05c73f49a796c0616cd62ec8fde63d0c9747dad43c5d14f6a1ed228287cc1679

Analysis

max time kernel
147s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
21/10/2024, 09:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-10-21_3a06d3bb3fea7022c1722473a2ea66c0_ryuk.exe
Size 1.9MB
Sample241021-ll91tsydpc
SHA256 05c73f49a796c0616cd62ec8fde63d0c9747dad43c5d14f6a1ed228287cc1679
MD5 3a06d3bb3fea7022c1722473a2ea66c0
SHA1 11b3ff3b4741fd1515927600dc502e974f395d87
SHA512 e3ca4dc75672b2a91a3a96546f5ec0d759cea7696bd76d96ef83969096205c35ef6cdf1faeba27807d7b97d4a2722a34efd7f1d77107f5368be46ad5d0a009e9
SSDEEP 24576:66V6JC/AyqGizWCaFby1TvJzY0VKRr6mcQDT6z:66cvGizWCaFbKJzY0VDoo
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
4016	alg.exe
3048	elevation_service.exe
2612	elevation_service.exe
3788	maintenanceservice.exe
1816	OSE.EXE
404	DiagnosticsHub.StandardCollector.Service.exe
3568	fxssvc.exe
1208	msdtc.exe
3848	PerceptionSimulationService.exe
4088	perfhost.exe
4596	locator.exe
2552	SensorDataService.exe
1648	snmptrap.exe
1796	spectrum.exe
1004	ssh-agent.exe
5000	TieringEngineService.exe
4684	AgentService.exe
444	vds.exe
4576	vssvc.exe
908	wbengine.exe
2244	WmiApSrv.exe
3576	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 24 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2024-10-21_3a06d3bb3fea7022c1722473a2ea66c0_ryuk.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\90ff05bf3e6c0d63.bin	alg.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdateOnDemand.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdateComRegisterShell64.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrmstp.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdateBroker.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9908 = "Wave Sound"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000af89922e9d23db01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000dcc1cb2e9d23db01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000cdce92f9d23db01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003688d02e9d23db01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004d2dba2f9d23db01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b79d862e9d23db01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b0d5bf2e9d23db01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009aacf62e9d23db01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b0d5bf2e9d23db01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000177644309d23db01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9933 = "MPEG-4 Audio"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
3048	elevation_service.exe
3048	elevation_service.exe
3048	elevation_service.exe
3048	elevation_service.exe
3048	elevation_service.exe
3048	elevation_service.exe
3048	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
660	Process not Found
660	Process not Found

Suspicious use of AdjustPrivilegeToken 42 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4752	2024-10-21_3a06d3bb3fea7022c1722473a2ea66c0_ryuk.exe
Token: SeDebugPrivilege	4016	alg.exe
Token: SeDebugPrivilege	4016	alg.exe
Token: SeDebugPrivilege	4016	alg.exe
Token: SeTakeOwnershipPrivilege	3048	elevation_service.exe
Token: SeAuditPrivilege	3568	fxssvc.exe
Token: SeRestorePrivilege	5000	TieringEngineService.exe
Token: SeManageVolumePrivilege	5000	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	4684	AgentService.exe
Token: SeBackupPrivilege	4576	vssvc.exe
Token: SeRestorePrivilege	4576	vssvc.exe
Token: SeAuditPrivilege	4576	vssvc.exe
Token: SeBackupPrivilege	908	wbengine.exe
Token: SeRestorePrivilege	908	wbengine.exe
Token: SeSecurityPrivilege	908	wbengine.exe
Token: 33	3576	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3576	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3576	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3576	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3576	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3576	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3576	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3576	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3576	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3576	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3576	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3576	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3576	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3576	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3576	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3576	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3576	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3576	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3576	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3576	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3576	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3576	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3576	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3576	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3576	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3576	SearchIndexer.exe
Token: SeDebugPrivilege	3048	elevation_service.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3576 wrote to memory of 1632	3576	SearchIndexer.exe	140
PID 3576 wrote to memory of 1632	3576	SearchIndexer.exe	140
PID 3576 wrote to memory of 2708	3576	SearchIndexer.exe	141
PID 3576 wrote to memory of 2708	3576	SearchIndexer.exe	141

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2024-10-21_3a06d3bb3fea7022c1722473a2ea66c0_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2024-10-21_3a06d3bb3fea7022c1722473a2ea66c0_ryuk.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:4752

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:4016

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3048

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2612

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:3788

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1816

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:404

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:4344

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3568

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:1208

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3848

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:4088

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4596

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2552

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:1648

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1796

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1004

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:3608

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5000

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4684

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:444

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4576

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:908

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:2244

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3576
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1632
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
  2⤵
  - Modifies data under HKEY_USERS
  PID:2708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
Size 2.1MB
SHA256 2f570ac07eeef7c5804278149599604cc3498e6da27f2f5734becd691d3b3ad1
MD5 c4d92b09b64901961844d79bd2b19273
SHA1 6d3cd644d8c44876ad3abc9fa8dce6b3f90d622a
SHA512 2249f9885bde9cad3080a93c6f8bb0d41731d603185c3857630aa05a6dfcf19859152a8489871a272078f4cfe406c0be7da1cd2817ef46a2e9efd7470e6f3eb4
SSDEEP 49152:KuYk3H5koUafTqkkYLO/W2buywzMbOX+T7z5vJzY0VDoo:KCfTqi90bLTVD9
MD5 SHA1 SHA512 SSDEEP

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 f65eba0865a09353f43403351ea5badbbb4b5f97bbcf5b9e37fe6e7059bd7bf5
MD5 31a27d8d279c17a73083efa742564254
SHA1 2e99ca9660d834e15fc68ca975a2e0b13cebf755
SHA512 ded4ebe43dba33c83ba0c321fe2580c214f72d652ff6ae0a0c24c88dbd64339d575f24996ada10e08984097d63ffdb6c45bb2217917ccb65921f2fd8d99ab08a
SSDEEP 12288:QsixPwEsHuXzYAdTv4YFZFAB1dDwdnnY0VKd7rZAjKJcevzs7cT6gJDqQ+:QZFwVuD3TvJzY0VKRr6mcQDT6z
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 be4d03d6e050ef1f9fe881cb8a0383a68b3d0d5416814d234715ac19f83ff52d
MD5 11c3daa2a556d0b7f0725f7abf2a8f4e
SHA1 95c5e0fbcc92bf6e6db78f212a722c93e208262d
SHA512 fb35063f05f9daa4a1d3ddfff9312e24e40346d9ff114e7fd30c60fae2805df5f63204f533a84157962b975af4f9d2e4cd63c5bf425fa14d3ae769c5c318260d
SSDEEP 12288:t7a3iwbihym2g7XO3LWUKfh4CoxAdTv4YFZFAB1dDwdnnY0VKd7rZAjKJcevzs7P:o+gkE4fh4CoiTvJzY0VKRr6mcQDT6z
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 fbd5347dfc699f93f349c064cb99d3b091ab0e797205897c2b2df66ae54bd3bd
MD5 25d16ffbe4d681eeb4872f31d4a04d50
SHA1 4c97ee4976c34e9149d3935184d4712aa6483b91
SHA512 2e21726ed3aea6710a3ca162e6e5a69f2eb00126f57247f52d5b8d8ebc3fbbb320df928a102fbd8684de369634341b625e98d8b5dc0a1e777ca2e9899507c565
SSDEEP 24576:fBpDRmi78gkPXlyo0GPjrXTvJzY0VKRr6mcQDT6z:JNRmi78gkPX4o0GPjPJzY0VDoo
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 e10b7cc9eba87e5e714b037f9e26033854f1648c1edc4183fe9b51a5183d1f84
MD5 773959daaf1a2444044b7b7cb7a4c648
SHA1 48062d493abe33408944e9a4b71c809b18ca9c65
SHA512 a557d75261761b9c035c8d520b869d24e5390f5a3abddec20d7ff828bee6219f0ef14024119763b39a27eeaa16c12d8592ecdb3875dd52c6b3e8ccffa7e81706
SSDEEP 12288:zfC6Aj+TN5uixZN+8rKhUdTC/wE1zD0Ca5ZIXVxAdTv4YFZFAB1dDwdnnY0VKd7y:jLOS2oPPIXViTvJzY0VKRr6mcQDT6z
MD5 SHA1 SHA512 SSDEEP

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.5MB
SHA256 6421a8435c05f82818e653f8fa16212cca2620f5a82e900fd7f82eda569a94d2
MD5 11e23b3c2cb7adfa40b4b9d1f381e8a6
SHA1 08b702778d1f5773bacf2182da17ddb9dab212ef
SHA512 d3612fac7bb3e2956276b817cb21ba473bfa2cb8ab14dcfa0159702ba72f353b11c44ef960ef386cb906a43217968664acc09a7e84a54a28de5b3027d4fb5543
SSDEEP 12288:7XbAdTv4YFZFAB1dDwdnnY0VKd7rZAjKJcevzs7cT6gJDqQ+:7XATvJzY0VKRr6mcQDT6z
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 a22d408360857b896487585b52ae78f0532fc9f5e9fbc37b47b51356940e34e4
MD5 7b75c5a82aa6b46309caf637d25efd97
SHA1 4d7d295a4429e7fa2e38ed3d63a0f4272e86c085
SHA512 cabd327eac8475ff83914e0a57a2c70d23cff71493f00a9f357a36c463cbf1b687f27305e55d38f66c12af9d19073fbb6cd9492a375fae0d06c89ae88a1dae96
SSDEEP 12288:+eBNUbTVO86U6AdTv4YFZFAB1dDwdnnY0VKd7rZAjKJcevzs7cT6gJDqQ+:+JIUtTvJzY0VKRr6mcQDT6z
MD5 SHA1 SHA512 SSDEEP

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 d7d28733e295a227a1c83a160a7cca6d0c2440f266ae816c197740df900e2351
MD5 02cd4c3d8af17b4eda96f33b5badc4bd
SHA1 81e0d0f79f4b3bc138fed6a1012b50aeec16b97a
SHA512 d3a1f653634264d144aa43e55a04da361fa751c09f10970a551938afa100e1644717b37c7bffcd668147e2c0cfcd59faa34f5a7459488f3b9541015ad8537e21
SSDEEP 49152:wQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJR9DN5J8NRV3THV:wQvGAdlCEL8c/RRNw5C8TVD9
MD5 SHA1 SHA512 SSDEEP

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 bf9631ea09cf06ae4a2e86a5b17534f0d833010d6d638bff6d0181c4dcd6dd5c
MD5 dc3d99d576ae81d563a706462266b7ca
SHA1 f1c3554b26196a0b51e8d5008a81b36c31bba5a0
SHA512 710db8b7d7359c7b9796aaf6e3797bb62af04be97f76f40d989c8a1410f010903e645eab89f4e20a625cf12bdaab636074d651f729405f2d352ef525752a3666
SSDEEP 12288:KAwSfxL/2Dc3MDLLmt0LDQewsAjwAdTv4YFZFAB1dDwdnnY0VKd7rZAjKJcevzsr:f9ewsAjvTvJzY0VKRr6mcQDT6z
MD5 SHA1 SHA512 SSDEEP

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 5bf995f10bec1f4d9b1e82aa4a2a6e1d721ff2a16f96116677ba90bc61bbd18b
MD5 ceb85d296773bfacc5b2d22ae20c50b4
SHA1 bfd38e1d9c7ecf8868247663ed9e1a6a6a9998af
SHA512 35d5a98a99c13ada20ba70dc9dc9a10aa6e299c66f7327f70000fa1751088dcd402dc992cbbde9d843c2f1874fa1f70ea43b6115cd66d87212a4e1d9010f293b
SSDEEP 196608:LUEtQeTbvf2zlO12sJTv6Ja1cpVLyRIldPlbuJHp9:LUEtQevvqc2W1cpV2RI32
MD5 SHA1 SHA512 SSDEEP

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 134840b25858c7cbded34ac0668bda90ed5c4728858553e41b41d390293f1800
MD5 d45341294e0100d59c6b46991df4e6e0
SHA1 2dda2d73c9a7e003838b8ea9d8d8c5e431cef1bf
SHA512 6b23884b5caffe37b10d58e39169daba1327555894ec0af961d547a3c14b0f1e4b816dc4f095e3a5632653042b9ef9ffd652650fdd5d21514f0825173184f2e5
SSDEEP 49152:HCbRquA/m2yL5zTfFiV+XenmE3/zrJzY0VDoo:QoquVjnmITVD9
MD5 SHA1 SHA512 SSDEEP

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 9f80e039fd5770500956577480dab4e9b6d40e2f90d1ad38e91487a2f7025bdb
MD5 04089f934171bbe68000bcf1ce22c155
SHA1 cb98bb8dc401a652c39800c789841ad71c9d9df5
SHA512 bbfcc20d76d021596c934e7517f95b06369d32e0bbe53690cdd07ccc13f65c057f4094f26df91a403dcc13cc9104dbd8a97385f5890ef6823f1344bed993a4b2
SSDEEP 24576:NAhGL2IFoiwtA5l7S53yTvJzY0VKRr6mcQDT6z:NAM1Foiq54JzY0VDoo
MD5 SHA1 SHA512 SSDEEP

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 ba1075f313c8482e1e39635b813fbd1b42b78d93e22da2cd969326c43fb845a9
MD5 952374b900f476cab1739647bb1cf81e
SHA1 aa84e80c92aabaea9b715219c7e0c401ac4e2f58
SHA512 cd65d02334be37367f538d0fb3e8ca3695361ddfb69b25f1782112296c975de3aedcf66af296101d694fa5b8e249bce611f028c0393e3548c17f5bc0d9aa5615
SSDEEP 12288:4mw5HEjsChNkBFgl0WDm+CVAdTv4YFZFAB1dDwdnnY0VKd7rZAjKJcevzs7cT6g0:1wuVOWrTvJzY0VKRr6mcQDT6z
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 5956ff1b06bb2ca1ca5510c581b17f9826ef9d6d05413df545a4b9b985d6f29c
MD5 263b07b06cc5061e2d92bbd4acc09f5c
SHA1 76e8d3923fafa03cdb2dfb6100ad594938a3c4c2
SHA512 02913dca8d5d9703b64c63b9c8e0890ddb859f34931d8394b83d82ecc0856980796c36a0ce4d8762fb4a8e6c930f8b7b3a1ba1253ffc510f89d292e5918fcbfa
SSDEEP 12288:aZZ1IyAAdTv4YFZFAB1dDwdnnY0VKd7rZAjKJcevzs7cT6gJDqQ+:8ZuETvJzY0VKRr6mcQDT6z
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrmstp.exe
Size 4.6MB
SHA256 463628a44af05c5cc0301e57490d3293e72e1756696fd3996da149f137a9fcd6
MD5 d2fd8a145a402b23d454b6eec52e5a07
SHA1 20832c0395aa705fe55895625aae02c5dd5e5f81
SHA512 dbbedb17a0bbc8d98d6817e4d132fe767e1b9cb5257d346e9eda599a2a66ce78ea32ec8d61e0a3189519c5fc2c9dd6fee7688bc3aa7bc6487e2875d66fd61ed8
SSDEEP 49152:vyEKQ5E3ieGR0PEtBFUow1b89eX61t+2xmepn/TRijbqYW3qkCbDypSfe6qwiXER:Lq9ceqP+2xl/SSay8TVD9
MD5 SHA1 SHA512 SSDEEP

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe
Size 4.6MB
SHA256 85b9fc99ccb295464f9880308db6f0eaa7ce1aeb703c689fe667211bcac293ac
MD5 910ab5b4da217864ad5c45fff4cc3464
SHA1 8a235f166ba278648367b760308ebb0b67f92819
SHA512 b932911929b929ddb2f2df9b010af94376b4419356ab5a5d4d5560edc1bb4b2aa39b661998ad1c6a6aea0f90e04d5adf62b01137fafc7672fc523f2ffe7cbaf1
SSDEEP 49152:oyEKQ5E3ieGR0PEtBFUow1b89eX61t+2xmepn/TRijbqYW3qkCbDypSfe6qwiXER:aq9ceqP+2xl/SSay8TVD9
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\123.0.6312.123\chrome_pwa_launcher.exe
Size 1.9MB
SHA256 9e8a884b5ff857b088e9e8ccf21a89c7ee7dc2804f312170597cb9368443c5a1
MD5 acc9ee7e1867e7a9c078d3fca096dcb6
SHA1 e5d137e7189d81cd3afcad592ccc4858dd90145f
SHA512 52f08a35e1dc87f61f2f29dae5cb5c4f3bdb755249a70baf0032307dc33f18ad2f2aba59bd3913d422adffbfc9e7d7974e2e9e013b39c2a9db4e1b6160c41a19
SSDEEP 24576:HVN8FYh+u0m/YOn/xvNSSTvJzY0VKRr6mcQDT6z:HVOyh+u0zyxrJzY0VDoo
MD5 SHA1 SHA512 SSDEEP

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
Size 2.1MB
SHA256 67ef74f4b426474236dfa39290033db6a86ed0622130d48829e6d5682aa365b5
MD5 233ed86a95b7017a379859ba277eec0a
SHA1 9d4af74d68ee61b0514add5bf417917f89cdba91
SHA512 c85e63292ba47ac5fff1184b284919af396c1502b271f1c38e04230135d130e88a90a0324d1cb0a193cea24e5db6d9118f8ad2a509e299c5f18715021d5d8ef8
SSDEEP 49152:d59PYHvI7wi/AIKuLFrFXlMWGxbghJzY0VDoo:dGgAIKgMeTVD9
MD5 SHA1 SHA512 SSDEEP

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\123.0.6312.123\notification_helper.exe
Size 1.8MB
SHA256 9cd319bfa9f6f9a20c74d3b4f8a1a1625b847838ba9ecc8b809ad5e45a25ded6
MD5 dcac0314ef719126b49d1e2df2bed1dc
SHA1 c21bc33f31801a5e6b6bdb267baa54292e9481b4
SHA512 77ef4fbbd0360e03d636d144caea0ca7ef906b178ca6fe77838cb51701acdb84fdf91ce4f24474e761cc5c362ec07d554ec41a6986834736eb243e686bf27a87
SSDEEP 24576:Ab6+S3zFphRwMVrLDnyhECINqzWipIxh0TvJzY0VKRr6mcQDT6z:AbrUzFjGMVPDy9INqZTJzY0VDoo
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 1.6MB
SHA256 aa4fdfb156a8e2f998a5ebcb10d979db891df2b0c83a71081bc077326e3373b6
MD5 3225842934ff71b2d4cdd4e9afa879a7
SHA1 026021703a670d2a9c6b2d472cb8d8313d67960f
SHA512 2e4dfc29bd01eb58a515090591dac0957088e2bbe67c97ee14195619ed3be90354dd5782bf9f87dc104a6c21406c938c4fb3d4f9ea8b1408d8af61a0bfea6193
SSDEEP 24576:B436epN7wcPROWFW9sQ0MtJLTvJzY0VKRr6mcQDT6z:B4qiwcPASW9mMttJzY0VDoo
MD5 SHA1 SHA512 SSDEEP

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.5MB
SHA256 35b29c326bd517e7cdbbdbf24f6540971ac87ee4aee9ce232bec6cbd38e8a253
MD5 1aae6b94086ccd8873768338053e6532
SHA1 29fd3beb8eed143be396257a4a9bf89c27e78bfc
SHA512 00db56abca7de312e6c6e36b833e31b2888166338e810093e88ff578010a52e9644a95e42fe0c2464f9ee233429ad2c17ac6de800858a1c6b3a9cf4a669d5819
SSDEEP 12288:7DAdTv4YFZFAB1dDwdnnY0VKd7rZAjKJcevzs7cT6gJDqQ+:7ITvJzY0VKRr6mcQDT6z
MD5 SHA1 SHA512 SSDEEP

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.5MB
SHA256 fc90df10703848ab1670cc080894811f1b454718ba9fb3a0cd962dc586d2fd0e
MD5 3071971ae7d029d63148b9230bde6e03
SHA1 411808ce3772ec207c30240cb1564c4db5f32421
SHA512 200fe3a46563596c7b8c4fe67c43265c7e1ed1d9e4ebbbd02cd60f7d12295bbbb2fef15d3d4ada9987c111784b1acbf941a4f54b53a5a00bbc1b989b78af1d0a
SSDEEP 12288:cUAdTv4YFZFAB1dDwdnnY0VKd7rZAjKJcevzs7cT6gJDqQ+:cjTvJzY0VKRr6mcQDT6z
MD5 SHA1 SHA512 SSDEEP

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.5MB
SHA256 076a3ef6342a7340c3cdcef60f08bbae81e89d7f1d8d7ba7b1f2c6173bf2b527
MD5 8b16efb46f7bbe0d35d2fb45c9dad3a6
SHA1 edbd002f3babb76d89182863d2bdc1d0609c434a
SHA512 e02841dd01b169c8ee89ceacf8446e1bf9d35a5d542940af9b1d6a0cf7e72fb428eb8b604d0097de89a7516811fd8b1132795ef8627cbd42ed5ed9e9a3744482
SSDEEP 12288:ViAdTv4YFZFAB1dDwdnnY0VKd7rZAjKJcevzs7cT6gJDqQ+:V1TvJzY0VKRr6mcQDT6z
MD5 SHA1 SHA512 SSDEEP

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 444245a75f9ab8259f0ba733b3f5207d27c4d7abb219784fc9dabb8f185dd3da
MD5 5c1fbf5c6a21b98f332bd9772e705e2e
SHA1 4746b92ec72792c6146eec761b35d4d83cc37f2d
SHA512 bb440a5d589423e32c520e2ef2ad0d28156b2bc47c20024c48f13cda84ed91ac429b6521857ea8e7803908c5d604a9422da9376b37195363b015e22bd47311b8
SSDEEP 12288:GVBAdTv4YFZFAB1dDwdnnY0VKd7rZAjKJcevzs7cT6gJDqQ+:3TvJzY0VKRr6mcQDT6z
MD5 SHA1 SHA512 SSDEEP

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.5MB
SHA256 b1f49696f1916a8de698f7598aa4afd93aca18745bf5e1b1ce1893bd1181fc63
MD5 f7a5f1f5a677a86ccfa60398f9115f74
SHA1 be91c1d0e119857e7f6d747f741596cef3b529bd
SHA512 9290abf2015395170efca63d800cc904c1f9886efa2e813802c3abad887afee2add1af2db99bdbaf47fa27416b424d6136fef561181b7a6c881e47e3413fa660
SSDEEP 12288:t5AdTv4YFZFAB1dDwdnnY0VKd7rZAjKJcevzs7cT6gJDqQ+:tqTvJzY0VKRr6mcQDT6z
MD5 SHA1 SHA512 SSDEEP

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.5MB
SHA256 3ef83a075888ca9ed2e3731325c586c158d3cc24070b3174a00d8d10c7b792d1
MD5 392fdb1e1629dab2de9b8b4e11f904a4
SHA1 43086353c35b751ad95790db1ab6c7e384aa5142
SHA512 a23feab24e5f78e9564fe1e04d74c4f2d0b477f5e19c6bd6fb48540c77e0a0f83704917fd5203e9deb0b0656f1fe92137b9418c677a6e447a7bc73e9c795bcf2
SSDEEP 12288:x4AdTv4YFZFAB1dDwdnnY0VKd7rZAjKJcevzs7cT6gJDqQ+:xXTvJzY0VKRr6mcQDT6z
MD5 SHA1 SHA512 SSDEEP

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.5MB
SHA256 5ee17e2e23c95daee9da49bb1b248eb83133175903704ccd0acc124f777298f5
MD5 c65e53f820aa442651026dd13a7407e4
SHA1 48652a16984454641416e536f5348d0c0285f033
SHA512 6becbcef0cd3cc627639182ea993b7fb6738ce8bb7de5dc21ebd5e35f1a52cd8dd7083341c69248a06693955da9ca7e0ad27b6066fffc1a775e55c2fc14e3d88
SSDEEP 12288:yMAdTv4YFZFAB1dDwdnnY0VKd7rZAjKJcevzs7cT6gJDqQ+:y7TvJzY0VKRr6mcQDT6z
MD5 SHA1 SHA512 SSDEEP

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 a8d751d11dba5acfb7963f218d9fb421472a71c32a566439ffa099b01197fa98
MD5 92d9a59665b614276e2bdf566bac2990
SHA1 27cafd58aee58bd90df2ec1165a7af4235252388
SHA512 3f8adb62a56117c349b04f0537eec892f7831b3aaa21052b934c1d9aeb2960a44cbdd524e41984af3ff98e22b93eec37b3b8dc443f7e85ac8f55736dd563bb1e
SSDEEP 12288:xiZwb5zzFEoS2cPvy0AdTv4YFZFAB1dDwdnnY0VKd7rZAjKJcevzs7cT6gJDqQ+:0ZM9zFVSODTvJzY0VKRr6mcQDT6z
MD5 SHA1 SHA512 SSDEEP

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.5MB
SHA256 826781ae5f3bec654145dc1f33fd6c992070e8575da46cfad980a5b68b7178a8
MD5 c18e46b1a77c5ac14c0b82b0e22afdf6
SHA1 b8858fb424af04ae723cfb8f42a1fa1b4ce8a2fa
SHA512 c8e852d3a712f05c214b2dbe29a0aa7441a0668f53752ac4504b0120862380df60e284a94ff6d25443d8a780b151186ef31aa49e6839ee70ba6a320b2fd0d7cb
SSDEEP 12288:8/AdTv4YFZFAB1dDwdnnY0VKd7rZAjKJcevzs7cT6gJDqQ+:80TvJzY0VKRr6mcQDT6z
MD5 SHA1 SHA512 SSDEEP

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.5MB
SHA256 997cf3343dc6d116dbfdd79b72455a083c85e369d35d74ca7539ea3f67de5cf1
MD5 005ca582b83aaa16b988b1e42f3f71fb
SHA1 5c9527c4380cd49d7d90d8bbe7f61f8def076332
SHA512 b692a45fa3185a9320008798b27e66990ee03b6cf76f8c379fe98d3eaa92ac1a1a64b1bfdcb141247c302cfea3855bd554f65cc17be5b9fe9cf94634131aae1e
SSDEEP 12288:qrAdTv4YFZFAB1dDwdnnY0VKd7rZAjKJcevzs7cT6gJDqQ+:qwTvJzY0VKRr6mcQDT6z
MD5 SHA1 SHA512 SSDEEP

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 11d46763e25b9bbe42e130a3fbcf73436a8477810be68b5d322f8977b8d5f314
MD5 c42b5f1a2e3bf95810031aca3b45eb9a
SHA1 8d7efdc6120807508c85007066da8e304824b91a
SHA512 65b337c7bd081d5c05579f1baedfb7504b3338c83efd089bda07d69f2a0447b45739c0cba20b0a7887596c865d8bd85c1e6408443e9112448cb3346a409ae392
SSDEEP 12288:QyPz5L8AAdTv4YFZFAB1dDwdnnY0VKd7rZAjKJcevzs7cT6gJDqQ+:hzyfTvJzY0VKRr6mcQDT6z
MD5 SHA1 SHA512 SSDEEP

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.5MB
SHA256 cb6a6311f2dfe0cb33d2bb487ea668b9b31002cb8bc765c22b9ce74b6869ced9
MD5 ef06f0064f09faebab90760e86decde5
SHA1 eb365114f6a96884788b68d4ed829e5b4be88da5
SHA512 8f215e6a31c5b713da747fe7ef7b4daac6f54691d159ce63525908544e4262642d2bd9458c747f4e3d3332f2171f3c49f20f1304de8cfeec9d1a987f16865101
SSDEEP 12288:H/AdTv4YFZFAB1dDwdnnY0VKd7rZAjKJcevzs7cT6gJDqQ+:H0TvJzY0VKRr6mcQDT6z
MD5 SHA1 SHA512 SSDEEP

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.5MB
SHA256 fa7ede8dfc59af4102402b82ade8ebc3c64b1ae25677efefb6529cda84ad583d
MD5 01994e571620b99a9fc5f25276dcadad
SHA1 72bef730dd41f80599940a1e24791d9f38d1bb2b
SHA512 0108cbd81579cc1090d3963ed6fff73d89f81414241e4ba075a1d5516eade78c1cec9717d3c06f62f5f658e858a55cc467bb8462caa59865a2064426bfd59875
SSDEEP 12288:z/AdTv4YFZFAB1dDwdnnY0VKd7rZAjKJcevzs7cT6gJDqQ+:z0TvJzY0VKRr6mcQDT6z
MD5 SHA1 SHA512 SSDEEP

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 f1ca762a563fe5d18ea32e27a917d96a1959f9624fc3fd3aca27435ef553afef
MD5 6638fd1bb4240181efdcbdafd35d2b9f
SHA1 3515e1912f196ca035b44ab5ec289e806bd49c10
SHA512 a70ba2f61ff3a5e34cca5ce653e7f376c80b0ce996eab7504dfd010a6599e307d0f2dc69fa24c02a7c3b14b689e4ab1a14ed3b7fe8bf311940cd083f72b7fd00
SSDEEP 12288:wyPz5L8AAdTv4YFZFAB1dDwdnnY0VKd7rZAjKJcevzs7cT6gJDqQ+:BzyfTvJzY0VKRr6mcQDT6z
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.7MB
SHA256 f49286b455c0e51e873dabf65a51f33deabf30325dcd77c3615d19a75a2d1fa2
MD5 07e7cd1cb1b934a4270b00c6125dc83e
SHA1 e7cb8c741026a14bf261399b8ea6d4b5cef61fe9
SHA512 cf4ba86e45367d0f815d6aaf666713ef1d8ef1b5011074d1c54346d820562604850d2c72113c6566dc2b245f164dfa9f9601c5db598b90284e6419d1dc076fac
SSDEEP 12288:lCd9jWYoaLHF3z0z04PDvhSAdTv4YFZFAB1dDwdnnY0VKd7rZAjKJcevzs7cT6g0:gTyaLl3z0zDFTvJzY0VKRr6mcQDT6z
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.9MB
SHA256 3df0dc518f182bc8441502fe601deded277998b7eeb8f4bd710d05c45c28cfcf
MD5 20735617075fdd548824e3c9570638b4
SHA1 49fc44b32d3f89c0fa2d76fb4cdbca4a89d9ff5d
SHA512 0b0d134177f237b65814ff6519d0145577dd246609c79e88ed8a9c346075e4b9df852afc6af792caa2e1b9c421d2ca30a0ece831c8201c26ba43f36cda827a4d
SSDEEP 12288:Ti4e7qRdTfgwCHKy7GLbbdIvtAdTv4YFZFAB1dDwdnnY0VKd7rZAjKJcevzs7cT8:T3Ld9CHKy7GZpTvJzY0VKRr6mcQDT6z
MD5 SHA1 SHA512 SSDEEP

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.5MB
SHA256 655a48559ff73d75b116ceb5a32ab0f2e1194d72bcdc93e6db202b9f45cf211e
MD5 6840e6dc9f779b7d4a96bc69629f95df
SHA1 31ee56458f2fd8a25d8615cd26552713ad42ab30
SHA512 17a64b5ee35601a49e434f27edf0c562fec2cfc2e02632332c160e99655c1e225b831cf05f1cbcc647acdae654ac34a61719fb72d9e4ce42532a315fa105656a
SSDEEP 12288:vCAdTv4YFZFAB1dDwdnnY0VKd7rZAjKJcevzs7cT6gJDqQ+:vVTvJzY0VKRr6mcQDT6z
MD5 SHA1 SHA512 SSDEEP

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.5MB
SHA256 2e0271f9d3444d5084dd546b327642d35d19f7a87f3c6fb181dc43e9d26727c3
MD5 5ca56c02fe2b1ae953850c4a62a39894
SHA1 4bfd0e54b6bfad4272c33bb5f135250ed9bcceaf
SHA512 48d953460cbc1229d67815d0fa4402ac674a3be188740d82a6d0f68359a76db5421a17ed3770b66697f1b8418101e5665a0e1fabecc4fdd2d55175beda0a7864
SSDEEP 12288:ygAdTv4YFZFAB1dDwdnnY0VKd7rZAjKJcevzs7cT6gJDqQ+:y/TvJzY0VKRr6mcQDT6z
MD5 SHA1 SHA512 SSDEEP

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.5MB
SHA256 a25c50913033646f5880e63cc044778c5bb1c56730eb8b9b00f11196334703d1
MD5 bf273edb7e12d20e64faa7d81aaa2cc4
SHA1 e682c5d0a291c8ed7d65c9db10a89020f35f27f1
SHA512 c8141f76917be8fc6c422930aceea6e21e5301a7594037371e54df02746030c77b9f10daf49a671e1847c0a4dbbc21b458e74e18be64daafdea3c50672cedab3
SSDEEP 12288:KtAdTv4YFZFAB1dDwdnnY0VKd7rZAjKJcevzs7cT6gJDqQ+:KOTvJzY0VKRr6mcQDT6z
MD5 SHA1 SHA512 SSDEEP

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.5MB
SHA256 bbf85a48c79ad3b3a5450c1a252b5b96a7298f620fd497c32915d5c9e2e5d092
MD5 d16720069a370ace4256344f6d3e1409
SHA1 04459ba4e632e810b4d009551d51cfdbc8c49cc2
SHA512 2d6a130e5c96767332bf8dce2403f75874ef315df776867618a2e3367dbbd52d2ddd80922049f054d0d20f9f9187aa76f999aa919ce78246714780b202c40373
SSDEEP 12288:0/AdTv4YFZFAB1dDwdnnY0VKd7rZAjKJcevzs7cT6gJDqQ+:00TvJzY0VKRr6mcQDT6z
MD5 SHA1 SHA512 SSDEEP

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.5MB
SHA256 4a10fd49923614d73158e1d1a26703596f75d6a508599b04e89993eb2c4674d6
MD5 f88e66916d532e663d8c63170f727e0f
SHA1 b125748825fcaba8d786b8a29be3822b363722f5
SHA512 e408aacc733cb1a7ed1fdd1e0935774f6110bcaa60b439ad0861639c22b53041e9ff56e7588a4b748fe6178ae990f44d377962feeab6aa771968e76a077a74d9
SSDEEP 12288:rCAdTv4YFZFAB1dDwdnnY0VKd7rZAjKJcevzs7cT6gJDqQ+:rVTvJzY0VKRr6mcQDT6z
MD5 SHA1 SHA512 SSDEEP

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.5MB
SHA256 a97f863d94c9a0bb41586407fd6f3e9f9888ce5edc82e42ce990f0a38939a78b
MD5 c6d1e7a5e52c72b8f7ad168010cc7db6
SHA1 3d0ac539f7dd15ee4e6188a4128d4e3002fd7884
SHA512 49ad736fd11d51bc2966d910cbf8c24d6d3ff2505c1b5a3affad36f3b5d90f79d3c326d081443c1ba8f6a04f4c5e511cefbc3cf7d391a95f3f7ac02c1c1e08fd
SSDEEP 12288:hXAdTv4YFZFAB1dDwdnnY0VKd7rZAjKJcevzs7cT6gJDqQ+:hsTvJzY0VKRr6mcQDT6z
MD5 SHA1 SHA512 SSDEEP

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.5MB
SHA256 38f711703e0a26ea173817cd2b22723e8da8247f84853437a0ff73fe64c23bf0
MD5 3f19a93005fdc146820d57eeecb4ff1b
SHA1 4896a20a1208065efc64722c95831966973a888d
SHA512 fcfb45bbad47c423d4bbb745ec25f9ee2b957161a9556aa2db0b67e704990b0fb912c029219ab747c228142ecfed92b5b453ee191a07da5255fdda539c1732cb
SSDEEP 12288:k5AdTv4YFZFAB1dDwdnnY0VKd7rZAjKJcevzs7cT6gJDqQ+:kqTvJzY0VKRr6mcQDT6z
MD5 SHA1 SHA512 SSDEEP

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 00cc11d083c038e5f217029b5f3d7905f355f09f0966de890d283a8329e85526
MD5 2a79351d835849681e37b74be82701ce
SHA1 6c0b5012fc9d64844279f2e9af03881349ccfe3e
SHA512 38a918fcf51373a22a27c6496786f64d8a56f7fadac45eda60191668670afe9eb1c045fee9d6986c679ebd955ca386249670bb7ca203a73eef0e9cac54ad0c24
SSDEEP 12288:kUFmDDLWAdTv4YFZFAB1dDwdnnY0VKd7rZAjKJcevzs7cT6gJDqQ+:W5TvJzY0VKRr6mcQDT6z
MD5 SHA1 SHA512 SSDEEP

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.5MB
SHA256 e8fa6515c3f9e51efb53ce873ee5984c3d1e627d80e057cd3530e1297a7030fd
MD5 f8d49584b953a81d59637b6bfcd0d9d4
SHA1 7f8503d6a764175d84b843424d379f6fea5f3327
SHA512 49a96996edc45280207b4d5fd3b69f89b44222b05078fbf724546d069c8d13020edf90396215682d5405087857c5387e260f3b279cb70b332cf71f9e03fc659d
SSDEEP 12288:heAdTv4YFZFAB1dDwdnnY0VKd7rZAjKJcevzs7cT6gJDqQ+:hBTvJzY0VKRr6mcQDT6z
MD5 SHA1 SHA512 SSDEEP

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 68bcc1079b3f40bd59a1c5b3efe1e43d9248c7b7cddafbc1cab343ddd136ae71
MD5 89e49745fd7c1eba82e05f31969cba86
SHA1 77cf153cafd67c72759437227002a7f9b5ae5c82
SHA512 9c89120dcac2ec63bd97c2590cb1ed8f67b2677d9bfb228750d299f7a30a54cdb5fa242b2a953809b9cf4a84474a83f81f9f84a754e676249725e576efd73662
SSDEEP 49152:5a0h2GEkuAe73q3pp46zwwQjJzY0VDoo:5a0hNYG4JwQTVD9
MD5 SHA1 SHA512 SSDEEP

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.5MB
SHA256 db091e4f94fec03564124ed90fb4c931ce7100c4d17eefd0380cea0c343e0a68
MD5 d6f73740d21dfbb4f62733f05fa93120
SHA1 f58587c1a35cefa5c53ab55895f8c587a19769b8
SHA512 bd4443b008825bb430d88a72c4c9c269247c30d7db9c53c4cc3d8f57dcc9cd83d9bfb4070ae403d3c65624c57ef12adb20765b4a30590584a18c9eb5e545bd38
SSDEEP 12288:WhbHjfX9AdTv4YFZFAB1dDwdnnY0VKd7rZAjKJcevzs7cT6gJDqQ+:WhbHjP+TvJzY0VKRr6mcQDT6z
MD5 SHA1 SHA512 SSDEEP

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 a79ce77496ab338ac3a79fdfab00d642d0d8516b974fe5bda408532cfbd3987d
MD5 1f2f6f811b617e0d06ad5ab722882a6b
SHA1 a81076b71eec3826b09d66ce1c534ea1b206270b
SHA512 41ea94117137c994c54aeb3ff0cb42aed336fbe63e2a1b74577d23c1ae6e873eff90debc84a8b299863dffa4a9e0de06f7ff97f052d4b7c3e855c5ecb5987ed0
SSDEEP 24576:p3YgnJcRTk4yti+R5dpR/WTvJzY0VKRr6mcQDT6z:pIgnaTk46ppR/MJzY0VDoo
MD5 SHA1 SHA512 SSDEEP

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.5MB
SHA256 42c51e86d96c56d3dcb73014aada97e71be523ef2e06fc2cbe873cb8a0088f84
MD5 ae3a5b8578346ba490911a3957cfb41a
SHA1 82c5722aac13dd2d8ce2b70f1c0ff18a6ddbca4d
SHA512 931bed6ff2161466a80d61148d7f7103e4cf4531ba08999a8c78159735873df32caa042a6dfce25c3f996fa1856b8e9c98876b898cea3e8af1143e25f58e90a3
SSDEEP 12288:+iAdTv4YFZFAB1dDwdnnY0VKd7rZAjKJcevzs7cT6gJDqQ+:+1TvJzY0VKRr6mcQDT6z
MD5 SHA1 SHA512 SSDEEP

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 6cc26c949580eb9c9230e28f208d110b5fdb51f9c9181d9a6e5421c205eead0d
MD5 f1ae836d5042b7f9f904d46269712a92
SHA1 4f520f9337a453efdf3e60ecb22200f452895b49
SHA512 88054fe0fe4450b77f7d82288949e7edac1278f7607c7c9f8ffb443c6188eeeb8b8694f7b269cd01a90859e4a448f5f2651f07e558c8df53b0047c2e315c0589
SSDEEP 12288:PObaA4LWOsvAYFTHAdTv4YFZFAB1dDwdnnY0VKd7rZAjKJcevzs7cT6gJDqQ+:QiL3UT8TvJzY0VKRr6mcQDT6z
MD5 SHA1 SHA512 SSDEEP

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.6MB
SHA256 0c2f5a316b812c38a43eae0c5e7084de7f5fd5b1e88bdd9449959209b14d6b1f
MD5 10b4db20d6726de08e18d2962408da05
SHA1 33aaefc59df02845fc70a18f309f4a4fee14fa44
SHA512 791839afe4fbd4767505136195bb4824f275d09540ffd3f96c1b3a4e7ae2014ff48aee3e46fb5811193405b5c490c1feac1ed9af3a116c8be41c4e35fd097307
SSDEEP 12288:lpFtaObAdTv4YFZFAB1dDwdnnY0VKd7rZAjKJcevzs7cT6gJDqQ+:2OATvJzY0VKRr6mcQDT6z
MD5 SHA1 SHA512 SSDEEP

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 1d586121daaca46916a5790c7da3b4388c7bf9c43fb84485fadd92a2d48d6384
MD5 90982edc95acd8620ca5c7a68e5536e8
SHA1 16b85a938cd6073aa26423773b603a886a090092
SHA512 19fe4a8f3ce0d3fa1c83c8ab88f62df21a55d31f99c957932b256e7e7b1d1b5546580f65ca9729f4983f62a80d52e81c4aac2ada8b67349e08e44d39f977c7e8
SSDEEP 24576:y7NM9YmZqmWMUkPjZM48Mv6bEhsxTvJzY0VKRr6mcQDT6z:y7cBWMpPjN8DbEhEJzY0VDoo
MD5 SHA1 SHA512 SSDEEP

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 bd9a28aab3c7a200422ba85a38d72847aa50f10153ba9c3832a81c1a7cb7fdec
MD5 29d9a5982e5f515f045225922ffcaa75
SHA1 8fabdcd7339ef21c8def57a5c5c1113db8c9ec51
SHA512 7583bdb38e4dbb6899704d63ec2ac0faa696817df49708efbd4e2d6e1cf258d96a8efe76b7668fe46f737cb287217716820f5650ade428bd7bcb491d14145901
SSDEEP 24576:DW6BApg2YuyuNDYTabvcRvNYf8km1jTvJzY0VKRr6mcQDT6z:DF2YuHNETovcvNYf8km5JzY0VDoo
MD5 SHA1 SHA512 SSDEEP

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 0a819830961e400ef22608aa7f6528c112cd07aed943b9332baf11a51dc977d4
MD5 a29c9e2807e665cb8b7c152519b02fcf
SHA1 0d66d1a7ea43ff9a7e996a68d11c2a6cd51c930b
SHA512 156972f0ebf38572ad1511631eca9a2a6c8c440527407e3c0ee04af04f6f61583d25cf99b20376f506b1b71c96e52f0c26523f1acb407561c66af3a7376baa64
SSDEEP 24576:XAFs06+OmlfQNXEbToETvJzY0VKRr6mcQDT6z:wFs060lcXuDJzY0VDoo
MD5 SHA1 SHA512 SSDEEP

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.8MB
SHA256 57067716d18135d25cbcfceae4f7717164b774416d8d39b984a2eca5759e58ab
MD5 87b2d25ea27f7a405ca3e053416017ca
SHA1 970adda342cc55914a1d2731525904e3a1497e41
SHA512 a17e7134b509db205bc866efbae0ef6e9120893cc7c5ec4c86125c98ed4332a5996a900191b54142f4697c1831810cac71ed8643c4dcfc9e12235889f44d5048
SSDEEP 12288:CCJnJ5D3Vkr2zxOAdTv4YFZFAB1dDwdnnY0VKd7rZAjKJcevzs7cT6gJDqQ+:DJnJ5D3We3TvJzY0VKRr6mcQDT6z
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 b1883979699ddcf825ce2d4bb7a12c0a328d11eeff8a774b17df2e8082508113
MD5 3287fb8d26fdd97aaadf71dbc217cec1
SHA1 ff4d597c2063c5ee2b4f5376ae25176a086e3f06
SHA512 38197470530a4e4655a24b920e3a83b32434697c9cc667c27e20ecad7cd7c34bab3f393035df2fe34359e2ca32fcb968d34e3fc3dd71d6f733c09ef976f50aba
SSDEEP 24576:6EPohm6/7IIXdwcXrif7qQncjlP65i3VuWTvJzY0VKRr6mcQDT6z:to06DIKdwc+eQnSt65aVVJzY0VDoo
MD5 SHA1 SHA512 SSDEEP

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.5MB
SHA256 575ac2db7b26f1c6fa7951e2d6f9ed911d55cd263d6b83e57f72d2a0fd7e621a
MD5 8a21561fff537d63dd17c84cfe7f6173
SHA1 7fb594d1fe8d7135aaa83e381ce687684307c5e2
SHA512 0af0e463de2145f540f8572307813a5f4745b5285f8cff7219cd9e90c82cf87a3da48d7025939880114e94576d337ed6ae738a31d5251bb859621ac99e40d938
SSDEEP 12288:NEP3Ro1AdTv4YFZFAB1dDwdnnY0VKd7rZAjKJcevzs7cT6gJDqQ+:uoWTvJzY0VKRr6mcQDT6z
MD5 SHA1 SHA512 SSDEEP

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.6MB
SHA256 9b849aedd7ef2c9580babc539f5f0d097b20f7e7b636ffeaab27b640bbf7908d
MD5 1e3335ff1078a562268a29d819aa7dc8
SHA1 cd421cc378471387825241027b151096268194c3
SHA512 73345ea0e650ed7c542c4ef7723b35bb5fa5d0f75eeec9eac0570e91c0cce0730040765fe84e0c9b458d5475eebfb1de0a97eba10037ae603196271ca5f11dac
SSDEEP 12288:LjkytAdTv4YFZFAB1dDwdnnY0VKd7rZAjKJcevzs7cT6gJDqQ+:LIyOTvJzY0VKRr6mcQDT6z
MD5 SHA1 SHA512 SSDEEP

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.5MB
SHA256 5d437d308a2fea0db9fe1d39992da08fb22808a62cf6b7f7ff4b46a526fe0fb5
MD5 dfa50f2f5aa9d93dfd3bddf5a92e293b
SHA1 fbe1a33e9d0d335225d9d5deef129e2de0aaf7a7
SHA512 364d7bfbacf8b6bc8a9630adf4b0ab36a61cb8a9e431329cf28f96ef09b34dc80f3d4e2a528a7dcab3fca144e7a75c2930c00eaeca3e6b47266b1a1ccb08bb14
SSDEEP 12288:l7LAdTv4YFZFAB1dDwdnnY0VKd7rZAjKJcevzs7cT6gJDqQ+:lQTvJzY0VKRr6mcQDT6z
MD5 SHA1 SHA512 SSDEEP

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 57d1facecc2cda59863d640137891adc1b50e6e83c3be0c18838e19095ffa705
MD5 f42cf48db0e7472d333628938758787c
SHA1 3fa320a5857d0499e5262f534e2e8a603f3bfd42
SHA512 db39e8c96b1ff6baf4be21b3fff60b25096948e032c9f371901cef82d33a932d2c90c6665102bfb28bb4789b7e34f9dead0f2883244d00b3f40d0972ba0480aa
SSDEEP 24576:BQ9MxZKdcz97w3ZTvJzY0VKRr6mcQDT6z:BVKXRJzY0VDoo
MD5 SHA1 SHA512 SSDEEP

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.7MB
SHA256 4e68fb8f4e4ec41bffe5faf39e0333974bbf085ae493b3a958a52171d0733b89
MD5 911d8682a54718a429a0e4b414dbd82e
SHA1 a75cd8ae01c765f24abcd2598cd62c246c88f2cc
SHA512 5125cb6e22111da54e0e449a4e4603a9fc56affef97281b4e7b269d6bb26d129af22ce45857a90ebf47b7a501c3d3aebbcb7b253cedc85642a534c88ea8fb398
SSDEEP 12288:7yoKo2gRple9pBAdTv4YFZFAB1dDwdnnY0VKd7rZAjKJcevzs7cT6gJDqQ+:7yocmApSTvJzY0VKRr6mcQDT6z
MD5 SHA1 SHA512 SSDEEP

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 7a1029a5cdd94620cd97cf9ee94c6f2ad393c0cb4a644649929061b3249b6c67
MD5 6a0f694f09980527a29ca732d128ac27
SHA1 bb389d24d45ab0cd40ea916b983de4aa9c657f0d
SHA512 f1a06467bee71d758e5f70349528aa96780eae42365bfe602c048b30b67bc75d27edf9be46b6e388c48dbbdeef0579eda7e1255cccc32b71a694d7995bc48061
SSDEEP 49152:iWcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIKIJzY0VDoo:U0zuNIcTVD9
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/404-240-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/404-351-0x0000000140000000-0x0000000140190000-memory.dmp

Download

memory/404-246-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/404-239-0x0000000140000000-0x0000000140190000-memory.dmp

Download

memory/444-378-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/444-668-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/908-402-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/908-670-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/1004-340-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/1004-626-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/1208-377-0x0000000140000000-0x00000001401A0000-memory.dmp

Download

memory/1208-265-0x0000000140000000-0x00000001401A0000-memory.dmp

Download

memory/1648-489-0x0000000140000000-0x000000014017D000-memory.dmp

Download

memory/1648-317-0x0000000140000000-0x000000014017D000-memory.dmp

Download

memory/1796-545-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/1796-328-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/1816-72-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/1816-124-0x0000000140000000-0x00000001401B6000-memory.dmp

Download

memory/1816-66-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/2244-414-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/2244-672-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/2552-667-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2552-307-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2552-426-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2612-50-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/2612-40-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/2612-49-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/2612-232-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/3048-231-0x0000000140000000-0x0000000140234000-memory.dmp

Download

memory/3048-28-0x0000000140000000-0x0000000140234000-memory.dmp

Download

memory/3048-29-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/3048-37-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/3568-250-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/3568-251-0x0000000000EA0000-0x0000000000F00000-memory.dmp

Download

memory/3568-262-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/3576-673-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/3576-435-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/3788-62-0x0000000001510000-0x0000000001570000-memory.dmp

Download

memory/3788-64-0x0000000140000000-0x00000001401B6000-memory.dmp

Download

memory/3788-58-0x0000000001510000-0x0000000001570000-memory.dmp

Download

memory/3788-52-0x0000000001510000-0x0000000001570000-memory.dmp

Download

memory/3848-277-0x0000000140000000-0x0000000140192000-memory.dmp

Download

memory/3848-389-0x0000000140000000-0x0000000140192000-memory.dmp

Download

memory/4016-24-0x0000000140000000-0x0000000140191000-memory.dmp

Download

memory/4016-22-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4016-16-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4016-208-0x0000000140000000-0x0000000140191000-memory.dmp

Download

memory/4088-401-0x0000000000400000-0x000000000057E000-memory.dmp

Download

memory/4088-291-0x0000000000400000-0x000000000057E000-memory.dmp

Download

memory/4576-390-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/4576-669-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/4596-294-0x0000000140000000-0x000000014017C000-memory.dmp

Download

memory/4596-413-0x0000000140000000-0x000000014017C000-memory.dmp

Download

memory/4684-375-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4684-363-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4752-2-0x0000000000440000-0x00000000004A0000-memory.dmp

Download

memory/4752-9-0x0000000000440000-0x00000000004A0000-memory.dmp

Download

memory/4752-13-0x0000000000440000-0x00000000004A0000-memory.dmp

Download

memory/4752-14-0x0000000140000000-0x00000001401F5000-memory.dmp

Download

memory/4752-0-0x0000000140000000-0x00000001401F5000-memory.dmp

Download

memory/5000-659-0x0000000140000000-0x00000001401C9000-memory.dmp

Download

memory/5000-352-0x0000000140000000-0x00000001401C9000-memory.dmp

Download