4c1d54c7cdf7fdf763438202da27ea962222dc957d7d1bf7b1f553de704fd480

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
02/06/2024, 22:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-06-02_b87d05195c684527d52894ddf5b8d0ed_bkransomware.exe
Size 712KB
Sample240602-2al3maab96
SHA256 4c1d54c7cdf7fdf763438202da27ea962222dc957d7d1bf7b1f553de704fd480
MD5 b87d05195c684527d52894ddf5b8d0ed
SHA1 d4547056b63fd1994599ebe9fd5623c2a5bf6503
SHA512 b34c79f7e888a9b949f2ef5d793b4f701e968e1602edbffddc232c84ec357dd38e7b99d4f2f2a642743c00d4e15fb3c54cb9a2aba5f1fceee492da0b3542192c
SSDEEP 12288:vtOw6BapU5VFWwHiC4mxYr8PCAwQy3KVMsMWsYNv+0kHe/6eZ0hW4:F6BkwH/BYcCAwQEKesf/NmLeiTd
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
464	alg.exe
1172	DiagnosticsHub.StandardCollector.Service.exe
60	fxssvc.exe
3776	elevation_service.exe
4536	elevation_service.exe
856	maintenanceservice.exe
4832	msdtc.exe
4492	OSE.EXE
8	PerceptionSimulationService.exe
3980	perfhost.exe
4384	locator.exe
2932	SensorDataService.exe
4636	snmptrap.exe
1520	spectrum.exe
728	ssh-agent.exe
2856	TieringEngineService.exe
4780	AgentService.exe
4740	vds.exe
4924	vssvc.exe
540	wbengine.exe
2204	WmiApSrv.exe
1168	SearchIndexer.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in System32 directory 31 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2024-06-02_b87d05195c684527d52894ddf5b8d0ed_bkransomware.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2024-06-02_b87d05195c684527d52894ddf5b8d0ed_bkransomware.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2024-06-02_b87d05195c684527d52894ddf5b8d0ed_bkransomware.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2024-06-02_b87d05195c684527d52894ddf5b8d0ed_bkransomware.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\alg.exe	2024-06-02_b87d05195c684527d52894ddf5b8d0ed_bkransomware.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2024-06-02_b87d05195c684527d52894ddf5b8d0ed_bkransomware.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2024-06-02_b87d05195c684527d52894ddf5b8d0ed_bkransomware.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2024-06-02_b87d05195c684527d52894ddf5b8d0ed_bkransomware.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2024-06-02_b87d05195c684527d52894ddf5b8d0ed_bkransomware.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2024-06-02_b87d05195c684527d52894ddf5b8d0ed_bkransomware.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2024-06-02_b87d05195c684527d52894ddf5b8d0ed_bkransomware.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2024-06-02_b87d05195c684527d52894ddf5b8d0ed_bkransomware.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2024-06-02_b87d05195c684527d52894ddf5b8d0ed_bkransomware.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2024-06-02_b87d05195c684527d52894ddf5b8d0ed_bkransomware.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2024-06-02_b87d05195c684527d52894ddf5b8d0ed_bkransomware.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2024-06-02_b87d05195c684527d52894ddf5b8d0ed_bkransomware.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2024-06-02_b87d05195c684527d52894ddf5b8d0ed_bkransomware.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2024-06-02_b87d05195c684527d52894ddf5b8d0ed_bkransomware.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2024-06-02_b87d05195c684527d52894ddf5b8d0ed_bkransomware.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\5bf1e92d92be0f3e.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\locator.exe	2024-06-02_b87d05195c684527d52894ddf5b8d0ed_bkransomware.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2024-06-02_b87d05195c684527d52894ddf5b8d0ed_bkransomware.exe
File opened for modification	C:\Windows\System32\vds.exe	2024-06-02_b87d05195c684527d52894ddf5b8d0ed_bkransomware.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2024-06-02_b87d05195c684527d52894ddf5b8d0ed_bkransomware.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2024-06-02_b87d05195c684527d52894ddf5b8d0ed_bkransomware.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\minidump-analyzer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2024-06-02_b87d05195c684527d52894ddf5b8d0ed_bkransomware.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2024-06-02_b87d05195c684527d52894ddf5b8d0ed_bkransomware.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2024-06-02_b87d05195c684527d52894ddf5b8d0ed_bkransomware.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	2024-06-02_b87d05195c684527d52894ddf5b8d0ed_bkransomware.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	2024-06-02_b87d05195c684527d52894ddf5b8d0ed_bkransomware.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2024-06-02_b87d05195c684527d52894ddf5b8d0ed_bkransomware.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2024-06-02_b87d05195c684527d52894ddf5b8d0ed_bkransomware.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	2024-06-02_b87d05195c684527d52894ddf5b8d0ed_bkransomware.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_91015\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2024-06-02_b87d05195c684527d52894ddf5b8d0ed_bkransomware.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2024-06-02_b87d05195c684527d52894ddf5b8d0ed_bkransomware.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2024-06-02_b87d05195c684527d52894ddf5b8d0ed_bkransomware.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdate.exe	2024-06-02_b87d05195c684527d52894ddf5b8d0ed_bkransomware.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	2024-06-02_b87d05195c684527d52894ddf5b8d0ed_bkransomware.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	2024-06-02_b87d05195c684527d52894ddf5b8d0ed_bkransomware.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe	2024-06-02_b87d05195c684527d52894ddf5b8d0ed_bkransomware.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2024-06-02_b87d05195c684527d52894ddf5b8d0ed_bkransomware.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2024-06-02_b87d05195c684527d52894ddf5b8d0ed_bkransomware.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2024-06-02_b87d05195c684527d52894ddf5b8d0ed_bkransomware.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2024-06-02_b87d05195c684527d52894ddf5b8d0ed_bkransomware.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2024-06-02_b87d05195c684527d52894ddf5b8d0ed_bkransomware.exe
File opened for modification	C:\Program Files\Mozilla Firefox\minidump-analyzer.exe	2024-06-02_b87d05195c684527d52894ddf5b8d0ed_bkransomware.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	2024-06-02_b87d05195c684527d52894ddf5b8d0ed_bkransomware.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	2024-06-02_b87d05195c684527d52894ddf5b8d0ed_bkransomware.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler.exe	2024-06-02_b87d05195c684527d52894ddf5b8d0ed_bkransomware.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2024-06-02_b87d05195c684527d52894ddf5b8d0ed_bkransomware.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_91015\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	2024-06-02_b87d05195c684527d52894ddf5b8d0ed_bkransomware.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2024-06-02_b87d05195c684527d52894ddf5b8d0ed_bkransomware.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2024-06-02_b87d05195c684527d52894ddf5b8d0ed_bkransomware.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000418816e3bb5da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000073e3ea6d3bb5da01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006d0bf26d3bb5da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007393fb6d3bb5da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000092b946e3bb5da01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000836f106c3bb5da01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a729ee6c3bb5da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 42 IoCs

pid	Process
3216	2024-06-02_b87d05195c684527d52894ddf5b8d0ed_bkransomware.exe
3216	2024-06-02_b87d05195c684527d52894ddf5b8d0ed_bkransomware.exe
3216	2024-06-02_b87d05195c684527d52894ddf5b8d0ed_bkransomware.exe
3216	2024-06-02_b87d05195c684527d52894ddf5b8d0ed_bkransomware.exe
3216	2024-06-02_b87d05195c684527d52894ddf5b8d0ed_bkransomware.exe
3216	2024-06-02_b87d05195c684527d52894ddf5b8d0ed_bkransomware.exe
3216	2024-06-02_b87d05195c684527d52894ddf5b8d0ed_bkransomware.exe
3216	2024-06-02_b87d05195c684527d52894ddf5b8d0ed_bkransomware.exe
3216	2024-06-02_b87d05195c684527d52894ddf5b8d0ed_bkransomware.exe
3216	2024-06-02_b87d05195c684527d52894ddf5b8d0ed_bkransomware.exe
3216	2024-06-02_b87d05195c684527d52894ddf5b8d0ed_bkransomware.exe
3216	2024-06-02_b87d05195c684527d52894ddf5b8d0ed_bkransomware.exe
3216	2024-06-02_b87d05195c684527d52894ddf5b8d0ed_bkransomware.exe
3216	2024-06-02_b87d05195c684527d52894ddf5b8d0ed_bkransomware.exe
3216	2024-06-02_b87d05195c684527d52894ddf5b8d0ed_bkransomware.exe
3216	2024-06-02_b87d05195c684527d52894ddf5b8d0ed_bkransomware.exe
3216	2024-06-02_b87d05195c684527d52894ddf5b8d0ed_bkransomware.exe
3216	2024-06-02_b87d05195c684527d52894ddf5b8d0ed_bkransomware.exe
3216	2024-06-02_b87d05195c684527d52894ddf5b8d0ed_bkransomware.exe
3216	2024-06-02_b87d05195c684527d52894ddf5b8d0ed_bkransomware.exe
3216	2024-06-02_b87d05195c684527d52894ddf5b8d0ed_bkransomware.exe
3216	2024-06-02_b87d05195c684527d52894ddf5b8d0ed_bkransomware.exe
3216	2024-06-02_b87d05195c684527d52894ddf5b8d0ed_bkransomware.exe
3216	2024-06-02_b87d05195c684527d52894ddf5b8d0ed_bkransomware.exe
3216	2024-06-02_b87d05195c684527d52894ddf5b8d0ed_bkransomware.exe
3216	2024-06-02_b87d05195c684527d52894ddf5b8d0ed_bkransomware.exe
3216	2024-06-02_b87d05195c684527d52894ddf5b8d0ed_bkransomware.exe
3216	2024-06-02_b87d05195c684527d52894ddf5b8d0ed_bkransomware.exe
3216	2024-06-02_b87d05195c684527d52894ddf5b8d0ed_bkransomware.exe
3216	2024-06-02_b87d05195c684527d52894ddf5b8d0ed_bkransomware.exe
3216	2024-06-02_b87d05195c684527d52894ddf5b8d0ed_bkransomware.exe
3216	2024-06-02_b87d05195c684527d52894ddf5b8d0ed_bkransomware.exe
3216	2024-06-02_b87d05195c684527d52894ddf5b8d0ed_bkransomware.exe
3216	2024-06-02_b87d05195c684527d52894ddf5b8d0ed_bkransomware.exe
3216	2024-06-02_b87d05195c684527d52894ddf5b8d0ed_bkransomware.exe
1172	DiagnosticsHub.StandardCollector.Service.exe
1172	DiagnosticsHub.StandardCollector.Service.exe
1172	DiagnosticsHub.StandardCollector.Service.exe
1172	DiagnosticsHub.StandardCollector.Service.exe
1172	DiagnosticsHub.StandardCollector.Service.exe
1172	DiagnosticsHub.StandardCollector.Service.exe
1172	DiagnosticsHub.StandardCollector.Service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
652	Process not Found
652	Process not Found

Suspicious use of AdjustPrivilegeToken 43 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3216	2024-06-02_b87d05195c684527d52894ddf5b8d0ed_bkransomware.exe
Token: SeAuditPrivilege	60	fxssvc.exe
Token: SeRestorePrivilege	2856	TieringEngineService.exe
Token: SeManageVolumePrivilege	2856	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	4780	AgentService.exe
Token: SeBackupPrivilege	4924	vssvc.exe
Token: SeRestorePrivilege	4924	vssvc.exe
Token: SeAuditPrivilege	4924	vssvc.exe
Token: SeBackupPrivilege	540	wbengine.exe
Token: SeRestorePrivilege	540	wbengine.exe
Token: SeSecurityPrivilege	540	wbengine.exe
Token: 33	1168	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1168	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1168	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1168	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1168	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1168	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1168	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1168	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1168	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1168	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1168	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1168	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1168	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1168	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1168	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1168	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1168	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1168	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1168	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1168	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1168	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1168	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1168	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1168	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1168	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1168	SearchIndexer.exe
Token: SeDebugPrivilege	3216	2024-06-02_b87d05195c684527d52894ddf5b8d0ed_bkransomware.exe
Token: SeDebugPrivilege	3216	2024-06-02_b87d05195c684527d52894ddf5b8d0ed_bkransomware.exe
Token: SeDebugPrivilege	3216	2024-06-02_b87d05195c684527d52894ddf5b8d0ed_bkransomware.exe
Token: SeDebugPrivilege	3216	2024-06-02_b87d05195c684527d52894ddf5b8d0ed_bkransomware.exe
Token: SeDebugPrivilege	3216	2024-06-02_b87d05195c684527d52894ddf5b8d0ed_bkransomware.exe
Token: SeDebugPrivilege	1172	DiagnosticsHub.StandardCollector.Service.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1168 wrote to memory of 4568	1168	SearchIndexer.exe	109
PID 1168 wrote to memory of 4568	1168	SearchIndexer.exe	109
PID 1168 wrote to memory of 2512	1168	SearchIndexer.exe	110
PID 1168 wrote to memory of 2512	1168	SearchIndexer.exe	110

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2024-06-02_b87d05195c684527d52894ddf5b8d0ed_bkransomware.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-02_b87d05195c684527d52894ddf5b8d0ed_bkransomware.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3216

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:464

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1172

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:4888

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:60

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3776

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4536

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:856

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4832

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4492

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:8

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:3980

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4384

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2932

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:4636

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1520

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:728

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:2704

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2856

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4780

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:4740

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4924

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:540

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:2204

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1168
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4568
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:2512

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
Size 2.1MB
SHA256 04aaba630d0cf6704e6f9700b26f6d56a99f72746e98c8f5d022b40a7993f21a
MD5 72aa3f8ca4d610a8e643bb42ae431ecb
SHA1 b82e9031184f22b306d5450a4572aed8efbdd5cf
SHA512 5a01aef7d0db665f3c4a1c8f0e340d2f4307352f513be88d6ff2994c30e9d61785400742a3169f52c4640b3e0d66163df33821343728fc6275e8da9110910893
SSDEEP 49152:9uYk3H5koUzfTqkkYLO/W2buywzMbOX+T7z5+CCAcKV/NmLvTd:97fTqi90bqCCMlwLv
MD5 SHA1 SHA512 SSDEEP

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 797KB
SHA256 8373890aeb7adccd0fc495d12f3a81b77745cfc3efb8b3210de338dcba260a28
MD5 8bf393bbace5cf8f4fd371241397868e
SHA1 0c15b6d6d2e99cab3f90a218e62313bde48a3845
SHA512 fcf5ee56ee979bcef7d689ecb95aac6e3e6e4fc0140627f9b37b7adf9b6a98c18f395637fdea630e0c014cf6e6ee3cadad405df65bebff1741b4a81d6bd79c5d
SSDEEP 24576:NiPnBsuE3wH/BYcCAwQEKesf/NmLeiTd:SSu4CCAcKV/NmLvTd
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 151229c268b10bd2117bb76c252256f4773096820611b1c1ec2d4da52f2e54cd
MD5 7a27b5ad527f541637e62087f6198340
SHA1 dd914ff0d75dacc004526dc5b54d7b928530763d
SHA512 a23f413b0bea0b143847b6aa28843af34a6154d896f14f1d8da0364964b3697ece6c318a9db678e2ecbb4da28bad083c00ee7b39688252a3dd580e774ade654d
SSDEEP 24576:X+gkEHfh4Co7wH/BYcCAwQEKesf/NmLeiTd:ugkE/SFCCAcKV/NmLvTd
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 9ff172384173c2c1f42a9f71690ae5cd6d5956b7f3d5f61c6bf2d4b424dcbdf5
MD5 28eb57b2bb2684cea42654477213c4fe
SHA1 1713676fef425948b885b6e9aac630c624857a98
SHA512 36061d5ceb4d5083d11110f932dcc29d2cbb88d5b9d6b2523330037eafe76092cae6a6a65170c93755c298f3c835e0a0c0e1126f0ab33167453dc227f7bb86c9
SSDEEP 24576:tBpDRmi78gkPXlyo0GtjrSwH/BYcCAwQEKesf/NmLeiTd:HNRmi78gkPX4o0GtjeCCAcKV/NmLvTd
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 215775679906c26dc016510a08d9ec64adfec93a45db18002b107584cf6468da
MD5 06511263e05ce9c263726294cd2811a5
SHA1 7ceefcf74264228ece512a2f0e5e25f3a6432c21
SHA512 4348e407f2d3c81c31f6fd5c6357297be09c5c48d81f6ab135037dfb2893a70185c173f5c17032e3c6bf0cb1fd4c8bc26565609eaad5b1e3e0ee769e591ae246
SSDEEP 24576:ALOS2oTPIXV7wH/BYcCAwQEKesf/NmLeiTd:4/T2CCAcKV/NmLvTd
MD5 SHA1 SHA512 SSDEEP

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 71a75863cbf606402bf1399b735a2eeee6c6d9c2405fe8065e5bc6d0c35939b2
MD5 252ec7495b6ebbc005308035fa1f3679
SHA1 dc6b42832075b6adc6eb79e3b4c7034a49d357fd
SHA512 297ef249f784ac6fd966ecaa20027f661fc4ec90c5c92706f035b338f72fc89640eb6c01c6f567548dab6d00e71d6d31d7ee28fa8d7a12f161e22286a7fd5362
SSDEEP 12288:EtMOU5VFWwHiC4mxYr8PCAwQy3KVMsMWsYNv+0kHe/6eZ0hW4:EtlwH/BYcCAwQEKesf/NmLeiTd
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 5838f293f7579401320c24a41cadfaf73f151d9c421a5048837075a87786b8b1
MD5 9e019f4be6e5ba72073bce71ecab234c
SHA1 a8b6713fc5c4d5ab6bdd501fa5b4da0bc2e92e53
SHA512 951fa833599ddb11bc050f9db51f35805d107d1bb4da042467232a86b501ded9c9ff1b483e31632d79a1529d065396e3453e308c333f40f2b89d54fb6f7cd178
SSDEEP 12288:FeBNUbTVO86UbOU5VFWwHiC4mxYr8PCAwQy3KVMsMWsYNv+0kHe/6eZ0hW4:FJIUEwH/BYcCAwQEKesf/NmLeiTd
MD5 SHA1 SHA512 SSDEEP

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 1bd9b0001e78d37244279d0a11130f2ba5530aa616e6d2c0846e6a1586c4c084
MD5 354bf47763ef5b2eaa6e66e49772ae2b
SHA1 b954daa5559bbb7c0221aecb307f4788733af22d
SHA512 8de6b84843ceed9b2e8692ead40496ed0cb9cc3e43963eea872e6cb63d6c6d25a3348a0940d12538d32c41bd734ae7dc30cf9d43c762118db12c9e9612af9326
SSDEEP 49152:OQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THg:OQvGAdlCEL8c/DRNw5CPCCMlwLv
MD5 SHA1 SHA512 SSDEEP

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 f16a341127b2e86a696d69c9f98c5473d7fbcd5240586bd31cc132175bb1040d
MD5 46c8583e2f047044bd3c741c6406a08a
SHA1 3202e6ddb5490b45da153231d908cdc3e24449e7
SHA512 9353b0eaf69f3588f52732883fdd4acc456dd6d9fd93ca4963d4e843c2323997000e9a80aea8744441cd45117a72267087921b2dbe7c7fa6a186365ba430d3f7
SSDEEP 12288:gAwSfxL/2Dc3RDLLmt0LDQewsAjBOU5VFWwHiC4mxYr8PCAwQy3KVMsMWsYNv+08:10ewsAjqwH/BYcCAwQEKesf/NmLeiTd
MD5 SHA1 SHA512 SSDEEP

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 d3d0ae448ed21634db495f407f35fc62e651513b1718295c096e2a285f9ce84b
MD5 886543f779e37fd88e5b0c2156d5b562
SHA1 55f5fc814ac5a2ebd127c20601a9c19028514ec3
SHA512 f611d6196adbb9f551e61540f868c4017d6b8aebbe065b2d557ed2ad4a5a43f534a04207c7fded49cb3b31e04f268e21e262ae81360a070276c769491fdb1b98
SSDEEP 196608:2UEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHi6:2UEtQevvqc2W1cpV2tI32i
MD5 SHA1 SHA512 SSDEEP

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 e06e1ee99d121ea368f1931a49bb0a14837031256a5f8c97ea7490442acae9b5
MD5 3320606738dd9110bd630d62a778bb50
SHA1 86bcf6839ef2b66b8a71771a55cb45daa67a20da
SHA512 a831ee1f338604d2adc1f11623a7ad36c60c0c962efc2dcf3c0a1ccdccf885da5cb2814c4841d4f62ea34f5addbbae5d9d181b1d942febe2519fc4284a9e8d2a
SSDEEP 49152:2CbRquA/m2yL5zQfFiV+XenmE3/zKCCAcKV/NmLvTd:7oqtVjnmrCCMlwLv
MD5 SHA1 SHA512 SSDEEP

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 d167d71c950a9b1395af8b51e970716cfa36ff9b46dc5c5551781449ea4838ec
MD5 81a19a0ef704932f413c0776c5159bf9
SHA1 62d97c0c01f8294b9185ceb100439f1740d92faf
SHA512 b5e5f03dd63a21024a8ef46811e5b154141bceef751ef0ef0437e73bcda725cdc5537d76f6f79a5445006a2494f20c5e9554ae9951c1348147b5a73b62374c80
SSDEEP 24576:xAhGL3IFoiwtA5l7S53LwH/BYcCAwQEKesf/NmLeiTd:xAMUFoiq5bCCAcKV/NmLvTd
MD5 SHA1 SHA512 SSDEEP

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 85cbd381a88b89c741d74c83212bb66e1db705a5634cf6ff6bb6c135f43e84f5
MD5 c85ce985e15bc5ca112cabdf120bbc25
SHA1 a5a4c57bc0fda13cb5cd394b7e33a1c199be4840
SHA512 aea97810e749f52da96627a4643813c1af242e81f5ca9e0e33f1c7b572738420136f774661e80799c51276c7b9a8c95232d5bc9429bb2e282865bffadf661a90
SSDEEP 12288:5mw5HEjsChNVBFgl0WDm+COOU5VFWwHiC4mxYr8PCAwQy3KVMsMWsYNv+0kHe/6Z:Uwu4OW2wH/BYcCAwQEKesf/NmLeiTd
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 da78b6d21c086952311801b6fe30e2a0e573c0feaf99896f350dcd599ccc5f54
MD5 36f64d3b33f0ffe27401d850edcfb21a
SHA1 540fc82b8bf20d87c7579f4fbc52ed43f35dc5a2
SHA512 ae185a108b7fc4bc75ab522a7baec94df3e53fe1ed02bc2dbf56b18ce13be9341734358854530c82c2744f0e72dcb8489de4be389885595c388ededfd59a009e
SSDEEP 12288:FeZ1IyROU5VFWwHiC4mxYr8PCAwQy3KVMsMWsYNv+0kHe/6eZ0hW4:wZupwH/BYcCAwQEKesf/NmLeiTd
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
Size 5.4MB
SHA256 51e2f09197133a7ee826a246f21690eefbb73cb6e1aee9aaa8a3b25095de8bda
MD5 29fe8a431c86635e36a4a477194193b8
SHA1 eb0deea9b2ee01de7b99e61f644117356ff31b61
SHA512 26417afcd4b0d41010a4137ebdfc448251a373764b486048c1e48274a29fc9b6fc64438abd6de948e4f20a471c09ba1ec8ad4feab52ce1aa09b1ad5aa6bfd3d9
SSDEEP 49152:20kwIi7c4xZlm5knEtw99Kn/2vim7vgv6m+yyJ/0gbvjy7yY7BHi3u7L/gBUUWLQ:gwfhY7g/rLO7yYA3awr341gTCCMlwLv
MD5 SHA1 SHA512 SSDEEP

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe
Size 5.4MB
SHA256 24ea85e5bffa13a5da7e42266f300bf8897672941d885b538e24e17e236517b1
MD5 de757152969e93925685e3326091038b
SHA1 5d61a45370a3ac5d46d48a1898615a2ede79f0b0
SHA512 07c0299ac076c1e55ac4958538927fd3e7ee152e347962e0909d0cdeedef018486150a06cee23017f56f2fcad44dedd82355b41954ac6147ec78d41576e4f14f
SSDEEP 49152:B0kwIi7c4xZlm5knEtw99Kn/2vim7vgv6m+yyJ/0gbvjy7yY7BHi3u7L/gBUUWLQ:xwfhY7g/rLO7yYA3awr341gTCCMlwLv
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe
Size 2.0MB
SHA256 b40bb864f44b48b819700d4402d83e172275571b98c2faee81487d047d7c1a9d
MD5 225aa131b117313df0b07c92e10cce1f
SHA1 4249b8af887981ed2909e227b15c8ad545373198
SHA512 99a4bc977611c13e26e82b00fb5b04e2e950552fe3392417ca28345070755e6a05c8806a0d1dfa2a3974d5fd2b886a0d85be35d433c13462c83202d63a9b7063
SSDEEP 24576:XcTyYv0FteQUd5I2kjgD6iQacA2wH/BYcCAwQEKesf/NmLeiTd:XuXv0FtpU5606zO2CCAcKV/NmLvTd
MD5 SHA1 SHA512 SSDEEP

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
Size 2.2MB
SHA256 99a59dbb8517ed1e95b9ad8130eb7c3844c3fff008e0d07afcce58a27466e088
MD5 98f7ef4dff8f84db43f27b1760163a95
SHA1 60ab6cc0dbec6ef418173d907b3f5d6d98c1fc0e
SHA512 27f2adfd047d57a9e903116eb7be4f12b8f423acdbb48aed3dc95c1a5c1e5abce8ef198611fa7b01e722584e8c25e3d1645647c0ab003cb573bce3e5dec22f3b
SSDEEP 49152:Vy7mTd0GxN8jyyncHjXKUyn4GVcbDSKrNTxqCCAcKV/NmLvTd:wmYeycHjWjMTqCCMlwLv
MD5 SHA1 SHA512 SSDEEP

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe
Size 1.8MB
SHA256 adaca8901f406f953f70173c9012bc375a6db5ca2c188a6de9872b7f9bbca278
MD5 ad5d2c54a33dee8b527a2b617ee3fc10
SHA1 22e433a2ec2d3537e03a0713b0daf6cd34c18c84
SHA512 87ca8925f8bae7f36b41e2eeeffbca200fbe1ebea36d8451488c5c4af08d94f775c624fe1041f86b2c7ea1a690e276bc7a6b79911da30be54e79b99ede5792c3
SSDEEP 24576:F6drZn1WEci182IEUZNbJeRgUebgW816BwH/BYcCAwQEKesf/NmLeiTd:FWnDci18NNNUgbY+CCAcKV/NmLvTd
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 1.7MB
SHA256 b40e8e68445bd2ea87fec69957a640e916afbc4aed62f2949499cd3e4f804c65
MD5 75582cd0077adb992ca71d4b3033b10f
SHA1 4e3c1d2d73df41e7816d6e396bb39e25c66800fd
SHA512 e74c6b41ef10dcb87092c442343bd3493a127cdc0305a18d1d14bc83b45797f9592f652f91f2c60b952927480f41cefdce1e438a1753eb1108b2b68156bed6bd
SSDEEP 24576:bk5lHW5EzMZupOG0G2reD+melRgTTv/1ny4wH/BYcCAwQEKesf/NmLeiTd:bizMZw0GhamSopCCAcKV/NmLvTd
MD5 SHA1 SHA512 SSDEEP

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 e310fd45980e29bf10b2a33454d6177601fd0760381b0aa1f460099fbdd3c14d
MD5 519a88374ac780f8cd092b47b13d5ddb
SHA1 cae31cb914c4160bff4b0878b1a5f1dde9010da3
SHA512 fd6fba86373751fef87bba805028843c75e528a43c62d803a7836746aa2ad6c3c87997953820e35d26db506d3aab7951a614f6faf504c9cf2b52b6908dcb2ec1
SSDEEP 12288:0EOU5VFWwHiC4mxYr8PCAwQy3KVMsMWsYNv+0kHe/6eZ0hW4:0twH/BYcCAwQEKesf/NmLeiTd
MD5 SHA1 SHA512 SSDEEP

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 dd199e41e9522b114e7a97797be65b26256c37505623c7aab078aac7a5fe111a
MD5 a69125f2a4f85f4a28680ecbe6b76c7b
SHA1 8d2aaad454f0a46304e3eb832604201062cbd6a4
SHA512 f961e15f21695a8ab3b2c6b10b3322e271a3c22df0a2f53187864822e2c7538030542f370e464a95eed6f27774186792abf106a5a3996a92c1a2203508d79f16
SSDEEP 12288:TFOU5VFWwHiC4mxYr8PCAwQy3KVMsMWsYNv+0kHe/6eZ0hW4:TuwH/BYcCAwQEKesf/NmLeiTd
MD5 SHA1 SHA512 SSDEEP

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 4b1fb3ac60076364d6db3baf41cd8878caf07b7bdf470effc6c2bcffd5a70b14
MD5 137458e4aed2c8792e8339a12c9b07e6
SHA1 94d7e6976e0d6b8ab0ef50d1745b6c02070d5510
SHA512 12991781e54bfe2c2dce85c7ced24dc13b46943c4a99f37bd6d274c0536588473619d9ba70fcf9a32618d29c2253995d59ad5589c65a5aa80d37f4e188eb754f
SSDEEP 12288:DTOU5VFWwHiC4mxYr8PCAwQy3KVMsMWsYNv+0kHe/6eZ0hW4:DMwH/BYcCAwQEKesf/NmLeiTd
MD5 SHA1 SHA512 SSDEEP

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 74c2762891ac83145e88056c571c527d98cad1eab89c8091d5bccc323e7d41e8
MD5 d16118510ce3fbdb45901299c8f31b84
SHA1 1c84298d270e64d7a8228950b18c18361ed182dc
SHA512 242a421138d3407493fe7d46960b702dcec5feef8ca8617cc3a7d8734fbaf1af590889588109b1ffae23b846d6efc10d29e15546b05995d88ba123a978f2233c
SSDEEP 12288:iVqOU5VFWwHiC4mxYr8PCAwQy3KVMsMWsYNv+0kHe/6eZ0hW4:GwH/BYcCAwQEKesf/NmLeiTd
MD5 SHA1 SHA512 SSDEEP

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 cdd1e094e2921582688ba335229fd4d9a82032ee7d17d6e7aad6f3dac3d65246
MD5 81bafb5ca033f2a25d34a93af6e7ef21
SHA1 c27695f87789692c50e9592d5495f7521b4facdd
SHA512 2899578f64a1133721397214016d77b9ce58991dd14db678bdbc4be84c6003471cfe40127ffbc67e5044e8c49b61598be292756e51607ab092460c2830c4d7a4
SSDEEP 12288:VyOU5VFWwHiC4mxYr8PCAwQy3KVMsMWsYNv+0kHe/6eZ0hW4:VjwH/BYcCAwQEKesf/NmLeiTd
MD5 SHA1 SHA512 SSDEEP

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 e0173ceff3bf90def72aad895883d2ccd5d9cd1a6c447f253c5a53b70ebb5926
MD5 03f7f86fecda709951e36be8fb25e494
SHA1 f77dd4618f945a692f46f679df861027c643e046
SHA512 f977f535d0b5f564c29693b5e67a62dae97ce14d2b82c76daf50ee86357abd060f03db52bb74e0cab0d70828914a110995474a393993d12908a32c19f4fbb186
SSDEEP 12288:b5OU5VFWwHiC4mxYr8PCAwQy3KVMsMWsYNv+0kHe/6eZ0hW4:bSwH/BYcCAwQEKesf/NmLeiTd
MD5 SHA1 SHA512 SSDEEP

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 0b601d92b108a6bc572c78fd8fd46916fcff6f365ad25f14fa49e0245efbac80
MD5 c5c51156ff318334ff64457ec3788928
SHA1 dae3e01b7017264e0aedf87bef17273457f716c0
SHA512 2017cf92b491d7259fdfb396a627c8942bedf6071060f09df0de8f4682cb9eb66f69f88f552123338c1b2fa34170d97f4e3b14fd02f59fb6e0e408aea6cdd7e5
SSDEEP 12288:8tOU5VFWwHiC4mxYr8PCAwQy3KVMsMWsYNv+0kHe/6eZ0hW4:8GwH/BYcCAwQEKesf/NmLeiTd
MD5 SHA1 SHA512 SSDEEP

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 90e5ab9dd0c0a4f28d31c4fdef2e4bf2bf3265da4e46afcfe25a8eb1a1903aae
MD5 17a3666247b798ac21007b73c93b267e
SHA1 0c2b1b3625260338a3f1430d21fd58abfedca400
SHA512 f60a48058473ff9ba3df0653a9ac63456cd70b1ebc8261c3f5119d2358917b551ae6269256bba88e3d03c19ec66ad6fc59f7485651721ddd9d04d09891d6eb39
SSDEEP 24576:fZMRzFVSOOwH/BYcCAwQEKesf/NmLeiTd:fZMRzfCCCAcKV/NmLvTd
MD5 SHA1 SHA512 SSDEEP

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 5f4300781a7d2bb31a87e808d54ce633ec2710af73486bd0c3500eed47242655
MD5 bcaf0a4bb05f35eb08f4136bcacce5d9
SHA1 803f0b9a0acb417188456356416f05ffef585ea4
SHA512 13cd4a466c25300c76fa49059592a7df837e552de44bca482032b79d268b803e3cb06b8a376e3fe5b8055b344de722c10f7bb7f0246f6f5fd45af32a837b35fd
SSDEEP 12288:xQOU5VFWwHiC4mxYr8PCAwQy3KVMsMWsYNv+0kHe/6eZ0hW4:xZwH/BYcCAwQEKesf/NmLeiTd
MD5 SHA1 SHA512 SSDEEP

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 5e013ab7c72c74b129af45a6fe6c9e0d3ef5bb5db99716b99b09c32f99f6ebfe
MD5 e12c787f2881a1e9e8d6490baf0eb1d4
SHA1 2cbcea07725b7fdd9b93f45b94fabad41743daf8
SHA512 6e983ce7ebcd5667c10302a43b94738a22543153a945a2d9ec53f4a59a64f65f9996688fe79381554fbdba52b53b9c972db589c35e6e6573c3a7dccd6b1d0001
SSDEEP 12288:ucOU5VFWwHiC4mxYr8PCAwQy3KVMsMWsYNv+0kHe/6eZ0hW4:uVwH/BYcCAwQEKesf/NmLeiTd
MD5 SHA1 SHA512 SSDEEP

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 fc33c36765990e0980023d5c739c764f367b8c0a61fbd971382b89b9a1e2a15d
MD5 8cde050345c862285cb52f2067d9bee7
SHA1 9e4edcf33777dab324d7a06a356fd86b3c4450fc
SHA512 4fcbe5e3f273f3e7c3d6feb4965f46e0a8f956724353fcf213020f125a3d425a3461c6fe14997c8bd162f89d87e574e4acd344aa051a1838ee075d7fb0e118cb
SSDEEP 12288:TyPz5L8ROU5VFWwHiC4mxYr8PCAwQy3KVMsMWsYNv+0kHe/6eZ0hW4:ezyawH/BYcCAwQEKesf/NmLeiTd
MD5 SHA1 SHA512 SSDEEP

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 0d1f8436245cabb09d83fc64266536f4eed21e2b42f8fb695a08f95fbb245833
MD5 3dc7e1c1141d03d5b98bdd4714ddcc0f
SHA1 1e9afdf6458e0e646ac5106b9da71df6463aba4d
SHA512 93c82977493d405a6aea3b00044c1174a6d5f8397a884b2d1204f04e58ebdbe42489fe12764b2208997cdb76d1a09c7313c86f95c816b0aef9c337c9859d3426
SSDEEP 12288:VQOU5VFWwHiC4mxYr8PCAwQy3KVMsMWsYNv+0kHe/6eZ0hW4:VZwH/BYcCAwQEKesf/NmLeiTd
MD5 SHA1 SHA512 SSDEEP

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 c320c3412fb8d95193a61e981e95b2c5479112bfbf6dde5b835ea0f4d2b7225d
MD5 f4de768b3ee5ebf6ed2b63e4fd7ab6c7
SHA1 23cdd83a5e2bb30412672ff320998f68b001dc9d
SHA512 48dae48ed2acfd6b8e10f6bc0c54a4865a8968f27becda6570ec9f9ecc98f1cb2ad6b339f8601527bb132ed3fa58743601ac84d7aea6f685dd66e07ab16179b8
SSDEEP 12288:NQOU5VFWwHiC4mxYr8PCAwQy3KVMsMWsYNv+0kHe/6eZ0hW4:NZwH/BYcCAwQEKesf/NmLeiTd
MD5 SHA1 SHA512 SSDEEP

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 22a80afc2fdd9c87f684fba3626bf827b0e9a92e24d9f741249e617557814bcb
MD5 8884e1bcb6e418e7689eacc796f872c8
SHA1 c1817bd07dfb1131303582b37578eb7498688f00
SHA512 94900601a7a50eedca669e04adc54656f17f30f6fa116835b463e2572a660a0dde3685ed9959452bb3f8c3bd5c2725a0dcdcd5cd2791854e21c7797d7cc1c3ec
SSDEEP 12288:NyPz5L8ROU5VFWwHiC4mxYr8PCAwQy3KVMsMWsYNv+0kHe/6eZ0hW4:kzyawH/BYcCAwQEKesf/NmLeiTd
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 df14801d7e704415c8141983d82825597557fd1bc74c240617f6b553c4ad96b6
MD5 25a60572f548ad51ed4a13678b69535a
SHA1 342a58ba75a6f779bc002ccb6620b57793598656
SHA512 63aa7740909c344fd712d1a2775c87a4d1147b515683e7a40d3f690ed83b0ace6c8c1dc759de7f53cf9e8b35281014154743382c8d79586a43278a9e7b740210
SSDEEP 24576:sTDaLl3z0zDcwH/BYcCAwQEKesf/NmLeiTd:sTuLljfCCAcKV/NmLvTd
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 9ef29b7d6539436f7358239ce724f642645c33830a33880022f3696556633110
MD5 778b1f9d18c3d7afd959c8eb06686776
SHA1 6dcdb71cd1734b39f348fad60a2c2eb83262ba7e
SHA512 079f28e40c0a0cc4102c01d38af3173c7cb1fce8804d5b54ba564d419562bb6094471e51de28fd73c941429580e88f030676d4abddac765ceb839847c7301dfd
SSDEEP 24576:G3vd9CHKy7GZQwH/BYcCAwQEKesf/NmLeiTd:ovd9CHKyaCCCAcKV/NmLvTd
MD5 SHA1 SHA512 SSDEEP

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 b16ad268c24053bc64752513c5ddb3e4147e9c1fbc1a8cd9ecc6bd27481dcfae
MD5 6d6af5feca18351babf6711d267cdb1f
SHA1 e2a868d721e145e086eb936f20a5ecef1e36bd9c
SHA512 db3243cf4d7548d2f0d5c56fee43b0b32d2fee19d2c8c2e1596ca43373c2f9f81146d13f403e916d9389ef89610d9058f5d260f86b5cd87640d1a701ff8f55bf
SSDEEP 24576:ScP4mcvIjkGOxhKP2l71nNKbrh/8KBRwH/BYcCAwQEKesf/NmLeiTd:dP4m4IpOO67W8KPCCAcKV/NmLvTd
MD5 SHA1 SHA512 SSDEEP

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 701KB
SHA256 323959b77815ed1680625ae0790a430b926d71075c4afca459c59802b56e4589
MD5 e826270ea5add1ced304ed83eda8c667
SHA1 d7c469c8f461352540a2af65aebf1647e158fa18
SHA512 0ca32414cd9044c08bec34bb7eac4f51082ce3ee0feb0c2dbadbeb10133ae5eef507c23e153c95a61dafb3b547fc8507db69c69a178df8c31581d2032ca50139
SSDEEP 12288:YUFmDDL3OU5VFWwHiC4mxYr8PCAwQy3KVMsMWsYNv+0kHe/6eZ0hW4:CgwH/BYcCAwQEKesf/NmLeiTd
MD5 SHA1 SHA512 SSDEEP

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 533d1d9b540be6108c6ae4f28635f087b8e412fad743ce1ed0cac49e5f726d11
MD5 b03043ab8d3c596f288c50d6ca5d03b5
SHA1 4409818723df919f3ae223df3d39548c68338ffa
SHA512 12796015b5b39c9e52f44be088e1c95b8543231447237a3e8ae7687dc4163f28a2aaa19185a689c3041f0f86310168b0e64faed10649f2b9a324d835437abb82
SSDEEP 12288:5gOU5VFWwHiC4mxYr8PCAwQy3KVMsMWsYNv+0kHe/6eZ0hW4:5JwH/BYcCAwQEKesf/NmLeiTd
MD5 SHA1 SHA512 SSDEEP

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 ead5089962c278a73bfebe41f02e922afbc0f0d38f79f4662408cd5cdbb86730
MD5 5f88f40d822a49a5a730e4c0a95666fe
SHA1 789dec89daf36c8993a2ba4a8374f46873570ba2
SHA512 5b41e4c0ce8636e34af13ffbeff19a3cbde2a76d548218f7733455773e03e5d9c445b789238ab6db762e4140d4de1c6a20a8a8dde0090be9bb75fb92140a625e
SSDEEP 49152:Xa0h2GEkuAe73q3pp46zwwQjCCAcKV/NmLvTd:Xa0hNYG4JwiCCMlwLv
MD5 SHA1 SHA512 SSDEEP

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 659KB
SHA256 9660812532299c2538d07cb54dfe0a9ebcab9300d725f5d1814302c4174dfc4e
MD5 a92acb6a5a2f8dd0939da50ecea09ccf
SHA1 a513bbad93dabed7717b26d7c01a057800b08d1c
SHA512 602d287c5b251a89f18d15d79a5c3acb6aaa7baef5cf410d822898dd0eb321867b82cabd18d509a8fef17648a9e15c4bb8bfb38805d70b76863f823d5a5faa7f
SSDEEP 12288:7hbHjfX1OU5VFWwHiC4mxYr8PCAwQy3KVMsMWsYNv+0kHe/6eZ0hW4:7hbHjP+wH/BYcCAwQEKesf/NmLeiTd
MD5 SHA1 SHA512 SSDEEP

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 33c91c9937cc2bc9a6f1510aa829d8459cd1562b1f3141e94718eb9e65f5e854
MD5 9700555b27218eb6ec2b9e371d394df7
SHA1 c9ec2ddd2d40f167511ec5b392d33f5ac6ca44b4
SHA512 59b9588021df432559d69dd565368c95705439a52730cf0dc8f22145cfd852116dfd5a35675cfae103c10d6b321cb1b819a8c54ce5ac3d8d6c4aa83b10d0eea9
SSDEEP 24576:v3YgnJcRTk4yti+R5dBR/2wH/BYcCAwQEKesf/NmLeiTd:vIgnaTk46pBR/2CCAcKV/NmLvTd
MD5 SHA1 SHA512 SSDEEP

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 578KB
SHA256 dd576b21ecaf417b9d3e69f264b1f0dd98e80a5b354639eebaea795f55ae0db8
MD5 1871f4070baadedf0453ae73c984d151
SHA1 00c599addb7d244f9d29ac8296cdb229e668f2cd
SHA512 cd581623c34e968ef874838639457569e4a025e41b9972ba42615cde70e5cf43061b1f2a3e635b121c032ac6556e85dcc6f38f5485244d494e67f4f65001ff6d
SSDEEP 12288:JsOU5VFWwHiC4mxYr8PCAwQy3KVMsMWsYNv+0kHe/6eZ0hW4:JFwH/BYcCAwQEKesf/NmLeiTd
MD5 SHA1 SHA512 SSDEEP

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 940KB
SHA256 3231456dc923ddef4cb0f8b700f5f66ec82442b04196dbd08b7586eeecd11268
MD5 1c038fe5758604d2facaf39b6cdecc6e
SHA1 5f8af023d062c0691ef3fda71d1eb3725ce4bc32
SHA512 462d7d4396fc4e79bbba9f0382bbc1e2c2e0044b89229e58df891748d81ef5fa8bc177ab465b30583b7f061285f56e10c73732504f24b605eaa2d8982c2c5653
SSDEEP 12288:iObfA4LWOsvAYFTvOU5VFWwHiC4mxYr8PCAwQy3KVMsMWsYNv+0kHe/6eZ0hW4:TbL3UTowH/BYcCAwQEKesf/NmLeiTd
MD5 SHA1 SHA512 SSDEEP

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 671KB
SHA256 97e26c66ea50e5a705ea9cca011e7d92d8ee7f3658ba005e6ad8fe1e52215036
MD5 8925e64aabc355a504af9f9965c0746b
SHA1 36b03c88abfa9de6a988f12a3957e6480cbc4329
SHA512 82eed6524c02705d2f22d2226895b9043907621c12b49b19033b85a9d0c94c115d080899b02a503c6f93c598517a5f31677ca74ad977d1b7821b0a3e008546a2
SSDEEP 12288:RpFtIO7OU5VFWwHiC4mxYr8PCAwQy3KVMsMWsYNv+0kHe/6eZ0hW4:wOkwH/BYcCAwQEKesf/NmLeiTd
MD5 SHA1 SHA512 SSDEEP

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 f4c5f15d8daa78964b2f8699ada43e2074ef05491d422e8d27ab35a8280e3bc9
MD5 88e60fe854e37fa34006eba190ea8af2
SHA1 d780bcac66d0a492662edb8c96a571258b069c76
SHA512 9228b848eba98ddb39b03f397bdfdedb883bbfa02452853df2aff9908dc33023eabf6c6580f32a09f69c346f4af2d3fa9e0ef492bcfd97827deddeb26f36e854
SSDEEP 24576:R7NM9YqZqmWMUkPjZM48Mv6bEhsZwH/BYcCAwQEKesf/NmLeiTd:R7cBWMpPjN8DbEheCCAcKV/NmLvTd
MD5 SHA1 SHA512 SSDEEP

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 8fc2c7f4905911541e5eedf567ce2e5f9a0f267b912fafa309783923f583ad4a
MD5 c595b0c387058d41d719054ab410f403
SHA1 7d0dc02649bf54952c7487fcaeef66ae22ce676e
SHA512 84f79517ccd7b864dbaca8fdb7c63d685143ddb2ce5c276bd6d44d9912cc56a55325b60027d0f7b7e04f12f5e6d96f96cde4a61de24d1378f6b00628e8b52c98
SSDEEP 49152:YF2YuHNETovAvNYf8km5CCAcKV/NmLvTd:d6BCf8kkCCMlwLv
MD5 SHA1 SHA512 SSDEEP

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 959c42738c13e5d91e30e0c43e957874d820a1d582de637ef9b26645481afdff
MD5 10d6bc3ca587be998a31a025756e46cf
SHA1 705347c40118c5fe98b21f6316d211d761fca024
SHA512 dbbdd145374b1c09cb8809db439a30bc8b4e55f9a5568f364e169a576a1a70b088d3803b3aa3311f73f74389d50e4b9a98442bdbba113f487007a4a29f14a86f
SSDEEP 24576:9AFs06+OmlfkNXEbToQwH/BYcCAwQEKesf/NmLeiTd:yFs060lwXuDCCAcKV/NmLvTd
MD5 SHA1 SHA512 SSDEEP

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 885KB
SHA256 f5afe2eb291dff7b7ba7bad20a1c4c54da6e658612e217ecf90c06ce34498ec6
MD5 258582856cfa81807334477dcce80edc
SHA1 a4da58d6c50e64e137e403be99edb5fd8869d988
SHA512 117fff3ae1631eaa736cbc9ed54669699cc0d4e15b5e2fe98c9eb496a4a8369fc4ff19a444c0ef060bffb834d32754da5f223524a28e25ee9edc4692ceb992f6
SSDEEP 24576:aJnJ5D3WXDwH/BYcCAwQEKesf/NmLeiTd:aJnJ5DGXDCCAcKV/NmLvTd
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 fd062d6458f4351a80340318634c4c17452d2e10a563070f380e85b0dc47fd46
MD5 a7e5d9c1bf98b6e19306d7563380e05e
SHA1 4d746ce5b4faf8e7cb44d6b6ce428f3196accc02
SHA512 03af44fadf377f9f22b67c92bec646bbe3abe7fee4d06c7ae48b9c068970f85faee323af7490b0ea80a2dd71deaba5e7b30fe3dab282f9f25733958a5da73dfa
SSDEEP 49152:Cg06DIKdwc+eQnSt65aVtCCAcKV/NmLvTd:73CCMlwLv
MD5 SHA1 SHA512 SSDEEP

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 661KB
SHA256 d486a9b2edb65c20dabfd0f4edf07bac4d61bc9aff53a3cfcf6065b7cc3140c8
MD5 abf8a24cb6f9887822bd0eb2d395c515
SHA1 74c690fe63dcfa4198941298013ba442508a22a5
SHA512 281f50c41cf518a51d4a41d789206bbc3c3b8087edeb7450bfdd7f9be92a55ef931de647a063d313ef212c0c26bac37d695737e47a57411a7b470e7219cceee5
SSDEEP 12288:tEP3RnOOU5VFWwHiC4mxYr8PCAwQy3KVMsMWsYNv+0kHe/6eZ0hW4:On/wH/BYcCAwQEKesf/NmLeiTd
MD5 SHA1 SHA512 SSDEEP

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 712KB
SHA256 ba4740b09193d89443b9aaf405eb7223711b8b3cc5d89bcd55417c5bae694a9e
MD5 d02f85c99d47ca6156a3e59e126a78ee
SHA1 295bcb1b636b86798e2cc92b0fafe8a506dde671
SHA512 153d6963cdd38aa0eb277e43570089af297c64e51a57a922c7ca85e672f066e033a446dcfc67c13f41edf5d72e34ffe2b425ba1fcf91abd49b6238fc4472f12f
SSDEEP 12288:vjkyFOU5VFWwHiC4mxYr8PCAwQy3KVMsMWsYNv+0kHe/6eZ0hW4:vIyuwH/BYcCAwQEKesf/NmLeiTd
MD5 SHA1 SHA512 SSDEEP

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 584KB
SHA256 d9b53230144b19fce1524c5241882131682b72e958c6b6824f239f644bc24c55
MD5 d6efbc3eaa7f8d9804719bbdd3c4e3f9
SHA1 1ed016a50fa0febe24dd329932bfb7d6944bc51f
SHA512 6d09efa4841f931377cb889b11f1fefee08c02ecc96bce84bde64aa1125b78a15cadc020822ce7ef2ffef338fb9c550bf445629ac4b93d557c6d1b8eb8d8d520
SSDEEP 12288:qyLOU5VFWwHiC4mxYr8PCAwQy3KVMsMWsYNv+0kHe/6eZ0hW4:zUwH/BYcCAwQEKesf/NmLeiTd
MD5 SHA1 SHA512 SSDEEP

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 874a3d121e0c40192e2c1ddf77167dbc41be367f3e6788be017a6db5ff71d835
MD5 f4f3fdc9d9ca915d06a61ab07a26e8f7
SHA1 26378c81bbf331764845d3b8f1714c157dc0c0d3
SHA512 a7c59ce86c07c0929def57fbca2bd70fa2207d566fc6c96c583fa430fdf7b341aedb4c871aa04c1c31e63fc6aeaeefbb90105d78effeeae3c485d75b301d918c
SSDEEP 24576:mQ9MxZKdcz9dw3hwH/BYcCAwQEKesf/NmLeiTd:mVKZhCCAcKV/NmLvTd
MD5 SHA1 SHA512 SSDEEP

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 772KB
SHA256 2bed6d5e994cc19f5f4d8e87fadebafe608240b5e60aa424321dc4b5a607f81f
MD5 03c84bbeb9cf05ad2014b94e1c354fa9
SHA1 79eb41b305150c38d500268f364c1f3555ac948f
SHA512 bf1d72a5628b473899696cf3e14ff28b11101ab4dab66c25c8081cb8f85266ff274db7a25c104c5a8ef5bbe97c344e2a00859ee5a46512c5d8c25d3aeb2e01d4
SSDEEP 12288:VyoKo2JRple9pBOU5VFWwHiC4mxYr8PCAwQy3KVMsMWsYNv+0kHe/6eZ0hW4:VyocDApqwH/BYcCAwQEKesf/NmLeiTd
MD5 SHA1 SHA512 SSDEEP

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 9edac9225df9f6d55c010ab0a8e497f647ec56002d9021ce79b6326fef721873
MD5 48a62fd2a17db194da598f7cf5c98250
SHA1 44c5b11ec39e8bd49999128a78ab384b374e52f3
SHA512 3637fbf69f6939a84623c62a21450f16beeec4cc9128bea6745cf9a450a66c57d432c587a690183ad2cb3648d94619a6b34b740fb35d9ca1d828bb833acc0da8
SSDEEP 49152:JWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKqCCAcKV/NmLvTd:x0zuNIoCCMlwLv
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 0a98ce71cdfe36fbb24f687deab21024682d23a639e7c0cde916c3c16e022bbb
MD5 fce2896f3745cc925f25d7d4469f7f15
SHA1 b89dab123ca28a92ee1c34fcfdb4f6582dda7489
SHA512 e9d27a72d79194b572abcf3b7fe4303d2849ce9e18d134dfb7602f0c5964c83315701acd8513b2672f3a7e5ed758178e953a7f1ae4c2c635e2382c118005f834
SSDEEP 24576:c1QT7EcpfxR+N5AWAz3ooiYujMqb/wH/BYcCAwQEKesf/NmLeiTd:BTDxR+N5YzT4jMECCAcKV/NmLvTd
MD5 SHA1 SHA512 SSDEEP

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 877KB
SHA256 acd9a2d352ca1e39faae64ab2a1639d118f679274c065b7bf1dc67b859728e50
MD5 8c69d7381e2f6c8a222ffd1af61bf572
SHA1 de876c89350a77b7c4e4f47f2bf2b179abe75533
SHA512 9bccb8e1fbeae16aa26fa6211d43dca21817c1d1764644cdec7f0c6b1e7977f2e5301a34eec5162c9d5efe3e1c0a70634b655f3c778676a9abd197feba14ec8b
SSDEEP 24576:kTMdOz0FFS+bmSLrwH/BYcCAwQEKesf/NmLeiTd:M0K+bmSLrCCAcKV/NmLvTd
MD5 SHA1 SHA512 SSDEEP

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 635KB
SHA256 d424c27a961a66026565836d02992611a99279525e108de0f37f8c500025654d
MD5 a70b2b41833daea74295f938fd094d85
SHA1 b80ee576d08ae31b5ee01c0d1c32775b0331389e
SHA512 1b7c73c19558a91143a9946afb2003543b17dc855186f31e05d3f07910829b3369c066799a8c3df1a8f4ae902b07054c05232ae4298ab24aff8ee364547b7073
SSDEEP 12288:o4KvOU5VFWwHiC4mxYr8PCAwQy3KVMsMWsYNv+0kHe/6eZ0hW4:eowH/BYcCAwQEKesf/NmLeiTd
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/8-148-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/8-90-0x0000000000600000-0x0000000000660000-memory.dmp

Download

memory/8-84-0x0000000000600000-0x0000000000660000-memory.dmp

Download

memory/60-28-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/60-51-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/464-333-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/464-13-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/540-162-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/728-154-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/856-64-0x0000000001690000-0x00000000016F0000-memory.dmp

Download

memory/856-62-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/856-66-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/856-60-0x0000000001690000-0x00000000016F0000-memory.dmp

Download

memory/856-54-0x0000000001690000-0x00000000016F0000-memory.dmp

Download

memory/1168-471-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/1168-196-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/1172-23-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/1172-24-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/1172-15-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/1172-407-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/1520-153-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/2204-470-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/2204-195-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/2856-156-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/2932-430-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2932-151-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3216-6-0x0000000002400000-0x0000000002467000-memory.dmp

Download

memory/3216-147-0x0000000000400000-0x0000000000584000-memory.dmp

Download

memory/3216-2-0x0000000002400000-0x0000000002467000-memory.dmp

Download

memory/3216-0-0x0000000000400000-0x0000000000584000-memory.dmp

Download

memory/3776-31-0x0000000000DA0000-0x0000000000E00000-memory.dmp

Download

memory/3776-39-0x0000000140000000-0x000000014024B000-memory.dmp

Download

memory/3776-463-0x0000000140000000-0x000000014024B000-memory.dmp

Download

memory/3776-37-0x0000000000DA0000-0x0000000000E00000-memory.dmp

Download

memory/3980-94-0x00000000004A0000-0x0000000000507000-memory.dmp

Download

memory/3980-149-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/3980-99-0x00000000004A0000-0x0000000000507000-memory.dmp

Download

memory/4384-150-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/4492-468-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/4492-82-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/4492-72-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4492-78-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4536-48-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/4536-464-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/4536-52-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/4536-42-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/4636-152-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/4740-158-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4780-134-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4832-81-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/4924-469-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/4924-160-0x0000000140000000-0x00000001401FC000-memory.dmp

Download