3a15587bba7cec7315da7a1f9807e98f24c76ba926f8295c39973db388dea1cf

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
24-05-2024 12:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-24_4a0e38ba60a91e8a06b2ca4ca07add9a_bkransomware.exe
Size

712KB
MD5

4a0e38ba60a91e8a06b2ca4ca07add9a
SHA1

6c78eb0cf54d353f019bf621ba3441ac7c154f99
SHA256

3a15587bba7cec7315da7a1f9807e98f24c76ba926f8295c39973db388dea1cf
SHA512

619f7e076cd2898f0e207fe81969a95f05c38cd4aab4a8ece3cb270a72031c346156b5d5eec5c59b36458a0a937c68df2ce7f4052aa761a921c7c8eee1cfca64
SSDEEP

12288:+tOw6Baf6JvY67VMBNO/aXpXI22+VufvdIOKek1h4TA8bXQJYe:Q6BE6J17W8CX32+KJNA80T

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

Processes:

alg.exeDiagnosticsHub.StandardCollector.Service.exefxssvc.exeelevation_service.exeelevation_service.exemaintenanceservice.exemsdtc.exeOSE.EXEPerceptionSimulationService.exeperfhost.exelocator.exeSensorDataService.exesnmptrap.exespectrum.exessh-agent.exeTieringEngineService.exeAgentService.exevds.exevssvc.exewbengine.exeWmiApSrv.exeSearchIndexer.exe

pid	process
4356	alg.exe
4696	DiagnosticsHub.StandardCollector.Service.exe
4448	fxssvc.exe
3008	elevation_service.exe
696	elevation_service.exe
2476	maintenanceservice.exe
1784	msdtc.exe
2740	OSE.EXE
2504	PerceptionSimulationService.exe
4076	perfhost.exe
4420	locator.exe
4648	SensorDataService.exe
1000	snmptrap.exe
3784	spectrum.exe
932	ssh-agent.exe
2648	TieringEngineService.exe
392	AgentService.exe
2908	vds.exe
4148	vssvc.exe
1108	wbengine.exe
4912	WmiApSrv.exe
2132	SearchIndexer.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in System32 directory 31 IoCs

Processes:

2024-05-24_4a0e38ba60a91e8a06b2ca4ca07add9a_bkransomware.exealg.exemsdtc.exe

description	ioc	process
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2024-05-24_4a0e38ba60a91e8a06b2ca4ca07add9a_bkransomware.exe
File opened for modification	C:\Windows\system32\dllhost.exe	alg.exe
File opened for modification	C:\Windows\System32\alg.exe	2024-05-24_4a0e38ba60a91e8a06b2ca4ca07add9a_bkransomware.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2024-05-24_4a0e38ba60a91e8a06b2ca4ca07add9a_bkransomware.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2024-05-24_4a0e38ba60a91e8a06b2ca4ca07add9a_bkransomware.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2024-05-24_4a0e38ba60a91e8a06b2ca4ca07add9a_bkransomware.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2024-05-24_4a0e38ba60a91e8a06b2ca4ca07add9a_bkransomware.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2024-05-24_4a0e38ba60a91e8a06b2ca4ca07add9a_bkransomware.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2024-05-24_4a0e38ba60a91e8a06b2ca4ca07add9a_bkransomware.exe
File opened for modification	C:\Windows\System32\vds.exe	2024-05-24_4a0e38ba60a91e8a06b2ca4ca07add9a_bkransomware.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2024-05-24_4a0e38ba60a91e8a06b2ca4ca07add9a_bkransomware.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2024-05-24_4a0e38ba60a91e8a06b2ca4ca07add9a_bkransomware.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	alg.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	alg.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2024-05-24_4a0e38ba60a91e8a06b2ca4ca07add9a_bkransomware.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2024-05-24_4a0e38ba60a91e8a06b2ca4ca07add9a_bkransomware.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2024-05-24_4a0e38ba60a91e8a06b2ca4ca07add9a_bkransomware.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2024-05-24_4a0e38ba60a91e8a06b2ca4ca07add9a_bkransomware.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2024-05-24_4a0e38ba60a91e8a06b2ca4ca07add9a_bkransomware.exe
File opened for modification	C:\Windows\system32\AgentService.exe	alg.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\locator.exe	2024-05-24_4a0e38ba60a91e8a06b2ca4ca07add9a_bkransomware.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2024-05-24_4a0e38ba60a91e8a06b2ca4ca07add9a_bkransomware.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2024-05-24_4a0e38ba60a91e8a06b2ca4ca07add9a_bkransomware.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\d0436180c3a5208d.bin	alg.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2024-05-24_4a0e38ba60a91e8a06b2ca4ca07add9a_bkransomware.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2024-05-24_4a0e38ba60a91e8a06b2ca4ca07add9a_bkransomware.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2024-05-24_4a0e38ba60a91e8a06b2ca4ca07add9a_bkransomware.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	alg.exe

Drops file in Program Files directory 64 IoCs

Processes:

2024-05-24_4a0e38ba60a91e8a06b2ca4ca07add9a_bkransomware.exealg.exe

description	ioc	process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2024-05-24_4a0e38ba60a91e8a06b2ca4ca07add9a_bkransomware.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2024-05-24_4a0e38ba60a91e8a06b2ca4ca07add9a_bkransomware.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	2024-05-24_4a0e38ba60a91e8a06b2ca4ca07add9a_bkransomware.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	2024-05-24_4a0e38ba60a91e8a06b2ca4ca07add9a_bkransomware.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	2024-05-24_4a0e38ba60a91e8a06b2ca4ca07add9a_bkransomware.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_105437\javaws.exe	2024-05-24_4a0e38ba60a91e8a06b2ca4ca07add9a_bkransomware.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdate.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2024-05-24_4a0e38ba60a91e8a06b2ca4ca07add9a_bkransomware.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	2024-05-24_4a0e38ba60a91e8a06b2ca4ca07add9a_bkransomware.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2024-05-24_4a0e38ba60a91e8a06b2ca4ca07add9a_bkransomware.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2024-05-24_4a0e38ba60a91e8a06b2ca4ca07add9a_bkransomware.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	2024-05-24_4a0e38ba60a91e8a06b2ca4ca07add9a_bkransomware.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2024-05-24_4a0e38ba60a91e8a06b2ca4ca07add9a_bkransomware.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2024-05-24_4a0e38ba60a91e8a06b2ca4ca07add9a_bkransomware.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateSetup.exe	2024-05-24_4a0e38ba60a91e8a06b2ca4ca07add9a_bkransomware.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2024-05-24_4a0e38ba60a91e8a06b2ca4ca07add9a_bkransomware.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2024-05-24_4a0e38ba60a91e8a06b2ca4ca07add9a_bkransomware.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe	2024-05-24_4a0e38ba60a91e8a06b2ca4ca07add9a_bkransomware.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	2024-05-24_4a0e38ba60a91e8a06b2ca4ca07add9a_bkransomware.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	2024-05-24_4a0e38ba60a91e8a06b2ca4ca07add9a_bkransomware.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	2024-05-24_4a0e38ba60a91e8a06b2ca4ca07add9a_bkransomware.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	2024-05-24_4a0e38ba60a91e8a06b2ca4ca07add9a_bkransomware.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2024-05-24_4a0e38ba60a91e8a06b2ca4ca07add9a_bkransomware.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe	2024-05-24_4a0e38ba60a91e8a06b2ca4ca07add9a_bkransomware.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	2024-05-24_4a0e38ba60a91e8a06b2ca4ca07add9a_bkransomware.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	2024-05-24_4a0e38ba60a91e8a06b2ca4ca07add9a_bkransomware.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2024-05-24_4a0e38ba60a91e8a06b2ca4ca07add9a_bkransomware.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2024-05-24_4a0e38ba60a91e8a06b2ca4ca07add9a_bkransomware.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	2024-05-24_4a0e38ba60a91e8a06b2ca4ca07add9a_bkransomware.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_105437\javaw.exe	2024-05-24_4a0e38ba60a91e8a06b2ca4ca07add9a_bkransomware.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2024-05-24_4a0e38ba60a91e8a06b2ca4ca07add9a_bkransomware.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	2024-05-24_4a0e38ba60a91e8a06b2ca4ca07add9a_bkransomware.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	2024-05-24_4a0e38ba60a91e8a06b2ca4ca07add9a_bkransomware.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateBroker.exe	2024-05-24_4a0e38ba60a91e8a06b2ca4ca07add9a_bkransomware.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe	2024-05-24_4a0e38ba60a91e8a06b2ca4ca07add9a_bkransomware.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	alg.exe

Drops file in Windows directory 3 IoCs

Processes:

2024-05-24_4a0e38ba60a91e8a06b2ca4ca07add9a_bkransomware.exemsdtc.exealg.exe

description	ioc	process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2024-05-24_4a0e38ba60a91e8a06b2ca4ca07add9a_bkransomware.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

SensorDataService.exespectrum.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

TieringEngineService.exe

description	ioc	process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

SearchProtocolHost.exefxssvc.exeSearchIndexer.exeSearchFilterHost.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003930aa5dd6adda01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000094825b5dd6adda01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003aef2a5ed6adda01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000017d50c5dd6adda01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c892ac5dd6adda01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

Processes:

2024-05-24_4a0e38ba60a91e8a06b2ca4ca07add9a_bkransomware.exe

pid	process
4824	2024-05-24_4a0e38ba60a91e8a06b2ca4ca07add9a_bkransomware.exe
4824	2024-05-24_4a0e38ba60a91e8a06b2ca4ca07add9a_bkransomware.exe
4824	2024-05-24_4a0e38ba60a91e8a06b2ca4ca07add9a_bkransomware.exe
4824	2024-05-24_4a0e38ba60a91e8a06b2ca4ca07add9a_bkransomware.exe
4824	2024-05-24_4a0e38ba60a91e8a06b2ca4ca07add9a_bkransomware.exe
4824	2024-05-24_4a0e38ba60a91e8a06b2ca4ca07add9a_bkransomware.exe
4824	2024-05-24_4a0e38ba60a91e8a06b2ca4ca07add9a_bkransomware.exe
4824	2024-05-24_4a0e38ba60a91e8a06b2ca4ca07add9a_bkransomware.exe
4824	2024-05-24_4a0e38ba60a91e8a06b2ca4ca07add9a_bkransomware.exe
4824	2024-05-24_4a0e38ba60a91e8a06b2ca4ca07add9a_bkransomware.exe
4824	2024-05-24_4a0e38ba60a91e8a06b2ca4ca07add9a_bkransomware.exe
4824	2024-05-24_4a0e38ba60a91e8a06b2ca4ca07add9a_bkransomware.exe
4824	2024-05-24_4a0e38ba60a91e8a06b2ca4ca07add9a_bkransomware.exe
4824	2024-05-24_4a0e38ba60a91e8a06b2ca4ca07add9a_bkransomware.exe
4824	2024-05-24_4a0e38ba60a91e8a06b2ca4ca07add9a_bkransomware.exe
4824	2024-05-24_4a0e38ba60a91e8a06b2ca4ca07add9a_bkransomware.exe
4824	2024-05-24_4a0e38ba60a91e8a06b2ca4ca07add9a_bkransomware.exe
4824	2024-05-24_4a0e38ba60a91e8a06b2ca4ca07add9a_bkransomware.exe
4824	2024-05-24_4a0e38ba60a91e8a06b2ca4ca07add9a_bkransomware.exe
4824	2024-05-24_4a0e38ba60a91e8a06b2ca4ca07add9a_bkransomware.exe
4824	2024-05-24_4a0e38ba60a91e8a06b2ca4ca07add9a_bkransomware.exe
4824	2024-05-24_4a0e38ba60a91e8a06b2ca4ca07add9a_bkransomware.exe
4824	2024-05-24_4a0e38ba60a91e8a06b2ca4ca07add9a_bkransomware.exe
4824	2024-05-24_4a0e38ba60a91e8a06b2ca4ca07add9a_bkransomware.exe
4824	2024-05-24_4a0e38ba60a91e8a06b2ca4ca07add9a_bkransomware.exe
4824	2024-05-24_4a0e38ba60a91e8a06b2ca4ca07add9a_bkransomware.exe
4824	2024-05-24_4a0e38ba60a91e8a06b2ca4ca07add9a_bkransomware.exe
4824	2024-05-24_4a0e38ba60a91e8a06b2ca4ca07add9a_bkransomware.exe
4824	2024-05-24_4a0e38ba60a91e8a06b2ca4ca07add9a_bkransomware.exe
4824	2024-05-24_4a0e38ba60a91e8a06b2ca4ca07add9a_bkransomware.exe
4824	2024-05-24_4a0e38ba60a91e8a06b2ca4ca07add9a_bkransomware.exe
4824	2024-05-24_4a0e38ba60a91e8a06b2ca4ca07add9a_bkransomware.exe
4824	2024-05-24_4a0e38ba60a91e8a06b2ca4ca07add9a_bkransomware.exe
4824	2024-05-24_4a0e38ba60a91e8a06b2ca4ca07add9a_bkransomware.exe
4824	2024-05-24_4a0e38ba60a91e8a06b2ca4ca07add9a_bkransomware.exe

Suspicious behavior: LoadsDriver 2 IoCs

Processes:

pid process

660
660

pid	process
660
660

Suspicious use of AdjustPrivilegeToken 45 IoCs

Processes:

2024-05-24_4a0e38ba60a91e8a06b2ca4ca07add9a_bkransomware.exefxssvc.exeTieringEngineService.exeAgentService.exevssvc.exewbengine.exeSearchIndexer.exealg.exe

description	pid	process
Token: SeTakeOwnershipPrivilege	4824	2024-05-24_4a0e38ba60a91e8a06b2ca4ca07add9a_bkransomware.exe
Token: SeAuditPrivilege	4448	fxssvc.exe
Token: SeRestorePrivilege	2648	TieringEngineService.exe
Token: SeManageVolumePrivilege	2648	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	392	AgentService.exe
Token: SeBackupPrivilege	4148	vssvc.exe
Token: SeRestorePrivilege	4148	vssvc.exe
Token: SeAuditPrivilege	4148	vssvc.exe
Token: SeBackupPrivilege	1108	wbengine.exe
Token: SeRestorePrivilege	1108	wbengine.exe
Token: SeSecurityPrivilege	1108	wbengine.exe
Token: 33	2132	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2132	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2132	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2132	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2132	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2132	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2132	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2132	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2132	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2132	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2132	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2132	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2132	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2132	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2132	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2132	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2132	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2132	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2132	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2132	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2132	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2132	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2132	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2132	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2132	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2132	SearchIndexer.exe
Token: SeDebugPrivilege	4824	2024-05-24_4a0e38ba60a91e8a06b2ca4ca07add9a_bkransomware.exe
Token: SeDebugPrivilege	4824	2024-05-24_4a0e38ba60a91e8a06b2ca4ca07add9a_bkransomware.exe
Token: SeDebugPrivilege	4824	2024-05-24_4a0e38ba60a91e8a06b2ca4ca07add9a_bkransomware.exe
Token: SeDebugPrivilege	4824	2024-05-24_4a0e38ba60a91e8a06b2ca4ca07add9a_bkransomware.exe
Token: SeDebugPrivilege	4824	2024-05-24_4a0e38ba60a91e8a06b2ca4ca07add9a_bkransomware.exe
Token: SeDebugPrivilege	4356	alg.exe
Token: SeDebugPrivilege	4356	alg.exe
Token: SeDebugPrivilege	4356	alg.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

SearchIndexer.exe

description	pid	process	target process
PID 2132 wrote to memory of 5480	2132	SearchIndexer.exe	SearchProtocolHost.exe
PID 2132 wrote to memory of 5480	2132	SearchIndexer.exe	SearchProtocolHost.exe
PID 2132 wrote to memory of 5524	2132	SearchIndexer.exe	SearchFilterHost.exe
PID 2132 wrote to memory of 5524	2132	SearchIndexer.exe	SearchFilterHost.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2024-05-24_4a0e38ba60a91e8a06b2ca4ca07add9a_bkransomware.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-24_4a0e38ba60a91e8a06b2ca4ca07add9a_bkransomware.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4824

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4356

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:4696

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:1184

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4448

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3008

C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:696

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2476

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:1784

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2740

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2504

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:4076

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4420

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4648

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:1000

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3784

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:932

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:3916

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2648

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:392

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:2908

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4148

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1108

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:4912

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2132

C:\Windows\system32\SearchProtocolHost.exe
"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
2⤵
- Modifies data under HKEY_USERS
PID:5480

C:\Windows\system32\SearchFilterHost.exe
"C:\Windows\system32\SearchFilterHost.exe" 0 916 920 928 8192 924 896
2⤵
- Modifies data under HKEY_USERS
PID:5524

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4288,i,11746347647270949551,7786733067759450703,262144 --variations-seed-version --mojo-platform-channel-handle=3936 /prefetch:8
1⤵
PID:5384

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

Query Registry

T1012

Peripheral Device Discovery

T1120

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\elevation_service.exe
Filesize
2.3MB

MD5
469b71aa761ed17ac78e9e8b491d695e

SHA1
e86e04f307cfc96e407ca3d1dbb95178acb23d30

SHA256
e0fe97f3f941fabf1c65050d7bc0becf40b4bed46ffd1942f6f0c2632704e68d

SHA512
012ad735533a1074b88f569d860cb85cf372bac81dc784871d7f2b1b196da4004ade9f3e8c6f2e91c999925e7efe95d393a116dc0c27dbb3b9ade118039ca6ca

Download Submit
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Filesize
797KB

MD5
468e21431b7b4add58840f386acee98d

SHA1
e09d24898e62dbc92bc152b11ae7210243a01ddd

SHA256
209d9bcd9782698d06bed28b9fa36f3269bc8cd1c82c4d2d4520651e20dabd1c

SHA512
d96a8fe17dbd0654e9352c42297aa1d6e9df09c8bed35229f3ed7c555718903ba9cea8e4f83d7dc799e34f5b5042a0d8271ddb21c396ff91918e962d90401926

Download Submit
C:\Program Files\7-Zip\7z.exe
Filesize
1.1MB

MD5
9c8750dfbaacba6c9e06588b410dc199

SHA1
7cbc66c92bc6883c28c8b73382f2524931a51233

SHA256
03a868754a9f57cf253e32f334cd34903b1b0d162fd89a04ef86d341625701fc

SHA512
eb099da7e5403c8b6e30e3cfa8537e64db7f71bb8dcf0a2497811432e891f1e22e43a833a2fe818676d4c45bdf31f278674a7963412f5e1809ebda5267d626b9

Download Submit
C:\Program Files\7-Zip\7zFM.exe
Filesize
1.5MB

MD5
5921abd503fafe8bae1856795f8e0cdb

SHA1
51faecedc57d1f4a331cb58e978c0daa8eeef588

SHA256
4a8a6739ad1a2f08a27aa7997b5a77baf906c8c36e3990693c06bde88d7d7698

SHA512
aaa88bbd2f06762fc246c2fe16d83d7ebeec6749f63bb016147d81c9f43474786e9e36ed01c8a877c5880bba4a17ed7d7ade7058b618e097aeafa11f1f8b4636

Download Submit
C:\Program Files\7-Zip\7zG.exe
Filesize
1.2MB

MD5
192ec86c2fe3ce5673e0d7e797439b0d

SHA1
aa8a965f7376fd38218cfd0f5ba68123361aa22a

SHA256
7f308863e0b361cbf3fb49854b8a636f1960f803a29f0134bf238b20b7ecc9bc

SHA512
f909873177ed06f95cecf2ba8699a5fd8050627a3c034e2dcbeb55af34f4956dff0536b0545c7c5d616a7753e5ddf2399ac4ca788aa43ab55b3186f06f98f4e3

Download Submit
C:\Program Files\7-Zip\Uninstall.exe
Filesize
582KB

MD5
962b0cb8ee117f9eec561509222b95b6

SHA1
bbafbf9046c6c3298518048fc4ae9d72dca1b92c

SHA256
a3cbf7fa6c5e6b5ff3e2a44c0c7a8b05fb60e6e042008753aaa49da34adccf5a

SHA512
10296a3a85b542b7e69447c8cdcea2b20b69c7b7bcda6eebf023c4ecb4eb6a539b96ed18f0b442116b754d980274e444b97b38e7fb94e7546a2f0db359a84867

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Filesize
840KB

MD5
39e7aee6d47b6348ed2eb900f978ff41

SHA1
baf01dd55e807e880b81cc8955f8209454616d76

SHA256
b4a89de747ae3b8482a120bf08d73fd5f8c4f41119f34189b629ac0181a56d08

SHA512
610be54f4bc3899d0052e52d9babb302a775d5362d8ab858d25ac5e633582b4be91e93fb6b7efa0b7a3e01a2e01407395e9d64a97ff801c324d93350d208cd6a

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Filesize
4.6MB

MD5
7c19bdfc8e68d4e6d519f9e4ca675a27

SHA1
6cb684bee27e1c7a1492f4c31028a69b5f9a8a63

SHA256
e384c80ef36a97189322c37df5c6d0b192130ddaa05a838ec9f6f799058e05b5

SHA512
72c28b786833777c952df4a7d269f928af5011b5694bbec7d48f69e88cd72c99ddec4008ac4f012dd4e29f074384f83b0d82403c4636a9b9128e2b4d7cc152bc

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Filesize
910KB

MD5
b57c17e4c54ead71ccf7609aa31d8059

SHA1
44b9db0c57c8587a26fec4aba70237dbe953948f

SHA256
46f6e88e3e0dd8d7a38bc9195923e1c1b2067eacd379b1855015a670cda26a96

SHA512
bee2c443c5d3478623b3eb8c42bbf3674f9f0b6868fc9db8014f361cee80e4046f617c2fa1addc47caa8076bf984287616bb465a6e23623c0ba889f9e1803df9

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Filesize
24.0MB

MD5
68ffc0a59557c08a773b68453006aa10

SHA1
0d37f20e00c718e4b73a4f577cf1d4a9e2514ba0

SHA256
a451c7f2c19a756ee27b22a6565b03b9b49311524f3033df2dbdf8a92f338dde

SHA512
625cb03bdb0c1177a6240fff15c46ac1854d1503add51fbb1a1f82cd4789722dfcf9b9f8a93b3e071569837f37a533f4d5b4f79a028492bc56585a791a1d0491

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Filesize
2.7MB

MD5
3cf7cc1cfd79ffa9df3bf1239b6ba022

SHA1
e74e286c94605d568cb993298aa7116f24c1d9a4

SHA256
b05e8ecc40a176c68dfdd9a7f135e17ed1cbfbb4a7126a2ed4fbff85af7a31c7

SHA512
7ef598bc88e6855151410c4f1f723969808fbf58970b32c133337e2782d6fcf453506e0dde5d80debcb195578ee393b4e8d02423178efd381c2effebbdb516e9

Download Submit
C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Filesize
1.1MB

MD5
b723b98f818238c65aaf1d604facacf0

SHA1
ac67b38a09371f29879529304224eacda102ef04

SHA256
05e92711d894a442cf1a98343072ea269f6969a53b5ad76109a0eb78a283cfe3

SHA512
e5173c06749c26cec65ba68bbc6629d2e9ce049a549d9987d302e41c6966bee8846ff52fe86828ac70136cf5480b0020a55ca2a8b84d436135aad9d7f93e78c0

Download Submit
C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Filesize
805KB

MD5
581489cba14d88b001212012d1179597

SHA1
cb9f0d22ee84f9878340736ba5e37cf343401fd3

SHA256
e56042e3dafb412823ef4d5e8c5638f0784267e0af42605a9cfafd4f2957eeef

SHA512
b7c4a66898bb2181f19aa7d5ae1d3549a31f96de65db2b12d4e14a765918b8adf8d19becfeeefb79664a5c491eb42578b51d1622a5f2fc2dc424f42917ef7318

Download Submit
C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Filesize
656KB

MD5
b953d616d433c95e071b593fdf76c22a

SHA1
3628a497a91c8bcb521a5ea0c57d955eed42ed35

SHA256
9a623d3824802a98ff16e95eddb1dea4e88c8c91567a45202ba65dc2a6c8584c

SHA512
2521d1eae95ce6c76eefe28d98e77885ba729de8017b36714b987a172a49ea661510bb1ddfe61c08dfa2d307023dbae4bdcd45397de2bd8a7e549cd43060e1f4

Download Submit
C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
Filesize
5.4MB

MD5
ca30fda4e1b6e3c62ada7a49b32ef469

SHA1
cf786d79a2b22a8b16fbd06cdc5bd7b5d854f15e

SHA256
bbecea4669ca7d2e9bdf2123f5d326bfa56fcc13b9912b118f75182eba5543dd

SHA512
1210ebb3cba9cb3b1e8f5720e1807b7c25f15f99de81e314cff6daade5f4518c1501ad2571c565f2542526e4f9cf100bab2e01ef4df598782d9b9dbc54dce738

Download Submit
C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe
Filesize
5.4MB

MD5
02f45a9284ea1cbbac3c6303a25780fe

SHA1
e02ffc0c944bddaab8f23fe7fd7187a5b8b2e869

SHA256
5c4f3894271665fd2f854f7dd4e4f096cf7a8c4f03fdf3616cb52bb64679dd69

SHA512
5bb205f53a95aded4e30c1abf813b0a2ace5644b9ff0c85dc9a4a841945dfacc4e171207a42f8006977ecd4bc013cfd4825610c8225996fa404d77d773dca0e4

Download Submit
C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe
Filesize
2.0MB

MD5
8a1912892f4814e3e932a7ac28ed0c41

SHA1
bea0a0cf39515fd69b89c684b532122e02d6bf9f

SHA256
aa4080c4847ce1ec121546ec3a8e02783e8d476ffb17ad093151b1391dd16d84

SHA512
6fb01ef4eefffbc16c9ef74d8ddd8a957feea6de552c347d94a472a47c4dfaf6a15d10b4256d7c03b5aa91add7ed0bf4c2eb3cfd7c59a2e747fb07e0282e7d64

Download Submit
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
Filesize
2.2MB

MD5
f0fecd04b95a1696a18f44c0e9372c38

SHA1
28c527d6cbb3d963c560458a33576db2ac40b662

SHA256
e1eded98117556c07a789217804ef0d4a12846c9bd721d488f6db2e93b52c022

SHA512
b6313df2ec9207002bfce35793084a5cd3a745a59882cf9806f198d8a97ec999b17e13751ec8675f2f124e9dca399fcbb74196c8bd4b0ec3d6f8078dcabce1a8

Download Submit
C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe
Filesize
1.8MB

MD5
e99e2161261af9bbbaf4540bf36da0d1

SHA1
c47e4b6cbf02da1b35832026ebf9ba61c176f428

SHA256
785cd61760cf5c4bfc3a06b44c1a8735cc4811d44dd2a34b68b51ecd9e0ccadc

SHA512
b29f2375edcd4df4479e17d88a1d8e9c624a0ff313954d28515ddcf57c5f667dd7aaad5a43b7992533c152967a52e0a1b9277b04b9b97d0950c494148b6e5847

Download Submit
C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Filesize
1.7MB

MD5
f4a38735f9e37fd3e1cdb311ee1742a0

SHA1
b08a7e603a84a6e3d2db9e205db905e69849ab9e

SHA256
935e88cc4812056cd5cd60878e3ede20d9ddf1728f9bf1ba49181b0c9934d16a

SHA512
6e3a8f49902e7d128d87cf5ffdbd560c44efd7bcbcb88f207997709aec1024353347b66dad2f3b88a8a3b15527fa18b74cd0fbf9399eb2804669c4ba5d8eecd7

Download Submit
C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Filesize
581KB

MD5
6e66c0decae940fab68b5f78456f951c

SHA1
02c18c05a91cb0ac2d475e81db1e224c872cd6c0

SHA256
3ff00044fdde39603c52dcf34e54b825856bb67084261314ec2667854ff0aee0

SHA512
ff3e9399689c20264148b177e7fbb0b59ce36ee4d78b55adfc5fbf88819d4e36a72394180b5f041fee2b49ea4057b6b14ed946889ee2dfbea5876ee4d0154599

Download Submit
C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Filesize
581KB

MD5
85347492515e44ef8af07d173e9dfee2

SHA1
27c2a9384bdce0c74395cfbbdc22fa55c77cfd2d

SHA256
a0519a0e51f472dc7410def5df7cadeaff73bef969c03f7b2255c0ae8e23b38d

SHA512
17968c1894d1d5d0e8bbaca8079becf3e9639da1251e5370b6fa1de30a75b3f6586ca1ade2ddf4ec92514dadeb81c80339364b7e4ab4dfdf0888c8d99bee7da8

Download Submit
C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Filesize
581KB

MD5
b78c691690333698856dcbedaf23f614

SHA1
67906ded7baaced919e8c549ddc2b14ec2e10083

SHA256
c0b1a6390e5979be1e378664ab1f78b3bbc4bf17ebfd38b9eae4648f2374b928

SHA512
c5e6c4ff05c8a3c1983aaa0e3fa95e6c0590f8f72b7189f3756fb463f6cf080c5b9de4d0bc074c14a9c24a9a91d6d53df7654c7c090fe660d9b46e3ebb2d6f5f

Download Submit
C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Filesize
601KB

MD5
5bffa95ec0bdd143cd2f3a205794c528

SHA1
d690e25db7c49b300c12db8dad4a51a3571ae2a7

SHA256
8cd150aa156101a27934e64443b246afd17a74f62d2001d36e22fe4391606748

SHA512
d22f0252599c166ce19b7ded744f1ea93df5d202d960b8346eb020bd68c2cd46db9e7eb4cdfcf13e64de20949ae4a89b93973f6dd0ad67795245047a71915ca0

Download Submit
C:\Program Files\Java\jdk-1.8\bin\jar.exe
Filesize
581KB

MD5
05cf152ac290d95e68ce9bebd90ae118

SHA1
f361747389ee45cc1fcf4dc6c2fa4bc7b59df8c2

SHA256
aa8f4aceb9994d14f2fc5fc6122ef1442f148326e41a70cc9cc7c54b17c00121

SHA512
5387b6c666b6da8d1fe8cf8ac0e4ae817c6f3e9e2ed348b6bf7a651993bf1c74505b3e71f3816e356d3567b6a97e80d87e3c55a9a82dff413d1f39ccf0dae4ab

Download Submit
C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Filesize
581KB

MD5
9b31d0f6046acabd792367c80e341040

SHA1
bd119d6a821c3f3c526642aad7cc27c12b91e1db

SHA256
a2846f475796992b29ac21367db27aa6472d9e26839b2a4b9af4680cf849e308

SHA512
995c4ffd2546c7af48560ca732721991611df61b7ec3609d0d7cc038e503cb7cc62dd7befeb163f46586011f313a361891fa0d8b62469da1057d6a27f50e72ec

Download Submit
C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Filesize
581KB

MD5
1a793fe3dce3d4edd8863f42dfff806f

SHA1
1d410950e6761c493dca3b5ceb1eec59390fa999

SHA256
d28aaf3e9c2e180555f2f6f249ba63361ba1d00215ebd619ddd118dd911755f1

SHA512
f3500c38d7511f4721e18c38e4111388e6e4c2c71fb65ff693e54721eb28ca401486cdf7cbb723890a964b63b02143741a7baa8bcefeafd13fcb767d3c348f9f

Download Submit
C:\Program Files\Java\jdk-1.8\bin\java.exe
Filesize
841KB

MD5
0b528ae05b7fb9f067912ce344d9948f

SHA1
a302969d45f20a9e8f7cf329cbe0ad25fad6a570

SHA256
f4683c7c35fa979bdd8412c6bd5b1f64c1e277fe32a44d978fc769ac1d366d4a

SHA512
42257c81b53d191fa29e1f2b4e6b07ac058ce9fa266752f0982f8527b75ed2ae2c880b040e18f948cf2c6d64e615da22c02636fe284ad859b57758d9d40cfca8

Download Submit
C:\Program Files\Java\jdk-1.8\bin\javac.exe
Filesize
581KB

MD5
1cb95b98c4e6031583c3ecaa53e126b1

SHA1
1d7a5bc4a5680549ea236fd1498b029e5ea3beea

SHA256
dabc3c5779028d73364d4b639fcb0bb2f1fd754c74c3801f5ba0778e68e776f3

SHA512
dfb2a31f33cea0bd6ebc2cbdad1d826a35a75dd06003fbd96a67e31093368f4a97bfc9b50601770993b38bf4891a942251172e4d19c770e65efbcceb5b9f2ab5

Download Submit
C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Filesize
581KB

MD5
ae9e6c24ffe5fe5cec7c17ea8ba56a55

SHA1
87e1942cd4f1e721f149d149a9963fb616e5604c

SHA256
1ea5d76bffcc829751d3124acd1918810efc2762c24e57dc3bb58448541bce29

SHA512
0c251e2fa22db25948dcd277236da3a3310fd1480a364bbfa55d26a85faf2d7c6714485e31ed785ea8cc4679ac0a9a6b6ecbc107dec4a632aadb245319471b0c

Download Submit
C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Filesize
717KB

MD5
c275b9adc4d97031aaa7453acb5c6188

SHA1
513f0c245c4a1b2d7b8eb2dee785facf8927aef4

SHA256
35f5807ea859f06b155f72da9663ac74d3e74d2e5133006797a94d5d2a3fd964

SHA512
4fd3351649784b3e97dc6a275058dd0ab2b9051ada467e4c5b27123bca2ae7983f23d7c6264c60a91b42baf017cf5968122d7aabeca3a6557b7ba47a9c4007bd

Download Submit
C:\Program Files\Java\jdk-1.8\bin\javah.exe
Filesize
581KB

MD5
a484de52a84fb902d8f8b256ae3f73fb

SHA1
109835ea370afa485ebcc6fac963112e9aaeab92

SHA256
5937af7afe82333eaddae83ac6a5eeb66fcf170e6612c324526e28742eca5096

SHA512
7e541f229069b5212c9b56b3c2c507e04c100001d48d068aa2c9f2e7915e6aa144416192c0646f16357209cc2ee6fd35558443a96ab558250888c2e36f45430d

Download Submit
C:\Program Files\Java\jdk-1.8\bin\javap.exe
Filesize
581KB

MD5
5b68653d9d474f1ba8df8112281fa462

SHA1
fca6c91e0e921ba421d5185319d3845e611df837

SHA256
59851f2ab7ebb79b729df7123e09d5fed2be8bf9d06fb80b548c3b50ce0261e5

SHA512
5b6e429bce707c171976af853b55f5b75e1289dff2de3abe02937279812676180de2acf1b6197b4eba80047cfbda8e55a9ca6d53d2bbbb92823de32014181162

Download Submit
C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Filesize
717KB

MD5
85b552ba8eb85c288519d6a9cbed7d1e

SHA1
ff25352c6977d1b38b4f67f91c286694c0ffdd8e

SHA256
7a415eeef06f67f24d69dcbe0d2c1266ed9dbfb0a483202136073e92c4782773

SHA512
57ee52bba61b42660c1ed98179ec01449fcf9e8497018b1250aab5c72617e365897138e0350914f18d9537b7dbff776f48f8edac5a2826ebb51a72472a6126ea

Download Submit
C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Filesize
841KB

MD5
d996f910459f9fceeb18e48fc283b77a

SHA1
395880e918209711187d43426dc650d2251e9ade

SHA256
248c750d99ec0c0f2da85ef08703072aef203bb0d16c2a5f903e14f72fe31251

SHA512
9875c896b9cc48386e3d390504828b1a7afb2d7bdbb4ffa4ed34e69251bb9c6d9b8269cca6f08ea833899999c2895a5385e35f95beded483c6e3761ec51e49db

Download Submit
C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Filesize
1020KB

MD5
33bb04f00eb63b8722f1d8cf130b554a

SHA1
bed6bcb69ce49bd181b397a5b3993f03e483ccbd

SHA256
2703aa63ac30e0cb07e4410b16af715ef55627f57e40ce221362e66af57d9c29

SHA512
60928f12f8fb316b5d93581a57e0d693a8e5ae82795b05d80086d76ad594cbda068f1e2099e17a264b77a494b9ebca58b98fd0a1b24f92dd6fcc0d55b02a3647

Download Submit
C:\Program Files\Windows Media Player\wmpnetwk.exe
Filesize
1.5MB

MD5
83e6b0725b9a842833093f1a4ce3e51a

SHA1
b525a4fcc7c8297b754c85f5c299b780e57ed36e

SHA256
464819fe88e4d1a3bc13aa834e1a3feb214ed59bda808189e1bcf6709404f1ec

SHA512
cab791e522613df5725bf48dac83e197e85441ce3ddff495c39b4435c35b58cf089a466a5c2c7b16474548e1dbdcf1b464d43552b7b8a6f946a28f0eff03e65e

Download Submit
C:\Program Files\dotnet\dotnet.exe
Filesize
701KB

MD5
8bc5493bdcc680b35546fa3268e53747

SHA1
c17b442e893ddac0aa15873f5cf773757b86af71

SHA256
b89f9e271b24d31499f3567099e91a47cbebbfba2cef67b8b40b246fff5d46de

SHA512
7675173248041e3c056d1ad915fef1c4f804cf7f1a0993d265f8dd99a98fa1ff6a177f632efaa8a93593eca1fdba2762ee06ed9f6f9fcc3c5614aa761c9b66f8

Download Submit
C:\Windows\SysWOW64\perfhost.exe
Filesize
588KB

MD5
1dd73a46cbd1d959fb09ef84e325358c

SHA1
a4a354052eff644ca43ff6c152ba13ef94ce5f47

SHA256
822b7f58b45021ff601f0ea13e6335ea05f9e42c489d02275d11b0d644ccf7f4

SHA512
b4e638403433e2414ef2d1d6811dffafda39d0ff4d8bbabaef4eb7d24129f7f71b5c42ded25162875b0ae20da9c7916d5f1894700378e6066965db314a1217eb

Download Submit
C:\Windows\System32\AgentService.exe
Filesize
1.7MB

MD5
e075334a7dba87661339772093155471

SHA1
ef425295e1f36a71c962e66d0f16f8a67195252a

SHA256
12debdff33e1451d0ff180054090fe552a51febfa266577c63a77d2d3edfd6df

SHA512
e367e946c98bc322c7d4b71b44ea5015555f5e23df164d808ee8213f0033130d8bf4a19ffe716bb1d896897247a3e110d6372486715dd58819a6a5ccf65e7251

Download Submit
C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Filesize
659KB

MD5
9b328f5c8f43dc2bb652653c1462073e

SHA1
9a5fced64675172d52175e814689ed7ff8ed3741

SHA256
e189075277ec1d67a78439510fdec4e9e0a6d6ee558c3c86b0d989ea63c164ce

SHA512
0126df3ab6be3dfffcd033451d8e1d635a34eca7bfa4907b9783cff4b4a850fd9cba6510e030172708c86b96f9271e92123af9c35100f0695cc564fc53473100

Download Submit
C:\Windows\System32\FXSSVC.exe
Filesize
1.2MB

MD5
a2abb61fb8f202f006da888232b9c478

SHA1
a42356f254065ffda673522de456c5ef2c126507

SHA256
447ee7bb206ddca6e79f3f5c620a8ae5dc37acaff0502f68107bd9026a1b3739

SHA512
fe2442919f8cde9f38b5fd4dd2310d19ab6251932f23f06fc00c3bd0548b4fda1823d6f2ebbd7f66cd6174d9e5957587887cbf88705560b676e96d392dd0fdf6

Download Submit
C:\Windows\System32\Locator.exe
Filesize
578KB

MD5
2b0b90490d6ad0104896f37637424f9e

SHA1
a3b2a50b696e2ace8d869cb5bdd555a91fe55d69

SHA256
975cfbc4ea095dc45b60dbd036a50a6895c0a332589e32eb75d686a4f67e6502

SHA512
e0a407c2895d837f2740f8c7f2fc1d616dc88ac3e5428ef76dc50da7d01e7c7af42fbe0350c44da5e3a8f2f6a60cf5bc73eb0c00ce54fdaabd4c7a9e905d6cca

Download Submit
C:\Windows\System32\OpenSSH\ssh-agent.exe
Filesize
940KB

MD5
a9c7ee386e04711f1a6e71360776d79c

SHA1
d8121cafee452b1fd0d7ad7cfe7beca40119ee53

SHA256
34b598fe89d0bc13179d779bc751c8b26a4168c09f2f2026be38895928fa63c7

SHA512
4eb8999832563c36eed640f072881d8bd20208b3396e5d4e2a9082dc4201429dbc3d1daf187cc472438117cbf424aed03d5c0d1a31a92580c5c719695abd8d38

Download Submit
C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Filesize
671KB

MD5
c146934d4c401876916ac316ec25e7f2

SHA1
4e2a7fc83020903b7f7e7d100463ba5f6c00146c

SHA256
81be0d8ed0bc2689c0ad17b0a5accea39ec11972e5ec04ccb2e5ae557e1a9adb

SHA512
cf2483b8938f48d71d2b1ba00c3ff92f76883daf71e88fb995cf5d6a218d482a9e6bb6f66cd338bd0327e09380cf1265140ce7b165f8e51396f3c7e64d4cf15d

Download Submit
C:\Windows\System32\SearchIndexer.exe
Filesize
1.4MB

MD5
45810b74cae9869c2b6faba39c622dd8

SHA1
eb36e0be620d561897a29b8cc5df2540fec5f1a3

SHA256
ccee6084bc64f0b05dd18b99fe4526d9238a7a7bfdf075ed6b30c662bde425a4

SHA512
5e381927c315678af5c4c75c217606125bdc9aec81a45d0d6f09b8648c2ce8e3e84a67d11ea4b40578875f09541dec1dbd1bb6abe7b0818a1fe5ec6a7060dcda

Download Submit
C:\Windows\System32\SensorDataService.exe
Filesize
1.8MB

MD5
aaa74c48d813244ed618a39fe0295a35

SHA1
546fba2838407d6f75cc409cfcdb1b4689aa7463

SHA256
2eca162e8a93012603bfb23029500051c4f377635ab73bd8c1b6fbe05282cfb4

SHA512
403376abca62039d40a8f177f65288653bc8a05872b65a23048167ff0a0aabc57f968944e0103b833bf448c026a186e89bdb7f29a70816a84944c1e7b1040643

Download Submit
C:\Windows\System32\Spectrum.exe
Filesize
1.4MB

MD5
ae1d461e2f72ed542d115909d4833146

SHA1
0fdbc27fbb6fdce922614c10a74c3d23fab1de18

SHA256
1b7e8f28abb5e31279874ad6ed0ff5c40d23be413d01175974a438f1d5bd607a

SHA512
cbd4e79bf20bce73787d2ae9762ac7158542aaa4b53a576761b827fc78c5073bdac0c951501e995b957627368339b92d1194d1591eac770b32a6539b6e2935f0

Download Submit
C:\Windows\System32\TieringEngineService.exe
Filesize
885KB

MD5
e7ad1d08a14716e4fc60dad6138de4f2

SHA1
0581341c683501b23972caa35309b6528ec01f18

SHA256
da578463aa9f6956a222aec6ebfb52a98c7d6a0b6cafa67389bddf48349074c7

SHA512
5474c992cc5d14d4c310f78f95360daed77ef040c74b7f08ec9f158d5fcf1be3635a130c410d3802955993752fc381f82f54f6f07ad25198c2fd387d71e03d99

Download Submit
C:\Windows\System32\VSSVC.exe
Filesize
2.0MB

MD5
4fb5fd65f34ad8534bdeecbe2b30df54

SHA1
556563d3260efdab8efde365fa9771452273f40f

SHA256
f116afab050799df639bd53a352981778ef7f87b3906738253c5993499afc637

SHA512
f1ee2e587147f0f49d9e6f189a1efcb82f243c48dff1c7da980712a2306a8bab27ec3475d2f1dcb2ac1bafc2a65f2a09bfd8bb20d39e6fdf8a29d43228452933

Download Submit
C:\Windows\System32\alg.exe
Filesize
661KB

MD5
5ceb300a95af935d7ae280eaf61a6b74

SHA1
8f3edb9c5a8ea360a90d572c7cd593e5163cc2de

SHA256
cc278f64b596bdde1190c49b3c938bb2689bee6dcf29d8234b55d56140f9111d

SHA512
7b693611a571949bc714f056427dcc90d766a42bdbd851dcdc327b9dc1a4f092be444ddaa879a2d369200deaba06ee6a8eb53c873754b0240a23eed950942f65

Download Submit
C:\Windows\System32\msdtc.exe
Filesize
712KB

MD5
8a59839ad110f02e174b039013558721

SHA1
33acc7748027bb6c192bea90013ef8c0859d7b22

SHA256
6c0475e525d67ab7b3d03b3362937a1df0b432864205e3e5f999a85e3a0461c8

SHA512
416a759f0fc4bc9d32e46826529e83dac3ffe7fc0d47aff90f98d58f78b48160a88e4dc289476dff111537a10bbc859ff29ba0e8de5709548cd6d6ff73116ab8

Download Submit
C:\Windows\System32\snmptrap.exe
Filesize
584KB

MD5
25d8a7cf6f6acb19d942fa48176c0ffb

SHA1
5789ec254e9e90c82becf2ce60912002db16feac

SHA256
8f1bbc3efbce8cb8f25141f1f8039d3ec0702532dd7192cf44a5e5d9d3520210

SHA512
83365d5d79e3fc61b0cadd43b30ef92f6f4e7a98fa138209f2a44ebfb2de0ef4793e08f0986378c83653ddc4009c13b8cdd46213d530e429932938666a0af99e

Download Submit
C:\Windows\System32\vds.exe
Filesize
1.3MB

MD5
ec39c6122ce7a271184ab7fb8bcbce6a

SHA1
ae2fb017c7be7ca425b134202052b7da592a40da

SHA256
daa58bf6b3e49809158cbc8a4eaac6d66397e1dd961344f9e7958ff5e8fc9cbc

SHA512
13e2c157a33862de2d900f0f964b25a939ed9f12a3555b833357edc7183535360b1217c46ad539cad00301069a94c20a023e65352b5e96c297f3c392c93882d8

Download Submit
C:\Windows\System32\wbem\WmiApSrv.exe
Filesize
772KB

MD5
89ff6a0de4ad9107202f100e40380d64

SHA1
94a8f009d0d37114ff1bdd959f98e16280f20319

SHA256
5dad043ece7d19e3c54b033f5fdb8f1747f2281c76bb6db9cbb3a17e5dd12bac

SHA512
2bb5baf97c2f41424cbef436884e52159380bb5b87073683360b86aa6da1635e0aad3ec6b3d2f704051505b243d72bb3271b66039dcce1877cc6dc49f4bd2f45

Download Submit
C:\Windows\System32\wbengine.exe
Filesize
2.1MB

MD5
fcec8f992c33d1cac97db6a48cd0d270

SHA1
ea8e1c7e2fe313136802f6479772aa7c306b995d

SHA256
68ef3233abc039e550809de9a39587772fdc2e084538b714c8b8d4b3e3e9350b

SHA512
439d14a2392a8e91320a738e682bbd39a5030a86cb005ea38282bf739b30cd97bc94a56ce3f6daa679d1359b5cba6bfb067e809b2e4ccfaab5f395f4ab56f385

Download Submit
C:\Windows\system32\AppVClient.exe
Filesize
1.3MB

MD5
e895901aec64f58fcfdd560f2baf5826

SHA1
28c759a1937380f501fdc6b4b31029c1f62554ea

SHA256
7a1bbb463f2667943d14a57d5ceabd10db67d85a2b94f8deb85d9764c7f03ffb

SHA512
9f2dbd76c4cba425a000ec6154529748425e0b84c1ab6bb796064b336524d2708752bd7f07ab67b96d097f92cba7d9e4b1571557e4561d6439cb8fd0bb16105e

Download Submit
C:\Windows\system32\SgrmBroker.exe
Filesize
877KB

MD5
c8c300e39886029bc0700424c03a666d

SHA1
5f6812ffc91fffa3e2493c9001850be39ec83a6e

SHA256
e79d1d021c40904f3072067e9ae7a6ffc0777e81af0b5ea8e56feaabb6503a17

SHA512
91e4afbafef3d1e9da33a985e83e5b278891d38ef9de2a5e3a2900a3d44798095311a9b2bf9bad95d194b2a53a008b4dd866ec1e379383f8a1e3c5f833a4b763

Download Submit
C:\Windows\system32\msiexec.exe
Filesize
635KB

MD5
1f3cf4d4b4d0780f6cb114ab21085f8c

SHA1
f592d79f9c338b652796296243d1f5f64e3c4df0

SHA256
7e48cbd51008415c740bbdd33bae6d422b157d17793ae1b6848de16eb506054b

SHA512
52a7ee3962cfb6712e726c5c51e0d863a319a06ed29339d78032fb0f7dfe05600ea9552185c2d7c5ac631553674a0477734332ba2e7a84577ded715a46d8664b

Download Submit
memory/392-222-0x0000000140000000-0x00000001401C0000-memory.dmp

Filesize
1.8MB

Download
memory/392-218-0x0000000140000000-0x00000001401C0000-memory.dmp

Filesize
1.8MB

Download
memory/696-64-0x0000000140000000-0x0000000140267000-memory.dmp

Filesize
2.4MB

Download
memory/696-65-0x0000000000990000-0x00000000009F0000-memory.dmp

Filesize
384KB

Download
memory/696-71-0x0000000000990000-0x00000000009F0000-memory.dmp

Filesize
384KB

Download
memory/696-186-0x0000000140000000-0x0000000140267000-memory.dmp

Filesize
2.4MB

Download
memory/932-187-0x0000000140000000-0x0000000140102000-memory.dmp

Filesize
1.0MB

Download
memory/932-564-0x0000000140000000-0x0000000140102000-memory.dmp

Filesize
1.0MB

Download
memory/1000-170-0x0000000140000000-0x0000000140096000-memory.dmp

Filesize
600KB

Download
memory/1000-443-0x0000000140000000-0x0000000140096000-memory.dmp

Filesize
600KB

Download
memory/1108-255-0x0000000140000000-0x0000000140216000-memory.dmp

Filesize
2.1MB

Download
memory/1108-586-0x0000000140000000-0x0000000140216000-memory.dmp

Filesize
2.1MB

Download
memory/1784-92-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Filesize
384KB

Download
memory/1784-88-0x0000000140000000-0x00000001400B9000-memory.dmp

Filesize
740KB

Download
memory/1784-217-0x0000000140000000-0x00000001400B9000-memory.dmp

Filesize
740KB

Download
memory/2132-282-0x0000000140000000-0x0000000140179000-memory.dmp

Filesize
1.5MB

Download
memory/2132-588-0x0000000140000000-0x0000000140179000-memory.dmp

Filesize
1.5MB

Download
memory/2476-75-0x0000000140000000-0x00000001400CF000-memory.dmp

Filesize
828KB

Download
memory/2476-76-0x0000000000C00000-0x0000000000C60000-memory.dmp

Filesize
384KB

Download
memory/2476-82-0x0000000000C00000-0x0000000000C60000-memory.dmp

Filesize
384KB

Download
memory/2476-89-0x0000000000C00000-0x0000000000C60000-memory.dmp

Filesize
384KB

Download
memory/2476-91-0x0000000140000000-0x00000001400CF000-memory.dmp

Filesize
828KB

Download
memory/2504-236-0x0000000140000000-0x00000001400AB000-memory.dmp

Filesize
684KB

Download
memory/2504-117-0x0000000140000000-0x00000001400AB000-memory.dmp

Filesize
684KB

Download
memory/2648-581-0x0000000140000000-0x00000001400E2000-memory.dmp

Filesize
904KB

Download
memory/2648-198-0x0000000140000000-0x00000001400E2000-memory.dmp

Filesize
904KB

Download
memory/2740-224-0x0000000140000000-0x00000001400CF000-memory.dmp

Filesize
828KB

Download
memory/2740-114-0x0000000140000000-0x00000001400CF000-memory.dmp

Filesize
828KB

Download
memory/2908-582-0x0000000140000000-0x0000000140147000-memory.dmp

Filesize
1.3MB

Download
memory/2908-225-0x0000000140000000-0x0000000140147000-memory.dmp

Filesize
1.3MB

Download
memory/3008-173-0x0000000140000000-0x000000014024B000-memory.dmp

Filesize
2.3MB

Download
memory/3008-50-0x0000000140000000-0x000000014024B000-memory.dmp

Filesize
2.3MB

Download
memory/3008-57-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Filesize
384KB

Download
memory/3008-51-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Filesize
384KB

Download
memory/3784-476-0x0000000140000000-0x0000000140169000-memory.dmp

Filesize
1.4MB

Download
memory/3784-174-0x0000000140000000-0x0000000140169000-memory.dmp

Filesize
1.4MB

Download
memory/4076-129-0x0000000000400000-0x0000000000497000-memory.dmp

Filesize
604KB

Download
memory/4076-248-0x0000000000400000-0x0000000000497000-memory.dmp

Filesize
604KB

Download
memory/4148-237-0x0000000140000000-0x00000001401FC000-memory.dmp

Filesize
2.0MB

Download
memory/4148-583-0x0000000140000000-0x00000001401FC000-memory.dmp

Filesize
2.0MB

Download
memory/4356-13-0x0000000000790000-0x00000000007F0000-memory.dmp

Filesize
384KB

Download
memory/4356-21-0x0000000000790000-0x00000000007F0000-memory.dmp

Filesize
384KB

Download
memory/4356-12-0x0000000140000000-0x00000001400AA000-memory.dmp

Filesize
680KB

Download
memory/4356-128-0x0000000140000000-0x00000001400AA000-memory.dmp

Filesize
680KB

Download
memory/4420-139-0x0000000140000000-0x0000000140095000-memory.dmp

Filesize
596KB

Download
memory/4420-260-0x0000000140000000-0x0000000140095000-memory.dmp

Filesize
596KB

Download
memory/4448-62-0x0000000140000000-0x0000000140135000-memory.dmp

Filesize
1.2MB

Download
memory/4448-60-0x0000000000530000-0x0000000000590000-memory.dmp

Filesize
384KB

Download
memory/4448-47-0x0000000000530000-0x0000000000590000-memory.dmp

Filesize
384KB

Download
memory/4448-38-0x0000000000530000-0x0000000000590000-memory.dmp

Filesize
384KB

Download
memory/4448-46-0x0000000140000000-0x0000000140135000-memory.dmp

Filesize
1.2MB

Download
memory/4648-563-0x0000000140000000-0x00000001401D7000-memory.dmp

Filesize
1.8MB

Download
memory/4648-279-0x0000000140000000-0x00000001401D7000-memory.dmp

Filesize
1.8MB

Download
memory/4648-150-0x0000000140000000-0x00000001401D7000-memory.dmp

Filesize
1.8MB

Download
memory/4696-26-0x0000000000690000-0x00000000006F0000-memory.dmp

Filesize
384KB

Download
memory/4696-34-0x0000000140000000-0x00000001400A9000-memory.dmp

Filesize
676KB

Download
memory/4696-35-0x0000000000690000-0x00000000006F0000-memory.dmp

Filesize
384KB

Download
memory/4824-5-0x0000000000400000-0x0000000000584000-memory.dmp

Filesize
1.5MB

Download
memory/4824-87-0x0000000000400000-0x0000000000584000-memory.dmp

Filesize
1.5MB

Download
memory/4824-0-0x00000000022C0000-0x0000000002327000-memory.dmp

Filesize
412KB

Download
memory/4824-8-0x00000000022C0000-0x0000000002327000-memory.dmp

Filesize
412KB

Download
memory/4912-587-0x0000000140000000-0x00000001400C6000-memory.dmp

Filesize
792KB

Download
memory/4912-261-0x0000000140000000-0x00000001400C6000-memory.dmp

Filesize
792KB

Download