFeK+yI47Ga:ATPLljVEysEVAFeVyd
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.9MB
SHA256 83f08c8e6e6a67cae0041a396c252b79cfac4af3477201de5d0d1b1dfde80755
MD5 74ae0e3035beec4b2605329a6b9c2bed
SHA1 f9df602d1d740f36520dee15b7d6f8cc307b746c
SHA512 cd31fba4c5d43e635af893031cc07cef22a5863b3a1f7b4c96cf771f1402579569507c4f693e06034c07f2b9f7e1ec4639dedf4929b83829211cba495d9c1adf
SSDEEP 24576:s3cd9CHKy7GZgEpwsQNgcdAFeK+yI47Ga:Wcd9CHKyaeEysEVAFeVyd
MD5 SHA1 SHA512 SSDEEP

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.5MB
SHA256 208918c6dc58b6dc2780a8aa0150bdfa8c7a2e7390b8fb663ead1a0a9ffdb46f
MD5 536cf088c66cd3ec9a56b36858c48245
SHA1 7106f9d9ec7657722d7858c2b026af5dfa41acfb
SHA512 e941d938427a7ff0835051e4769ccdaaa0b3cd4308a859f48effbf130a3144fea14a9a1315ea4df75a18fa5eb824f987fc7adb3f48953d124990c4a6963ec47b
SSDEEP 12288:sX0EpwfVqIjngMN0s8Jco9QzQ/b+Ka7zPKv2yI1677qasLkVI:skEpwsQNgcdAFeK+yI47Ga
MD5 SHA1 SHA512 SSDEEP

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.5MB
SHA256 060d9227c97d950e7ca63003ba97480510ed0b206e4ad2ffeb39eca2a9d1ba87
MD5 6e95341a982528859dca5652c71715c5
SHA1 2cfbf279135e7917ed52ab492a1bdb429a42b14d
SHA512 dea386874f02709d897f127932fe822a91981e216d50edff59263db89875792d6f128e2d9d1c73f69d842eca16e08599263774927e332d0ac983506c40247d2e
SSDEEP 12288:fl0EpwfVqIjngMN0s8Jco9QzQ/b+Ka7zPKv2yI1677qasLkVI:fGEpwsQNgcdAFeK+yI47Ga
MD5 SHA1 SHA512 SSDEEP

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.5MB
SHA256 9f6b2e2587b498c2be2bbd0f80743c53cee1c05756aa1ba829b3bb678f7dd1d8
MD5 682292819b93ec00c9ab547666b72fda
SHA1 fed8553d1a10128ed82a7f127d3d58c43a8a81b3
SHA512 1d53a640e647985a83420f35e4764bb044b04cff1d7cd950bd8fba7b54e83bc4f760c96882167a3241102673174ed842129f172a004cd12e9d88ac03138d12e5
SSDEEP 12288:ZO0EpwfVqIjngMN0s8Jco9QzQ/b+Ka7zPKv2yI1677qasLkVI:Z9EpwsQNgcdAFeK+yI47Ga
MD5 SHA1 SHA512 SSDEEP

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.5MB
SHA256 e5ed409bb2fd3b046ffd198e79dcebf0aa85187778c14d7097fee6db4f207b77
MD5 5236149d6dcb97a39061e520c7df45f3
SHA1 2c84431b1e72a950cd69c3204feae9fb5ded10ab
SHA512 ad4a391a816f9e0afc792d0dd86095ff05a4c99eef70412a7ec188922ddda40d14bd423f275554b06a0165536d26e0680fb98326eb7c7076c6abfa431b89ffa0
SSDEEP 12288:8A0EpwfVqIjngMN0s8Jco9QzQ/b+Ka7zPKv2yI1677qasLkVI:8DEpwsQNgcdAFeK+yI47Ga
MD5 SHA1 SHA512 SSDEEP

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.5MB
SHA256 3151ca2fb39f8e21b830c34aaeb45f8431d901bd96111bcbe1fcc47170a8a099
MD5 fbb9adbdb2019a4597994486a88cd5d2
SHA1 5d42a61555c4a91e07bf18c3727e04e4b485de00
SHA512 2e33b64f7675d9a3b030c1893b05fd9c5fbb9e43847a0b308f31cf08105f828ba2d8f69ef5a3f3dcc24fe1f3ade4e72086edc29027961dac3df46788ba502496
SSDEEP 12288:oX0EpwfVqIjngMN0s8Jco9QzQ/b+Ka7zPKv2yI1677qasLkVI:okEpwsQNgcdAFeK+yI47Ga
MD5 SHA1 SHA512 SSDEEP

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.5MB
SHA256 6a26d0a26f7a956cbc7948892c56889a3290216763502908371c48fa08ab8d8d
MD5 bbedbd0f506737e3f7cffc120e7ad1c1
SHA1 45ef583efd4fcc8220eb320878cd6dc5d143af4b
SHA512 1aa98b1ae647a98b81c69b069bdbbb6e16dd1f71d93b55083c78bbf6fd6d97c0f94a242c457eaecea9ba54b63a9440d1fdc7fc80a23c7533a1723b05bc25d43b
SSDEEP 12288:HY0EpwfVqIjngMN0s8Jco9QzQ/b+Ka7zPKv2yI1677qasLkVI:HrEpwsQNgcdAFeK+yI47Ga
MD5 SHA1 SHA512 SSDEEP

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.5MB
SHA256 203455e332a7107d5247b93d5137f93837c834dd1b3e9b8c77621b4c7929e59e
MD5 6697475283892a379daeb2dff19da38c
SHA1 9d370577dc7a0cc7412ac33bfd71ecb79c20d35d
SHA512 dabffa4d177c828c0d1f31cb889b226e63262920d98b326a761621da47610c087acdb80ceae2ee01689b9d5634ea36f3a11ed14874dac3f259ca36c5d3249fc8
SSDEEP 12288:GK0EpwfVqIjngMN0s8Jco9QzQ/b+Ka7zPKv2yI1677qasLkVI:GREpwsQNgcdAFeK+yI47Ga
MD5 SHA1 SHA512 SSDEEP

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 6a395856777fd4c2874c483ce857d649614c3ae57c6a6de85a4c11fbb461c295
MD5 39234b452de063db897f57221355720b
SHA1 2772bcfbde873eef1dc8db4d45fd02950b063a1b
SHA512 d51bc5f8c18b7c65bc4e462711a8389dcab25351eabcdc99358ea930e3d5a2d0fea2a5780f64113db523750111e490e378b8975877353bf57505d3c3eb833d28
SSDEEP 12288:zUFmDDLL0EpwfVqIjngMN0s8Jco9QzQ/b+Ka7zPKv2yI1677qasLkVI:7QEpwsQNgcdAFeK+yI47Ga
MD5 SHA1 SHA512 SSDEEP

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.5MB
SHA256 aedd21b153e0039c95e7dfbd36d8e0a0c8689d3afc1f445b49cb38c3210412f7
MD5 47aee557541853710ce8bd7670e35ae7
SHA1 c9d90ad250d53ee303ef413a3209ec01423f2f16
SHA512 7af208834fa6f0e99e40c7dc798d5af44a82240d73fb5fb62ae8d19f6e2582f5f42e890483c66ee0d57cdf5a7dc9902afd7ff500c0c79163d4dc5bbfb43950e3
SSDEEP 12288:tSEpwfVqIjngMN0s8Jco9QzQ/b+Ka7zPKv2yI1677qasLkVI:tSEpwsQNgcdAFeK+yI47Ga
MD5 SHA1 SHA512 SSDEEP

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 a6eb4c20928893366416571159959c9ec30137a2017623dbdfbe6d7478f38044
MD5 16d714a2243124a0b7479c822b779312
SHA1 b3478c3ec15f60c2e8796982adf7370f1f6d5a88
SHA512 1e75766db5d19044a36d2885475e78eeedfd5d272bd457b0d793bed4ccb0913d391b471ee5b03f28be5da4c9f4ce4012b8b79fd081ada65a2bbda60bcdb7bf04
SSDEEP 49152:Ha0h2GEkuAe73q3pp46zwwQMEysEVAFeVyd:Ha0hNYG4Jw4NM0d
MD5 SHA1 SHA512 SSDEEP

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.6MB
SHA256 18771e509362c27f234added3ffde78d208a2c6cdd0006a1788b350dc0b3e014
MD5 89ed2203984daf50ac47dee261712984
SHA1 4adb99b5651bcf75ca813e97ba549760506f6349
SHA512 89387dca8df831e9906af35a67df44cd06c3743fe463865872e3f526925599311f4e9621427c44ad3565313f634c0dc2170af0028b46501ba8d1eb5d569558ca
SSDEEP 12288:hhbHjfXPEpwfVqIjngMN0s8Jco9QzQ/b+Ka7zPKv2yI1677qasLkVIT:hhbHjPPEpwsQNgcdAFeK+yI47Ga
MD5 SHA1 SHA512 SSDEEP

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 ece473fecc907ab4b8c539b6fbd35858b3d2bea940c4a9a7a04c2ef885a3f568
MD5 0c7297297b18296efb008f7877aa0baa
SHA1 fc52f7807de1f177cda67bb6b1acc3bbbe00526b
SHA512 5a8b5cdc9e78b15b72e19424ddf4d3cbd5d77dfc34c4aeee40346b2cebaaef5bab50aa4bee6e7dd9d62ce813336d9cdecf9d4758c18a8b86b55b0bc073c7414a
SSDEEP 24576:23YgnJcRTk4yti+R5dpR/XEpwsQNgcdAFeK+yI47Ga:2IgnaTk46ppR/XEysEVAFeVyd
MD5 SHA1 SHA512 SSDEEP

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.5MB
SHA256 f8ab727281792ec0e38e2abff436a3795914e82f9222a95fae111f05aa12aefb
MD5 a4db41cd69285972aeca5629eabee7e9
SHA1 205fc67264ba22d31b1d891f81bf86dd55c80d83
SHA512 79e7bad3f8b430c10aebac317ca45d9c22f688c629d0cb0ca7e3d54aa0c5e73ee60ce0fad1c4598b0710f573909574a58c17a7426614e909404aaaa7782bf4f1
SSDEEP 12288:F+EpwfVqIjngMN0s8Jco9QzQ/b+Ka7zPKv2yI1677qasLkVI:F+EpwsQNgcdAFeK+yI47Ga
MD5 SHA1 SHA512 SSDEEP

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.9MB
SHA256 9f594b0183eafe36772cf18d1f435298f2db272bb2d1546e539028d3ff9a0f16
MD5 ca5a5e19ddbfd5edb6e8402a7ba5462c
SHA1 e80e0db22b00231155b337266ad21460737f3d61
SHA512 174179ccac9b5c0167584b343fbf6c9fdfd2573ce612492ad07f100912d2b408b9315c82dbd59e63d8288d2d4daab00485e8e22e8e818bb236990c155e865ec8
SSDEEP 12288:gOb8A4LWOsvAYFTZEpwfVqIjngMN0s8Jco9QzQ/b+Ka7zPKv2yI1677qasLkVI:d8L3UTZEpwsQNgcdAFeK+yI47Ga
MD5 SHA1 SHA512 SSDEEP

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.6MB
SHA256 e912fcee71fd2a12dabf1fd3d456bf0cf6ea6a0d38ffc233f898920277e3c044
MD5 b5a1f5b67976c0023f27e68f4ae92ad8
SHA1 3b2ed85ee1c045a2c86e586c6a8fb71360156178
SHA512 86b60a68582892443ecd5daf02f425bf1d697258f11aa66f6bfc32f5558c073f23d5e2ce8caba71f3d7e29b85af4989ca42bbdb2ea6a57aed6f459164674fa3f
SSDEEP 12288:XpFt+OFEpwfVqIjngMN0s8Jco9QzQ/b+Ka7zPKv2yI1677qasLkVI:AOFEpwsQNgcdAFeK+yI47Ga
MD5 SHA1 SHA512 SSDEEP

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 d75cea720ce7e32ebfdafea77ae05734bffbd5df579ff831dbe22a74d8a2ade4
MD5 83084f7bab99d7b96f40255f50360442
SHA1 206e4b0258f1c1902da6f38dc6f5d6d3c6f9e2b2
SHA512 b7b263c781fe910963d7460fbcb8eb7d7bacd4c2523e621b4d920b6836c9c69e9fc94b297f60fbba8eef58c5849bd692a19e4bc53003081b04bc961a0b5799aa
SSDEEP 24576:U7NM9YmZqmWMUkPjZM48Mv6bEhsiEpwsQNgcdAFeK+yI47Ga:U7cBWMpPjN8DbEhvEysEVAFeVyd
MD5 SHA1 SHA512 SSDEEP

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 caa6ff8ca57219342f6dc68ffa4fad3d0c022c0030d65bd81676d727ffb6c3f9
MD5 683cdc14acde96473b5e9a318aa88bda
SHA1 a44dafbde6d781305e286aeb52b83edc42fe5006
SHA512 fc2ddde963d41b3e270c3d911a9c5889a391598f57e48e33e091ae45274f34dae5caca9d70dfe79b1c095cc8f5ac4c60095d4b4d04552246aff5edee4391475e
SSDEEP 24576:+W6BApg2YuyuNDYTabvcRvNYf8km1gEpwsQNgcdAFeK+yI47Ga:+F2YuHNETovcvNYf8kmCEysEVAFeVyd
MD5 SHA1 SHA512 SSDEEP

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 5729fecd66a62f13759220aaa10108156349c4cfcbd81b168e9ca410e0e935c7
MD5 6ed24bae1205e1b1fdc8634398993771
SHA1 0ddbdffbbcb84c8d4c11bc58431b0b9cd7258d9e
SHA512 3787b05889f05216e938688e7e27cb71530bc6df18d9cd3682c5ad0c6f40a4e34f90e6f0429399e9c29288a5a9627535971eff850eac7c7b969c24cfb8363a4f
SSDEEP 24576:bAFs06+Omlf3NXEbToxEpwsQNgcdAFeK+yI47Ga:UFs060lVXusEysEVAFeVyd
MD5 SHA1 SHA512 SSDEEP

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.8MB
SHA256 02a8e612894c377d4174ffb0961302652c747d9dceaffe452e7419ecab55b080
MD5 4591c69a10b691d3bbf45f52959ef7a5
SHA1 e77bc11c7c0bae36fdceb75933e6d68489f35cac
SHA512 6089f245a2d361c9cff12bb1297350aaf6eac2e188db517eab23e898a77f215300cb3943c5fa8e2acf11ffd677d45f32a4b911208214eb5e729e2c2ba414b585
SSDEEP 12288:QCJnJ5D3VkrWzxCEpwfVqIjngMN0s8Jco9QzQ/b+Ka7zPKv2yI1677qasLkVI0:lJnJ5D3W+sEpwsQNgcdAFeK+yI47Ga
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 b2e69166bcede9c4fc06f47a9c5eea041b7ec7255b23f3d23571d9ecf25af029
MD5 b2fd82e69ac4867cfb9ef2e60bef92d5
SHA1 10493103bc580afaa791d6814fa6a5d7a4c96348
SHA512 b24ae9c1e9c7a10fa05fae2e89a8cdf92aab5dd08be86b0a5eab6f263489c109a54fd31cafac5690895eefef01e5e621344d859bfdc68d466675b73ecc64714e
SSDEEP 49152:/o06DIKdwc+eQnSt65aVWEysEVAFeVyd:APNM0d
MD5 SHA1 SHA512 SSDEEP

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.6MB
SHA256 6613115e8f40dc0f3af997c40469fa305f513d195342680ddcf1a9b4a2d55dba
MD5 f64feac93a9255bc2ee4e3f3a873c012
SHA1 fea9db4984a5a5c1f841d11494077cb90333d408
SHA512 2550378ecf1092731b1f689d3602d35c3e391f33a8c4b127b34d43a87d209310c34dd93b5a61059018c970ffc1ee011fd346171fd22b5be750feada717c2bd11
SSDEEP 12288:BEP3RI/EpwfVqIjngMN0s8Jco9QzQ/b+Ka7zPKv2yI1677qasLkVI:yI/EpwsQNgcdAFeK+yI47Ga
MD5 SHA1 SHA512 SSDEEP

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.6MB
SHA256 b750487941c73fdea123cdd6dbb3861194231427ab728bc045077f855766e3df
MD5 06a6c61d08c188e8848af355b4e2d6e0
SHA1 4d7fdba4ce57ff469641b92a088d65112cd9356d
SHA512 7be3c927da08248fae003bddcbdd8411b90abc67be0c42e4903edeabc12dae5a6f59c5b5e6b4f932c32e01ff1c35084675549b8214b42f8c2cccf7bc8df21ecd
SSDEEP 12288:Xjky/EpwfVqIjngMN0s8Jco9QzQ/b+Ka7zPKv2yI1677qasLkVI:XIy/EpwsQNgcdAFeK+yI47Ga
MD5 SHA1 SHA512 SSDEEP

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.5MB
SHA256 fecc8b2b37d5687e2c454641747af0259cff7d70a196b8e9881b3885ed75ed2f
MD5 7fb5cb05ad919e0d8218a2438b9905a6
SHA1 a9a31695b177814f04c4e379dfb48127e26f9865
SHA512 11149e0f5ffd9af7006b4ba3942d338cbb262b00d6666332e0c11f10dbbc717a9b7524a15964ccb391e3100bcc6629bf35a36272b87282e5300024a141d55ead
SSDEEP 12288:hw1EpwfVqIjngMN0s8Jco9QzQ/b+Ka7zPKv2yI1677qasLkVI:61EpwsQNgcdAFeK+yI47Ga
MD5 SHA1 SHA512 SSDEEP

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 a76df82c9a7b3f83deb526111bdccdda0b5fbada68ed338cd2e4795299e7a662
MD5 864559be84fdd106b4250dd416fc29e3
SHA1 559bdfc8af736c09ffabbd126112bcba5e785e88
SHA512 b9d8dfd65f94288ce064f17717a34ceca7217db96a59a5435111b0f0aa174533e061d3508633c3aeeaa446b393fb7a8a6d8e41af39f8ba20b55de4ce5da610c1
SSDEEP 24576:wQ9MxZKdcz97w36EpwsQNgcdAFeK+yI47Ga:wVKX6EysEVAFeVyd
MD5 SHA1 SHA512 SSDEEP

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.7MB
SHA256 72ff8c6d9cb5a72e1c02425dce6029f15ab13e8bce42c6ff97051c8d6213e103
MD5 cea4037c988992f0753457291cc27246
SHA1 b00ef0eecc9307e22c8dbc5aa47f9a1ea8e9364a
SHA512 b4bc1eb623f72e253f3c31ee53852a392e3bc01f73d8bce4448bb2fdabaec2816ebdbec0ffd02b20dba2e275bd1147796cdb09e8e66e47063cd5da371ddf7792
SSDEEP 12288:WyoKo2ARple9pLEpwfVqIjngMN0s8Jco9QzQ/b+Ka7zPKv2yI1677qasLkVI:WyocGApLEpwsQNgcdAFeK+yI47Ga
MD5 SHA1 SHA512 SSDEEP

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 f69aee0725f72d577f9a58274bc488be21ee91f8b2d6a8ec7dfe1bed7e267add
MD5 e72811b99688f6866d83b96347db3861
SHA1 39944e71fa5ce311fcd7766b0ff0d2e5804b03da
SHA512 95fb617d7751ca1b59b5404428f405b36595d017576a317fa732651797ed87b204c0b1037d9dbd04ce7c1e62b32e43bdca2c7a96f5c139c6a3d6b9c47b2504fa
SSDEEP 49152:xWcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIKLEysEVAFeVyd:p0zuNIkNM0d
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/812-649-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/812-412-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/1188-251-0x0000000140000000-0x000000014019A000-memory.dmp

Download

memory/1188-370-0x0000000140000000-0x000000014019A000-memory.dmp

Download

memory/1188-243-0x0000000000670000-0x00000000006D0000-memory.dmp

Download

memory/1188-249-0x0000000000670000-0x00000000006D0000-memory.dmp

Download

memory/1236-339-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/1236-640-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/1436-234-0x0000000140000000-0x000000014024B000-memory.dmp

Download

memory/1436-37-0x0000000140000000-0x000000014024B000-memory.dmp

Download

memory/1436-38-0x0000000000520000-0x0000000000580000-memory.dmp

Download

memory/1436-29-0x0000000000520000-0x0000000000580000-memory.dmp

Download

memory/1600-238-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/1600-74-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/1600-71-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/1600-65-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/1860-646-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/1860-388-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/2104-295-0x0000000000400000-0x0000000000588000-memory.dmp

Download

memory/2104-411-0x0000000000400000-0x0000000000588000-memory.dmp

Download

memory/2336-52-0x0000000001A70000-0x0000000001AD0000-memory.dmp

Download

memory/2336-73-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/2336-62-0x0000000001A70000-0x0000000001AD0000-memory.dmp

Download

memory/2336-58-0x0000000001A70000-0x0000000001AD0000-memory.dmp

Download

memory/2568-267-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/2568-262-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/2568-254-0x0000000000960000-0x00000000009C0000-memory.dmp

Download

memory/2928-336-0x0000000140000000-0x0000000140187000-memory.dmp

Download

memory/2928-636-0x0000000140000000-0x0000000140187000-memory.dmp

Download

memory/3028-650-0x0000000140000000-0x00000001401B7000-memory.dmp

Download

memory/3028-424-0x0000000140000000-0x00000001401B7000-memory.dmp

Download

memory/3328-305-0x0000000140000000-0x0000000140186000-memory.dmp

Download

memory/3328-423-0x0000000140000000-0x0000000140186000-memory.dmp

Download

memory/3440-647-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/3440-400-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/3516-445-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/3516-651-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/3688-386-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/3688-374-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4008-278-0x0000000140000000-0x00000001401AA000-memory.dmp

Download

memory/4024-13-0x0000000140000000-0x00000001401FF000-memory.dmp

Download

memory/4024-7-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/4024-1-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/4024-14-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/4024-0-0x0000000140000000-0x00000001401FF000-memory.dmp

Download

memory/4064-643-0x0000000140000000-0x00000001401D3000-memory.dmp

Download

memory/4064-371-0x0000000140000000-0x00000001401D3000-memory.dmp

Download

memory/4464-357-0x0000000140000000-0x00000001401F3000-memory.dmp

Download

memory/4464-642-0x0000000140000000-0x00000001401F3000-memory.dmp

Download

memory/4616-42-0x0000000000990000-0x00000000009F0000-memory.dmp

Download

memory/4616-237-0x0000000140000000-0x0000000140267000-memory.dmp

Download

memory/4616-41-0x0000000140000000-0x0000000140267000-memory.dmp

Download

memory/4616-48-0x0000000000990000-0x00000000009F0000-memory.dmp

Download

memory/4672-233-0x0000000140000000-0x000000014019B000-memory.dmp

Download

memory/4672-16-0x0000000140000000-0x000000014019B000-memory.dmp

Download

memory/4672-17-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/4672-25-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/4756-289-0x0000000140000000-0x000000014019C000-memory.dmp

Download

memory/4756-399-0x0000000140000000-0x000000014019C000-memory.dmp

Download

memory/4864-324-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4864-639-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4864-442-0x0000000140000000-0x00000001401D7000-memory.dmp

Download