d2a9d23b1d17aea8ce47cc533e20706bfa1530e8a5033d3bb5d7e929156cd73b

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
27/05/2024, 18:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-05-27_65735e808d05ea013fdc5c621d914242_bkransomware.exe
Size 1.8MB
Sample240527-wnlfcsdf29
SHA256 d2a9d23b1d17aea8ce47cc533e20706bfa1530e8a5033d3bb5d7e929156cd73b
MD5 65735e808d05ea013fdc5c621d914242
SHA1 14050b801801f89885dbe89ed8afee3a5156f38d
SHA512 3df260aa28b1f37411c3c0f1d2bdaabe1d4a907ce4f291b98a76f63c9c24dbacb1516a1106c39c1248adebc924701cd55c4f33a3dd30e534fef6a41d14adeb4b
SSDEEP 49152:wE19+ApwXk1QE1RzsEQPaxHNyP4suIRbDv:V93wXmoKaPHn3
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
1920	alg.exe
700	DiagnosticsHub.StandardCollector.Service.exe
2076	fxssvc.exe
3376	elevation_service.exe
3384	elevation_service.exe
2632	maintenanceservice.exe
2284	msdtc.exe
4792	OSE.EXE
3204	PerceptionSimulationService.exe
3664	perfhost.exe
1852	locator.exe
1796	SensorDataService.exe
220	snmptrap.exe
3772	spectrum.exe
2936	ssh-agent.exe
2468	TieringEngineService.exe
5080	AgentService.exe
1336	vds.exe
1532	vssvc.exe
4060	wbengine.exe
116	WmiApSrv.exe
1180	SearchIndexer.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in System32 directory 31 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\alg.exe	2024-05-27_65735e808d05ea013fdc5c621d914242_bkransomware.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2024-05-27_65735e808d05ea013fdc5c621d914242_bkransomware.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\5e72fcf6b4b1389a.bin	alg.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2024-05-27_65735e808d05ea013fdc5c621d914242_bkransomware.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2024-05-27_65735e808d05ea013fdc5c621d914242_bkransomware.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2024-05-27_65735e808d05ea013fdc5c621d914242_bkransomware.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	alg.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2024-05-27_65735e808d05ea013fdc5c621d914242_bkransomware.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2024-05-27_65735e808d05ea013fdc5c621d914242_bkransomware.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2024-05-27_65735e808d05ea013fdc5c621d914242_bkransomware.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2024-05-27_65735e808d05ea013fdc5c621d914242_bkransomware.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2024-05-27_65735e808d05ea013fdc5c621d914242_bkransomware.exe
File opened for modification	C:\Windows\System32\vds.exe	2024-05-27_65735e808d05ea013fdc5c621d914242_bkransomware.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	alg.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2024-05-27_65735e808d05ea013fdc5c621d914242_bkransomware.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2024-05-27_65735e808d05ea013fdc5c621d914242_bkransomware.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2024-05-27_65735e808d05ea013fdc5c621d914242_bkransomware.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2024-05-27_65735e808d05ea013fdc5c621d914242_bkransomware.exe
File opened for modification	C:\Windows\system32\AgentService.exe	alg.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2024-05-27_65735e808d05ea013fdc5c621d914242_bkransomware.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2024-05-27_65735e808d05ea013fdc5c621d914242_bkransomware.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2024-05-27_65735e808d05ea013fdc5c621d914242_bkransomware.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2024-05-27_65735e808d05ea013fdc5c621d914242_bkransomware.exe
File opened for modification	C:\Windows\system32\locator.exe	2024-05-27_65735e808d05ea013fdc5c621d914242_bkransomware.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2024-05-27_65735e808d05ea013fdc5c621d914242_bkransomware.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2024-05-27_65735e808d05ea013fdc5c621d914242_bkransomware.exe
File opened for modification	C:\Windows\system32\dllhost.exe	alg.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2024-05-27_65735e808d05ea013fdc5c621d914242_bkransomware.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	2024-05-27_65735e808d05ea013fdc5c621d914242_bkransomware.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_99718\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2024-05-27_65735e808d05ea013fdc5c621d914242_bkransomware.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2024-05-27_65735e808d05ea013fdc5c621d914242_bkransomware.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	2024-05-27_65735e808d05ea013fdc5c621d914242_bkransomware.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe	2024-05-27_65735e808d05ea013fdc5c621d914242_bkransomware.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	2024-05-27_65735e808d05ea013fdc5c621d914242_bkransomware.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2024-05-27_65735e808d05ea013fdc5c621d914242_bkransomware.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2024-05-27_65735e808d05ea013fdc5c621d914242_bkransomware.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2024-05-27_65735e808d05ea013fdc5c621d914242_bkransomware.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	2024-05-27_65735e808d05ea013fdc5c621d914242_bkransomware.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2024-05-27_65735e808d05ea013fdc5c621d914242_bkransomware.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2024-05-27_65735e808d05ea013fdc5c621d914242_bkransomware.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	2024-05-27_65735e808d05ea013fdc5c621d914242_bkransomware.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	2024-05-27_65735e808d05ea013fdc5c621d914242_bkransomware.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe	2024-05-27_65735e808d05ea013fdc5c621d914242_bkransomware.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	2024-05-27_65735e808d05ea013fdc5c621d914242_bkransomware.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe	2024-05-27_65735e808d05ea013fdc5c621d914242_bkransomware.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	alg.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2024-05-27_65735e808d05ea013fdc5c621d914242_bkransomware.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2024-05-27_65735e808d05ea013fdc5c621d914242_bkransomware.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2024-05-27_65735e808d05ea013fdc5c621d914242_bkransomware.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2024-05-27_65735e808d05ea013fdc5c621d914242_bkransomware.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2024-05-27_65735e808d05ea013fdc5c621d914242_bkransomware.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	2024-05-27_65735e808d05ea013fdc5c621d914242_bkransomware.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	2024-05-27_65735e808d05ea013fdc5c621d914242_bkransomware.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	2024-05-27_65735e808d05ea013fdc5c621d914242_bkransomware.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2024-05-27_65735e808d05ea013fdc5c621d914242_bkransomware.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2024-05-27_65735e808d05ea013fdc5c621d914242_bkransomware.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	2024-05-27_65735e808d05ea013fdc5c621d914242_bkransomware.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	2024-05-27_65735e808d05ea013fdc5c621d914242_bkransomware.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	alg.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2024-05-27_65735e808d05ea013fdc5c621d914242_bkransomware.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d2f2765160b0da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000078ca8e5160b0da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000703fa45160b0da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f5a0c55160b0da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9908 = "Wave Sound"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e4dda15160b0da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
3724	2024-05-27_65735e808d05ea013fdc5c621d914242_bkransomware.exe
3724	2024-05-27_65735e808d05ea013fdc5c621d914242_bkransomware.exe
3724	2024-05-27_65735e808d05ea013fdc5c621d914242_bkransomware.exe
3724	2024-05-27_65735e808d05ea013fdc5c621d914242_bkransomware.exe
3724	2024-05-27_65735e808d05ea013fdc5c621d914242_bkransomware.exe
3724	2024-05-27_65735e808d05ea013fdc5c621d914242_bkransomware.exe
3724	2024-05-27_65735e808d05ea013fdc5c621d914242_bkransomware.exe
3724	2024-05-27_65735e808d05ea013fdc5c621d914242_bkransomware.exe
3724	2024-05-27_65735e808d05ea013fdc5c621d914242_bkransomware.exe
3724	2024-05-27_65735e808d05ea013fdc5c621d914242_bkransomware.exe
3724	2024-05-27_65735e808d05ea013fdc5c621d914242_bkransomware.exe
3724	2024-05-27_65735e808d05ea013fdc5c621d914242_bkransomware.exe
3724	2024-05-27_65735e808d05ea013fdc5c621d914242_bkransomware.exe
3724	2024-05-27_65735e808d05ea013fdc5c621d914242_bkransomware.exe
3724	2024-05-27_65735e808d05ea013fdc5c621d914242_bkransomware.exe
3724	2024-05-27_65735e808d05ea013fdc5c621d914242_bkransomware.exe
3724	2024-05-27_65735e808d05ea013fdc5c621d914242_bkransomware.exe
3724	2024-05-27_65735e808d05ea013fdc5c621d914242_bkransomware.exe
3724	2024-05-27_65735e808d05ea013fdc5c621d914242_bkransomware.exe
3724	2024-05-27_65735e808d05ea013fdc5c621d914242_bkransomware.exe
3724	2024-05-27_65735e808d05ea013fdc5c621d914242_bkransomware.exe
3724	2024-05-27_65735e808d05ea013fdc5c621d914242_bkransomware.exe
3724	2024-05-27_65735e808d05ea013fdc5c621d914242_bkransomware.exe
3724	2024-05-27_65735e808d05ea013fdc5c621d914242_bkransomware.exe
3724	2024-05-27_65735e808d05ea013fdc5c621d914242_bkransomware.exe
3724	2024-05-27_65735e808d05ea013fdc5c621d914242_bkransomware.exe
3724	2024-05-27_65735e808d05ea013fdc5c621d914242_bkransomware.exe
3724	2024-05-27_65735e808d05ea013fdc5c621d914242_bkransomware.exe
3724	2024-05-27_65735e808d05ea013fdc5c621d914242_bkransomware.exe
3724	2024-05-27_65735e808d05ea013fdc5c621d914242_bkransomware.exe
3724	2024-05-27_65735e808d05ea013fdc5c621d914242_bkransomware.exe
3724	2024-05-27_65735e808d05ea013fdc5c621d914242_bkransomware.exe
3724	2024-05-27_65735e808d05ea013fdc5c621d914242_bkransomware.exe
3724	2024-05-27_65735e808d05ea013fdc5c621d914242_bkransomware.exe
3724	2024-05-27_65735e808d05ea013fdc5c621d914242_bkransomware.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
656	Process not Found
656	Process not Found

Suspicious use of AdjustPrivilegeToken 45 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3724	2024-05-27_65735e808d05ea013fdc5c621d914242_bkransomware.exe
Token: SeAuditPrivilege	2076	fxssvc.exe
Token: SeRestorePrivilege	2468	TieringEngineService.exe
Token: SeManageVolumePrivilege	2468	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	5080	AgentService.exe
Token: SeBackupPrivilege	1532	vssvc.exe
Token: SeRestorePrivilege	1532	vssvc.exe
Token: SeAuditPrivilege	1532	vssvc.exe
Token: SeBackupPrivilege	4060	wbengine.exe
Token: SeRestorePrivilege	4060	wbengine.exe
Token: SeSecurityPrivilege	4060	wbengine.exe
Token: 33	1180	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1180	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1180	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1180	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1180	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1180	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1180	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1180	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1180	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1180	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1180	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1180	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1180	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1180	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1180	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1180	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1180	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1180	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1180	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1180	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1180	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1180	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1180	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1180	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1180	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1180	SearchIndexer.exe
Token: SeDebugPrivilege	3724	2024-05-27_65735e808d05ea013fdc5c621d914242_bkransomware.exe
Token: SeDebugPrivilege	3724	2024-05-27_65735e808d05ea013fdc5c621d914242_bkransomware.exe
Token: SeDebugPrivilege	3724	2024-05-27_65735e808d05ea013fdc5c621d914242_bkransomware.exe
Token: SeDebugPrivilege	3724	2024-05-27_65735e808d05ea013fdc5c621d914242_bkransomware.exe
Token: SeDebugPrivilege	3724	2024-05-27_65735e808d05ea013fdc5c621d914242_bkransomware.exe
Token: SeDebugPrivilege	1920	alg.exe
Token: SeDebugPrivilege	1920	alg.exe
Token: SeDebugPrivilege	1920	alg.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1180 wrote to memory of 3488	1180	SearchIndexer.exe	114
PID 1180 wrote to memory of 3488	1180	SearchIndexer.exe	114
PID 1180 wrote to memory of 4608	1180	SearchIndexer.exe	117
PID 1180 wrote to memory of 4608	1180	SearchIndexer.exe	117

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2024-05-27_65735e808d05ea013fdc5c621d914242_bkransomware.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-27_65735e808d05ea013fdc5c621d914242_bkransomware.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3724

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1920

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:700

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:3636

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2076

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3376

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3384

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2632

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:2284

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4792

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3204

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:3664

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:1852

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1796

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:220

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3772

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2936

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:2176

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2468

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5080

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:1336

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1532

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4060

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:116

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1180
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3488
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
  2⤵
  - Modifies data under HKEY_USERS
  PID:4608

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
Size 2.1MB
SHA256 7e2435a142c067d7aa45be45644c3d9605d65c8052ab143751e57007bfde21cb
MD5 945f2b0cdc52e62ec2cc7cb910560540
SHA1 b74ac99260ef0294aafc137c9543a20e821b8f12
SHA512 bf92cfd150b35c28809a50078385351d03d9487843b33a2e050e435a93077f054b7351b9d85d7ba3ac0b7a0ff83b002fc5adc52c8238402084b062c1722e245d
SSDEEP 49152:cuYk3H5koUXfTqkkYLO/W2buywzMbOX+T7z5PP4suIRbDv:cPfTqi90brPHn3
MD5 SHA1 SHA512 SSDEEP

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 797KB
SHA256 fa89e2ec6e31718db751007fedc6b86b9ec8503d0fdc7895eee1b401eff42fed
MD5 a511b694da96cc1cd79042582a32f74d
SHA1 954df5e63d183ffe4238046c01290db17400682e
SHA512 799c5853473e7d6ed767d3e0b2cdac8844805b14545ac8334167b0b3e410f47eab68958e0b5aa491636c7ca97ac16618780cb6ce55712deaa310124120c947e9
SSDEEP 24576:TidnBsuEyHofe3y1sInB2COzRq8DvFqt:OSuVP4suIRbDv
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 6d75c6491e9b68db6a00af52143f35c708af6937d9b9a971ba545f9b44c93cbb
MD5 00deba1469057f049abc5f71d6d1acdd
SHA1 aa2883d292a9071063acfbff9c12b867f8e2227a
SHA512 02a45db973e4c4001d79d3cef57b74243a93839c9604d09fd8ea554bd86bc2caa859a96fdf24e7133ff1f7904dd2d109dae9e59491dce261bf35151b865c533c
SSDEEP 24576:x+gkEVfh4Co+Hofe3y1sInB2COzRq8DvFqt:4gkExSeP4suIRbDv
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 a486c34b9000cc09f81b31abf322b37a0d195b9122f8b3d222c523ce108d5df6
MD5 0e3d47b7a047bcf31682707637c2ecf5
SHA1 401e9b6623538f0a654fb35a4e70d56b791b37d6
SHA512 467571c078db97b71d0c2d001ee01e1dcdd8d60cb3a8abe922e11e9a080f5ad4ba0656aed581ac1b86664638f655e95c08107bd0d61da9a1c4a003554e253e50
SSDEEP 24576:FBpDRmi78gkPXlyo0GxjrrHofe3y1sInB2COzRq8DvFqt:vNRmi78gkPX4o0GxjvP4suIRbDv
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 92eca284e400657cc0645ba30bdba8a0f877a6905ec3f5919ffadc16729dddff
MD5 d2c166ff59b7f49c143e15b33a0c7dc0
SHA1 3753623c31fb7262dfc692a667aedc89f998a387
SHA512 f52778e43e8346a78187ce75e4e99a12413fc253e1758310dae5dfa3f14eb35e6b7348107c89b2a76b5a35c39dceec649cacd262e5a6938c2c13318d5c6e5878
SSDEEP 24576:ULOS2oyPIXV+Hofe3y1sInB2COzRq8DvFqt:s/ynP4suIRbDv
MD5 SHA1 SHA512 SSDEEP

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 416a03df6c72cfb4721ffedfb8c674d2c1f2cb753b0cd5434fe1cf323e82aa6b
MD5 46ba0163daf46ad71775a68622984037
SHA1 0082ddeac59fa9cc7ce320e2f4060730a9c1fed0
SHA512 166e676f0f85a2cd0295c454641313d318cacdd3bf62627723b76a68f87c3558b1e04f80be7c4cc285d801e92897fb152f203d665ecba8ce6842a61986786965
SSDEEP 12288:dfA3Dbif4YAJ93y1NrLiLtJ8nBxu7DCOzRq8DvQgqAbhI:dfAHofe3y1sInB2COzRq8DvFqt
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 2bd3fad3914ac207e4b314c0cd559c35602439b70b1769576e70aad5629148ec
MD5 929d9bfc58314969d7f098c31256d46d
SHA1 fbc6f1bf34aa0f796a9223fd8258a3b557ba4273
SHA512 64bc8a870fc4fa8cdcd2f1fd25914daacc839c79283ec163ea36a68f0acb68cbafbeeb306cf469272983c4e0ed6351e6da92824ae5cfa3d769671c720fd21011
SSDEEP 12288:8eBNUbTVO86Ul3Dbif4YAJ93y1NrLiLtJ8nBxu7DCOzRq8DvQgqAbhI:8JIUlHofe3y1sInB2COzRq8DvFqt
MD5 SHA1 SHA512 SSDEEP

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 4aebf10210195b883580776023739a42785f82ceaa2fb93eff8b17cb4d3b2926
MD5 7a81e3ac1f95b33e5be98bad3808a9f7
SHA1 b3af6e004216cd8976fd98cbebbaf5eca7deda6e
SHA512 b869dadaca4912b0eab41b18f2c0d6c355f83fa3a2b3219087b865236fe0d1e330a854e8d255206144141f205f539e1815e0b4d3750918c11002630f8a478baa
SSDEEP 49152:6QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THh:6QvGAdlCEL8c/yRNw5CEPHn3
MD5 SHA1 SHA512 SSDEEP

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 b784d1c3b24595c26888e1e2786392673f02b62c3fe79167bd694bb13bb931c3
MD5 39d514a2cf6ceb0fb6f8f9b0c3a2b000
SHA1 c8b6dec8241c68c9a70d862fccdb1faa8b6d8015
SHA512 3782b469de168b97cfd59f4826a6541c225e75930fbe5a8679c9497c59851c4b6110af00288fd8c3b0f203cad41ed6a936e45d15b3bdf1f002ab41c65bb66c8d
SSDEEP 12288:tAwSfxL/2Dc34DLLmt0LDQewsAjT3Dbif4YAJ93y1NrLiLtJ8nBxu7DCOzRq8DvU:edewsAjTHofe3y1sInB2COzRq8DvFqt
MD5 SHA1 SHA512 SSDEEP

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 c085dc57f9b77245bbea91c9b734e12e9b8a57b400ed83cd934b036a76d68cbb
MD5 046e8eeb82c05e8e28fe338b189e1e0b
SHA1 73d83df2da79fb28bb0e0afacde1f9904aaf1f44
SHA512 5d930b2f2ffd8ab449bb6625ab81018397c44e86f275d807430f1fed0a488c00b8f9eb7644aba61549657436647dfb6c64e5713560af21bd724655fdb8afe114
SSDEEP 196608:+UEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHDP:+UEtQevvqc2W1cpV2EI32D
MD5 SHA1 SHA512 SSDEEP

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 56403dd426fb908aa624e1d2761603cdc9971fe16cd17df6152e9e856761a2d6
MD5 6c8737adf07a849b521ff064e46da7ed
SHA1 0432bf143b3891d9ad95ac9127119dc396c16d6e
SHA512 d567fa1ac0df63bc351606f6b0db772c90876eb016be7c137650e172274a3f42c3121db3528a98bc580cd1d500321d06bf2960e943b1eeb6c41048a05594a5b9
SSDEEP 49152:iCbRquA/m2yL5zTfFiV+XenmE3/zLP4suIRbDv:noquVjnmAPHn3
MD5 SHA1 SHA512 SSDEEP

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 675f5c1734d9060e8d6a48c7c0e56765952ce95dd5859ea39bdca78acf41de66
MD5 61c01296ded8296dee3eaa26180154ff
SHA1 c83dff19eec31f8bd239d1ffd3d97d889fd5189d
SHA512 f98e8c8dfbd5088aadc8d5556e77c718fe53feec1992d7791b1af963c45167d72f16886f0c76684b4ad109facc12fbe2cf0ff749f6af9ee1273b5aaf2efad21e
SSDEEP 24576:ZAhGLJIFoiwtA5l7S53uHofe3y1sInB2COzRq8DvFqt:ZAMyFoiq5wP4suIRbDv
MD5 SHA1 SHA512 SSDEEP

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 c0e718ff8a82e13fe6bfe2d9f418f024f86d4ed1fd0c6856b8667c1c03d24a20
MD5 c52ef811f805aa39b17227f8791cd959
SHA1 00848add2a2a359d501cd879a4b4e84ef5f54232
SHA512 43caaf14afa5aefdbef643f006f99ffb86cbfdd33355891a83a2dcf20ac66e83af3bdebe78f3aa21a32043d60f3e1008a62f8bf4e614f585648e0c03068ee8ca
SSDEEP 12288:0mw5HEjsChNVBFgl0WDm+Cq3Dbif4YAJ93y1NrLiLtJ8nBxu7DCOzRq8DvQgqAbu:xwuoOWHHofe3y1sInB2COzRq8DvFqt
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 bdd917c92d6bd6498a08929c8e08e9462a13f745632cceb4f4b2af0f08cbb6a6
MD5 7eb61b177717c2691c149f0a6a0f6a79
SHA1 7c4b59075024477a21bbb72ca5786bd3ca7662e1
SHA512 cf09e0d48f549b3960cbbe2bc03a1075778e54c4871442ae9996e877b91934044a3d01c61ffa531d58be8582e28687484ef6878a7aabc75c0605d6043acc089c
SSDEEP 12288:GBZ1Iyj3Dbif4YAJ93y1NrLiLtJ8nBxu7DCOzRq8DvQgqAbhI:QZuMHofe3y1sInB2COzRq8DvFqt
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
Size 5.4MB
SHA256 96480a6cd04924c36b15072303e0d51d6c432c3b2851106e4b4c01ea74149409
MD5 2173909843c91ab417a7928dddabd327
SHA1 23169dad7b27f5b1e412715eb40617acbb64a3ce
SHA512 eb70d3cfa1c5d41f4c805ee5b2f81de711f452fb5552083e7835cd6113b2c903e3aa96ae500769526fe8c92564b9f279c519a9056fac74fd8e18e5d3e4ed2574
SSDEEP 49152:B0kwIi7c4xZlm5knEtw99Kn/2vim7vgv6m+yyJ/0gbvjR7yY7BHi3u7L/gBUUWLR:xwfhY7g/rLd7yYA3awr341gIPHn3
MD5 SHA1 SHA512 SSDEEP

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe
Size 5.4MB
SHA256 b7a2b4b86c0174199dc4b2d1e25d51fe301a40925c83daf93a4d3789f1092a05
MD5 f8959cfd68164286838ef938c63bf6c2
SHA1 4ba06e6e20fd33880aee0a4c472ea7eadd4ccc00
SHA512 9282bba607c75b0dcdd8897560008646e30b4efd551d07750f6e9a2e272a547b78ec79c7ae001215f8d4642a1e745e9ac5c70752a58e5526df88c75859c2c8ed
SSDEEP 49152:M0kwIi7c4xZlm5knEtw99Kn/2vim7vgv6m+yyJ/0gbvjR7yY7BHi3u7L/gBUUWLR:KwfhY7g/rLd7yYA3awr341gIPHn3
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe
Size 2.0MB
SHA256 30990262cd1251fc3e857771b091744b08bbf45e391e4faca2a7fe4e75136283
MD5 e0758d14e6eb8f3c94f698d3dad7965a
SHA1 e10ae6df8e171d10c8f6b5f3490050b7bd719dff
SHA512 1e1347c81f830d7a317d2f04cf92c8cde9bff19bc51767e20d17e53f99dede9ffd12240b50da3e223bf83477b66add1626fa0c988e6781396e8eb93afbda5afd
SSDEEP 24576:ccTyYv0FteQU+5I2kjgD6iQacAHHofe3y1sInB2COzRq8DvFqt:cuXv0Ftpn5606zOnP4suIRbDv
MD5 SHA1 SHA512 SSDEEP

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
Size 2.2MB
SHA256 1def6f211df413b6888fca0982c0918ee18fb86869ac0fae8aee3512a554923c
MD5 f3ef1734252c2cc8b405f1b708cc8c13
SHA1 c30abc133862c9e1ce422760dcafc3620a602226
SHA512 9e2617c50d6926ccb76382923005e7b939024ab4b393141673f963d245b757225746c7be858cb729a270cf783925b5c72d4cc3f81355fed17b4e4201a63309e2
SSDEEP 49152:ry7mTd0GxN8jyynxHjXKUyn4GVcbDSKrNTxrP4suIRbDv:WmYeyxHjWjMTrPHn3
MD5 SHA1 SHA512 SSDEEP

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe
Size 1.8MB
SHA256 662f541e9bcc6a9cba2ab22fd62dc318a5a20a27c77835bbd1f882c581fd93f1
MD5 58fe2d37001e2974d490a76ec3d21790
SHA1 3d1e6f0a42b9af3d2cb55cf4002d815eeb9a4737
SHA512 297ad3e59970c47a5e61318750dcf094f3453993719d8a92800d4cd3967868c81361d07c7f6511fcf63ececbbdea30e7a5144d9097629a807a4713840403abae
SSDEEP 24576:q6drZn1WEci182IEUeNbJeRgUebgW816UHofe3y1sInB2COzRq8DvFqt:qWnDci18yNNUgbYPP4suIRbDv
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 1.7MB
SHA256 232f88340d8ad7543e34b203ecadffdcd7e7dbeca71be8c54c255e24a9f0b89e
MD5 2721755a8f69fdb3092dce5f94178305
SHA1 6b4ba46df9fc4ff0dcceb4e3318bd3c9b970048f
SHA512 69ded2b73f3a5f2813f109010d7ae635a4e9ce2bb1584571be7352c1d799dad3b01fb965638d24bbd32cf346121a4e93d863603430a25e924096181ea7589a26
SSDEEP 24576:Sk5lHW5EzMZupO80G2reD+melRgTTv/1nyxHofe3y1sInB2COzRq8DvFqt:8izMZm0GhamSoSP4suIRbDv
MD5 SHA1 SHA512 SSDEEP

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 0107ca84c699775329a051873d3bd1f0d347a8ea4ad2de5276dad789c6753162
MD5 002ca5d6f223085b5e432d03fc930783
SHA1 0984931b1d96bec80ee247c022d857f72a09d46e
SHA512 988909550f4dcabf0447a2a662842c75ef602c50ce875227dc3095da80f1ea6d831a49e03a0e2c7d229811de07e9c2e985fa7b127c67fef0fffda7c9964b0795
SSDEEP 12288:QY3Dbif4YAJ93y1NrLiLtJ8nBxu7DCOzRq8DvQgqAbhI:QYHofe3y1sInB2COzRq8DvFqt
MD5 SHA1 SHA512 SSDEEP

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 7ddbf2210fc951bfca76e2bb3bb4e2b9143e992b9c10abdebb9943abdf51fba2
MD5 d35d294d1f136bf703ca3a6d39b4860d
SHA1 9e8ea03147e50132d5df4d2a85034f508ec8579d
SHA512 97fa2e736cfb5f8857ba9bbc282ca9eead59f89909e401bef17d98d38d7816c14113654fdd81adabdfdf9263ad8f9a450647a5568dc5ce2b60a6c235a0a77d50
SSDEEP 12288:4v3Dbif4YAJ93y1NrLiLtJ8nBxu7DCOzRq8DvQgqAbhI:4vHofe3y1sInB2COzRq8DvFqt
MD5 SHA1 SHA512 SSDEEP

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 6a609f4213168a19d01fa1bf119dd65d4f7ba4f1aff33377beed088e60462473
MD5 e4c063ea8322f70b9fdbd5d0c4014cfa
SHA1 7ce4156db00ab37534868b9052bb409c6e350a80
SHA512 965ecca78ebced79450488fdf2b4afdee065c651780c56f70c4425025e3565d2011783c99458fe94f857880a20630d1c3c0e63b9fade3f6e50df514b999745b7
SSDEEP 12288:Jd3Dbif4YAJ93y1NrLiLtJ8nBxu7DCOzRq8DvQgqAbhI:JdHofe3y1sInB2COzRq8DvFqt
MD5 SHA1 SHA512 SSDEEP

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 473355d7487be4871d21b31a9bfa835af37f1221ea053ec012bf54eb72f48c9e
MD5 7f877cca15ffe398c4b26db16c2debe7
SHA1 e4fd8c57bce6541762ffe322971a0ca86ee63f54
SHA512 b3c908bbd86dd7cc187d264867e12f61df62c8c5ba348c83f11a3aeafb75087cb78af11f23d5101cbe505330cf5d2127367a4a6113f50eac2b48be6aa7d5c969
SSDEEP 12288:CVO3Dbif4YAJ93y1NrLiLtJ8nBxu7DCOzRq8DvQgqAbhI:XHofe3y1sInB2COzRq8DvFqt
MD5 SHA1 SHA512 SSDEEP

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 767f24a837b0fcc5831c2cba859ddb310fcd922311d5f3c5ce8c88f8ea0499c7
MD5 2674525959b0e71ee33ba33b57daf50f
SHA1 dc2b0ac75d9e2024ddfd6cd9820a1e7c6a7248cb
SHA512 7d12c854272a1d2bc8d4bc75e461808a0f1b71caf30334057dcff509ff4b427c6c873c41635d7d9041174264e3a2aef275d0d5a4401ed39db619852beb862404
SSDEEP 12288:f23Dbif4YAJ93y1NrLiLtJ8nBxu7DCOzRq8DvQgqAbhI:f2Hofe3y1sInB2COzRq8DvFqt
MD5 SHA1 SHA512 SSDEEP

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 9f6ba10c3aab45bce9112e4795a862b08edd117aab1ce41d92470603586aee61
MD5 b6bad95cb25343bc356e6963a07c95cb
SHA1 1d138efdb2536f205ee1466c5c2cd9ee643f38c8
SHA512 2390793e35872b04f72e6b8c8078cfc7cea6779c1abb173a12a5db976b9503f0847c243dd2cc0de9ce87d6a88796de51c4b0899d9d2f2679489f70921c5a916a
SSDEEP 12288:dr3Dbif4YAJ93y1NrLiLtJ8nBxu7DCOzRq8DvQgqAbhI:drHofe3y1sInB2COzRq8DvFqt
MD5 SHA1 SHA512 SSDEEP

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 5ba5a41d1cb50f3604af16639ede63f9798e9f8c787a80364f432e1b57bde7f6
MD5 5366b3b71d4cc2d2ba8d908cb5cdd46b
SHA1 0dccc43903deeefab31d5291cfdb60886d0bec17
SHA512 3a1e3fb63a2e91d21964f8251b3a7cf9de1a9f38d77d7064389e7e3a9d66bf1913c1a25a31bdf7e0ee8d7b4147dff22072a2a5ac8ea3089fd238794c7af2c0d8
SSDEEP 12288:U33Dbif4YAJ93y1NrLiLtJ8nBxu7DCOzRq8DvQgqAbhI:U3Hofe3y1sInB2COzRq8DvFqt
MD5 SHA1 SHA512 SSDEEP

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 50406dbfa18d89986ca0f57fe804c174c17d8c4d7bff7a49d4e9efdfb2d01abd
MD5 67b31c6e86bb8f383834490ddacb1ff5
SHA1 bd8131a22c45eaf488a136c2397e7f0e9b3e0c1a
SHA512 0ed460196ceb56a9e9ac416ff5bb30a335a09bcee5038aaed83e08874881b1c9c7df052c3385aa68d6ed39057dd66f5c85b801c7de4ba5e7ad837014edf4233a
SSDEEP 24576:OZMSzFVSOPHofe3y1sInB2COzRq8DvFqt:OZMSzfjP4suIRbDv
MD5 SHA1 SHA512 SSDEEP

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 06143a8200881ac4a1b2e095a68103ca042ad0cccaa3743af0d84b90ddbba37a
MD5 c0fe83a2320d0b8bf0d10f7a1dd8b934
SHA1 6184a674cf38ba02e41cb480a5939b793d68451f
SHA512 2954374ff18df40b759564192a2d90816f0ab1583d17ce468e7b24c95469b3f97067badb62b581a8a11a0bafc29e05da58e7d4220e0749174ecd0ab5751691da
SSDEEP 12288:Tc3Dbif4YAJ93y1NrLiLtJ8nBxu7DCOzRq8DvQgqAbhI:TcHofe3y1sInB2COzRq8DvFqt
MD5 SHA1 SHA512 SSDEEP

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 f4a0a5c22b010299e7dddede0b37360d1d7f22d77611a2d11c7ec115c67b3ef4
MD5 a122258ef60860fe42760f94c42c03a2
SHA1 6c4248b1616b0a3c9a2cfe9d30a63d4a7ba4f282
SHA512 f8d3edf4e91b7be7dd0f2b29e84d98a450cc09392a9a29d98b05a4e240cfd5c6d984e68b20e7226374ca769e16ff1cc38f5b4254b7386bff262633f63b935acf
SSDEEP 12288:PQ3Dbif4YAJ93y1NrLiLtJ8nBxu7DCOzRq8DvQgqAbhI:PQHofe3y1sInB2COzRq8DvFqt
MD5 SHA1 SHA512 SSDEEP

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 b41b98008abd5ed700cb3f479edc868dbafcf3f86ee4f5d946cce5b1f88180d8
MD5 9ceaf8dc4aad5ccbc06682811322ba37
SHA1 878b6eba2649405e7efdf5b20a90c981215e20a6
SHA512 e2586f57dda566f1aa4b866c3e541c84e77dd27463afac0be9dc2090046777f397f2c95cfa08457d46dfa543c9e861c0230c1f1ae7bfd10d22122ade721ca124
SSDEEP 12288:8yPz5L8j3Dbif4YAJ93y1NrLiLtJ8nBxu7DCOzRq8DvQgqAbhI:lzyjHofe3y1sInB2COzRq8DvFqt
MD5 SHA1 SHA512 SSDEEP

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 bde74d93b0707870800afb3cafe02332dcabd9efffacd4d58eb2362e19ea41ca
MD5 b35d2555ac811e96f51dbf63629f6dc0
SHA1 f12edc85e2f080addfd3d54d9a0930b5db655140
SHA512 e4d129389ead790cd0e37bb39d3597dd901337ff0718741988d780687a64bb7a49948333ca0b01135bfdec0e1b0f228604a6abf0f6ee9c45d3da8242e0fcfdbd
SSDEEP 12288:yc3Dbif4YAJ93y1NrLiLtJ8nBxu7DCOzRq8DvQgqAbhI:ycHofe3y1sInB2COzRq8DvFqt
MD5 SHA1 SHA512 SSDEEP

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 5e7d43a6ec8172067976a9ee7e4536572c0a37204c01d6e68c8a94f53fa969a7
MD5 c1bbe16efbfa459ccc960d4a49cdd43f
SHA1 2227eed930f2c39415338b67588ee3e216ea1676
SHA512 90919aa62d39f1f0ec9d414afe8773bd21478bbb8a0022045adb1c4935a3272302b59e4236b5876d3e3790c5ef81f1cf1b5e475f3a7f617b663bfe9b0a817330
SSDEEP 12288:2c3Dbif4YAJ93y1NrLiLtJ8nBxu7DCOzRq8DvQgqAbhI:2cHofe3y1sInB2COzRq8DvFqt
MD5 SHA1 SHA512 SSDEEP

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 b28764654c8f9957cb59707fce049d31d7cdb60ee6fba1171976e52557aab4f9
MD5 48f3147b6cd5bc418738fe95fd218279
SHA1 a95c63aef7b0d52c98774d30046d17e2a09963ce
SHA512 2941b625bf6d537f5d4ed39659d9bf349e158d22825677042c56990e6c84b7407b2b45124af66b59d637b44b2f47a2c3054a72be562876ad9c899e28c93a38b3
SSDEEP 12288:GyPz5L8j3Dbif4YAJ93y1NrLiLtJ8nBxu7DCOzRq8DvQgqAbhI:7zyjHofe3y1sInB2COzRq8DvFqt
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 ff963eee48b57d93a53bb7b9eec3305b879884f8e8eba212e7da6df51e585a53
MD5 51c0bd7638ae8e152b1cfcd2e26316c0
SHA1 9baf8bc74280d9beef1c9746fac7f69c292f0a5d
SHA512 c87b984fd19cc7f8817946e3463e57033384e330ebc36f30f6e2b795f7d5beff84f0de1860f305c223f98330dd5d3911b75943d5705329cf10174f9b23f25077
SSDEEP 24576:lTHaLl3z0zDNHofe3y1sInB2COzRq8DvFqt:lT6LljUP4suIRbDv
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 12205634b4bc52b14764d67a54245477fba2ecf4b55afde3b9604f7885761ebf
MD5 1e32afec042831ff396aef654e7fedd8
SHA1 c8ede96f25d4fc0b4268b75ba55f925715295776
SHA512 769f269338dd0dc42482dab7305908fbc446b16946b5fb1356c50c99777cfeed8146552af29936ee175f72b562d0b36194c553753c093ba3e3e9354fcb4c169c
SSDEEP 24576:Y37d9CHKy7GZ5Hofe3y1sInB2COzRq8DvFqt:i7d9CHKyajP4suIRbDv
MD5 SHA1 SHA512 SSDEEP

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 682f603e9f43dea40aae8a2092bb3f02b4c25479a9e26ead0b09900d8d967a4c
MD5 91c81dc11413eb11ace6249e5a94243d
SHA1 7afb3ff66dd1cf3757fb09389216ff8e3a7d5477
SHA512 dace8d2c5500724cab5b7ca8bae1b177ca652b0507c8e76a3952bc33b47f0f840b1fdf77bb2ba85bccae3e0212b1b4bfd01c642acee95d160f457f455a34fe3e
SSDEEP 24576:UcP4mcvIjkGOxhKP2l71SNKbrh/8KBEHofe3y1sInB2COzRq8DvFqt:vP4m4IpOO67N8KEP4suIRbDv
MD5 SHA1 SHA512 SSDEEP

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 701KB
SHA256 3c585d33bbf1f7326bd856970be79800d2043c7a88f7a35b6896f0926fb9f0a1
MD5 311300c8e506e8df714fa42b35979a8d
SHA1 a4314c4643cb66e92e963783739f61931e4cde9d
SHA512 a7da6e125d660528613b8e0a785faa4874dca0c4d6ff4d9e44eb1fd5b3ad3c555e165f643a36bf47d982b346e2e7fadf3b80531ce4d1f23b44127435d0ed6329
SSDEEP 12288:mUFmDDLp3Dbif4YAJ93y1NrLiLtJ8nBxu7DCOzRq8DvQgqAbhI:cpHofe3y1sInB2COzRq8DvFqt
MD5 SHA1 SHA512 SSDEEP

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 a1c03f21dae924e4f480ea524d505a15df03f5138fe07c5d14d6a8279d8064ee
MD5 e658d3637f7f456ca618622b15042cb2
SHA1 08c926789f2f56db7d86f7e6f21d89bb8f1443e9
SHA512 d5621ba00793ee846e390e2b11409721a44cf1f88a949777e2277d3ef39dc3547cedf06a40d3bb542459e43bc69f3e80f7b9552e46db088deb5694e67254d026
SSDEEP 12288:Js3Dbif4YAJ93y1NrLiLtJ8nBxu7DCOzRq8DvQgqAbhI:JsHofe3y1sInB2COzRq8DvFqt
MD5 SHA1 SHA512 SSDEEP

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 40d80e07202294b4bd49decf4c2af27058a16dc3c5ffd122361f7a06b1f5ae7a
MD5 fb25f2404f003f64730df0df20f57c52
SHA1 714e68cc7650499c8985837614e626595f94387c
SHA512 d16e9425eb9a475aac9978b4a5aadd7baa5121c74b255f30eb1197b2f4a88c996951412bb0b45f085387ae3951577791f72daf0810e43ee519e5aeccc6c9542c
SSDEEP 49152:Ka0h2GEkuAe73q3pp46zwwQYP4suIRbDv:Ka0hNYG4JwDPHn3
MD5 SHA1 SHA512 SSDEEP

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 659KB
SHA256 eedcb484564723ba18ce1962fec2dead7fedf6e2f2511090cb9d6aed6e3eebbf
MD5 8926efcee467b8898edbad08945bc30d
SHA1 3aba4432548b7f2ba3694e37e094cdaf5a3a6562
SHA512 5de60aa908af87fdd191e9c064425b40a2f8e97392b307cf6de169c8c538c030c58970c09d53533b05126c03afad40ffe03965a6abe5a9f3625ee5fe950e5025
SSDEEP 12288:HhbHjfXf3Dbif4YAJ93y1NrLiLtJ8nBxu7DCOzRq8DvQgqAbhI:HhbHjPfHofe3y1sInB2COzRq8DvFqt
MD5 SHA1 SHA512 SSDEEP

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 6c5edb43bfbf00c5f401f55a63cc84b014554607c5196eb5ecf63eb79af8b426
MD5 923fb2a74101926abc34352d6a2d5ace
SHA1 2bd545b4a8882b1d129af03cabfdae7b8305b641
SHA512 f2e1b99e81959cdff52e22eb146773e8a895c8b1aa0088a5ec59629d317513dfb3bf9a58c9e19c8d85c73ad6c68598105058396d02da482603c9d587068367bd
SSDEEP 24576:B3YgnJcRTk4yti+R5dpR/HHofe3y1sInB2COzRq8DvFqt:BIgnaTk46ppR/nP4suIRbDv
MD5 SHA1 SHA512 SSDEEP

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 578KB
SHA256 4769957ebd213349e1b21d5348d9e17fa4301debd896528dfb02a326fb150f4e
MD5 a5402312927f14947eaf76330b468220
SHA1 fd875d79b33660804d7cc80c6c42536e5103e646
SHA512 bf92883b0722edfaba1f6ffacda1aa68b47251b6d028c992a0986a1231da5c1fb991d5a50e94382062c57ef3fcda5e1f60d9baaa0dcc37038b29aab62a8baae5
SSDEEP 12288:lg3Dbif4YAJ93y1NrLiLtJ8nBxu7DCOzRq8DvQgqAbhI:lgHofe3y1sInB2COzRq8DvFqt
MD5 SHA1 SHA512 SSDEEP

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 940KB
SHA256 3d35b481e0da955a79f15b603d95ae33ce48d7ba48e3ebbd7597af09fe4e2cc9
MD5 9556b8c7a81ffea0ce736ca435a77135
SHA1 3772f80e6aed005c9c885096b46e059d6327303d
SHA512 0926fa1951ddb843924bd75a4e6c1950954b6b954dab67bf0947754c37023cf70cfc892e1a670e8533b75e79258f84ebe89ee97ccae45773c586a05008ab6fb3
SSDEEP 12288:oOb9A4LWOsvAYFTB3Dbif4YAJ93y1NrLiLtJ8nBxu7DCOzRq8DvQgqAbhI:FpL3UTBHofe3y1sInB2COzRq8DvFqt
MD5 SHA1 SHA512 SSDEEP

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 671KB
SHA256 9513956ec9be99647b207b7a4d00ae14dbaf5bd64f03aed82e3a5277d8b3d88e
MD5 5b261e80d4e8590a48c2da8f08c7daae
SHA1 4d73df932081c7f4d58930121a606147cd60775e
SHA512 ebca2a2e7ab973278d69e5084d1e584571b5e6bc36851ac7218a813c7a835ba5549a8f8bccbd0e33a768fc823f905a2d7b9bd05de49c2398f9952d7a0614716f
SSDEEP 12288:ipFtpOF3Dbif4YAJ93y1NrLiLtJ8nBxu7DCOzRq8DvQgqAbhI:QOFHofe3y1sInB2COzRq8DvFqt
MD5 SHA1 SHA512 SSDEEP

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 7bebf96577695ea6c8e37c2e86388f05c084dcd55c4d0a0ca5fd0c559c2b0f57
MD5 487291fba6bdfde75015d4a6ef9269f4
SHA1 f63d2d37d49e3af6e0c7071102bebcea949209a4
SHA512 494e510d21e57eede06bf98e100e7f9bf051952c2f69d88f888fa988346516e0f9387f6ed34ac1e0a68de56944768d43620485704aabb4610f69557fcd1e42bb
SSDEEP 24576:y7NM9YmZqmWMUkPjZM48Mv6bEhscHofe3y1sInB2COzRq8DvFqt:y7cBWMpPjN8DbEhvP4suIRbDv
MD5 SHA1 SHA512 SSDEEP

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 e30d7a1b5bfcda66b21cb20d9c983ba231ed049740ab3f26c9402ef65d1750a4
MD5 e7e8a8ac13c907cef1f2a788ffba3556
SHA1 79c561241608d2ce7d1e336fd90e5dcfd38442eb
SHA512 5c4fa11d12c07e0f56b8c51892225d1269aa07c86325bc352d136a841cec0ba8ba3028f8582eebf762b49af969c19ffe910c566c582968b75a65615a620f609d
SSDEEP 24576:IW6BApg2YuyuNDYTabvcRvNYf8km1SHofe3y1sInB2COzRq8DvFqt:IF2YuHNETovcvNYf8kmiP4suIRbDv
MD5 SHA1 SHA512 SSDEEP

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 67ce418991ce276647e3c4f2d7212440fae40930c55eb77d4398e1e9b9a99de7
MD5 b58f7f6cc7b81246c114a554bb3a9c1f
SHA1 d41fccc6e09baa10fe85bc0ebf63f230f14e7474
SHA512 f35e94b9e6a17b0d7e22f85a934a28dfbde1b379397024949f4c3382c96c9a96ec615c108e99cc00333a3d00ff0380f238e3462b08c8ea62ce7ea8af54d4d76b
SSDEEP 24576:3AFs06+Omlf3NXEbTo5Hofe3y1sInB2COzRq8DvFqt:QFs060lVXu4P4suIRbDv
MD5 SHA1 SHA512 SSDEEP

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 885KB
SHA256 c3c884e9a835c3ba41ddc3c0180c45c8a40f3e2755ae7c54fc20301088b4f434
MD5 9e71253c8f6d1b0282df6dd7f0760821
SHA1 e23f3b54a385e5edce7c24c0c54e4b6161653adb
SHA512 b72bf2a719f1a9c14e5e402e8d7aab2f16048ad8be584f8d3ce3fbec057297842331199859428f53104d29d0eae504bd2063fdf0160a53e7345fd8def78aa4a4
SSDEEP 24576:fJnJ5D3WtWHofe3y1sInB2COzRq8DvFqt:fJnJ5DGt4P4suIRbDv
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 3909905de06ab77e30bddbe661b72a840dfaf688488eed99e0d8591cfcdd7c40
MD5 a4ce97be17aa4bd3c5447990e2381050
SHA1 3844c9f9e9686ec119d8a31f229202e0e5a1b3e5
SHA512 bc938c700141f4a4ad21bbd40fa7f56f4ccc53f9d0b3f46a236c17639f286bddf912d87d328f62b13f51e259d4472b167a32dd5dd35be80b1de5fc222f937061
SSDEEP 24576:lEPohm6/7IIXdwcXrif7qQncjlP65i3VuHHofe3y1sInB2COzRq8DvFqt:yo06DIKdwc+eQnSt65aVmP4suIRbDv
MD5 SHA1 SHA512 SSDEEP

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 661KB
SHA256 955ad47d75008f0f766f6eeab8c271a55d6963b928eae106a5a8d1a5a6817ffb
MD5 6bc3ae145d695ddf3fed2e0f5129d414
SHA1 c5068b9e30774c0cec19694321ecd132125dca0d
SHA512 89f309d6700e30ea7853cbad763eefa35076f744636099e076deab5d11bca8b6ca64eaacb72bf2cb27521aaf532c29336488d158e1d4779548c87d7307625625
SSDEEP 12288:zEP3Rrq3Dbif4YAJ93y1NrLiLtJ8nBxu7DCOzRq8DvQgqAbhI:4rqHofe3y1sInB2COzRq8DvFqt
MD5 SHA1 SHA512 SSDEEP

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 712KB
SHA256 97e9ec9df5cd8e3be10b5bccf8a39ff100125199c68ebed0a2cf85133b98a752
MD5 48d7c4a5c93a8b7946be40f7fac69665
SHA1 1074194a53177a8b5e994ae0931550b98597a232
SHA512 e033fb18f1aa27846764b33c063068fe62e3cfc673f67f10b5cd5cba72cb2cb176106c59c50c26fe0ac0dd881c3c2c6ffafee4ffa39ae019a0df4fb76ada3e18
SSDEEP 12288:Sjkyv3Dbif4YAJ93y1NrLiLtJ8nBxu7DCOzRq8DvQgqAbhI:SIyvHofe3y1sInB2COzRq8DvFqt
MD5 SHA1 SHA512 SSDEEP

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 584KB
SHA256 1074cf338bb943f322dfcd5d3e1e80d52fd9b75b1c19912cf2f6b062ea7db59a
MD5 824facb01cc4ddaec0d7c684c1883d1d
SHA1 c5d57dd7737ab67a1a2d7acbae5b579f229098d7
SHA512 e4a3f459124975c1dd5c6e8aaf7424075408a1144ba61cb800ebe7007f803fd17ca7a9793012aad3ea3728704910fcbbc0df246012f6e572a02a45d5f481597a
SSDEEP 12288:wFV3Dbif4YAJ93y1NrLiLtJ8nBxu7DCOzRq8DvQgqAbhI:eVHofe3y1sInB2COzRq8DvFqt
MD5 SHA1 SHA512 SSDEEP

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 16d86d9fa496bd4d74eb5d354897cf411ea18ec8e0fb6510578a469025aa70ae
MD5 46f4025a9245aa5c02ab7ceffb74b374
SHA1 8114f2d38293e04d4b616fbef4f63bf1e69156a3
SHA512 72678dcf7bce8ef9e12157c5ebd297e7fdbcbaa936990404771482579bd5fb76b1b555ae7a598dfccf0e5f8aa61cc1e700e114c323e05457b8b79dc7eaa4e178
SSDEEP 24576:wQ9MxZKdcz97w30Hofe3y1sInB2COzRq8DvFqt:wVKXqP4suIRbDv
MD5 SHA1 SHA512 SSDEEP

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 772KB
SHA256 dfe463173a918c755c2843af819a76deccbf6555d357ab3d7c410ef637e71ba2
MD5 8ddbd91a0f2e4b85da3bc386317678ac
SHA1 646900bf9b9c7a0013463eb4e5641d4571f8c5cf
SHA512 1fda7b74c34e674d7aecc1f5d5fff85ac74c0723b08591bfc9e173884af29ad068389cc8cef445a98aa0041ce0e17b59800c1c8137926e3ee658201d8ec2cab9
SSDEEP 12288:hyoKo2HRple9pT3Dbif4YAJ93y1NrLiLtJ8nBxu7DCOzRq8DvQgqAbhI:hyocxApTHofe3y1sInB2COzRq8DvFqt
MD5 SHA1 SHA512 SSDEEP

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 9830ef1dd60b20c6e4d2e2a55027fc7174f9afcefb8c80c9dab2fd7ca1472cba
MD5 71922382d6f13ed193ac97e426879eea
SHA1 656f336918e6662220019b2b4603a8534c473b13
SHA512 ee41b6085c3be89be8e0f7a8a02b6b29b0b0b67ac244385b30139452c25458aabaee592a3f081a411ab185ff9d2895df160302e89ff553515f9d6bc30117769f
SSDEEP 49152:OWcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIKrP4suIRbDv:o0zuNIXPHn3
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 c49b76e5c271be0fe803c748d80eda51fa373a42bae34e77d1aed25ff0fa4d6c
MD5 660305d8bae2a89c4d69aae87078f1a8
SHA1 23e5d940250c7db9764f7ff1c6277b4103f2584e
SHA512 89a458cead6c5d55e145c0ed9ffacd75e845118b5b49ba855b94c28477dcdbf39d47a89d0cf18542532360932630d6bdfd3fb8b5cb2c950dc027b082e7aadf81
SSDEEP 24576:q1QT7EcpfxR+N5AWAz3ooiYtjMqbqHofe3y1sInB2COzRq8DvFqt:XTDxR+N5YzTfjMBP4suIRbDv
MD5 SHA1 SHA512 SSDEEP

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 877KB
SHA256 bb2b68e0d96e2618a4b7c5f894e225a0469233dcf101d0b979b443a545717d7b
MD5 90c6a4b42a1d2217b21cafb41b17ef0b
SHA1 1b480c2f896062076c74636323ff32196ae98f63
SHA512 879a367588415862f04c853c9cfffb38395b03604106c0872f0c3352319edaac05445e139a478b1adf611964851350cbd5e12df7724752f716aa87dedaf7732e
SSDEEP 24576:uTMdOz0FFS+imSLOHofe3y1sInB2COzRq8DvFqt:a0K+imSLAP4suIRbDv
MD5 SHA1 SHA512 SSDEEP

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 635KB
SHA256 5a047aed510078edc4b875fd2c700c51e15a50dac035b4aa30a0dd85d631a139
MD5 6aa886050c2f992c77208ddd5d63caf2
SHA1 9ba43153bb3965bd3666ef0576382cc76b9b5475
SHA512 8e5ff14200981b3bb6e065fc2abe876a6b9b2110c9090c3af1d50abf329498adab31ad96c09479235ec4c888d2892f5847a31949ed46c9446ce0194b8c89254c
SSDEEP 12288:047B3Dbif4YAJ93y1NrLiLtJ8nBxu7DCOzRq8DvQgqAbhI:TBHofe3y1sInB2COzRq8DvFqt
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/116-262-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/116-564-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/220-445-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/220-164-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/700-26-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/700-33-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/700-34-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/700-32-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/700-132-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/1180-565-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/1180-267-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/1336-225-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/1336-509-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/1532-231-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/1532-560-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/1796-266-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/1796-474-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/1796-144-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/1852-261-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/1852-133-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/1920-20-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/1920-19-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/1920-103-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/1920-18-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/1920-12-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/2076-38-0x0000000000950000-0x00000000009B0000-memory.dmp

Download

memory/2076-45-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/2076-47-0x0000000000950000-0x00000000009B0000-memory.dmp

Download

memory/2076-50-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/2076-48-0x0000000000950000-0x00000000009B0000-memory.dmp

Download

memory/2284-203-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/2284-92-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2284-91-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/2468-476-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/2468-192-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/2632-82-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/2632-77-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/2632-89-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/2632-84-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/2632-87-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/2936-187-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/2936-475-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/3204-123-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/3204-230-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/3376-54-0x0000000000440000-0x00000000004A0000-memory.dmp

Download

memory/3376-60-0x0000000000440000-0x00000000004A0000-memory.dmp

Download

memory/3376-173-0x0000000140000000-0x000000014024B000-memory.dmp

Download

memory/3376-53-0x0000000140000000-0x000000014024B000-memory.dmp

Download

memory/3384-64-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/3384-72-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/3384-70-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/3384-180-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/3664-129-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/3724-75-0x0000000000400000-0x00000000005D9000-memory.dmp

Download

memory/3724-8-0x0000000002330000-0x0000000002397000-memory.dmp

Download

memory/3724-0-0x0000000002330000-0x0000000002397000-memory.dmp

Download

memory/3724-5-0x0000000000400000-0x00000000005D9000-memory.dmp

Download

memory/3772-174-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/3772-467-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4060-242-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4060-563-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4792-218-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/4792-112-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/5080-217-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/5080-204-0x0000000140000000-0x00000001401C0000-memory.dmp

Download