cefc8837451e05490673504014320c6c658d124288a8d894410d37f2b6672f87

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 00:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-06-02_855592405dae1b61b6430b9a43ca49ab_bkransomware.exe
Size 712KB
Sample240603-adlsgsca61
SHA256 cefc8837451e05490673504014320c6c658d124288a8d894410d37f2b6672f87
MD5 855592405dae1b61b6430b9a43ca49ab
SHA1 c8aa5c65027b4f56e8ea0d568b518a30dddec4ed
SHA512 d7f693749ffb9f694bb1ed69304116a608a227b6db8c5c4e35277e612a323d765a56d4f12c8e957d70da0da4ff401013351dae984045e47dac64a8be9b189875
SSDEEP 12288:atOw6BalnJKQ1uBeAMlwesHU8wqy2VYCIbvpOBlU1RlgIDMCZgjtGlxHZ9/I:06B081SwPHU8X31PfU17DhZy0lxHZ9/I
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
3316	alg.exe
4780	DiagnosticsHub.StandardCollector.Service.exe
4544	fxssvc.exe
2044	elevation_service.exe
3828	elevation_service.exe
4552	maintenanceservice.exe
2120	msdtc.exe
4960	OSE.EXE
3136	PerceptionSimulationService.exe
4812	perfhost.exe
3644	locator.exe
3188	SensorDataService.exe
3440	snmptrap.exe
3552	spectrum.exe
496	ssh-agent.exe
3468	TieringEngineService.exe
1624	AgentService.exe
2396	vds.exe
4712	vssvc.exe
3196	wbengine.exe
3156	WmiApSrv.exe
4528	SearchIndexer.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in System32 directory 31 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\spectrum.exe	2024-06-02_855592405dae1b61b6430b9a43ca49ab_bkransomware.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2024-06-02_855592405dae1b61b6430b9a43ca49ab_bkransomware.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2024-06-02_855592405dae1b61b6430b9a43ca49ab_bkransomware.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2024-06-02_855592405dae1b61b6430b9a43ca49ab_bkransomware.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2024-06-02_855592405dae1b61b6430b9a43ca49ab_bkransomware.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\19c54f4b293b476c.bin	alg.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2024-06-02_855592405dae1b61b6430b9a43ca49ab_bkransomware.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	alg.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	alg.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2024-06-02_855592405dae1b61b6430b9a43ca49ab_bkransomware.exe
File opened for modification	C:\Windows\System32\vds.exe	2024-06-02_855592405dae1b61b6430b9a43ca49ab_bkransomware.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2024-06-02_855592405dae1b61b6430b9a43ca49ab_bkransomware.exe
File opened for modification	C:\Windows\system32\dllhost.exe	alg.exe
File opened for modification	C:\Windows\System32\alg.exe	2024-06-02_855592405dae1b61b6430b9a43ca49ab_bkransomware.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2024-06-02_855592405dae1b61b6430b9a43ca49ab_bkransomware.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2024-06-02_855592405dae1b61b6430b9a43ca49ab_bkransomware.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2024-06-02_855592405dae1b61b6430b9a43ca49ab_bkransomware.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2024-06-02_855592405dae1b61b6430b9a43ca49ab_bkransomware.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2024-06-02_855592405dae1b61b6430b9a43ca49ab_bkransomware.exe
File opened for modification	C:\Windows\system32\AgentService.exe	alg.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2024-06-02_855592405dae1b61b6430b9a43ca49ab_bkransomware.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2024-06-02_855592405dae1b61b6430b9a43ca49ab_bkransomware.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2024-06-02_855592405dae1b61b6430b9a43ca49ab_bkransomware.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2024-06-02_855592405dae1b61b6430b9a43ca49ab_bkransomware.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2024-06-02_855592405dae1b61b6430b9a43ca49ab_bkransomware.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	alg.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2024-06-02_855592405dae1b61b6430b9a43ca49ab_bkransomware.exe
File opened for modification	C:\Windows\system32\locator.exe	2024-06-02_855592405dae1b61b6430b9a43ca49ab_bkransomware.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2024-06-02_855592405dae1b61b6430b9a43ca49ab_bkransomware.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	2024-06-02_855592405dae1b61b6430b9a43ca49ab_bkransomware.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	2024-06-02_855592405dae1b61b6430b9a43ca49ab_bkransomware.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	2024-06-02_855592405dae1b61b6430b9a43ca49ab_bkransomware.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\110.0.5481.104\chrome_installer.exe	2024-06-02_855592405dae1b61b6430b9a43ca49ab_bkransomware.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	alg.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2024-06-02_855592405dae1b61b6430b9a43ca49ab_bkransomware.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe	2024-06-02_855592405dae1b61b6430b9a43ca49ab_bkransomware.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2024-06-02_855592405dae1b61b6430b9a43ca49ab_bkransomware.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2024-06-02_855592405dae1b61b6430b9a43ca49ab_bkransomware.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2024-06-02_855592405dae1b61b6430b9a43ca49ab_bkransomware.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	2024-06-02_855592405dae1b61b6430b9a43ca49ab_bkransomware.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2024-06-02_855592405dae1b61b6430b9a43ca49ab_bkransomware.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2024-06-02_855592405dae1b61b6430b9a43ca49ab_bkransomware.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2024-06-02_855592405dae1b61b6430b9a43ca49ab_bkransomware.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2024-06-02_855592405dae1b61b6430b9a43ca49ab_bkransomware.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2024-06-02_855592405dae1b61b6430b9a43ca49ab_bkransomware.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateSetup.exe	2024-06-02_855592405dae1b61b6430b9a43ca49ab_bkransomware.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	2024-06-02_855592405dae1b61b6430b9a43ca49ab_bkransomware.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2024-06-02_855592405dae1b61b6430b9a43ca49ab_bkransomware.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe	2024-06-02_855592405dae1b61b6430b9a43ca49ab_bkransomware.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2024-06-02_855592405dae1b61b6430b9a43ca49ab_bkransomware.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2024-06-02_855592405dae1b61b6430b9a43ca49ab_bkransomware.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	2024-06-02_855592405dae1b61b6430b9a43ca49ab_bkransomware.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	2024-06-02_855592405dae1b61b6430b9a43ca49ab_bkransomware.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2024-06-02_855592405dae1b61b6430b9a43ca49ab_bkransomware.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	2024-06-02_855592405dae1b61b6430b9a43ca49ab_bkransomware.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	2024-06-02_855592405dae1b61b6430b9a43ca49ab_bkransomware.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	alg.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2024-06-02_855592405dae1b61b6430b9a43ca49ab_bkransomware.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000081bded449b5da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009581ddd249b5da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ac57bad449b5da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006ce2a4d449b5da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000211111d449b5da01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000080d172d449b5da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b415b4d349b5da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000091f7d3d249b5da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006ce2a4d449b5da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ac54f8d449b5da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004230d2d449b5da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
1076	2024-06-02_855592405dae1b61b6430b9a43ca49ab_bkransomware.exe
1076	2024-06-02_855592405dae1b61b6430b9a43ca49ab_bkransomware.exe
1076	2024-06-02_855592405dae1b61b6430b9a43ca49ab_bkransomware.exe
1076	2024-06-02_855592405dae1b61b6430b9a43ca49ab_bkransomware.exe
1076	2024-06-02_855592405dae1b61b6430b9a43ca49ab_bkransomware.exe
1076	2024-06-02_855592405dae1b61b6430b9a43ca49ab_bkransomware.exe
1076	2024-06-02_855592405dae1b61b6430b9a43ca49ab_bkransomware.exe
1076	2024-06-02_855592405dae1b61b6430b9a43ca49ab_bkransomware.exe
1076	2024-06-02_855592405dae1b61b6430b9a43ca49ab_bkransomware.exe
1076	2024-06-02_855592405dae1b61b6430b9a43ca49ab_bkransomware.exe
1076	2024-06-02_855592405dae1b61b6430b9a43ca49ab_bkransomware.exe
1076	2024-06-02_855592405dae1b61b6430b9a43ca49ab_bkransomware.exe
1076	2024-06-02_855592405dae1b61b6430b9a43ca49ab_bkransomware.exe
1076	2024-06-02_855592405dae1b61b6430b9a43ca49ab_bkransomware.exe
1076	2024-06-02_855592405dae1b61b6430b9a43ca49ab_bkransomware.exe
1076	2024-06-02_855592405dae1b61b6430b9a43ca49ab_bkransomware.exe
1076	2024-06-02_855592405dae1b61b6430b9a43ca49ab_bkransomware.exe
1076	2024-06-02_855592405dae1b61b6430b9a43ca49ab_bkransomware.exe
1076	2024-06-02_855592405dae1b61b6430b9a43ca49ab_bkransomware.exe
1076	2024-06-02_855592405dae1b61b6430b9a43ca49ab_bkransomware.exe
1076	2024-06-02_855592405dae1b61b6430b9a43ca49ab_bkransomware.exe
1076	2024-06-02_855592405dae1b61b6430b9a43ca49ab_bkransomware.exe
1076	2024-06-02_855592405dae1b61b6430b9a43ca49ab_bkransomware.exe
1076	2024-06-02_855592405dae1b61b6430b9a43ca49ab_bkransomware.exe
1076	2024-06-02_855592405dae1b61b6430b9a43ca49ab_bkransomware.exe
1076	2024-06-02_855592405dae1b61b6430b9a43ca49ab_bkransomware.exe
1076	2024-06-02_855592405dae1b61b6430b9a43ca49ab_bkransomware.exe
1076	2024-06-02_855592405dae1b61b6430b9a43ca49ab_bkransomware.exe
1076	2024-06-02_855592405dae1b61b6430b9a43ca49ab_bkransomware.exe
1076	2024-06-02_855592405dae1b61b6430b9a43ca49ab_bkransomware.exe
1076	2024-06-02_855592405dae1b61b6430b9a43ca49ab_bkransomware.exe
1076	2024-06-02_855592405dae1b61b6430b9a43ca49ab_bkransomware.exe
1076	2024-06-02_855592405dae1b61b6430b9a43ca49ab_bkransomware.exe
1076	2024-06-02_855592405dae1b61b6430b9a43ca49ab_bkransomware.exe
1076	2024-06-02_855592405dae1b61b6430b9a43ca49ab_bkransomware.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
676	Process not Found
676	Process not Found

Suspicious use of AdjustPrivilegeToken 45 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1076	2024-06-02_855592405dae1b61b6430b9a43ca49ab_bkransomware.exe
Token: SeAuditPrivilege	4544	fxssvc.exe
Token: SeRestorePrivilege	3468	TieringEngineService.exe
Token: SeManageVolumePrivilege	3468	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	1624	AgentService.exe
Token: SeBackupPrivilege	4712	vssvc.exe
Token: SeRestorePrivilege	4712	vssvc.exe
Token: SeAuditPrivilege	4712	vssvc.exe
Token: SeBackupPrivilege	3196	wbengine.exe
Token: SeRestorePrivilege	3196	wbengine.exe
Token: SeSecurityPrivilege	3196	wbengine.exe
Token: 33	4528	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4528	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4528	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4528	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4528	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4528	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4528	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4528	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4528	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4528	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4528	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4528	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4528	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4528	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4528	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4528	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4528	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4528	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4528	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4528	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4528	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4528	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4528	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4528	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4528	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4528	SearchIndexer.exe
Token: SeDebugPrivilege	1076	2024-06-02_855592405dae1b61b6430b9a43ca49ab_bkransomware.exe
Token: SeDebugPrivilege	1076	2024-06-02_855592405dae1b61b6430b9a43ca49ab_bkransomware.exe
Token: SeDebugPrivilege	1076	2024-06-02_855592405dae1b61b6430b9a43ca49ab_bkransomware.exe
Token: SeDebugPrivilege	1076	2024-06-02_855592405dae1b61b6430b9a43ca49ab_bkransomware.exe
Token: SeDebugPrivilege	1076	2024-06-02_855592405dae1b61b6430b9a43ca49ab_bkransomware.exe
Token: SeDebugPrivilege	3316	alg.exe
Token: SeDebugPrivilege	3316	alg.exe
Token: SeDebugPrivilege	3316	alg.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4528 wrote to memory of 1168	4528	SearchIndexer.exe	116
PID 4528 wrote to memory of 1168	4528	SearchIndexer.exe	116
PID 4528 wrote to memory of 4272	4528	SearchIndexer.exe	117
PID 4528 wrote to memory of 4272	4528	SearchIndexer.exe	117

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2024-06-02_855592405dae1b61b6430b9a43ca49ab_bkransomware.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-02_855592405dae1b61b6430b9a43ca49ab_bkransomware.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1076

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3316

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:4780

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:3380

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4544

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2044

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3828

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4552

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:2120

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4960

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3136

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:4812

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:3644

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3188

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:3440

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3552

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:320

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:496

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3468

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1624

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:2396

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4712

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3196

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:3156

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4528
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1168
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
  2⤵
  - Modifies data under HKEY_USERS
  PID:4272

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
Size 2.1MB
SHA256 7796f0883e695db6d6c16848b35ac9cd5eb81eddd663d1b98464062efb4c7f86
MD5 d0343c4c27f49824d2a16bea1e8c0590
SHA1 f773a4389546dd8e19c87240f7536d2304436287
SHA512 e2b2ba179901391ae21153f92d1455c6ed7d9e260ad6e43040c8e94a3214babc6f3a464fd9413bb57fdfd20c6e6c7c747bd04b18175b3b2d3af4546fb9affac1
SSDEEP 49152:muYk3H5koUXfTqkkYLO/W2buywzMbOX+T7z5Tw/3FPfUNDZ4:mPfTqi90bgfFPfUNF
MD5 SHA1 SHA512 SSDEEP

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 797KB
SHA256 6eb27e6c213b18dfb078eea16dc0e5f310179c5b7628802e912e7ffa134fd111
MD5 f6b532c9e88d9552b4f145fa29e4b2db
SHA1 2b958683f3041350f3af383b0f6c66f431b8ba23
SHA512 779356766320f5c39ea8761a2f1443f8dc4a8b4343bbf5e7635f510b11b8562ab42350699a2f539c799f62c870b178227cfbac8e2e2ca7277620b8dc5cdc8242
SSDEEP 24576:tidnBsuEx1SwPHU8X31PfU17DhZy0lxHZ9/I:0Su5w/3FPfUNDZ4
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 7086dbd55e65d054578116d5a3a4a4e0a50ff5cfd3bae6b37ee4de9b9455c8c8
MD5 a3ab05e933d07c9a59f74545e043fa4c
SHA1 dcb343ae1bb9ac32ae190792f7d0dfdb4482c9b2
SHA512 2bf9f0bf14a931ee04869d4bb669f39c35e57de986196fdacbbc91844ea443d2404a20ec3e98ae59fd1bfb6136eb12a2048ae61245b5cbb115ecefbdd3c9bc69
SSDEEP 24576:v+gkEVfh4Co11SwPHU8X31PfU17DhZy0lxHZ9/I:mgkExSMw/3FPfUNDZ4
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 b0c6d3c61531bb1904b70bb8ad93242f45e32cf90f403afac5e856ef20803300
MD5 1cd9726d3510fe116bd99e4aed3e1c57
SHA1 b239d07e35711e5d568444388a9ec8781eafed88
SHA512 3c019daf6912ed7a374000de6cbf8bf0701740d9b4ff89195f63f385557a608b5852a3266c8e780f66366e082430788655b64a75ac78e7b580952999663a2a52
SSDEEP 24576:RBpDRmi78gkPXlyo0Gxjrq1SwPHU8X31PfU17DhZy0lxHZ9/I:DNRmi78gkPX4o0Gxjzw/3FPfUNDZ4
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 49706fd00e193efc5bb8a94bc2a8582b8fed9f102dd4a502b4098f59b7cb4646
MD5 203302e1df6ca5837db52365b7d5f340
SHA1 ad5fdbfcf0198458f0824bcd335257c66b572a31
SHA512 db2002000857e1dc11ed748afd7e89ed936eee6c6ea74c7057fdb3bcae4a387b7ca5dd0c9aa23b8ca0308068ec51b4acd55fff8889bf059a7ce9fabbdc80b970
SSDEEP 24576:rLOS2oyPIXV11SwPHU8X31PfU17DhZy0lxHZ9/I:V/yLw/3FPfUNDZ4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 092ff50e0533d9fa4caea585fbe77a0334a9d21eb0e9263fe0186d9d628e4e9a
MD5 84f0d41b5578d16e11cc2650cd8aff0b
SHA1 9640032fceb7c8282cfd06358b89f549917a21da
SHA512 6ec561b18dcfcd34a467b17bfa6a5e30bda33ad3e36f4ea276ec812c16295b5b906e686d653d05285ca12c8f8010ee05512d9c8b81ada6eeb0c9f079ad1ce01b
SSDEEP 12288:qfqJKQ1uBeAMlwesHU8wqy2VYCIbvpOBlU1RlgIDMCZgjtGlxHZ9/I:qf/1SwPHU8X31PfU17DhZy0lxHZ9/I
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 546dbb04e5dd6cd82a6324bcaadc56d80f19585e6fc585e6de14a4ff1da3d2e8
MD5 e1f4c1964628acbd8a9eff993f5a6aeb
SHA1 3d91f2855266965c6446d6d4e9d2a6d4d7a2971e
SHA512 702d4a751c1262ef276796b6027c035775b6aa057104d3ead3b1ce84b97140bf5e05ff27849d12f0b0173351a6a9785d3b233c99acdcf8977419f5a6f5a06c9a
SSDEEP 24576:xJIUc1SwPHU8X31PfU17DhZy0lxHZ9/I:xJIU9w/3FPfUNDZ4
MD5 SHA1 SHA512 SSDEEP

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 2e74880050252599b68399bac24322df9145e512dd8357cd9b871029524ae3a2
MD5 bd7c95c1b4afbc68fd18f3cb54da1929
SHA1 b318090dda8034d897787672a3c63f987cf65428
SHA512 47e34721cb46ce3ca59b6d895a0aa17266d29187994f255f6fc0aa03e0bb7033f35802821e0c8eed02071b326a594cf191c4d3a858777ea4e68a5156e8bacedd
SSDEEP 49152:sQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THI:sQvGAdlCEL8c/yRNw5CtfFPfUNF
MD5 SHA1 SHA512 SSDEEP

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 905e73ab8a79c0b9f1bfbc900ef1d35fd6dd0dff2be29d00f4d18b4de807fbfc
MD5 8087aa41e1f391a099c84214632fdf5c
SHA1 cc86762d7a83ddd72b42092d2e7a9dd8ab18acbe
SHA512 4235f1d3b774df264b9b57e10492c75bb13ad3991ef00352e20bbd517e77a37c5ba7112183f0ae29b167b4d660d76a6a0a61ab0f9725f6e769d23733d178f9e8
SSDEEP 24576:ZdewsAjy1SwPHU8X31PfU17DhZy0lxHZ9/I:Hlj3w/3FPfUNDZ4
MD5 SHA1 SHA512 SSDEEP

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 a7a9e526c2c35f9e771bd05af3303999df4821bd247211dc3eba3ba83e411179
MD5 9811634290754872fb85330773d12737
SHA1 4ef34885447e8a9db857d556b9aea8c609f43bfd
SHA512 9456ff27f14240ee97e9671cb4a2e4081eff3cc82fcbef3e7a7d4e6823fbc6d411175c5ef7661e7dd51f2e8a99a4290cd7b70d902b8663246ee014af4a0bfba1
SSDEEP 196608:GUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHWnU:GUEtQevvqc2W1cpV2EI32sU
MD5 SHA1 SHA512 SSDEEP

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 6044d8b57ac0f8b898d798956e985e48c05151ef0fb8b053e8f96dae89a1124f
MD5 e3ec079f29cd4c788374a4712c72e741
SHA1 eb08ad592b415ffd6586b7be0c8f343ec2e4e04a
SHA512 733346c0d41844e0e28e85ff55481afbc4d19c2b8d43e75a3af3ae70accde60ccdddd619898b9147dd1082b2d3c7f8d62b67111789d83fb21975f1ceb125938f
SSDEEP 49152:KCbRquA/m2yL5zTfFiV+XenmE3/zXw/3FPfUNDZ4:/oquVjnmBfFPfUNF
MD5 SHA1 SHA512 SSDEEP

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 1b8f654375f18a7877aed2474edda018bdd2aa2cdee94e04dd2412adf825a000
MD5 f4b1e589f10b5e36ba556eed4e069cc0
SHA1 01b3a287656ba769856ca8a4d5ee386d7d78447f
SHA512 7f050784c2cd3bc56c9373b378bd66e9ff8d2731cf7291805c88b81782c133569e82047f99d98ca74bb85bbb5a85717abcbb70d27af42763f4029c86f486341a
SSDEEP 24576:dAhGLJIFoiwtA5l7S53l1SwPHU8X31PfU17DhZy0lxHZ9/I:dAMyFoiq5Gw/3FPfUNDZ4
MD5 SHA1 SHA512 SSDEEP

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 c2ceff279d820c7b0fe3d61b68935b85c39115001bc7d85b81027714121fbbe7
MD5 c381d8e795fdf2b00776c970e198f532
SHA1 4df2699a9d59ea001f66aec3c8dce48c8ba9f2ae
SHA512 6889524ae1584a64010ea6c1839a806b5ae1a437df3c412b81daa8242b0fd012329cf1574a6810fda6446234f1e95bfa369872bc0c2b8c980ae433402837f058
SSDEEP 24576:owuoOW+1SwPHU8X31PfU17DhZy0lxHZ9/I:owDOqw/3FPfUNDZ4
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 d88e53673ba0e3cc21463a7cc849fd7e0564408a095efee7cc3a93a3f41eb37b
MD5 8af568ffedb4229a7bb7d1a1ea030d98
SHA1 69e7b95a17bba67325f69f2acaec240f29225ca4
SHA512 daf803e1ee0baa82eb049fd248e9de61e44f469438122228a38a45fe32e36b1d931be7cfb3038e66189482f0e692b6dd6ee9877db9ee1ce1d3cc306c719dda53
SSDEEP 12288:YBZ1IyNJKQ1uBeAMlwesHU8wqy2VYCIbvpOBlU1RlgIDMCZgjtGlxHZ9/I:GZuD1SwPHU8X31PfU17DhZy0lxHZ9/I
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
Size 5.4MB
SHA256 36d379a2039359e3f79761170ac8da22c7117d32280300e987527fadad2a5cfb
MD5 61ad47fdec57bd393d54d4af9b9e901d
SHA1 61cd812b3a40187f05b91bdb85df0933141dccf5
SHA512 7060b717ea22a252053fc02666ecd0da0add0dcafc3fb1d3093233c9cee62266f74d7459fb40648d4c58c7b8aef6d2e1466e052dd77841495f57ae9e444a5342
SSDEEP 49152:w0kwIi7c4xZlm5knEtw99Kn/2vim7vgv6m+yyJ/0gbvjR7yY7BHi3u7L/gBUUWLY:2wfhY7g/rLd7yYA3awr341gpfFPfUNF
MD5 SHA1 SHA512 SSDEEP

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe
Size 5.4MB
SHA256 685ae8dfe2964f00ebaa3fd8002a7f1045f1cd469daa36eee9ab8dcac3c09e8d
MD5 4784fa1d344bd151f1c159f5da9e1218
SHA1 b99236b4ae490f8fe36db9807a6a37b1b93c8d75
SHA512 be71c81e86da0db2acc9ac8663063d7c179bd67e76957d02719d7bb1173894f04d547689dae6d5bb53cd9164ad7afc8f03817a89788c0a6ea27a07a14a796ad1
SSDEEP 49152:M0kwIi7c4xZlm5knEtw99Kn/2vim7vgv6m+yyJ/0gbvjR7yY7BHi3u7L/gBUUWLY:KwfhY7g/rLd7yYA3awr341gpfFPfUNF
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe
Size 2.0MB
SHA256 3ddc9a419b38e02a1f618329c34462f511a2e4c3ad2321edf56dd82829c0ad09
MD5 508b8c8b8a8e0a4fcb1e917e3349abbf
SHA1 1cf44122b4754cea2c0b1f81a7cdb38aad599692
SHA512 fe77ccff9014931383534ae9e44a20e8e998e7fa3a95c531c47c9ed9942b87eeca62ea997297432136961580589d45d9af2cbeee66fca73300a654f0d548c69f
SSDEEP 24576:QcTyYv0FteQU+5I2kjgD6iQacA+1SwPHU8X31PfU17DhZy0lxHZ9/I:QuXv0Ftpn5606zOLw/3FPfUNDZ4
MD5 SHA1 SHA512 SSDEEP

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
Size 2.2MB
SHA256 4b703085801266082afdf32fbb5c0e9fbd8488357a39bec51efdfc5fd3ea6045
MD5 b259df8e6f410d8e2e17dfe8c25e4d2d
SHA1 4c42f59e524d53172d1e95c289dd373de3ec5bf9
SHA512 a6ffbe74cc63c5cf7647388254d6e2b18c182f9e936d9c26c6f2ca6d58b18b501ec4bfda46844ceff54df5511c1ced9ac5b3b66ff4229d775439cd18fdffb29d
SSDEEP 49152:By7mTd0GxN8jyynxHjXKUyn4GVcbDSKrNTx3w/3FPfUNDZ4:cmYeyxHjWjMTgfFPfUNF
MD5 SHA1 SHA512 SSDEEP

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe
Size 1.8MB
SHA256 5abc640400fc90b36d5297847ad5cff7216a3c13e7e49595b41186251bc5fe32
MD5 923c13a8c0c56790780ac23c162b35e1
SHA1 9f391207479c2b1a41a3ecace424c4d58753e572
SHA512 6e25e3bf05a586886f6c22c321613bb7c7369ea2bfc8b335bcdef5c27fedeb9177fece28b8a5c36136d8f749b1dc6709cce0db87c2e5eb98dfba150eac890af4
SSDEEP 24576:z6drZn1WEci182IEUeNbJeRgUebgW816r1SwPHU8X31PfU17DhZy0lxHZ9/I:zWnDci18yNNUgbYTw/3FPfUNDZ4
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 1.7MB
SHA256 da69dfecdb5b5bb35042736f492c93158c2c18c4d1bbc61a3af36554fefe3544
MD5 5b847d32ed8287f8b9000845db2108bf
SHA1 e70057ac5870b81df8ed797a88a2d3b48ff103b2
SHA512 c999ce5000f391e6c6556168d1292a91b25411a117ad0d90af449478458281488c2edcce0990df060244089f6a87a3a59d57e8d49ce009f044c20678d3d1173c
SSDEEP 24576:9k5lHW5EzMZupO80G2reD+melRgTTv/1nyg1SwPHU8X31PfU17DhZy0lxHZ9/I:pizMZm0GhamSoIw/3FPfUNDZ4
MD5 SHA1 SHA512 SSDEEP

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 1e02f9e64e37fe94d8d42a18073a404ca5e949cd1108cd868166257e1b47ddd0
MD5 356807188e637deb7bd35572d176bc08
SHA1 42eba488e413fba22730695f14b8761d4077363d
SHA512 fc3a863b95d8255d73339338b7699c9007937ef662d134364cffc732595b0bc5e8aa7c28b6ada7aeb3d9b082cc01ad08131b56fc3e512eea33d38c3b84965d5c
SSDEEP 12288:diJKQ1uBeAMlwesHU8wqy2VYCIbvpOBlU1RlgIDMCZgjtGlxHZ9/I:d31SwPHU8X31PfU17DhZy0lxHZ9/I
MD5 SHA1 SHA512 SSDEEP

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 6c44caed4f250d6dbdedd43886cb5eaa9633ea239dc308a0b9a461d89f7d659b
MD5 8b437a4638fe97ad95303100d60a7e2f
SHA1 e7c673a4eae5a5e371a8e083d9eed79e284f03d4
SHA512 e8c68fa1883c0472c4abdda0ac43f75cfe82f291a6bcfe762ad5c59d4c9179d41798b98bdfbfc60052fd1c69d053a165a1d9aa89aa70b68638e7763ae5ec9e63
SSDEEP 12288:KpJKQ1uBeAMlwesHU8wqy2VYCIbvpOBlU1RlgIDMCZgjtGlxHZ9/I:KG1SwPHU8X31PfU17DhZy0lxHZ9/I
MD5 SHA1 SHA512 SSDEEP

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 3b8ae2310e24f303daca48d32a833efb87cfd62e91c4035ee5b1c2a555deac82
MD5 e69229de6eec32832feb9ee3289d1d34
SHA1 18fc56040684b5f54cbe7c7ab1371dc5c2865be0
SHA512 53adfcd69d9d02f479a18de9bd59b2757f8e8a0151adf392c3d2f0893b2cba3071c6ed2c63c2ec155804dd2b26de4f6b07614d48d5d22f63879ea24510200ad4
SSDEEP 12288:4/JKQ1uBeAMlwesHU8wqy2VYCIbvpOBlU1RlgIDMCZgjtGlxHZ9/I:401SwPHU8X31PfU17DhZy0lxHZ9/I
MD5 SHA1 SHA512 SSDEEP

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 7a20852d0f1a5924e5c8e1002e56a81a3d8f321b75621de6e8d96be833dc843d
MD5 6813d7a6acd9438b7ea0a0e2d5bbe2c0
SHA1 6a6f77e6efe1c63b153465c67b3875d4b7df3dc5
SHA512 1b586e777b00059e7e4baf7761b96cd0107dd6d1792ef59b32956a0a8a4024fe6aeded5b14746f3e7b61ae074cf2551ba78c96ac7f55c4280df665e3f79116e6
SSDEEP 12288:xVQJKQ1uBeAMlwesHU8wqy2VYCIbvpOBlU1RlgIDMCZgjtGlxHZ9/I:J1SwPHU8X31PfU17DhZy0lxHZ9/I
MD5 SHA1 SHA512 SSDEEP

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 26abfdc6bb4593f9a31a9c9d4e484a1c492e5190bb86d74f055e919e45981cba
MD5 b51a8934b3c66dc10aa134f02074d3bb
SHA1 a96546e7669030774d1930bff7d50c2e8a241a11
SHA512 a57ed2c141818612f286d259280efd8643ff0fa2678067f02553766ac961f739081a47cf3f574c6b6e61fa72ce60d6c65a45f665603751581d69593f36023df4
SSDEEP 12288:i4JKQ1uBeAMlwesHU8wqy2VYCIbvpOBlU1RlgIDMCZgjtGlxHZ9/I:iN1SwPHU8X31PfU17DhZy0lxHZ9/I
MD5 SHA1 SHA512 SSDEEP

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 b3087d22c20cd15f674d1a766b9d43851564bc371969a7094a136f38294317e0
MD5 8423318ecd76f96a45a628bf7321a1ec
SHA1 929c38d4134aa4b17b69e76956a89df7fdb125e9
SHA512 25ecba392c65c5b3d529f6cc0177892e0f99ea04e46bf87867f96eff0a323b1420b9d679aa6750d8fb0f22ef048b8a2fb3229956372c2f75d876c0490c683e2f
SSDEEP 12288:K1JKQ1uBeAMlwesHU8wqy2VYCIbvpOBlU1RlgIDMCZgjtGlxHZ9/I:Kq1SwPHU8X31PfU17DhZy0lxHZ9/I
MD5 SHA1 SHA512 SSDEEP

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 f2eb426f46e3628cb6cbb2e63f21ad75ba63dc7088eef2b980f7d0f33339c915
MD5 59be7c9e3876611d1ce9a78378243c2b
SHA1 5af676c7150704cab9033e09b7147f7edb48eb5d
SHA512 911c8fb3cebd4e0a2764492cc45185ed98ba761b6df16632d1740d98c381db023f797a3470a9f943ca78971f0ffa3cf0ab58cd256748e91a8bc89a9afa71a303
SSDEEP 12288:uRJKQ1uBeAMlwesHU8wqy2VYCIbvpOBlU1RlgIDMCZgjtGlxHZ9/I:uu1SwPHU8X31PfU17DhZy0lxHZ9/I
MD5 SHA1 SHA512 SSDEEP

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 5c1b9e2935fe600bb19f0254e6313cc8a9ca675f2aba70fe0ee26cb91c41dead
MD5 3ceb20d8d41368984651d161b51600f6
SHA1 74365c470caaed9b26727193644ca1635e391abf
SHA512 cedfd60f230550c4eeb16b02c959f15c23116c8804685915550b6817983d648062b1ccee64ec14cf8799bed3a6bba2018d35b8c037414bc73ae69461e6b4047b
SSDEEP 24576:yZMSzFVSOm1SwPHU8X31PfU17DhZy0lxHZ9/I:yZMSzfPw/3FPfUNDZ4
MD5 SHA1 SHA512 SSDEEP

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 aefa459426cb4b564b8ba7295bd97c9a66b967239f6bc82b27f4b1988380eb65
MD5 ed6654dc90376f6ad07c98c5d9742523
SHA1 d0d94db99856941396e650dd388c09988c3f6e33
SHA512 52915b3468fbc73bc396f2a55ed594936686310f88ed11739b3e987638669919f43c57431e8e09d13006a5ba321b025e8a147a33a55ec619b76c2c014f5fef23
SSDEEP 12288:bWJKQ1uBeAMlwesHU8wqy2VYCIbvpOBlU1RlgIDMCZgjtGlxHZ9/I:bT1SwPHU8X31PfU17DhZy0lxHZ9/I
MD5 SHA1 SHA512 SSDEEP

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 2454e5eb7a2e6c844a9cfdbcb028e0e6ed29ee3816c22d21693592eea8bca24f
MD5 d2b365643dc2dc3e61d79f2d1b74cfbd
SHA1 2fdde632e1355a183ba2c4557cb188d9fb80657c
SHA512 d1b72d53deb06f767d556aa4d8a9d96838aceb355705dee666e7372afa516e245d5b883489f1e16095e47991b3f927470bb65ec47cdd2c1206f184957c93ad93
SSDEEP 12288:06JKQ1uBeAMlwesHU8wqy2VYCIbvpOBlU1RlgIDMCZgjtGlxHZ9/I:0P1SwPHU8X31PfU17DhZy0lxHZ9/I
MD5 SHA1 SHA512 SSDEEP

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 1566805e762a527255e3ddfde0da0d8983a00d6b2a5ee16660d9853236f820dc
MD5 6fdd403c56c1356e0da59913fb2b5dd0
SHA1 9006d3876d676ff0511ffa6972a88cc4b5f3c50c
SHA512 f0ad6ad7f8fac00c489d3d7660d1a3ea09bf4136f28e9b2a1def41048daeebdfd8cbbebb507378bb32e0b7d8053a3c8efbd5e10e1a1593be69173d71691fb9c7
SSDEEP 12288:3yPz5L8NJKQ1uBeAMlwesHU8wqy2VYCIbvpOBlU1RlgIDMCZgjtGlxHZ9/I:6zyC1SwPHU8X31PfU17DhZy0lxHZ9/I
MD5 SHA1 SHA512 SSDEEP

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 a1e06b90ecfc9a59645f5e1124b79ea3f6399d654543d7fb7c0562edd9245f4a
MD5 4a5ef9654ffda20c04173c54055bbe45
SHA1 36ba79594bec00617f72a9bf49c65ed496538612
SHA512 42eb293670ec9497ccaab4946b3d11d05e26d6fc612311fd0f97b87d58ad935a4434a559bca3b1a36d6bf469db5d53efda39402cb3f626d16d7b7baa4faea3ab
SSDEEP 12288:hWJKQ1uBeAMlwesHU8wqy2VYCIbvpOBlU1RlgIDMCZgjtGlxHZ9/I:hT1SwPHU8X31PfU17DhZy0lxHZ9/I
MD5 SHA1 SHA512 SSDEEP

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 7b201c98e3a470ec4779433cf60a856280301324c9c39f305a31809835d9d835
MD5 acc8634624bcd8054e0c3f241077ed49
SHA1 fef8ee1664176fce6bb89e581f04c570b1ad1f69
SHA512 e65a1a542b6eb14882f2f857e5dc5868e38f6c5017c9d9ee2138abf0d279ef3bab76af4d01394661761b9e99174ee8d21d76c6ca6744886ef468c3e21b98d916
SSDEEP 12288:TWJKQ1uBeAMlwesHU8wqy2VYCIbvpOBlU1RlgIDMCZgjtGlxHZ9/I:TT1SwPHU8X31PfU17DhZy0lxHZ9/I
MD5 SHA1 SHA512 SSDEEP

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 261f65d3a69b5e6341e4a1c7b02e6768a9b3954e25963eacae5edc8fa15cfc8a
MD5 21470abfdbc46eebe04ab024e14a52b7
SHA1 edcbbf872817359b57a88a7f558ad9d1a2cacf47
SHA512 9affc0910c5c91e2807ba071042c585bc3307f1438e84aaae7a781b35181fdaba22fcc763af623b7e6be5b77d2674db8d3516c07ab65457b85556491c4f5fc77
SSDEEP 12288:HyPz5L8NJKQ1uBeAMlwesHU8wqy2VYCIbvpOBlU1RlgIDMCZgjtGlxHZ9/I:qzyC1SwPHU8X31PfU17DhZy0lxHZ9/I
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 67e3cf540a8d1033bea06b584d04b3abbd9fc4f2002ae792a532e47f2c9874fe
MD5 503bda9e6789272cb8f833a32f14e31f
SHA1 ee6ff918d611d9f0acb500480ac2c1449f360d61
SHA512 544e0f58fc1a7b5380f45a519ee3d8b68a2caf441587666a0e1a3e985a82ec46ad397d41bc3f1406b55ae0161456da35cddbeff85b001a3bf5f924e7dc6f68ff
SSDEEP 24576:tTHaLl3z0zDk1SwPHU8X31PfU17DhZy0lxHZ9/I:tT6LljCw/3FPfUNDZ4
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 21e6a223cc1d21da75c17ac2de5652451090b467d97a02ef016fd193e97b5d39
MD5 ff70796c8b70f1e3d7a2d2d4d4d3eb22
SHA1 d2c02ffe3b4d6d9c68715627714e509721416413
SHA512 49b54b2c95ce0bc292ead3daaf132ed7bd2270911ecbaebdc9d47ef89b86c4f2cb88fce4677e7f3f3c5c446443bbe9a576d9552d5773d358598f6d69de3df904
SSDEEP 24576:o37d9CHKy7GZo1SwPHU8X31PfU17DhZy0lxHZ9/I:y7d9CHKyaPw/3FPfUNDZ4
MD5 SHA1 SHA512 SSDEEP

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 22d8ea4dfa836853fb3912dc2b6b053139ef94861613e45e4a862e20961ffe38
MD5 8972cc760f0bf11a94e93caddaceadf1
SHA1 5fb0ac437f601cf9f422014c4afb460cf895afdc
SHA512 0da2c59eed68aae99d1e7136bf600456206fda4f3abf398729c9f118fe3cd24a6c68e732b96ff5f4e436baa366fc6b2c860bda165d1a3537bffa4273f2360608
SSDEEP 24576:2cP4mcvIjkGOxhKP2l71SNKbrh/8KBb1SwPHU8X31PfU17DhZy0lxHZ9/I:RP4m4IpOO67N8KSw/3FPfUNDZ4
MD5 SHA1 SHA512 SSDEEP

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 701KB
SHA256 89541f5457244832987411427f72e650cdb340d5f0f123aef316b9431506dc5c
MD5 70190881ac85a26a9c8956a418de8074
SHA1 1a2cfd7d8306e14380ab328b96d7b82dc38d4658
SHA512 1fecd74b4bcd13ea776bbd1f1affa9e1da6a5de89c9ae59805c02e49ab4b518a731d6123983bf94d0d208a0cb11978c2899b8951903eda0b169f4c157a779078
SSDEEP 12288:qUFmDDL7JKQ1uBeAMlwesHU8wqy2VYCIbvpOBlU1RlgIDMCZgjtGlxHZ9/I:IY1SwPHU8X31PfU17DhZy0lxHZ9/I
MD5 SHA1 SHA512 SSDEEP

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 0669e48c3bbc2f2c9f2e4ad7e1dae08ad519dafb769a7035848b2d9c142964b4
MD5 f572c217e11082fcba518a9246cde42e
SHA1 bc66e408a35f23ea30fe58a3e19b605b84f9e8c9
SHA512 f17139e3b8c42314e326233e04fc290a10748a8e0aac6f962ebd0943a38ca070499dc6ed3019fbf59bae209dca00f18f5cc74d75c8e694b81cd7d8f73c08f2b0
SSDEEP 12288:FmJKQ1uBeAMlwesHU8wqy2VYCIbvpOBlU1RlgIDMCZgjtGlxHZ9/I:Fj1SwPHU8X31PfU17DhZy0lxHZ9/I
MD5 SHA1 SHA512 SSDEEP

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 1c3b6196a94875af2a8c997b49b86ac02fb7ef9db30a0e5f63c2b4c09f4de5b7
MD5 0461c15c4060f02080d33ccb593ed39d
SHA1 89a5d7c354632f9836f470ca5de5be4cfbfe18e9
SHA512 b0bf1f2b928da55dbad1b66f4d510bd28aba1fed2df3b06844a5c6e2a5294290ad20a723abc4e5100560eb7c66ea0186ab1daccc25156a65c6ceacc48448f2f7
SSDEEP 49152:Za0h2GEkuAe73q3pp46zwwQOw/3FPfUNDZ4:Za0hNYG4Jw4fFPfUNF
MD5 SHA1 SHA512 SSDEEP

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 659KB
SHA256 398cac1fbeefa33db516719e3c4597a1525305540ab21bb9a55079ae2cc16dc5
MD5 603c5fff9059ffb117dc69677ee46153
SHA1 5521c246ccb475e239a06b7a0aca5a286d3763f0
SHA512 0570d79621c291e453191e6a1e69bc4c1576f272a6d736757e92030d7b7cb8f2f87e607f7c87e944cd22b297280cac231ba1269ec417d33a855c5ec09d97059c
SSDEEP 12288:/hbHjfXZJKQ1uBeAMlwesHU8wqy2VYCIbvpOBlU1RlgIDMCZgjtGlxHZ9/I:/hbHjP21SwPHU8X31PfU17DhZy0lxHZK
MD5 SHA1 SHA512 SSDEEP

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 91b125bc367ab64b977672577c9e6596ca5f511056aaa23448fa6bcdb908c6c1
MD5 a84264430978cadd42b3ab6c3d264ed3
SHA1 9f608e624cd87eedc7204f28228389bc0bf4418e
SHA512 d9b0be43c7f3af295411fdd443a23c2732b9c3671d1b9487b1f7027f17483d8657f1c08ee98c8cf4339a2c0bdf8c427da90c2506a558d06210affa2c71c49329
SSDEEP 24576:d3YgnJcRTk4yti+R5dpR/+1SwPHU8X31PfU17DhZy0lxHZ9/I:dIgnaTk46ppR/Lw/3FPfUNDZ4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 578KB
SHA256 4ec3b541821e24972ac907c0460856c890a04ad9242f9537b408a92b6148fc61
MD5 3bcc0b44e0a1440040fbf35d9f59c53c
SHA1 eafe63a351827a4d5000f5cd9afa1f8fb14c02f8
SHA512 2c37389bf7accb600ff5b26ae0b050c335da06545d6158478236789370919b40a585d5e4377b542aa7d1a9f5fd6bbc5ff76fa7d46e15559c53132621d72cc289
SSDEEP 12288:kKJKQ1uBeAMlwesHU8wqy2VYCIbvpOBlU1RlgIDMCZgjtGlxHZ9/I:kf1SwPHU8X31PfU17DhZy0lxHZ9/I
MD5 SHA1 SHA512 SSDEEP

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 940KB
SHA256 6ed40499b9392e3ed5acea826e6271b1812cd9ec5b665651b9cf4135f4100211
MD5 7f33125b8ab407db48927b2c612c8d43
SHA1 1b54ad047a343e0f134516ba49099d895db21437
SHA512 79741fc6eda16180bf5c7fbbeb7e724baae40425e0221a4bc82a3b29afa6d280469407e30c1a26a6c773422edd3774a68c9022b4562c9129adc612b3210a2730
SSDEEP 24576:ApL3UTw1SwPHU8X31PfU17DhZy0lxHZ9/I:ApL3U9w/3FPfUNDZ4
MD5 SHA1 SHA512 SSDEEP

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 671KB
SHA256 1b53eb400ccecc60bff48a1dfa5c27198fb808be7583861685f714c7b0912353
MD5 14dc1da59be3ac81009dd1868eb0d72a
SHA1 4b125dd0d11101c27006de345ef2c00405372016
SHA512 ae9bb8525a900123afbbcedb616c3cbf8751b1576d3d312f6dd1e8bb212937fc56cbb62b82875310fbe2a14dc89f1ebc975bf6d33498951b02f20f1003c67769
SSDEEP 12288:0pFtpOnJKQ1uBeAMlwesHU8wqy2VYCIbvpOBlU1RlgIDMCZgjtGlxHZ9/I:eO81SwPHU8X31PfU17DhZy0lxHZ9/I
MD5 SHA1 SHA512 SSDEEP

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 b3d374335bd7755cee992a2d2fd062b1dcb01c356e4779e30d1fb2d5b3b02fd2
MD5 9a62f4f4e1501b7ad53d1dc4d1c714f3
SHA1 91f71af2087feaae9287635a5692f3a6cf3e6576
SHA512 b3d8f958bdf46e1cf8416482fe300c54f92b607d2b6648510853de7c56f13ffcdddf8eb7a975106d2a363c7febaca1f38b4b3120bb9da7821814ce3a89313b7f
SSDEEP 24576:b7NM9YmZqmWMUkPjZM48Mv6bEhsT1SwPHU8X31PfU17DhZy0lxHZ9/I:b7cBWMpPjN8DbEhzw/3FPfUNDZ4
MD5 SHA1 SHA512 SSDEEP

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 2e907af29864f63c04c728cd7756c8ff9a5e55b2e646224ff96ed32e840ca8dd
MD5 f02bc74358fe267d66dea616c217daf6
SHA1 57c8ca84f6459075a3b36c2886c959fb9de43a75
SHA512 45aa14c77aa23a226e7326fe620390aa06ce7ec473a2ad6f8aae5474a9bf23f29e045102977a9aa98039360a7bcecc1e2798651e1ba4e48324101f5bb63044ac
SSDEEP 24576:7W6BApg2YuyuNDYTabvcRvNYf8km1R1SwPHU8X31PfU17DhZy0lxHZ9/I:7F2YuHNETovcvNYf8km4w/3FPfUNDZ4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 8a0a1ab4edf0782da468bf961769fa7d944e664b7a7cbc46a3f0bf9cf698f7c3
MD5 9254b15714a0f4f44d01d775c8d86b2e
SHA1 3d9a6325782643640a4fc262e578ae85f7a51e82
SHA512 40801a4646175cb8ea5534255b611af07fb3f2b0bcea5512d4e8660fbff11e6e901baff26c9edd2e93de4d6a0e116a968d7a379d44bce4a2fab63564cd00dcb0
SSDEEP 24576:mAFs06+Omlf3NXEbToo1SwPHU8X31PfU17DhZy0lxHZ9/I:PFs060lVXuuw/3FPfUNDZ4
MD5 SHA1 SHA512 SSDEEP

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 885KB
SHA256 0752e41eaa9061268b1e6d551c3ecee8fc1349b6c7e219e604e3e4639ba6c6f1
MD5 c0c1355cdc357914afc6f2f23b0e5b33
SHA1 f5908008ba37a407e4672883f3437518a843683d
SHA512 1c1d7b09c0a489d4cca189d0ac9066e42d44f30c9811d84950854eafe1df769250a563ee4b14ba54a884d3e3e99cc0d39e577f66963252a9e0356173c4a9f086
SSDEEP 24576:CJnJ5D3Wtt1SwPHU8X31PfU17DhZy0lxHZ9/I:CJnJ5DGtuw/3FPfUNDZ4
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 fed6b9c8da1c3cc2877be4b18bf7e01bd5fe65f445a443626804a7d1ee19198a
MD5 391f43449b1a95e580d0312d80ec24ae
SHA1 fed9d5e7d642dc9fc4c3f9441177fe01b16d88c6
SHA512 c3156ac51022bfb836bcde63131ed116efbac9bd34b2de248752ca6a1b6be33e4b6ae0b94ecef4738e918e728fedd1e6fa053386140cc316d550c5393dda2d98
SSDEEP 49152:+o06DIKdwc+eQnSt65aV0w/3FPfUNDZ4:3VfFPfUNF
MD5 SHA1 SHA512 SSDEEP

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 661KB
SHA256 21cc4b2b041a4002f64f68dcb100310ac4f643ddde9ce36e58bbd201e0b2e33a
MD5 b1ec172f7e4707e524bb328f0ee0aae8
SHA1 de7580bdb226457728941c882af739e6b8dac056
SHA512 f58e43b6b5437dae56bfedb7d0187e7359c859b62dd98bbf263975d32f08035d6c0dce3611d29b704219a4cb8803268ca0e51fa9f21928ba0ab93a74d2f4a58a
SSDEEP 12288:/EP3RrcJKQ1uBeAMlwesHU8wqy2VYCIbvpOBlU1RlgIDMCZgjtGlxHZ9/I:Erp1SwPHU8X31PfU17DhZy0lxHZ9/I
MD5 SHA1 SHA512 SSDEEP

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 712KB
SHA256 b3c6854995345c914529f2003a32e61c712dc7f1c231406b03d28ca2c82539ab
MD5 3aea10b2980046d9a9dfe4d0597d21c8
SHA1 c5583d2aaf008d9a9c67f5527db391e78396ee0f
SHA512 38082add1e1dd019d1c5ffe24eabba0316d28f7f89125bbfa32c700d8f051c0afe55faeabebb73dfc0743267881352560c5f59c53e527ed4e4161da7a28677d4
SSDEEP 12288:jjkypJKQ1uBeAMlwesHU8wqy2VYCIbvpOBlU1RlgIDMCZgjtGlxHZ9/I:jIyG1SwPHU8X31PfU17DhZy0lxHZ9/I
MD5 SHA1 SHA512 SSDEEP

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 584KB
SHA256 21ca95a483864d7b7e788133ad94afe7ef8fd1e6bd9cbe50b6744c9914076813
MD5 dd2cfcc77cbf513b0cfdc032aa7da561
SHA1 cc93e776dddac0637858243fb9d5c2ce5e505c1e
SHA512 38bd7f16967fbec87d0d14121f42e3feb3dc63f8bf59d08ed715cff1e30c40b81e5b8ff89b74b451041235cf466b45e7466f4bdec8a64428f37f8db09f28ecca
SSDEEP 12288:AF3JKQ1uBeAMlwesHU8wqy2VYCIbvpOBlU1RlgIDMCZgjtGlxHZ9/I:uM1SwPHU8X31PfU17DhZy0lxHZ9/I
MD5 SHA1 SHA512 SSDEEP

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 286caf71f5990698c83edf747ce165e4aefa43c26874ef1fbad0f47a36d92972
MD5 e4a2ffdc199308631e01a7c42e090f2f
SHA1 dba6956934eec0fd14a5dd88bfc2fa3f6bba954a
SHA512 8e877d3113cdf8e3fba9758b4740f7e15252aa262d3a83db9cd88403e79d0ec2444df2425f056dc68bed5f847c25815c1b812daf20e5f372843ed5c7765ef3ab
SSDEEP 24576:JQ9MxZKdcz97w3L1SwPHU8X31PfU17DhZy0lxHZ9/I:JVKXgw/3FPfUNDZ4
MD5 SHA1 SHA512 SSDEEP

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 772KB
SHA256 82ce6cc1183cb2944b01e6741b169a4fe5910f2b3217bc99cae4344b392b7acf
MD5 5edc769b9a66d7d89fa33fb1d290e7be
SHA1 d113a299623a4826865d003aa24353680eac1df9
SHA512 eae0db8483f1f34668278b7c8f769f346e6bc87f0415525682df062deaf0f52d0bd21b04b18fe07fbcef9de417912f10df1d1126ef244ed0e15b7bb65692e697
SSDEEP 24576:RyocxApy1SwPHU8X31PfU17DhZy0lxHZ9/I:8ocxAp3w/3FPfUNDZ4
MD5 SHA1 SHA512 SSDEEP

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 f44edc6ebd98698247df52df89a89a923a3c92c947147f7b240203c1cffb723d
MD5 414266d5e2e747c76d1eee13f941c408
SHA1 9d60cf027461f2625a7cfe125a002ed8e8cc1eb4
SHA512 592a0d90692d8ab3c3e09f3e046e68f26d02885ef30f971374592b23b1913d5eb5c4e8a76a13b1bab4fe91ec8b44ec906ffd5bdceafa11a37f6df383901768b4
SSDEEP 49152:VWcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIK3w/3FPfUNDZ4:F0zuNIkfFPfUNF
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 68b27ea020d33c16ee0abfbd93c6aa5a8bc0554cf9ec6fa91139d7868088954e
MD5 d2228f550313bb7b11a43fa7d8b6c34c
SHA1 b36f746f18dd3071a861efdff639a1f8068f47d1
SHA512 b24b2128a66485152f80a188e1d866b83e01c5f2cc134ce0d111029c6106b91d9de6b934ac8f8863a83c0a2bff04fd38722efd8a85105f02229e52eeadf8b1c1
SSDEEP 24576:a1QT7EcpfxR+N5AWAz3ooiYtjMqbp1SwPHU8X31PfU17DhZy0lxHZ9/I:nTDxR+N5YzTfjM9w/3FPfUNDZ4
MD5 SHA1 SHA512 SSDEEP

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 877KB
SHA256 3bbad373293b88b65c5fbcfc7304b3e4bd397af9d3fb105c916606b24850209f
MD5 92732deec92eebbee54e51467a51af57
SHA1 74c2aae846ade8e28dfd501a5baa10cadb534627
SHA512 c5442d1cde5911fe8d8cc98c95c17ce1db99beaf46aa4932fb875d64221ad6d26ab37fb77c2455a4b1bd13b5922854000e41f166bec70b49bdd4463e0acc68b0
SSDEEP 24576:DTMdOz0FFS+imSLF1SwPHU8X31PfU17DhZy0lxHZ9/I:h0K+imSL2w/3FPfUNDZ4
MD5 SHA1 SHA512 SSDEEP

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 635KB
SHA256 904970d91a9b31b86b938a86b8156a6221abbdcc2aa13ddb2d61d8fca7188582
MD5 ef51a3fd2fbd7dec50c0628b90574d32
SHA1 742822cdae7d450843204ff0cc502e0d5f36190a
SHA512 0d68ccf02f9ac60e850e25f61bb59ed7a128be2f48c6747c143db0997de8475270ad962eede8815de72574a84e5d80d4eba9840641185ae005ad7f59ebbb0b65
SSDEEP 12288:w47zJKQ1uBeAMlwesHU8wqy2VYCIbvpOBlU1RlgIDMCZgjtGlxHZ9/I:Xw1SwPHU8X31PfU17DhZy0lxHZ9/I
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/496-188-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/496-472-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/1076-74-0x0000000000400000-0x0000000000584000-memory.dmp

Download

memory/1076-6-0x0000000000A60000-0x0000000000AC7000-memory.dmp

Download

memory/1076-1-0x0000000000A60000-0x0000000000AC7000-memory.dmp

Download

memory/1076-0-0x0000000000400000-0x0000000000584000-memory.dmp

Download

memory/1624-215-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/1624-211-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/2044-174-0x0000000140000000-0x000000014024B000-memory.dmp

Download

memory/2044-60-0x0000000140000000-0x000000014024B000-memory.dmp

Download

memory/2044-52-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/2044-58-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/2120-210-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/2120-92-0x0000000000D90000-0x0000000000DF0000-memory.dmp

Download

memory/2120-91-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/2396-226-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/2396-527-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/3136-117-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/3136-229-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/3156-532-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/3156-254-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/3188-266-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3188-475-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3188-151-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3196-250-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/3196-531-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/3316-90-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/3316-19-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/3316-20-0x0000000000700000-0x0000000000760000-memory.dmp

Download

memory/3316-11-0x0000000000700000-0x0000000000760000-memory.dmp

Download

memory/3440-415-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/3440-155-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/3468-524-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/3468-191-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/3552-465-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/3552-175-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/3644-253-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/3644-132-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/3828-69-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/3828-63-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/3828-179-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/3828-71-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/4528-267-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4528-533-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4544-44-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4544-46-0x0000000000530000-0x0000000000590000-memory.dmp

Download

memory/4544-37-0x0000000000530000-0x0000000000590000-memory.dmp

Download

memory/4544-48-0x0000000000530000-0x0000000000590000-memory.dmp

Download

memory/4544-50-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4552-85-0x0000000002240000-0x00000000022A0000-memory.dmp

Download

memory/4552-76-0x0000000002240000-0x00000000022A0000-memory.dmp

Download

memory/4552-82-0x0000000002240000-0x00000000022A0000-memory.dmp

Download

memory/4552-75-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/4552-88-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/4712-230-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/4712-528-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/4780-32-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/4780-33-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/4780-26-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/4780-25-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/4780-128-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/4812-129-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/4812-241-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/4960-103-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/4960-223-0x0000000140000000-0x00000001400CF000-memory.dmp

Download