30c2ba6a537820ea23dd5041e7c384a2586544bfd35084b7009da48006700c17

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 16:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-06-03_a86509ea7205317da1d7228c6e6cff2f_bkransomware.exe
Size 1.8MB
Sample240603-tlqaesbh4s
SHA256 30c2ba6a537820ea23dd5041e7c384a2586544bfd35084b7009da48006700c17
MD5 a86509ea7205317da1d7228c6e6cff2f
SHA1 71d196be7d42c453565b6773e62bac8904c8007a
SHA512 71f3eb836b13c866729d5fb312fe24a59f04a471529226c4a27c309416f88618c4cb6bb9131e553f185641b02baf47756b0697cb3afd8489987635babfb56f57
SSDEEP 49152:HE19+ApwXk1QE1RzsEQPaxHNw8HNUPCAaq8Wdo0:Y93wXmoKI8t4C7
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
3592	alg.exe
1004	DiagnosticsHub.StandardCollector.Service.exe
3964	fxssvc.exe
4836	elevation_service.exe
2988	elevation_service.exe
2168	maintenanceservice.exe
1156	msdtc.exe
4168	OSE.EXE
404	PerceptionSimulationService.exe
1808	perfhost.exe
920	locator.exe
4812	SensorDataService.exe
1936	snmptrap.exe
4492	spectrum.exe
2256	ssh-agent.exe
8	TieringEngineService.exe
1244	AgentService.exe
388	vds.exe
4980	vssvc.exe
2724	wbengine.exe
2728	WmiApSrv.exe
1768	SearchIndexer.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in System32 directory 31 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2024-06-03_a86509ea7205317da1d7228c6e6cff2f_bkransomware.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2024-06-03_a86509ea7205317da1d7228c6e6cff2f_bkransomware.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\8c6df76cbb5459c0.bin	alg.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2024-06-03_a86509ea7205317da1d7228c6e6cff2f_bkransomware.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2024-06-03_a86509ea7205317da1d7228c6e6cff2f_bkransomware.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2024-06-03_a86509ea7205317da1d7228c6e6cff2f_bkransomware.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2024-06-03_a86509ea7205317da1d7228c6e6cff2f_bkransomware.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	alg.exe
File opened for modification	C:\Windows\System32\alg.exe	2024-06-03_a86509ea7205317da1d7228c6e6cff2f_bkransomware.exe
File opened for modification	C:\Windows\system32\locator.exe	2024-06-03_a86509ea7205317da1d7228c6e6cff2f_bkransomware.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2024-06-03_a86509ea7205317da1d7228c6e6cff2f_bkransomware.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2024-06-03_a86509ea7205317da1d7228c6e6cff2f_bkransomware.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2024-06-03_a86509ea7205317da1d7228c6e6cff2f_bkransomware.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2024-06-03_a86509ea7205317da1d7228c6e6cff2f_bkransomware.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2024-06-03_a86509ea7205317da1d7228c6e6cff2f_bkransomware.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2024-06-03_a86509ea7205317da1d7228c6e6cff2f_bkransomware.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2024-06-03_a86509ea7205317da1d7228c6e6cff2f_bkransomware.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2024-06-03_a86509ea7205317da1d7228c6e6cff2f_bkransomware.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2024-06-03_a86509ea7205317da1d7228c6e6cff2f_bkransomware.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2024-06-03_a86509ea7205317da1d7228c6e6cff2f_bkransomware.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2024-06-03_a86509ea7205317da1d7228c6e6cff2f_bkransomware.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	alg.exe
File opened for modification	C:\Windows\system32\AgentService.exe	alg.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2024-06-03_a86509ea7205317da1d7228c6e6cff2f_bkransomware.exe
File opened for modification	C:\Windows\system32\dllhost.exe	alg.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	alg.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2024-06-03_a86509ea7205317da1d7228c6e6cff2f_bkransomware.exe
File opened for modification	C:\Windows\System32\vds.exe	2024-06-03_a86509ea7205317da1d7228c6e6cff2f_bkransomware.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2024-06-03_a86509ea7205317da1d7228c6e6cff2f_bkransomware.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2024-06-03_a86509ea7205317da1d7228c6e6cff2f_bkransomware.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	2024-06-03_a86509ea7205317da1d7228c6e6cff2f_bkransomware.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2024-06-03_a86509ea7205317da1d7228c6e6cff2f_bkransomware.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	2024-06-03_a86509ea7205317da1d7228c6e6cff2f_bkransomware.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2024-06-03_a86509ea7205317da1d7228c6e6cff2f_bkransomware.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2024-06-03_a86509ea7205317da1d7228c6e6cff2f_bkransomware.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2024-06-03_a86509ea7205317da1d7228c6e6cff2f_bkransomware.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	2024-06-03_a86509ea7205317da1d7228c6e6cff2f_bkransomware.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe	2024-06-03_a86509ea7205317da1d7228c6e6cff2f_bkransomware.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2024-06-03_a86509ea7205317da1d7228c6e6cff2f_bkransomware.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	2024-06-03_a86509ea7205317da1d7228c6e6cff2f_bkransomware.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdate.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2024-06-03_a86509ea7205317da1d7228c6e6cff2f_bkransomware.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2024-06-03_a86509ea7205317da1d7228c6e6cff2f_bkransomware.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	2024-06-03_a86509ea7205317da1d7228c6e6cff2f_bkransomware.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	2024-06-03_a86509ea7205317da1d7228c6e6cff2f_bkransomware.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	2024-06-03_a86509ea7205317da1d7228c6e6cff2f_bkransomware.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	2024-06-03_a86509ea7205317da1d7228c6e6cff2f_bkransomware.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2024-06-03_a86509ea7205317da1d7228c6e6cff2f_bkransomware.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2024-06-03_a86509ea7205317da1d7228c6e6cff2f_bkransomware.exe
File opened for modification	C:\Program Files\Mozilla Firefox\minidump-analyzer.exe	2024-06-03_a86509ea7205317da1d7228c6e6cff2f_bkransomware.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2024-06-03_a86509ea7205317da1d7228c6e6cff2f_bkransomware.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	2024-06-03_a86509ea7205317da1d7228c6e6cff2f_bkransomware.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2024-06-03_a86509ea7205317da1d7228c6e6cff2f_bkransomware.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2024-06-03_a86509ea7205317da1d7228c6e6cff2f_bkransomware.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2024-06-03_a86509ea7205317da1d7228c6e6cff2f_bkransomware.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2024-06-03_a86509ea7205317da1d7228c6e6cff2f_bkransomware.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2024-06-03_a86509ea7205317da1d7228c6e6cff2f_bkransomware.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	2024-06-03_a86509ea7205317da1d7228c6e6cff2f_bkransomware.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2024-06-03_a86509ea7205317da1d7228c6e6cff2f_bkransomware.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	2024-06-03_a86509ea7205317da1d7228c6e6cff2f_bkransomware.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateSetup.exe	2024-06-03_a86509ea7205317da1d7228c6e6cff2f_bkransomware.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	alg.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2024-06-03_a86509ea7205317da1d7228c6e6cff2f_bkransomware.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000028a7860d0b5da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ae450a5ed0b5da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008773c260d0b5da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a5a5d15fd0b5da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
1748	2024-06-03_a86509ea7205317da1d7228c6e6cff2f_bkransomware.exe
1748	2024-06-03_a86509ea7205317da1d7228c6e6cff2f_bkransomware.exe
1748	2024-06-03_a86509ea7205317da1d7228c6e6cff2f_bkransomware.exe
1748	2024-06-03_a86509ea7205317da1d7228c6e6cff2f_bkransomware.exe
1748	2024-06-03_a86509ea7205317da1d7228c6e6cff2f_bkransomware.exe
1748	2024-06-03_a86509ea7205317da1d7228c6e6cff2f_bkransomware.exe
1748	2024-06-03_a86509ea7205317da1d7228c6e6cff2f_bkransomware.exe
1748	2024-06-03_a86509ea7205317da1d7228c6e6cff2f_bkransomware.exe
1748	2024-06-03_a86509ea7205317da1d7228c6e6cff2f_bkransomware.exe
1748	2024-06-03_a86509ea7205317da1d7228c6e6cff2f_bkransomware.exe
1748	2024-06-03_a86509ea7205317da1d7228c6e6cff2f_bkransomware.exe
1748	2024-06-03_a86509ea7205317da1d7228c6e6cff2f_bkransomware.exe
1748	2024-06-03_a86509ea7205317da1d7228c6e6cff2f_bkransomware.exe
1748	2024-06-03_a86509ea7205317da1d7228c6e6cff2f_bkransomware.exe
1748	2024-06-03_a86509ea7205317da1d7228c6e6cff2f_bkransomware.exe
1748	2024-06-03_a86509ea7205317da1d7228c6e6cff2f_bkransomware.exe
1748	2024-06-03_a86509ea7205317da1d7228c6e6cff2f_bkransomware.exe
1748	2024-06-03_a86509ea7205317da1d7228c6e6cff2f_bkransomware.exe
1748	2024-06-03_a86509ea7205317da1d7228c6e6cff2f_bkransomware.exe
1748	2024-06-03_a86509ea7205317da1d7228c6e6cff2f_bkransomware.exe
1748	2024-06-03_a86509ea7205317da1d7228c6e6cff2f_bkransomware.exe
1748	2024-06-03_a86509ea7205317da1d7228c6e6cff2f_bkransomware.exe
1748	2024-06-03_a86509ea7205317da1d7228c6e6cff2f_bkransomware.exe
1748	2024-06-03_a86509ea7205317da1d7228c6e6cff2f_bkransomware.exe
1748	2024-06-03_a86509ea7205317da1d7228c6e6cff2f_bkransomware.exe
1748	2024-06-03_a86509ea7205317da1d7228c6e6cff2f_bkransomware.exe
1748	2024-06-03_a86509ea7205317da1d7228c6e6cff2f_bkransomware.exe
1748	2024-06-03_a86509ea7205317da1d7228c6e6cff2f_bkransomware.exe
1748	2024-06-03_a86509ea7205317da1d7228c6e6cff2f_bkransomware.exe
1748	2024-06-03_a86509ea7205317da1d7228c6e6cff2f_bkransomware.exe
1748	2024-06-03_a86509ea7205317da1d7228c6e6cff2f_bkransomware.exe
1748	2024-06-03_a86509ea7205317da1d7228c6e6cff2f_bkransomware.exe
1748	2024-06-03_a86509ea7205317da1d7228c6e6cff2f_bkransomware.exe
1748	2024-06-03_a86509ea7205317da1d7228c6e6cff2f_bkransomware.exe
1748	2024-06-03_a86509ea7205317da1d7228c6e6cff2f_bkransomware.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
664	Process not Found
664	Process not Found

Suspicious use of AdjustPrivilegeToken 45 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1748	2024-06-03_a86509ea7205317da1d7228c6e6cff2f_bkransomware.exe
Token: SeAuditPrivilege	3964	fxssvc.exe
Token: SeRestorePrivilege	8	TieringEngineService.exe
Token: SeManageVolumePrivilege	8	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	1244	AgentService.exe
Token: SeBackupPrivilege	4980	vssvc.exe
Token: SeRestorePrivilege	4980	vssvc.exe
Token: SeAuditPrivilege	4980	vssvc.exe
Token: SeBackupPrivilege	2724	wbengine.exe
Token: SeRestorePrivilege	2724	wbengine.exe
Token: SeSecurityPrivilege	2724	wbengine.exe
Token: 33	1768	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1768	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1768	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1768	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1768	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1768	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1768	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1768	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1768	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1768	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1768	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1768	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1768	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1768	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1768	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1768	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1768	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1768	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1768	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1768	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1768	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1768	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1768	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1768	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1768	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1768	SearchIndexer.exe
Token: SeDebugPrivilege	1748	2024-06-03_a86509ea7205317da1d7228c6e6cff2f_bkransomware.exe
Token: SeDebugPrivilege	1748	2024-06-03_a86509ea7205317da1d7228c6e6cff2f_bkransomware.exe
Token: SeDebugPrivilege	1748	2024-06-03_a86509ea7205317da1d7228c6e6cff2f_bkransomware.exe
Token: SeDebugPrivilege	1748	2024-06-03_a86509ea7205317da1d7228c6e6cff2f_bkransomware.exe
Token: SeDebugPrivilege	1748	2024-06-03_a86509ea7205317da1d7228c6e6cff2f_bkransomware.exe
Token: SeDebugPrivilege	3592	alg.exe
Token: SeDebugPrivilege	3592	alg.exe
Token: SeDebugPrivilege	3592	alg.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1768 wrote to memory of 2596	1768	SearchIndexer.exe	110
PID 1768 wrote to memory of 2596	1768	SearchIndexer.exe	110
PID 1768 wrote to memory of 2896	1768	SearchIndexer.exe	111
PID 1768 wrote to memory of 2896	1768	SearchIndexer.exe	111

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2024-06-03_a86509ea7205317da1d7228c6e6cff2f_bkransomware.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-03_a86509ea7205317da1d7228c6e6cff2f_bkransomware.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1748

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3592

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:1004

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:4864

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3964

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4836

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2988

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2168

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:1156

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4168

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:404

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:1808

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:920

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4812

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:1936

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4492

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2256

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:1656

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:8

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1244

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:388

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4980

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2724

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:2728

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1768
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2596
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
  2⤵
  - Modifies data under HKEY_USERS
  PID:2896

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
Size 2.1MB
SHA256 f838edaad557c7fb6370ff618e555fe25b51ba9c0813c50f45a8c44515b41ac2
MD5 882e9c3017d3dc07fa45786a51be1d72
SHA1 33bd430fe5f8a495e29d14121db46ca157a3868a
SHA512 38517243acc5659fadaeb9f3b61ae7cf175790643f4435a515a734c79e1a3c52102827ed9c35fb4f56d4f0274619bf8e35e0d703643a332b236a9d185b911d13
SSDEEP 49152:suYk3H5koUXfTqkkYLO/W2buywzMbOX+T7z588HNUPCAaq8Wdo0:sPfTqi90bg8t4C7
MD5 SHA1 SHA512 SSDEEP

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 797KB
SHA256 a74b5f3f47435f1321b68039ef085a1af5a0c5a46c2a6ef25f2a9717f72371c6
MD5 bd55a543f181d17f9994872090d53af7
SHA1 e5eb7f449be9ddf272942e3538700aeab74e49c1
SHA512 7c48acb9b6faa1e233c61f1a7af6dd739a481611f48f1b034ddbd2261f165f1269a165a395d202f5e1ba44497809115d2dcf6da9e2dc86860775b8bf91b87345
SSDEEP 24576:LidnBsuEX1N3RUDHNmdPCAaq8Nozgi/rE0TOj:2Suu8HNUPCAaq8Wdo0
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 5f66bd70fbf5ff5af9e2dae916eef83fbe100a3416f83957df2cf1d469194420
MD5 402637b40a06e288710c9da2764dea48
SHA1 78e9bab78fe317a8f32d35a538e193c164a3dee2
SHA512 e999bed31a1811c6f9a09c41351180b42985aa3bf80ffb6591a7ac47b32550e5181765bca7db491bd76f6bbf71fd08e7a1324918248007e2b4db0a57457d73e4
SSDEEP 24576:n+gkEVfh4CoT1N3RUDHNmdPCAaq8Nozgi/rE0TOj:+gkExS58HNUPCAaq8Wdo0
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 6af7d1f9207f045d2a6916bc1364e8bac7f27f06cca89c7317494cb3453db803
MD5 cc7ab42d41569c2f2c83a1c6af180027
SHA1 4c5f54902c5fc9508cd4a2833b8172752a71bc78
SHA512 faa428f8a23460fda13e5b8ebf346e95069b0454b213f53c60fa43ca3de3d1a2353b76afdb567dca99958ad800eefe048bf76728d90b1224f2213ccd8f71b1f8
SSDEEP 24576:pBpDRmi78gkPXlyo0Gxjrw1N3RUDHNmdPCAaq8Nozgi/rE0TOj:LNRmi78gkPX4o0Gxjc8HNUPCAaq8Wdo0
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 89d257c3cf2ef7b0c230b9f1d5770a68436443f26020304dbfdc808f58758de1
MD5 1c73e8c78a943ab845734f379f5fa88b
SHA1 f016a1987a797dabbb2c22e05cce89e3e59ed917
SHA512 076ff2d3c03ab3e4a18c786a22859f0f8884b37b9fa82f2e7e9ebb22a0c46edc60e18599302657fda2cde929c51b41c6751bb34cd11a7ba34f86c880aaa30111
SSDEEP 24576:RLOS2oyPIXVT1N3RUDHNmdPCAaq8Nozgi/rE0TOj:r/yU8HNUPCAaq8Wdo0
MD5 SHA1 SHA512 SSDEEP

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 b9e6bb8c33a4f39233440eca5163f0da2aa32309a52a6e33371077c6bdaa6a3e
MD5 ffb511e488850f46a2ab019ad66187aa
SHA1 0ff4299283a7ccbfc5af3500cb284b2518f4fa7f
SHA512 f3cc13f346deea5d2c67a3768d872012350ef04809a658dfb5176a0b0ce5ca02bfdc424493df49ba84f103dc03ff1d3ae62d3d9d7f53162a7b3d3b211c52a860
SSDEEP 12288:Qf93FN92mrRUDkDTYNmN3Rus3SAFYq8Noz9qirzrEX1fsd7TOoOTd:Qf91N3RUDHNmdPCAaq8Nozgi/rE0TOj
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 cbca90ad4402e15b02c16a044e84169d13c9ec8c2003410e78fba65862ed05cc
MD5 83b75f7187ad9f2ded97fef1804b08da
SHA1 ddcbe1f5b5ff75af78f9e1151949ee9b7711a5ae
SHA512 e634262f017a3a3693e630a04b36374186dc3a93ec93d593f3dc8fbd021956ca41822cd868144e1a562acd41631dddb508d1caba899b49d0837661886d88989b
SSDEEP 24576:aJIUq1N3RUDHNmdPCAaq8Nozgi/rE0TOj:aJIUC8HNUPCAaq8Wdo0
MD5 SHA1 SHA512 SSDEEP

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 e5c979edd3597bfacb419c9e7babda01273f0e8670fb1ce980d54d1c6f7c5cff
MD5 2e97e2502c3c54818bc9a245490f00aa
SHA1 2e7817d6cd937dc4aa7babfd8f42bf4a8fda2dec
SHA512 46897c1d791c8ecf2a5a1e1d9586ec917dc2d2ae24dc4931d099fb687999cd0cfa50c88fa9ee46df27341368da18057a45d2934b76bf809cab43d1bb310f312f
SSDEEP 49152:sQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THY:sQvGAdlCEL8c/yRNw5CL8t4C7
MD5 SHA1 SHA512 SSDEEP

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 978aa4ef75c955c92f79a214822959d2a896a802ccac89a608554bb869d02d9e
MD5 8215224fd0a293886ab21f7422f7c897
SHA1 099cac01c2a2debe2e7d443067add993d70958ce
SHA512 e63d13fc483fcb4dd8f944c2ed9b7240f9ff76f9a097f91cbf97a36dee91b060edb0bcf0e8c72efa2fa40f44fef7c6b26b2b67bcd5e0a48b5eb353c18cc86ec1
SSDEEP 24576:7dewsAjY1N3RUDHNmdPCAaq8Nozgi/rE0TOj:pljg8HNUPCAaq8Wdo0
MD5 SHA1 SHA512 SSDEEP

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 7bbcde0c51daf1093b55887e5478d267473e0f2e2bdf17d5d729d14743a2c775
MD5 a98e8ddbb12f25b6caba406e9cf1ea0f
SHA1 a2d9677514363692c3f946bb97e1d3ed740a4f9b
SHA512 029f4e4e7bda03a6d72b46882e7cad2304454b007d5e95cc4c90124e2ec17ee39b141e3da25fc2b070e9900d6f8b538d9858907efd1f9aa176fb17108d28dd32
SSDEEP 196608:3UEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJH48d:3UEtQevvqc2W1cpV2EI324q
MD5 SHA1 SHA512 SSDEEP

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 0ce363148ccabb59b8c179f68541651c5d5740de8809451448ce4145941243cf
MD5 e3ffc686fa8c48113c4e301a66f83ea0
SHA1 f82b2239e1192a7f67a71749b33e6f20a5212591
SHA512 fdfcec3abef2359cfda289b41e05010a1f8fb425185a340f840e4d70f90e20f6a0870f6046af7eaa428b5ea8641ec2e5b13ac520172cb0562069f31e6e6348d7
SSDEEP 49152:UCbRquA/m2yL5zifFiV+XenmE3/zA8HNUPCAaq8Wdo0:9oqHVjnmv8t4C7
MD5 SHA1 SHA512 SSDEEP

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 01989c80c6486041588afe6eb227dc29f1aa939ebb742a94dc282348516dcc4a
MD5 edbff65035df87eb148b47bac4ef5dc6
SHA1 07d8640c02a5dd0c6465f5ed9a5e0ffab9e5ebfe
SHA512 6feded12dd4266f60fe6f0d26bb54264b072a65d3fc4d09b1991520a92433fd2d970820407ad0d45bada02cff21cecc8c48b3ca733cb333dce08d69df7d21727
SSDEEP 24576:tAhGLJIFoiwtA5l7S53j1N3RUDHNmdPCAaq8Nozgi/rE0TOj:tAMyFoiq5/8HNUPCAaq8Wdo0
MD5 SHA1 SHA512 SSDEEP

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 372c8f7432b16e0a12a5265c48383285333c3e145cf2221e9686375d6d978f4c
MD5 4d9218b34ca64aea8f44106a0cb95249
SHA1 ec3e1f69b15e66369d011af5963af20fa9b4a843
SHA512 88f2c84b6bab47fe924ad98180636552af560e4c8cf8363b83bc69d962b0647299a1849957d14bdb20a6ab29f27a862df3a96ee3fc5b5ccf241f6a0ad47523b4
SSDEEP 24576:3wuoOWc1N3RUDHNmdPCAaq8Nozgi/rE0TOj:3wDOj8HNUPCAaq8Wdo0
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 18364c99ed9b197d966485c0388d2d14129443bc810977afabe94cf25f2bc255
MD5 314ed85b2e584544395ee532ad3ba222
SHA1 b48dd23ba715af953ee805c09e0044a1f3f7de6b
SHA512 8c487738671926dc8969fbe9e33327dfd41aaeefca8b18a5df6f85241837a3037c2922cd27a323f6b8f448840d6ac6eea2e2555002595f08d586b5a2daccfa87
SSDEEP 12288:8BZ1IyI3FN92mrRUDkDTYNmN3Rus3SAFYq8Noz9qirzrEX1fsd7TOoOTd:KZup1N3RUDHNmdPCAaq8Nozgi/rE0TOj
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
Size 5.4MB
SHA256 dc50d35672fbaad74d3ab03b598bac5fe5ebf2fc694384e316ccbd4cce9776b7
MD5 d96f42633f8b53d0e16784edbcfaf18c
SHA1 96eb17dbc8972e8900119d2e6d3d02d79b12a408
SHA512 57fc33a8c27c1e94ab99a97785f421ee2b7fd8d5d35029cc82756a5cf96efb62397b1b01b08647af21a2081b783fc424f9312abf351c805724e514c3cf1cb71f
SSDEEP 49152:Z0kwIi7c4xZlm5knEtw99Kn/2vim7vgv6m+yyJ/0gbvjR7yY7BHi3u7L/gBUUWLo:pwfhY7g/rLd7yYA3awr341g38t4C7
MD5 SHA1 SHA512 SSDEEP

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe
Size 5.4MB
SHA256 946e45650cbfbca28d7273a04754813109a9eddf4db5010112b29bf6e3646b5b
MD5 314686d8e8d569e3b6b2c7a9a15a78b8
SHA1 7b16fb583e6a9728720bb6b755a896319afbaf1a
SHA512 fba971f56e026b47b740702ed44c41b4fab45a816acdde91cbed8a595e4c92fcf0b112eeab7d61f402e3afe29401da1ff9033eb6bc803cbe5cf6aabfcd58a382
SSDEEP 49152:q0kwIi7c4xZlm5knEtw99Kn/2vim7vgv6m+yyJ/0gbvjR7yY7BHi3u7L/gBUUWLo:cwfhY7g/rLd7yYA3awr341g38t4C7
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe
Size 2.0MB
SHA256 5e4512f3a56a278fe1759c2532ebb96618d59002df8cf0e9b1977a2b7695e8eb
MD5 d94254c114fbd47a205ba68e69cad1fd
SHA1 7a2f144a7fa824edfb1a494c4a04b76dae8cb41c
SHA512 d89c57259e447ae1bf10550edce523f0a8b6ff548ab9f983858a12fde7039398e3b93f311ee5e3e34985a10041adca38920e5caf3a4baee8118bfb0c8cfaaca6
SSDEEP 24576:McTyYv0FteQU+5I2kjgD6iQacAc1N3RUDHNmdPCAaq8Nozgi/rE0TOj:MuXv0Ftpn5606zOU8HNUPCAaq8Wdo0
MD5 SHA1 SHA512 SSDEEP

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
Size 2.2MB
SHA256 3e4796fcaf951ad10deced45ee1a1e1f7e2dc12c8b5e02f738f75f3a5d3a4ebe
MD5 8a598f64dfb26ebba7bb92e18c343571
SHA1 e51ffbfa22bec0b3eebf3ecd5822b433e642491d
SHA512 e559f7cba1c548684ab4266fc258cedcaa697599c44e82363136f6bc56cf18deab96245bc2947b2810712fb853f402e68ea751c79c4fe3d56096532a58b1e1ab
SSDEEP 49152:my7mTd0GxN8jyynxHjXKUyn4GVcbDSKrNTxg8HNUPCAaq8Wdo0:NmYeyxHjWjMTg8t4C7
MD5 SHA1 SHA512 SSDEEP

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe
Size 1.8MB
SHA256 6b775673981b75d9372ac13c5acf873633cbe51735d1ba349202ce66ec96b894
MD5 d5470ed20c5bfd23c891907547f952ce
SHA1 30ba4c6c2a53d4e4060ab88d747d45ddc77d14e0
SHA512 306c2f88b696c72783b182c9e6110c6340fd1f0f98406c450a9871ad29ac65f19b498518834fa82d9ace001353ff9de09f092fd9cb5068cd173b5bd17e8ec05e
SSDEEP 24576:H6drZn1WEci182IEUeNbJeRgUebgW816x1N3RUDHNmdPCAaq8Nozgi/rE0TOj:HWnDci18yNNUgbY88HNUPCAaq8Wdo0
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 1.7MB
SHA256 54b39256965ddddc44d16f98364121056685315e493664194acb5d7a9989a5c3
MD5 a7172944fe94ceb3fabccd4ee6a109f1
SHA1 d0d98a47f5e671a8be0393afe0127425a6d1fac0
SHA512 08d4b2fbc01ab4be4b00acddb2c58b4aa28481e08b956f5ef9ff5bf60d732cad2e0cc0c02d42255b89036812165bc44887a4fad3440fd3bfde9261b9240b3f4e
SSDEEP 24576:lk5lHW5EzMZupO80G2reD+melRgTTv/1nyG1N3RUDHNmdPCAaq8Nozgi/rE0TOj:BizMZm0GhamSoV8HNUPCAaq8Wdo0
MD5 SHA1 SHA512 SSDEEP

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 528a1108cc4f786816846507e8aa6b387108bc25a6524305069054c5ff7c8ece
MD5 26d41cd01f87fc10b8fd0044010d8a47
SHA1 dc67f34b63748f556f6fe363d55e171322fbdd14
SHA512 05f309d50b4c70f3b2c3fcb5f476291b0a19e161e5c417e7f7f222fd8d1df5cbdf33e35ef0acec4f20cf8696cc40db0a70ce1deac1faefd7822d03927fc1f645
SSDEEP 12288:J13FN92mrRUDkDTYNmN3Rus3SAFYq8Noz9qirzrEX1fsd7TOoOTd:J11N3RUDHNmdPCAaq8Nozgi/rE0TOj
MD5 SHA1 SHA512 SSDEEP

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 dbebe1ba9a352c918f5e0701ffaba94501caf024c17f1733901855692a0cc58d
MD5 302614deed11bf47c81d0f64992e1cb3
SHA1 7db4bacad0d0e3a48aea02b7e395793ffc1b6d79
SHA512 92d355bee4e8c6edce89a6f872658ef9aceffdbad0f3ee7fbab024dd40df2e4646ac15f696160b9c7dbe7b4a346d321733310523a76e9533e52a1297db918e9e
SSDEEP 12288:Hk3FN92mrRUDkDTYNmN3Rus3SAFYq8Noz9qirzrEX1fsd7TOoOTd:Hk1N3RUDHNmdPCAaq8Nozgi/rE0TOj
MD5 SHA1 SHA512 SSDEEP

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 43caa2aa4239580ad256919cc97bd3be76b142e80feed693bf3f989d2adb78e7
MD5 92c0c8327f64ce787e5c92a2a48d9620
SHA1 1d0de8c95b70506b747d989c998791d155a51777
SHA512 a4a95346ee109ba11c4b288d3eec94d02965704933b2a2dcf4f461a49366c5398bf17af2893672e0f09a5250138519905d42fc030212c6651fa1d54f9f7fc951
SSDEEP 12288:3i3FN92mrRUDkDTYNmN3Rus3SAFYq8Noz9qirzrEX1fsd7TOoOTd:3i1N3RUDHNmdPCAaq8Nozgi/rE0TOj
MD5 SHA1 SHA512 SSDEEP

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 286800ce397ff25a1325ca98ccb7b36ae7ea3e5c73e54eab1a2870bf0d8bfcce
MD5 d9fddda0630dcde2334ab60713dc9bd0
SHA1 bd28d0061ba79492acb4e9ffd51910a8076955ba
SHA512 3db10b77a1458d076fcd6ce4ec43162b0eea5f082636c3baef04355efe7b277986c698d1cc853cb3ad1d10e8f8be502bcace68e77e626364b46d09d299bf4595
SSDEEP 12288:bVD3FN92mrRUDkDTYNmN3Rus3SAFYq8Noz9qirzrEX1fsd7TOoOTd:p1N3RUDHNmdPCAaq8Nozgi/rE0TOj
MD5 SHA1 SHA512 SSDEEP

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 b9b67592c6761f774eb7ce1963530a72da8a62dc669889fcafe14b8be07b5752
MD5 6a9f6a071e8c393c6cf209779314f00a
SHA1 7eb36a8c3cf18503ebd2688a5ba392f0987455ea
SHA512 60541b2f9f85d73b7e9f876a34912988f3ed68532048204796a72bb016f4be67dbfcbc5d4966a73e9008d89c6a95989544cea868ad31ccabc61eb37991d7ea09
SSDEEP 12288:6r3FN92mrRUDkDTYNmN3Rus3SAFYq8Noz9qirzrEX1fsd7TOoOTd:6r1N3RUDHNmdPCAaq8Nozgi/rE0TOj
MD5 SHA1 SHA512 SSDEEP

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 51634ca3da60742b9381248d3776cfc131d30b86a361d72a9c03d07a02181b77
MD5 32273bc79fdfafc49df0d88087626213
SHA1 e74075cb1796dd69fe99fe9bbb7e2818f46807bd
SHA512 395e6a81ccf86b630e110a95b2382a322e6a3ebc418949504cc5b3c8662c7ec1fece24b1f053ed859ee064477f85d487c4559c2fc49b39800873b6b5e0194422
SSDEEP 12288:tw3FN92mrRUDkDTYNmN3Rus3SAFYq8Noz9qirzrEX1fsd7TOoOTdO:tw1N3RUDHNmdPCAaq8Nozgi/rE0TOj
MD5 SHA1 SHA512 SSDEEP

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 96024825fce776f55cfa20e537a16eb8c5851e19cc95a449ccc8949c00e16678
MD5 5a29b6135cbb4a700fae8105a68aec61
SHA1 b72854df170935026dddf8f3886c05f79bef1be3
SHA512 ae941f0d550b9048826dba99561a4825e6f20558bdfe75bd63bc3158528005a61ad43d81bf15954f5995809968907b341d49af1a85d7558033768f8497f43ecd
SSDEEP 12288:Ks3FN92mrRUDkDTYNmN3Rus3SAFYq8Noz9qirzrEX1fsd7TOoOTdm:Ks1N3RUDHNmdPCAaq8Nozgi/rE0TOj
MD5 SHA1 SHA512 SSDEEP

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 2ae5493bf78caea10550f3550bab00541a4e4e2f7907d5dc4dcd979be4237287
MD5 b466d0b6120682f9d911d8d13a29c059
SHA1 0345ca39cf495f831422482e17659a1a565ee2b2
SHA512 9a8fdb3273b6f297338fcb4aa93824584f1956e55f8701c606fde147302bbd87e979dea01b0f1f2c23ebf197737aece14eeb4c2a619b8a8ecd4b7a8cdf2114e9
SSDEEP 24576:3ZMSzFVSOE1N3RUDHNmdPCAaq8Nozgi/rE0TOj:3ZMSzfY8HNUPCAaq8Wdo0
MD5 SHA1 SHA512 SSDEEP

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 f3f6dd75301c4e96502b14deaaae535cf04d9bfb7870a322ff2f1113d9bf514a
MD5 a4e11e4747f7b669dc10549a9d1f6336
SHA1 9e3eff31d0494e29e6896a5fa19be429b96f182f
SHA512 1db2eba7c64b1118ac0650524cef4e44d8590218d3a469f4d7ddecc2883fb17c8af37b348401b64b2673a47afa0afd689c85ee4b19c65de060ffbee0788196f9
SSDEEP 12288:eZ3FN92mrRUDkDTYNmN3Rus3SAFYq8Noz9qirzrEX1fsd7TOoOTd:eZ1N3RUDHNmdPCAaq8Nozgi/rE0TOj
MD5 SHA1 SHA512 SSDEEP

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 0a7549489c00030188d4b309bfe65d66e9bad1a4d11244368f577bcdb8401e08
MD5 13f5efa4cd2ed0f7341d74c2eb54e413
SHA1 ea0b2fc8fb4a6949c78bd50855a0c83de51c10a0
SHA512 9793877637157284ab79de9b7032869af3a51c95b22d6e64d4941780d0f99399e0727f6dc5ef054d4781a0939703d8f841f88eeb51b4194d310f289c1e0ef955
SSDEEP 12288:4t3FN92mrRUDkDTYNmN3Rus3SAFYq8Noz9qirzrEX1fsd7TOoOTd:4t1N3RUDHNmdPCAaq8Nozgi/rE0TOj
MD5 SHA1 SHA512 SSDEEP

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 a5f841152733cb46c9c63ea7129ebd2ba0af047af7cbec200e32673559cc3d52
MD5 8c62392e111ddcfad2b3482d5cdfd6f3
SHA1 ad777f068c5d6fe1b2f58ce421962cd6d3e86d89
SHA512 dadf4219389492720bd33887c78c871ece1eaad91c8dc647aeba16ccf4014ced9e4d2b4cd9b57f1bc0c28346bb642d4a7e4dcbbc8b06167bf418952ae84b8e64
SSDEEP 12288:5yPz5L8I3FN92mrRUDkDTYNmN3Rus3SAFYq8Noz9qirzrEX1fsd7TOoOTd:4zyI1N3RUDHNmdPCAaq8Nozgi/rE0TOj
MD5 SHA1 SHA512 SSDEEP

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 2f6ed1fff0233aae607141c1e58e60ad47131e4f3d1622370220f6e1d602fad3
MD5 a7d1c65fa59c339a0fbf3780a00d8ec4
SHA1 f8823a2583b99f54de141a24ac67416e36b2014f
SHA512 c910bf9a453075ec5acd6291251065c89e6616b2ed6ee83f5682e0532f549f553d08d88c74772cb4d8f91e1dd2b1bb8ac4087521a45f33ceb5166d6739f29980
SSDEEP 12288:9Z3FN92mrRUDkDTYNmN3Rus3SAFYq8Noz9qirzrEX1fsd7TOoOTd:9Z1N3RUDHNmdPCAaq8Nozgi/rE0TOj
MD5 SHA1 SHA512 SSDEEP

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 1259e80a412e0244fcdb7988a6056bd3765af1e1c2d521d6d58380ab59199f65
MD5 67620042aac297a1f4bf445a95b135c4
SHA1 80467d9eb0a983d9e2817f9c857fa2308446464a
SHA512 4f5dfab25c64e8e5eb90be8932d0586e5ce962d4bcc0cbb0d7943fac7cbba3abe719f9183af1b14b9dbdb5379efece6304fb3c7759cd291464a0de5b9a362cdd
SSDEEP 12288:3Z3FN92mrRUDkDTYNmN3Rus3SAFYq8Noz9qirzrEX1fsd7TOoOTd:3Z1N3RUDHNmdPCAaq8Nozgi/rE0TOj
MD5 SHA1 SHA512 SSDEEP

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 86fae9a01eebe76891638637a1b10627c51553d695e6d38e1360e1f677506ca6
MD5 67cd15166252acea77f0a21a023e3739
SHA1 a353c4dc2f8bd80cd339091f490ca636510b8c22
SHA512 f74c3d0ece39b9799ea59bc12b46938df118ba926b07ce5b5fe3fd7c0414ad38c897f43a009d81ec378c68ec824d7a1d8a0c78f7f7789c2cda8880bbfea7e744
SSDEEP 12288:byPz5L8I3FN92mrRUDkDTYNmN3Rus3SAFYq8Noz9qirzrEX1fsd7TOoOTd:WzyI1N3RUDHNmdPCAaq8Nozgi/rE0TOj
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 4037d638738964a5c0beabd0ee132b740b2295a092b394eb04ef1c54f3c97a7d
MD5 978d1e4c424d0708f5530cc5e6cbbe4e
SHA1 9873fcd418046481975fc4c2d64b4ba292ff1292
SHA512 d5577144cd4be20cd4df4da78a879046427aa02e6f92892d7f40a7e9abc0574a0e45db385247d3d1d6db57567ba8ce43f2cc3ce623cf7a8e2a61d5744eb7af0e
SSDEEP 24576:qTHaLl3z0zDy1N3RUDHNmdPCAaq8Nozgi/rE0TOj:qT6Llj78HNUPCAaq8Wdo0
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 c89c5bce57a349d891b422ef2189f0657efc0b07caeb7fde37a549c5b4613b1b
MD5 40ca79b24f00b76565c5eaa0305d407a
SHA1 4bc6e5e91ffae3dc5a64395fe0c6dee2ed015f9c
SHA512 be3f3aad366301bfdbd921d36f8727ce968d75a891886a15390552db209f7c47d0bc9e468cacd5c5abd6f57b1004974fc175ca81d10725c19ff65a63025abf89
SSDEEP 24576:i37d9CHKy7GZO1N3RUDHNmdPCAaq8Nozgi/rE0TOj:E7d9CHKyaY8HNUPCAaq8Wdo0
MD5 SHA1 SHA512 SSDEEP

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 00fa27fb8ea2820bad29d22bb1ac26316317f11f182a2d9f5f58027fea9a2d03
MD5 be38f43ffede0b7ca6d2128c843f9887
SHA1 715d239e75932ffd70e8a62d1e6ab42981c98ee7
SHA512 4ea46682183b8e79dc3de5a08e6b7443600b157e5978c54e34e0d6872cc5e72e9c893f66bb75a1f52a67e1787045761722da54f3c9d96b5598a1de13f812dad5
SSDEEP 24576:mcP4mcvIjkGOxhKP2l71SNKbrh/8KBB1N3RUDHNmdPCAaq8Nozgi/rE0TOj:hP4m4IpOO67N8KL8HNUPCAaq8Wdo0
MD5 SHA1 SHA512 SSDEEP

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 701KB
SHA256 1b44c84b08e69e47f780e2eaa1a5750baa7a6df3405d2ae2b9bfad89b4f98c86
MD5 e9b355f9451d514aca927ea4bc525411
SHA1 fc2f73d833fa77fb1e04893c1ef9c7124a282f95
SHA512 fed57920df49b9240cd92dfe1721b745b40e522de4f8ace0d190f987ab01edd50a22df84c43a24eff01efd8bdbe9457e8ce62cc9be20843b6604a147ca47951c
SSDEEP 12288:hUFmDDLe3FN92mrRUDkDTYNmN3Rus3SAFYq8Noz9qirzrEX1fsd7TOoOTd:le1N3RUDHNmdPCAaq8Nozgi/rE0TOj
MD5 SHA1 SHA512 SSDEEP

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 077f550a41a78478e44e79bb866cfd0e90fe0f4ef785b8cb3058852ee5c9bc13
MD5 90672deb3c1bcf4b802275b203908429
SHA1 c07ff3608974894b58e9c77887db42f52802f6d7
SHA512 efaa5197cd0aa7399acb134db20ecbcef55398ff86bc02edb647b2a3e7609aed165fa8c9d44250fed1de9bb0c53879e278727aadf3fde7681b59d3109342f487
SSDEEP 12288:bJ3FN92mrRUDkDTYNmN3Rus3SAFYq8Noz9qirzrEX1fsd7TOoOTd:bJ1N3RUDHNmdPCAaq8Nozgi/rE0TOj
MD5 SHA1 SHA512 SSDEEP

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 8ff30aa0e1f39b41158bae2be3c5c1d844e099a608657e7d329185b51ff982f8
MD5 d1664cedba4b38c3922bab44ef605c93
SHA1 7a57cdfd900bde6137084de23cb0786b226cd970
SHA512 95c107fa7415edf6025a51f0c23d88f861af914de8e405c5b0b87a4169f5bf190de22b9b7f371185e08870723447b9470de9c9dc2809ce7e2a3332159e496e24
SSDEEP 49152:4a0h2GEkuAe73q3pp46zwwQn8HNUPCAaq8Wdo0:4a0hNYG4Jw48t4C7
MD5 SHA1 SHA512 SSDEEP

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 659KB
SHA256 643e8deed1cca509a6e5cb884deb35d88de37f5c07a35eb486e4a8091abef581
MD5 23a959c386eb796286b7ea6eddf9da17
SHA1 a7662f48aa65d3f294b7efd0f3e6c893bc9496d0
SHA512 2888193a004a2869e8ee5c4c640a32b010094c2359fcfa69210085c57d9958cf846652ce8913ebb3cf78bd09ba7ee74dc9467ea0a9eda2744a9de05dc3f30487
SSDEEP 12288:fhbHjfX03FN92mrRUDkDTYNmN3Rus3SAFYq8Noz9qirzrEX1fsd7TOoOTd:fhbHjP01N3RUDHNmdPCAaq8Nozgi/rE/
MD5 SHA1 SHA512 SSDEEP

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 521ef0cc5adfe97f3381e783aa9429b1e21d391e6275795106ff95b7d0b2a974
MD5 2abcf4a8bf330700b4b4d675838feb3a
SHA1 25af7b2c528a0db8bbd79504bc0feada6c71e8d9
SHA512 3635129b236e53e50e633afa8291dff6fbd54b8d2245afebcc79c971850034a4d1a5d70a5f177dd6dfe6125be768ca7dc2f4472f79efbcdd0d068c5eb71b605b
SSDEEP 24576:S3YgnJcRTk4yti+R5dpR/c1N3RUDHNmdPCAaq8Nozgi/rE0TOj:SIgnaTk46ppR/U8HNUPCAaq8Wdo0
MD5 SHA1 SHA512 SSDEEP

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 578KB
SHA256 5d27ae39fec5bca13bd822eba7ead2f6bbc2481b12e13bbb2aa4a98575426888
MD5 8e26cbf8976ee07168d658e1cbb6d6b4
SHA1 24f22908626c6e7bc251bb0b423d1e885b050ab9
SHA512 1276d4354830b9f5dec3fbdf88698141da9adb74ac7df804347a3c17e30d6c4a896cf3d998398077f428f4fc47a74eca2ec9056c1fe732d028241e575f894900
SSDEEP 12288:nd3FN92mrRUDkDTYNmN3Rus3SAFYq8Noz9qirzrEX1fsd7TOoOTd:nd1N3RUDHNmdPCAaq8Nozgi/rE0TOj
MD5 SHA1 SHA512 SSDEEP

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 940KB
SHA256 f776ff5bdc9f3719f4b796c6f607f18cfa456b39431d13a750647977adbe417c
MD5 267af5a5484a9cccc4d61722e86ef175
SHA1 526679607d74e3002d48cb03b4ea3d06a75bc37b
SHA512 633e376996d63af43fe90dea032515804958eb81e9ddb2430030ff4b7d3d0d63bd6003016fc047578ccb9277d3f59797f0a2ddd247fb31e1be2ff62e32ed8b51
SSDEEP 24576:YpL3UT21N3RUDHNmdPCAaq8Nozgi/rE0TOj:YpL3UC8HNUPCAaq8Wdo0
MD5 SHA1 SHA512 SSDEEP

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 671KB
SHA256 02a32b6fc1d72bd1355901dcacad31027d95fe942b52eb5f51f47e5ca6d19e7c
MD5 61e82adf4bde4a8c7e15e82199375cc0
SHA1 dc20ae09cfb12050250c62f9c4a1cefad80413d6
SHA512 09be7618974a2c2cd2e6aca58336fc75ca46a72e9c2c6db1e072e98860218587c3859530f6ddd5d3414560a8b72cba837fecf98edf946b26dcc7190ae85fa36c
SSDEEP 12288:npFtpOK3FN92mrRUDkDTYNmN3Rus3SAFYq8Noz9qirzrEX1fsd7TOoOTd:LOK1N3RUDHNmdPCAaq8Nozgi/rE0TOj
MD5 SHA1 SHA512 SSDEEP

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 3602eff3c57af58f770e78465b35c3106fbc1a9eae99cd3cf6dc5c3dcedfad0d
MD5 71e9bc5effe336fba1d31c094c68b841
SHA1 9c36e666bb8ac86b1a974710ce747454b74ea2df
SHA512 26b163b5bda4a289dc01ae66ef6dc5f6214b25f8700b9cd20c0ac04b90548cfb85e3efc41df62f5b99b15e7b6d9f065673fcbd8ce2bbfcb8ddcdbe91b7c33605
SSDEEP 24576:m7NM9YmZqmWMUkPjZM48Mv6bEhsZ1N3RUDHNmdPCAaq8Nozgi/rE0TOj:m7cBWMpPjN8DbEhc8HNUPCAaq8Wdo0
MD5 SHA1 SHA512 SSDEEP

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 f3266b88a84d0ea89af32c5a5e303aebf73b3482aaabceb32ebc2b106ab45d25
MD5 e4a19f13132ddcc4ca1db42bd23caeef
SHA1 02acd01ea4e792449bbc2595b4615ec7d84071d1
SHA512 12507d5871d673cb0a5d5221c9fd15e65d12f8057ddb7c069e58b7cc102ad636cfbb05f100a3acb7ee4e9f48faec7bcd16c6d1c69b35a5ebe063827c7737970b
SSDEEP 49152:FF2YuHNETovcvNYf8kmF8HNUPCAaq8Wdo0:g6tCf8ki8t4C7
MD5 SHA1 SHA512 SSDEEP

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 061c488a3837e0ed4a726a0a40754ea8523311c6df37c42e295a0788ccae548d
MD5 5f1decfc7ddc6f8f01619a58719dcf56
SHA1 c8782fec7fb5e55d913f7d67690c39ae85c9d2a0
SHA512 e7d122f1e7d7efc96f4f0a56933da2a5ac1496ca9603153731a7551d0c12a2a821d2b4f77d395e489bdaec0140ae68a8b8987f71193618429cb9acfece1a894b
SSDEEP 24576:/AFs06+Omlf3NXEbToO1N3RUDHNmdPCAaq8Nozgi/rE0TOj:IFs060lVXuH8HNUPCAaq8Wdo0
MD5 SHA1 SHA512 SSDEEP

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 885KB
SHA256 2836906d5f36f90dc012d8a2fa2516978e188252d72652f5e8f1425b1a6dc033
MD5 fb46f25c41d0608bf7a594fa62a29ef7
SHA1 656bc309e7f9af578a85553f26633d0927f2a8e0
SHA512 444ac9fbc466cc198d60399d2061b55381e3c91ec47e4b3db5657249a03047e781ee67aae547813d3caa38c2c77345ff54a4da704ba4a32702efe68a6864fb33
SSDEEP 24576:NJnJ5D3WtL1N3RUDHNmdPCAaq8Nozgi/rE0TOj:NJnJ5DGtH8HNUPCAaq8Wdo0
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 6ab4e7edf3dce9bd6c6f79087c1c08953654003e0dfc12708c409531bbe7fd1c
MD5 dbf4fbf1b25bbe69ca2662b8e5248561
SHA1 072b43aafe21d474139be48d29952f16a9dde4f9
SHA512 6ea86a3d0aae1e44f5a6d05b5a15048c65124714f2d70ca7643fb4af0d172461d61a785c99907d44581696f138c1ac4e33a0236872d1cc51d748f812123a7c48
SSDEEP 49152:Ho06DIKdwc+eQnSt65aVh8HNUPCAaq8Wdo0:IT8t4C7
MD5 SHA1 SHA512 SSDEEP

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 661KB
SHA256 186eb771c196971d857e3206e08e7368134e276f72363a6910feb526f4f4d9bb
MD5 55bccf5c1a269d28e72125e54a8bf16c
SHA1 a881f7a9796c86a9796e92fca6e20ef34b29ace0
SHA512 e2cf6caca8c63f98e3d595adf1fee9b3e90320f8c65d502713066788bd2b7117b9474c23982adef929cc95f0ad57300263fdb5a84ec96a16c640e08a651f17f1
SSDEEP 12288:XEP3RrP3FN92mrRUDkDTYNmN3Rus3SAFYq8Noz9qirzrEX1fsd7TOoOTd:crP1N3RUDHNmdPCAaq8Nozgi/rE0TOj
MD5 SHA1 SHA512 SSDEEP

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 712KB
SHA256 87df33e70dd477f364d3af77aa23b0427faa96b68fcef0f74853d528425c38de
MD5 aba297d482d537c875eeb765b356c352
SHA1 34fb415202c3691e0fa1c6fe7d766e97b48feda7
SHA512 24387d436a53be956a1d211e8fc4eda0e346269c53e6ebced5385fe4a716d6fcbd92e91902186bb4a4b010e20a96f32f924762189059e1d9178448e5e9b73ca2
SSDEEP 12288:sjkyk3FN92mrRUDkDTYNmN3Rus3SAFYq8Noz9qirzrEX1fsd7TOoOTd:sIyk1N3RUDHNmdPCAaq8Nozgi/rE0TOj
MD5 SHA1 SHA512 SSDEEP

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 584KB
SHA256 fca3f5447e1d84de39b9bc016b1df5266b67dba3c048f781810cf2a07e650fa2
MD5 51639f3a239b1c200a9a8403896a62fe
SHA1 4002134f023f2fe2812c4ab8a96d6a833dc047ff
SHA512 c7cfe8deb4d32510e797678a71beb798740cebd6278262b0ad2a74e3abd00eda86027748f459835ccf959e3481e561749fa5ae90445d8cbe53e6afc005702d45
SSDEEP 12288:GF63FN92mrRUDkDTYNmN3Rus3SAFYq8Noz9qirzrEX1fsd7TOoOTd:E61N3RUDHNmdPCAaq8Nozgi/rE0TOj
MD5 SHA1 SHA512 SSDEEP

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 e04fc0211620d8efc8c37b2a87024d5482f5e2404a4b912e0ea9b99e9a149d44
MD5 7735911b08091a759195f6ef6638ac9e
SHA1 2dc1892f7085e36962819e712cfe6b661f5abcd5
SHA512 23f574ddb8bab47ebafbbde434cbd399f9fe7cd327e2993a72cfed0a62f8ce4a548b82788f4fdd4892522a1d6a9c7679a193055c9b6724d238cc9f2390cb52ac
SSDEEP 24576:mQ9MxZKdcz97w3R1N3RUDHNmdPCAaq8Nozgi/rE0TOj:mVKXN8HNUPCAaq8Wdo0
MD5 SHA1 SHA512 SSDEEP

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 772KB
SHA256 0e1289050bff2bd9d21618d7d7e03ab55f3f7f54b5a6d216bd9c6eb3bcc95121
MD5 b788c11456dd7c3d8afea4df58d3f3f8
SHA1 56c5046651d1f88682c6446a3ff5baf754161424
SHA512 f727f6bb994be41112e45ef34e3adff5d18693866c18ce3739c5e1229e1deb06e91a4c15030ef75d6c85b54d27e5b53ed21552e3e83ac5afdf0df83b1f408e59
SSDEEP 24576:EyocxApY1N3RUDHNmdPCAaq8Nozgi/rE0TOj:5ocxApg8HNUPCAaq8Wdo0
MD5 SHA1 SHA512 SSDEEP

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 59c884e0061c579ae7ec3acdc7cb39b6adf49a3a0cb7024520ebafe3d2f116ae
MD5 bba80927cb220d825fd5ae27a6181af9
SHA1 f8c466ae4f359c7406cc5ca470d0e3ca77e9ccea
SHA512 7d87eefb03dd86ff7e2dd9b3db5c408766f9c62e6f47f4d2692a3ce08edbffd55ac820d32bf88e1497b373c8abe38b51b0750d373a6043bf01210443655a05a6
SSDEEP 49152:0WcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIKg8HNUPCAaq8Wdo0:e0zuNIk8t4C7
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 3fad3d062959ee8ea516e0491d98d656baa90b9bdd0d2db1400c2bcd6a2bc93d
MD5 ac7361ccdd4e5b5911c57312478b3be9
SHA1 f349958313786bfa0b3664f6e06f4bded3277753
SHA512 d3e59c2c51f2bc6a170b6da5d04829991abba1c07e9a7ea46234045352bd80b10ad25095c5b2e8e8ba504b6555647231b81aee60c6c3270d41f4755b12c81541
SSDEEP 24576:N1QT7EcpfxR+N5AWAz3ooiYtjMqbP1N3RUDHNmdPCAaq8Nozgi/rE0TOj:4TDxR+N5YzTfjMC8HNUPCAaq8Wdo0
MD5 SHA1 SHA512 SSDEEP

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 877KB
SHA256 0b7b097e16e9adb07324c251c8b1c1221593b72c584350c7485b20df777b9fc5
MD5 6d42f805d15e48adfde6a4aa59a36d9d
SHA1 a5adbbf9f524274f5b5dc33a32efdf562eb94ad4
SHA512 05d51e893a00f3e431ef6f463a7b33328e6ebb32af11c8986c4a7a921dd63208e5f4dd34e342fdeb1d579ec2e36dcfffeb7dbc87b8806a8a299aa2acdd97b113
SSDEEP 24576:HTMdOz0FFS+imSLD1N3RUDHNmdPCAaq8Nozgi/rE0TOj:10K+imSLv8HNUPCAaq8Wdo0
MD5 SHA1 SHA512 SSDEEP

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 635KB
SHA256 18089fdf01c752bcf4817879dbd9c925541559e4fcdbe8b51c926f88d1b0bd72
MD5 bbef376710edf370a0bab06a1a96ca82
SHA1 37aabf169f717345716a0a0ec53ab77cee276505
SHA512 af6332d5ee3ffb1d57d9220a0a236e1ac1ed24b06cd18d143bf1fd54d411e4a6900667b59bbb13ce9ccf9eae8810b1894ab772c0edcca638151c4243cce3964c
SSDEEP 12288:f4723FN92mrRUDkDTYNmN3Rus3SAFYq8Noz9qirzrEX1fsd7TOoOTd:q21N3RUDHNmdPCAaq8Nozgi/rE0TOj
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/8-567-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/8-198-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/388-233-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/388-570-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/404-236-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/404-124-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/920-266-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/920-139-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/1004-31-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/1004-25-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/1004-33-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/1004-138-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/1004-32-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/1156-89-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/1156-90-0x0000000000D80000-0x0000000000DE0000-memory.dmp

Download

memory/1156-209-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/1244-218-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/1244-222-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/1748-101-0x0000000000400000-0x00000000005D9000-memory.dmp

Download

memory/1748-6-0x00000000008B0000-0x0000000000917000-memory.dmp

Download

memory/1748-1-0x00000000008B0000-0x0000000000917000-memory.dmp

Download

memory/1748-0-0x0000000000400000-0x00000000005D9000-memory.dmp

Download

memory/1768-282-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/1768-578-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/1808-135-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/1808-248-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/1936-162-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/1936-453-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/2168-80-0x0000000001A60000-0x0000000001AC0000-memory.dmp

Download

memory/2168-74-0x0000000001A60000-0x0000000001AC0000-memory.dmp

Download

memory/2168-82-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/2168-86-0x0000000001A60000-0x0000000001AC0000-memory.dmp

Download

memory/2168-87-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/2256-531-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/2256-187-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/2724-574-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/2724-255-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/2728-269-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/2728-577-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/2988-71-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/2988-69-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/2988-186-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/2988-63-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/3592-19-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/3592-11-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/3592-20-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/3592-134-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/3964-38-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/3964-37-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/3964-49-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/3964-47-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/3964-46-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/4168-102-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/4168-232-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/4492-476-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4492-174-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4812-158-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4812-548-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4812-281-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4836-58-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/4836-60-0x0000000140000000-0x000000014024B000-memory.dmp

Download

memory/4836-52-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/4836-173-0x0000000140000000-0x000000014024B000-memory.dmp

Download

memory/4980-571-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/4980-237-0x0000000140000000-0x00000001401FC000-memory.dmp

Download