29c035715fedd8b8790b728142be254f50be2d8fccb911387d1469c5877fdfcc

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
08/06/2024, 12:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-06-08_651aec3b8a10ea2c90779adcbcff6287_bkransomware_karagany.exe
Size 677KB
Sample240608-pyjaescf56
SHA256 29c035715fedd8b8790b728142be254f50be2d8fccb911387d1469c5877fdfcc
MD5 651aec3b8a10ea2c90779adcbcff6287
SHA1 288e0a941edde6a24eda96ebc6aab383a8931397
SHA512 445103da46b69185f2e6b0a269b4feffa14ae18fc33e3c0d5e88f19aacc85aa670482917cdbf1437b72e2199a3effbd9db197a35b02a01887bb4c3ee944bb546
SSDEEP 12288:PvXk1GLD7bHVKMQ4O4vSjNsyMLpRNO2FLzTGT/SRel8lkEoiqAj:3k1GX7bHsMQ4/O6yMLprOInyT/Swl8Mg
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
4420	alg.exe
1532	DiagnosticsHub.StandardCollector.Service.exe
2236	elevation_service.exe
60	elevation_service.exe
1088	maintenanceservice.exe
5092	OSE.EXE
3192	fxssvc.exe
4508	msdtc.exe
372	PerceptionSimulationService.exe
3692	perfhost.exe
4600	locator.exe
5080	SensorDataService.exe
3516	snmptrap.exe
1768	spectrum.exe
3992	ssh-agent.exe
452	TieringEngineService.exe
2348	AgentService.exe
3976	vds.exe
3520	vssvc.exe
412	wbengine.exe
3456	WmiApSrv.exe
1552	SearchIndexer.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in System32 directory 28 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2024-06-08_651aec3b8a10ea2c90779adcbcff6287_bkransomware_karagany.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2024-06-08_651aec3b8a10ea2c90779adcbcff6287_bkransomware_karagany.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\7edfaf541ed82f9f.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2024-06-08_651aec3b8a10ea2c90779adcbcff6287_bkransomware_karagany.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2024-06-08_651aec3b8a10ea2c90779adcbcff6287_bkransomware_karagany.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_107921\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Install\{38ACDD0D-FF02-4A34-B36C-7A103582B8C1}\chrome_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000455792c9a1b9da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008c4be4c8a1b9da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006ef670c9a1b9da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000047fb13c9a1b9da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000033352ec9a1b9da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001afcf4c8a1b9da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000077b994c9a1b9da01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000077b994c9a1b9da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000033352ec9a1b9da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005aaee6c8a1b9da01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000066e61fc9a1b9da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9933 = "MPEG-4 Audio"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f8a943c9a1b9da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
1532	DiagnosticsHub.StandardCollector.Service.exe
1532	DiagnosticsHub.StandardCollector.Service.exe
1532	DiagnosticsHub.StandardCollector.Service.exe
1532	DiagnosticsHub.StandardCollector.Service.exe
1532	DiagnosticsHub.StandardCollector.Service.exe
1532	DiagnosticsHub.StandardCollector.Service.exe
2236	elevation_service.exe
2236	elevation_service.exe
2236	elevation_service.exe
2236	elevation_service.exe
2236	elevation_service.exe
2236	elevation_service.exe
2236	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
656	Process not Found
656	Process not Found

Suspicious use of AdjustPrivilegeToken 40 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1460	2024-06-08_651aec3b8a10ea2c90779adcbcff6287_bkransomware_karagany.exe
Token: SeDebugPrivilege	1532	DiagnosticsHub.StandardCollector.Service.exe
Token: SeTakeOwnershipPrivilege	2236	elevation_service.exe
Token: SeAuditPrivilege	3192	fxssvc.exe
Token: SeRestorePrivilege	452	TieringEngineService.exe
Token: SeManageVolumePrivilege	452	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	2348	AgentService.exe
Token: SeBackupPrivilege	3520	vssvc.exe
Token: SeRestorePrivilege	3520	vssvc.exe
Token: SeAuditPrivilege	3520	vssvc.exe
Token: SeBackupPrivilege	412	wbengine.exe
Token: SeRestorePrivilege	412	wbengine.exe
Token: SeSecurityPrivilege	412	wbengine.exe
Token: 33	1552	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1552	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1552	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1552	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1552	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1552	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1552	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1552	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1552	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1552	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1552	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1552	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1552	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1552	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1552	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1552	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1552	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1552	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1552	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1552	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1552	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1552	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1552	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1552	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1552	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1552	SearchIndexer.exe
Token: SeDebugPrivilege	2236	elevation_service.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1552 wrote to memory of 4688	1552	SearchIndexer.exe	119
PID 1552 wrote to memory of 4688	1552	SearchIndexer.exe	119
PID 1552 wrote to memory of 4304	1552	SearchIndexer.exe	120
PID 1552 wrote to memory of 4304	1552	SearchIndexer.exe	120

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2024-06-08_651aec3b8a10ea2c90779adcbcff6287_bkransomware_karagany.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-08_651aec3b8a10ea2c90779adcbcff6287_bkransomware_karagany.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:1460

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:4420

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1532

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2236

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:60

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1088

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5092

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:2912

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3192

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4508

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:372

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:3692

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4600

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:5080

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:3516

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1768

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3992

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:3084

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:452

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2348

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:3976

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3520

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:412

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:3456

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1552
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4688
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 804 808 816 8192 812 788
  2⤵
  - Modifies data under HKEY_USERS
  PID:4304

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
Size 2.1MB
SHA256 37a9d4871bd2a6e3eea0498d85d12d43b85da0ef57387452706cb6ab7b9b8f57
MD5 764b264d8a38db5adb8fed8f30fc5025
SHA1 a1feefa1c934842c672a55c511b34467c6bf5804
SHA512 d8e5e309bfc50b56bcbadea09bb01c708bc95226cc5bd534e935a9578b754ee98e4ecb4774b63523d22d559de15d3ca28cff3a83a9e544bfc9b4cdfd9d5f8859
SSDEEP 49152:QuYk3H5koUXfTqkkYLO/W2buywzMbOX+T7z51XvYMLprznyDSga9:QPfTqi90bBXvYCp3nyG
MD5 SHA1 SHA512 SSDEEP

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 797KB
SHA256 d37d345c583748ee0f008074dc135d4295b81d54ff0734d2815d3c0f56f1e6b7
MD5 684b3f757c8c734252b65a3fcdd80c0c
SHA1 707a98a94434a2cc89e4061d6143e13e9596c3aa
SHA512 412eed2c685fdd9088a2a45925328bc75ea953fbdf94b631dd5f439156967cec84b4716f2be9a42c80918bf6362893a243f9278b0e73ee7e66e811ef2f8fb0f2
SSDEEP 24576:CidnBsuE8X7bHsMQ4/O6yMLprOInyT/Swl8Mi9:RSujXvYMLprznyDSga9
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 b7c4ff949726f0e95a160a2a3590d078d754973f09bb28f9767012c9a86197a9
MD5 a05eace7340b7c8808a6220e34505b54
SHA1 b74b713d53993900557e11b6604aaea09f45c558
SHA512 76f2031e07ee0a981b2af85c1e2e51185becba05575de399eb86ea4e1f6db240f6eb07f6675d7a855fccfc1d133a4f56f6518f3d6ddd205da7df20d2239158d6
SSDEEP 24576:3+gkEVfh4CoAX7bHsMQ4/O6yMLprOInyT/Swl8Mi9:OgkExSWXvYMLprznyDSga9
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 c18d6c2191125e095348af2201f49e3fa3fdc3e2be86dfce3cb79a70b7c47b2b
MD5 a77fd433b55e4fe5c2bc61d673a4ead7
SHA1 cd4f7ed05ba0149176d3cfcd85e6bdedf51dc6c6
SHA512 793c7a3d186e691ac028f553b2f1ba4d48f99ab7a72a89583048ecd9678312dc8a2d5dc88ebe7b4f178698a968eb39ca988cf3835476de726c00ad1c26f35a84
SSDEEP 24576:ZBpDRmi78gkPXlyo0GxjrJX7bHsMQ4/O6yMLprOInyT/Swl8Mi9:bNRmi78gkPX4o0GxjVXvYMLprznyDSgo
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 1e2a794bcddcf2992d70ef7988f8e1786c234e5651e45203322123545f734ce8
MD5 c1595ed36c31f1355a954272300025b5
SHA1 2330188c695f74c20c31e1f1bc833f257ec78806
SHA512 72edc4fae916ddca0ecfffd2b00bc40083393db1337f4c63d8f8e21bcbf51933ec342a8df951716612ca12f12b4c8c0f7c0fdda175cf1812e7a20d46e858afe6
SSDEEP 24576:wLOS2oyPIXVAX7bHsMQ4/O6yMLprOInyT/Swl8Mi9:o/ytXvYMLprznyDSga9
MD5 SHA1 SHA512 SSDEEP

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 931feb84cb2db6c063d38ffee70bdb815df4be054d5e75e6b41dccd98a2071f2
MD5 7fbb86dc58a48371d23beda780bca202
SHA1 b0fd1a50e74f97ff44b1c41bb0faf60cb445cf9d
SHA512 1c7ce4dc297040e2e291af6d7718ae474c4a20196d844517e3a2df457e94d46265cffc24c51bb6d446432d62ea66258609a5ce41053b82997579b323eeba4d67
SSDEEP 12288:8f2LD7bHVKMQ4O4vSjNsyMLpRNO2FLzTGT/SRel8lkEoiqAj:8f2X7bHsMQ4/O6yMLprOInyT/Swl8Mi9
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 51b96294ac6fb1fc8d4dd74ff3b5b47d260ef37c2d36e37955ee29c4d63d8621
MD5 2c0b6e639a07b95f6767dbbc99042b95
SHA1 505ecae3814c1e706124eba761bdc8ad80fcf13c
SHA512 3478fe27b6f9b4b9cc89018eee0e1818b4516b387f9f38e5683d776e7c5e7b106ba4e73a652014ed603e173eb6d02b12cad8de01308d4e0a6d17e03ba05b689b
SSDEEP 24576:nJIUvX7bHsMQ4/O6yMLprOInyT/Swl8Mi9W:nJIUvXvYMLprznyDSga9W
MD5 SHA1 SHA512 SSDEEP

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 f6573d89c2803b7488f95732e88c628497ac06ce1c4a19dfadf536dbb6396d1c
MD5 60a0082dce2271fd3503a96ad4020efc
SHA1 1b51e3562ebb28919c06041b5beac9ab844e143f
SHA512 a31f9824952e9da1f9434832cefb12c6d371a228563f8d18dd33d3f148a0ab99f06d0e242b6bc3f4722b60aa24c586333cf604dd0abfcbbf37b3934d4e97f7a9
SSDEEP 49152:AQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THp:AQvGAdlCEL8c/yRNw5CUXvYCp3nyG
MD5 SHA1 SHA512 SSDEEP

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 6349d995d9922b86be9c6b9363f3da899b1525616ca44475e94195a61dcb807d
MD5 ab5a71c378d2c112697e4ba83bdcd66c
SHA1 1bffe243842ece64948a7b8f068764218acd9c5e
SHA512 d8cf803decdd86f37cf63188aaf4180ba39b6d0377a0b51d28556d4fee15e079369104f30e14af4281062b0fa5f3fc10b58367a5c453d59490aedf22d0462e28
SSDEEP 24576:wdewsAjBX7bHsMQ4/O6yMLprOInyT/Swl8Mi9:AljBXvYMLprznyDSga9
MD5 SHA1 SHA512 SSDEEP

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 5a0710259584e45dbe63822e946afe9d7535eb35679a60b8e9cdfe004148578e
MD5 146e63ce350ffbc731a4a009c871b72b
SHA1 eaf1bed2ba2ff6171e154b09225a56c0010e0018
SHA512 eebfb37e0866e70d29e42ebf4c41e22e3399da5029f9170f023d1e10396454976af3c29db1d80bbda5d2b85f1114e73e2b5680e18389d440821e586b93121fda
SSDEEP 196608:5UEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJH5Tp3n:5UEtQevvqc2W1cpV2EI32Bh
MD5 SHA1 SHA512 SSDEEP

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 e8ca8a12575531003dea480f13bf8904477b152f898f70df3ac514e6abe216ce
MD5 ddbcb129d5e10c94acf9db3432d6b547
SHA1 e64b82f4cae461ea69e8d971fac7f7d12b09ebc0
SHA512 edd544ce9a3484a96e35a9a5dd02305c79e9a15e10f2efc2e550ce7633ab796abd7f581c8555e5b911e48207f3fc143161e52bc3e09aeebd2d8d3eebceb41606
SSDEEP 49152:aCbRquA/m2yL5zLfFiV+XenmE3/zhXvYMLprznyDSga9:voq2VjnmQXvYCp3nyG
MD5 SHA1 SHA512 SSDEEP

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 1eb6bf6a268f385317d3f60412486f61bb623f9b81204de5c7435177e95ef6bd
MD5 8c0728e344d68916258a07360672480a
SHA1 784d85f9981e2a6e11539c8f2b628d934b5ad640
SHA512 b99f1a49fead98f5dbc86fe4d99afd91d833ebdd66c80b660007452b0582a426cff558bd086584271614f323de0f0874746d1a80636c1f7db70a148dc999e9e0
SSDEEP 24576:LAhGLJIFoiwtA5l7S53wX7bHsMQ4/O6yMLprOInyT/Swl8Mi9:LAMyFoiq5gXvYMLprznyDSga9
MD5 SHA1 SHA512 SSDEEP

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 266efc5382d91a1d8493b08376480cd065f939cac114345025d09bfc24154963
MD5 00170c1816c41e1f2d50f55fd89da21f
SHA1 38fc2446e7b0f660f9e4c3d6edd82b349c1b82eb
SHA512 7495d8a5feed1ac5a14ce9be6be3f31ffbfa802e6953dc355ef9951e29453c16b174c7811d32d865bd80c6a6bcb26b2677778c7ff459547b07a8e7242ce2a840
SSDEEP 24576:rwuoOWtX7bHsMQ4/O6yMLprOInyT/Swl8Mi9:rwDOMXvYMLprznyDSga9
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 edba5b7acdede7b3ee8e426cd7b5f2930164ee74420b8816ec7de7be01e5a8ca
MD5 3c6a2c557969104c6a76e9297698b211
SHA1 0f0fc4beda99f969034d4ee28761cc47ced18e40
SHA512 3d35cbca9df7c64dd4c7bae51cd619a263abfcfbd2fa805bc2f2a42a82e22277bab6ad7a320d15e54e8a7965b0545d66ed76a464877dbe3b6159608e1a3dc105
SSDEEP 12288:5BZ1IyRLD7bHVKMQ4O4vSjNsyMLpRNO2FLzTGT/SRel8lkEoiqAj:XZuaX7bHsMQ4/O6yMLprOInyT/Swl8Mg
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
Size 5.4MB
SHA256 61cd75e7665b10517524240ac20892e84afca7340d9a29334b33f4ff01977e34
MD5 3aa93922bd5f61c074ab9a3a33540846
SHA1 1900d24342819468aea331bfe988f5e5dc88e132
SHA512 94102c52481efa137fc823283a28b8b0b9e5638fa53108b61ebc36eb60a5c2d1c3e0c950fb61946e91a92f6d9758ca36e39a733865d3e46833807dd5ef6b3e54
SSDEEP 98304:OwfhY7g/rLd7yYA3awr341gYXvYCp3nyG:e78yhYTp3n
MD5 SHA1 SHA512 SSDEEP

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe
Size 5.4MB
SHA256 c11e8c5bb41769d6b4c90df11ce75803c59f1dc744ebab00352d9f1cdbb177a2
MD5 a4f0d025d32fcd60061a954ab07a3a07
SHA1 87e9aac59b99bd0bb5b8fcf853a94111db6352dc
SHA512 b204d3993a00564d2e9ccb2138673f0f24dd3ba9521c0c1fc700c5588a4a9e7c3df450037cda1e6c22563d786e2ab6d36c579f6e9cb835244085b6239e64dbb7
SSDEEP 98304:+wfhY7g/rLd7yYA3awr341gYXvYCp3nyG:u78yhYTp3n
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe
Size 2.0MB
SHA256 79f64de961076bee0efda561be36a1ebf8b14a751639c1fa01897fe2537d7e1c
MD5 22619aef106d6a5a72704ef8907af2e4
SHA1 9da28d3c0ac1830e7d7dc6fc7fb6057a2f9a4a15
SHA512 f5aa43b7f9ce2fb3b4638ff1595e4ff20998ab402f0a93b977e6570642df0d866bdf46c0a12125a88491d6644e6181456c5806efced290dcc3245afda52170be
SSDEEP 24576:RcTyYv0FteQU+5I2kjgD6iQacAtX7bHsMQ4/O6yMLprOInyT/Swl8Mi9:RuXv0Ftpn5606zOtXvYMLprznyDSga9
MD5 SHA1 SHA512 SSDEEP

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
Size 2.2MB
SHA256 35d3825225a9a5af0e3415607892470a7f6609dcfae51be1446f24303b79c82a
MD5 1c6019c13b75ffb3452e67566ab8d0d2
SHA1 cb1d068264ab5a4607193472476cbd31d1f87fdc
SHA512 4e9f3df732d32f8431465c1f274342afc3653baa942e0093e3256a4acd5085d7f9407d9ecc499216c5b0f83b71dc3ff6648a6481e1347190a02a9d2b8c62b8b7
SSDEEP 49152:+y7mTd0GxN8jyynxHjXKUyn4GVcbDSKrNTxBXvYMLprznyDSga9:1mYeyxHjWjMTBXvYCp3nyG
MD5 SHA1 SHA512 SSDEEP

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe
Size 1.8MB
SHA256 fd038694fdb5eca94b13fa427bb1369932db26cd37cdd309d58afe79a0c8b443
MD5 e344c0c2de2111cd024b23476d5d5c53
SHA1 62393f188c67eab745d79830b7b0b57fc8a20338
SHA512 f76da27058e3b66ff9fd60cf5180756caa7e341369dcd529a646c51a10205662c0b0ba95b0ae37fcea71973d27f5579bad8a8523b9d8c7a2b4a384fc55c7b24c
SSDEEP 24576:E6drZn1WEci182IEUeNbJeRgUebgW816SX7bHsMQ4/O6yMLprOInyT/Swl8Mi9:EWnDci18yNNUgbY1XvYMLprznyDSga9
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 1.7MB
SHA256 6ccc9fa4e588fbb34986fa1fca22a666e604bdbd3975a00a79df620dabc0afa9
MD5 9a017247f31cd7e14252f6fd605fe88f
SHA1 c7fd930e234f8dcf24a2f1e282f8fe5d1c5a0dd5
SHA512 2aa52ac28864ee74619db6e8ef812b007a4f754a81184125a87144480218e994d0ffe4cdc32a106339553da178456b5fe4445c01f5c4a30618d77778bc886aea
SSDEEP 24576:Uk5lHW5EzMZupO80G2reD+melRgTTv/1nyjX7bHsMQ4/O6yMLprOInyT/Swl8Mi9:KizMZm0GhamSoaXvYMLprznyDSga9
MD5 SHA1 SHA512 SSDEEP

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 be03bc4c1d75bf5813c6c99d383ba41462fdf77ecb3febd2d095e0776bb1da5e
MD5 3b666fdb480a9b4dc64162b6ce3de8eb
SHA1 c390dcde9ad7b8f7b39f68ac6e978b794c9c037b
SHA512 73a8a8ccc858e9a42f2e299b36a90c5f851055958febdabe6de03a8bcb18ad47240683bfb5cf95fec668723148be99ca428b7c0ffda219f67c2ebd75f4922c81
SSDEEP 12288:w+LD7bHVKMQ4O4vSjNsyMLpRNO2FLzTGT/SRel8lkEoiqAj:w+X7bHsMQ4/O6yMLprOInyT/Swl8Mi9
MD5 SHA1 SHA512 SSDEEP

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 55a2748de2c0a20677e50b4c36ab4bcfec289319cbf585327391ee919f9f65c0
MD5 af1af3fdbb351855105522ed671cfbf5
SHA1 23493853527df59869caaffea3734abe82e9e8d9
SHA512 7127efdd0fd6a9d095c956ec91537407c8adf36138556bde112b6ad9bc394e47b7eabe087fb6da42419afe13560f2d793ffe73353f62a364de389c0555fc170e
SSDEEP 12288:5FLD7bHVKMQ4O4vSjNsyMLpRNO2FLzTGT/SRel8lkEoiqAj:5FX7bHsMQ4/O6yMLprOInyT/Swl8Mi9
MD5 SHA1 SHA512 SSDEEP

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 63b5cd652d079e1509ef8941205a54b203465e1816cf3f2814eef9a619f7459f
MD5 3c3b3202def8e568e75b08686cf2de1e
SHA1 76f07d601c629880787c69fcc1d02cbe4efcf10d
SHA512 ca893d6c486e3d48e4f6f9322aaf505e3236721514bb9dc4eb19d54584498720e7fe96ff1f5a40de81c0ff9efb989b351047b853785ed38116f03527c88c678b
SSDEEP 12288:EXLD7bHVKMQ4O4vSjNsyMLpRNO2FLzTGT/SRel8lkEoiqAj:EXX7bHsMQ4/O6yMLprOInyT/Swl8Mi9
MD5 SHA1 SHA512 SSDEEP

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 f2268b3555b41cce0fa6f101343fbfd0d935cc2c1101b8c4da1bc791bfe889b1
MD5 b234f7b381db189aceb8231915d3c8f7
SHA1 ea5cd01956bd8203b435808a6abea9e89b4e7b5b
SHA512 b8b05990ecce95582796f7e481d9a36b0d188f880b6566a721199f593383d8879cf527bf6959026b6dee258abb5c88c2d6077a75940e324a6217ab093a449b88
SSDEEP 12288:JVQLD7bHVKMQ4O4vSjNsyMLpRNO2FLzTGT/SRel8lkEoiqAj:MX7bHsMQ4/O6yMLprOInyT/Swl8Mi9
MD5 SHA1 SHA512 SSDEEP

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 8997d84eaea0b4cfd4b8e99a8976645f0fa7733b82fb6bc6802f28c03c32e65d
MD5 80e965616123da4979747d0f18a85547
SHA1 87ce0f1a34592651f90037daaaca3ce95f9f31ac
SHA512 0eab22c3ba834152dd8e5f627fec24588eb64085ab45a44f52f801c997686e28b4294f9ab12cba2ff17f7da9a40f648122ff94612463cd534a4135c4a51064b2
SSDEEP 12288:iILD7bHVKMQ4O4vSjNsyMLpRNO2FLzTGT/SRel8lkEoiqAj:iIX7bHsMQ4/O6yMLprOInyT/Swl8Mi9
MD5 SHA1 SHA512 SSDEEP

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 a2b9fd2c98846832e6b0a239cce8775483969fe3fbb6db69534997aa423aa2b3
MD5 751946ef7a98ab8c2088ce7066c4f0cd
SHA1 bed4ab5bb5c31579d15cf034149caad631ba123d
SHA512 a72b2d1732d12744940393084481b00ab546152f7ed277106e069129305affc7f638b4c4c7cd2fd96e20e51463bf023cf3d7b885dc46131cbbd7941761bad7d0
SSDEEP 12288:uJLD7bHVKMQ4O4vSjNsyMLpRNO2FLzTGT/SRel8lkEoiqAj:uJX7bHsMQ4/O6yMLprOInyT/Swl8Mi9
MD5 SHA1 SHA512 SSDEEP

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 5f7849140083e67fdfc2461a712d84d36ecfd144334c3c8bf1f734e1bcd6e5f0
MD5 e4259b7366054843c90537f0341a4f35
SHA1 80c6b5322c061b52e3b888da9169032901b6646d
SHA512 27a90c45fdb94c31a95482901a161874be8443638e9c461e495a85f2d6f219380ae66778a5c3ec4e40ecf2ee53614a095055c4c399e25d628c01e36d35f507cd
SSDEEP 12288:BdLD7bHVKMQ4O4vSjNsyMLpRNO2FLzTGT/SRel8lkEoiqAj:BdX7bHsMQ4/O6yMLprOInyT/Swl8Mi9
MD5 SHA1 SHA512 SSDEEP

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 6dec6a5fcd768e28003f1d656145b7b2e37e0ea2674273e73c3e0377b8ad58ad
MD5 fbc8fcd82225ff45e585346f5cc22874
SHA1 23a585bf0aefb3f8a923394facbe53d6a3aa1ebd
SHA512 f31372a7a3f1514509d929566dbc9711943a5bd4b61b3d14fe56284da57980cbc9b8b979db15a9adfba03b865cc09e4378d2cc3c8235ac71f366f65ff0616a81
SSDEEP 24576:sZMSzFVSOlX7bHsMQ4/O6yMLprOInyT/Swl8Mi9:sZMSzfZXvYMLprznyDSga9
MD5 SHA1 SHA512 SSDEEP

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 b4d2054d77607cbcfc2590939035f6e6debd8f16a4aeffb8b57f5ae7f58536f9
MD5 5a2bcfb847dc21432b2465d060455438
SHA1 b3bd7ec8050c84566c6e75cd217bdd7e589978e1
SHA512 41ec3e46a622677040f185de647019495665f3b85b5b3ca656e1a8d8b3e317a39a37b292068a5f4cd6bbf66471086d3d99cb07e7a05a801c5413a42b95eb737d
SSDEEP 12288:BqLD7bHVKMQ4O4vSjNsyMLpRNO2FLzTGT/SRel8lkEoiqAj:BqX7bHsMQ4/O6yMLprOInyT/Swl8Mi9
MD5 SHA1 SHA512 SSDEEP

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 81ddea6cea0235087486f318325f96b3d3c1b0969508453a5c4ee7f884d9d1e7
MD5 ff535c1ab455bb5221de3dbe14b4cf3e
SHA1 6eee279d13bd219a6e21f9a511486238245a8959
SHA512 0da292d32a7f58e8c5a5cd022f87c2c3e2a846145e79a3ca91ae9a35d72aa40fea60efb0b2913e977dc5b95f2ad2068fe40e9e8cb591ffffd4ca6d44147eff7a
SSDEEP 12288:iGLD7bHVKMQ4O4vSjNsyMLpRNO2FLzTGT/SRel8lkEoiqAj:iGX7bHsMQ4/O6yMLprOInyT/Swl8Mi9
MD5 SHA1 SHA512 SSDEEP

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 4bc62a58d4c65366bda1a7fc67d36cffcac7a874b8be0aaf0ba6db99210d8d5b
MD5 5669de0be1dc03fa8496413806b4a097
SHA1 15c277eb27caaca078913deb4c3e1c1171591fee
SHA512 bdc4cef9aa27af90d065b8d53ab331bdb679a3ba5f295b7dfce291420422574596bfe0343c0677bda882943e78090fbb87523e355eb12ddf7e5b1810f245b462
SSDEEP 12288:ryPz5L8RLD7bHVKMQ4O4vSjNsyMLpRNO2FLzTGT/SRel8lkEoiqAj:GzyRX7bHsMQ4/O6yMLprOInyT/Swl8Mg
MD5 SHA1 SHA512 SSDEEP

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 a98b8969aae6ea183a4da12d55bd93b7368f0ac0f09813eb12b270cc81fd1a6b
MD5 db25a05c5ec5eb72a7ca42fc5f3053ba
SHA1 01144fe84ccdd715b97bb57fe55befb61e05669e
SHA512 2d3b5caf718151b92ac9edea8c0e90fdc6b7554dfc38ffcd806ceddc6faccbd4255b3316b0ca2f70d6a4ab6d224588d5e88b05f72b18665fd960c4edbbf9c7a5
SSDEEP 12288:yqLD7bHVKMQ4O4vSjNsyMLpRNO2FLzTGT/SRel8lkEoiqAj:yqX7bHsMQ4/O6yMLprOInyT/Swl8Mi9
MD5 SHA1 SHA512 SSDEEP

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 3bb51d8e094006f50094c5814fbd0bc7b902044c565a430fae6fd0aaaf900098
MD5 b311571483c4a2c1d93af523e333d020
SHA1 23cfbcd35ff3c72092f8ffc0abe18e3b590eb5c4
SHA512 bc85b07a1c02a767ca53ffe0e4df49450f3d885669e37fc65f7f5d9d6f1ce1b3b73795729b9ed6d607f152992da4328a9c23c7163583fac671d994948342e583
SSDEEP 12288:VqLD7bHVKMQ4O4vSjNsyMLpRNO2FLzTGT/SRel8lkEoiqAj:VqX7bHsMQ4/O6yMLprOInyT/Swl8Mi9
MD5 SHA1 SHA512 SSDEEP

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 1842cfdc9ff531ace8fe27f00b46529471436302c685c80e69ee0f89956dd465
MD5 a95dc9bef3206bbbd7bb0517bf9b81ab
SHA1 d1628c0bc92e7ebd43bd9b75774160915f0bb45e
SHA512 092396fd72b920fa5c1e3b45175bfc7c54c81fdc5c9190dc0bd208d5cfc5eaa56ef2260cb5ef77cb8d0033d7ef117cbec6e8844572f52b154231d7f4b6c4a626
SSDEEP 12288:kyPz5L8RLD7bHVKMQ4O4vSjNsyMLpRNO2FLzTGT/SRel8lkEoiqAj:9zyRX7bHsMQ4/O6yMLprOInyT/Swl8Mg
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 7a3941ebf58a298c8e252cc9989653407907b976e2f2b51b652ac827385e7e7f
MD5 d4745b0e146849dd6b99b2b74e41b89e
SHA1 029530bd4e8103d0408aa06d40de8b8524f0ece0
SHA512 6d052f5ceec9e24eb4694cb334d54c74d80d7b8a627d1eacad4641c09fcfdf2d5a357cd186222b21e80841d2d4219f8043a260bf3cb7a5086eb6cb5efd78fc8c
SSDEEP 24576:0THaLl3z0zDHX7bHsMQ4/O6yMLprOInyT/Swl8Mi9:0T6LljEXvYMLprznyDSga9
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 ddf1e465cac3f51135d730c926989e57477eb353ad7921f2a04819fff9f9a326
MD5 ab65aeadeafead85701c34cd69669d40
SHA1 5f4c5347d7f94544131ff3b17357a1abe47b165f
SHA512 74229b51e7623ef68f113432726e90d6b074ca7498fb36dffc8a6fecccffe8b222ec4482fe0d1022762c3b4f516b43c9764c3f527131389b9e987bc9eefd88f6
SSDEEP 24576:037d9CHKy7GZ7X7bHsMQ4/O6yMLprOInyT/Swl8Mi9:+7d9CHKyaZXvYMLprznyDSga9
MD5 SHA1 SHA512 SSDEEP

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 a3445123cb490e05f82aedf84c56c869379dabb2fefab7631ddaccb8c9cc9fdf
MD5 f4073d32dfea38c2d438afd91fb5cd57
SHA1 3202558e7ea340638bddc4d9c0a11104d5b4c042
SHA512 f86f6ab51d027bc455745a052a85782741b781259f65d7aa8f74acbd3e0d6ac7071f465da6b8ed46ded4a2192b5800ba544b175dbd25a98ccbcd7dcdf77356ad
SSDEEP 12288:L3LD7bHVKMQ4O4vSjNsyMLpRNO2FLzTGT/SRel8lkEoiqAj:L3X7bHsMQ4/O6yMLprOInyT/Swl8Mi9
MD5 SHA1 SHA512 SSDEEP

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 212bed280a4ed2f866eaa0c63797f5e6aaf69cf188ac5c60beb4ca15ceb351b0
MD5 0881b06fea0cbb61aecb0096b541d154
SHA1 cbebdd2acd97cbdf697fc0fa133de911dba39230
SHA512 49deaae11e4a0eb680059dec6b329db5559f138c6b3317d609b1aa2e8aa917fbc48213f0c9a6f558a33b0e04d56af2a8653234191c48ad5933579a4e0fca7210
SSDEEP 12288:OxLD7bHVKMQ4O4vSjNsyMLpRNO2FLzTGT/SRel8lkEoiqAj:OxX7bHsMQ4/O6yMLprOInyT/Swl8Mi9
MD5 SHA1 SHA512 SSDEEP

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 f92cf622d226dd5f3243c87811e34bd79a1aadc7335bee69eb249cf10a5d6312
MD5 ed0b55c95a8485710f792b8b66106e4b
SHA1 05d4e15abbc871a0e70b094bfa23158e53e4dd3f
SHA512 2f41a87ec7f8a63958f9b4f9f2a78135f3bc7abf4ea3a3a242cadf7ae561f381a3a7d5ce84339c7a92f068fbfa1b4ff8deb6ecef7089f6f626488bd3386ef097
SSDEEP 12288:48LD7bHVKMQ4O4vSjNsyMLpRNO2FLzTGT/SRel8lkEoiqAj:48X7bHsMQ4/O6yMLprOInyT/Swl8Mi9
MD5 SHA1 SHA512 SSDEEP

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 fd0814e778d534c859b709c6adb540c4905db503d856799c4abb97e737133718
MD5 d9961d2d8fcd5c799460a8fed3578b56
SHA1 0e82ab915cf6252a83e1ad2b35941617e4918a86
SHA512 c7a91e741683bf71f48eeb695f3cc67ce909bbff135cbb22c1f42560c514036ed6c26159b5de18fffa9d4347161f9ecda02cf74924b4950debbeefd88451a789
SSDEEP 12288:IqLD7bHVKMQ4O4vSjNsyMLpRNO2FLzTGT/SRel8lkEoiqAj:IqX7bHsMQ4/O6yMLprOInyT/Swl8Mi9
MD5 SHA1 SHA512 SSDEEP

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 5cab517b3a5dc9c21681bd1399a69df14273a52ee981a832b1a7c82b7043c5fe
MD5 c73dfa50c559bd60ee393deaa1185b41
SHA1 40fd92f5e2980332aabf83a7bb0294eddba6c522
SHA512 e928fbfdfc850a297b95f5925223a9c14ed5d4b196c9bc01577dda67f9a550012ae81109471c14ccb5e7c60b5e555c7a9582bd6e7120675cd50e16d1b9f0fcd4
SSDEEP 12288:93LD7bHVKMQ4O4vSjNsyMLpRNO2FLzTGT/SRel8lkEoiqAj:93X7bHsMQ4/O6yMLprOInyT/Swl8Mi9
MD5 SHA1 SHA512 SSDEEP

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 701KB
SHA256 5523d592c716302cbb3f042a550532e604bfb84eeefcd988c36c29c58549b3a7
MD5 3010926bc0ec71e6ebd8cb3a8e2925e7
SHA1 6c790a3f323ac8f20682c0a5d844a5a7520dac93
SHA512 04b5cd462b9b4613d57f4717f1f05a2fb3583545a7d5009a796cfd6cca240ba92a68cfb98d555d77536c48d223e7fce23821d7840335297a6b97ea2c080a33a5
SSDEEP 12288:tUFmDDLrLD7bHVKMQ4O4vSjNsyMLpRNO2FLzTGT/SRel8lkEoiqAj:prX7bHsMQ4/O6yMLprOInyT/Swl8Mi9
MD5 SHA1 SHA512 SSDEEP

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 dbc96f9703ac8b08a3c7a344673a53bbc3e997631117f5e6e87b895ddfe25d65
MD5 7f6787ff6f404d207bbbcec7a2a2ee93
SHA1 42dd622868b0e49292562e1129519842d08598e7
SHA512 1a3d643faca8fa61f334230bec4fe95ccee5404de715a753c9b5ef4567e620b54e5063b875a4f9874ad88a4aca71f5bcf0e5c368bff2c659be5df804432d3f9f
SSDEEP 12288:z4LD7bHVKMQ4O4vSjNsyMLpRNO2FLzTGT/SRel8lkEoiqAj:z4X7bHsMQ4/O6yMLprOInyT/Swl8Mi9
MD5 SHA1 SHA512 SSDEEP

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 834bb846e06b27ac2697b1faec8743b78313edb025dd9e4f99d63159dd4fe005
MD5 fd60857aeaa6693e81c856a17b8b14a0
SHA1 f9ea46a3dc6e6fc237e25a7b3d8133a1d3b7120a
SHA512 b2ad4f52a2bb9f3ffd3a80be9759c65846d57b9f5d33bf14f0a3fa1f7a4b278926505dbb509e4afbbfc5a455c0c0f046d9e4f451c479c5ad8573d299d9aa9bd3
SSDEEP 49152:ua0h2GEkuAe73q3pp46zwwQ+XvYMLprznyDSga9:ua0hNYG4JwHXvYCp3nyG
MD5 SHA1 SHA512 SSDEEP

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 659KB
SHA256 e9ddcb6eda83f753200cbeb31992fa28297d3824cec305611a1ee476ce7d277f
MD5 91ef0e64de13ae50e13fc4bbb44e5770
SHA1 c9a13741b994c954540e643817d849854ef0eda1
SHA512 42e6bb2224ea11ac03fa9d16f4dc4fcfc8685a837147e7b60c1e23739bc49259b1dc662b52cb1d66af1ee45850d8f893260d17eac2820423300189d1dedbc423
SSDEEP 12288:fhbHjfXxLD7bHVKMQ4O4vSjNsyMLpRNO2FLzTGT/SRel8lkEoiqAj:fhbHjPxX7bHsMQ4/O6yMLprOInyT/Swy
MD5 SHA1 SHA512 SSDEEP

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 e635716934864d06c1f66e794291042efec0d93423eabe3be620cf20054ffe49
MD5 cb31fcbfc43a6c02c5f8c86147762fb0
SHA1 b38930e41bdb608a5118b8cc675d7ae31351df43
SHA512 5d274e9e0f362f797dfadf5241f53945f44d259fbe2c8f84b84ea691e3d23c91b343bd134acc85d0236611f2da5b4d5b218dcb61d937608925221a9a5281acd9
SSDEEP 24576:v3YgnJcRTk4yti+R5dBR/jX7bHsMQ4/O6yMLprOInyT/Swl8Mi9:vIgnaTk46pBR/jXvYMLprznyDSga9
MD5 SHA1 SHA512 SSDEEP

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 578KB
SHA256 1eef34bc9f763e0cf97ebbfb849bbb6c370754499d2cb52a8f369b57da49da97
MD5 badbad933bcdb068e4bb841b7ab58ce5
SHA1 e2f0113f7d20e202d9f57a2a1c979f8ea8fb1358
SHA512 8da4227c2485236679d5085533e14f462d6e3c8678352862333b28df2ac46bcbb606335f9f112c4cee343d672272697738784b54dc611e295b71c4f628f9e93d
SSDEEP 12288:UMLD7bHVKMQ4O4vSjNsyMLpRNO2FLzTGT/SRel8lkEoiqAj:UMX7bHsMQ4/O6yMLprOInyT/Swl8Mi9
MD5 SHA1 SHA512 SSDEEP

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 940KB
SHA256 6e7151eea841db42936829a13f37866898e57033dd313df62ec4e2ef8801c0a4
MD5 39010d43b26c271a3dcd8142c2d9a736
SHA1 3c456d6aeee79ac1a2fcf618c31b4a16f25beec5
SHA512 2ebf67c85545d57970e2a10a0d0a40ca9044417126a33e0b430d47f788264049c064cd56fdb2d9979353a8886be7f51f5f4b4d4359ec8da544510a0b054e8b00
SSDEEP 24576:rpL3UTJX7bHsMQ4/O6yMLprOInyT/Swl8Mi9:rpL3UtXvYMLprznyDSga9
MD5 SHA1 SHA512 SSDEEP

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 671KB
SHA256 cefe91d5fe2eaac525c2cfa59035d1d8e99ed829445b1880d81a9009ddbff6a3
MD5 48bb4115d2fb8ebcf419218c7ceab5a9
SHA1 14c14989065cddeedfb07d1036762d47c4f457db
SHA512 7d805c22a07dcce1cd19d4b94334c2191c87a1ac870653523e88fa2dcc0941322c8c5a67f0a80d9f3b43d38ec38acd1b381c804c12bd4fc7935a9b7cd6eba62e
SSDEEP 12288:UpFtpONLD7bHVKMQ4O4vSjNsyMLpRNO2FLzTGT/SRel8lkEoiqAj:+ONX7bHsMQ4/O6yMLprOInyT/Swl8Mi9
MD5 SHA1 SHA512 SSDEEP

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 a9dfb91d9a132a5e1139647698c9328cd37cda09a0cbe76f616cd9c91474ac9a
MD5 516860247eebf03284c145e69e13459a
SHA1 96ad37be230045f6f1085d561b3a5133975bce27
SHA512 4f845be2d721fb739c8a350b13ef7850799f98de3d175c2d75e3deb933d66a8242be353cc101fab79c5e8687f3ecb17694f80839e54e666ede38c4fc7a7f3ce4
SSDEEP 24576:Q7NM9YqZqmWMUkPjZM48Mv6bEhsoX7bHsMQ4/O6yMLprOInyT/Swl8Mi9:Q7cBWMpPjN8DbEhrXvYMLprznyDSga9
MD5 SHA1 SHA512 SSDEEP

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 7f4375c1aab2aa031eabea6edb16335099e0273c747af95c7991ecf921bb65e1
MD5 71edf83aaeb88a49adb5933f4eb90653
SHA1 af783ebf44a40f46b4b949ae4539b5ab430c7866
SHA512 bce21bd04cede44b0ecea0cfd375ea9a7fa9121cab974b4514a054244001b88b0c75cd85c516679fc4cd3f803e91ac33a628c7484e48131fd61c940635c00541
SSDEEP 49152:MF2YuHNETovAvNYf8kmIXvYMLprznyDSga9:p6BCf8kNXvYCp3nyG
MD5 SHA1 SHA512 SSDEEP

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 1390b8213a7b9195c9f32a0b45f47a8791b9030c2103805239434c8301b39478
MD5 aed8284652104614c866c7b5afe238d1
SHA1 d0542adc920426ad4fadb65ef8502ecdf9dc3e94
SHA512 eef49ca05de228465c1a7c2d1a1a81acb925d0d2c32cea67b69f8f0fc48338005a021518992823d83d957ca6f6667cb368d1ecd60fa210206b58634bd80c9023
SSDEEP 24576:dAFs06+Omlf3NXEbToxX7bHsMQ4/O6yMLprOInyT/Swl8Mi9:SFs060lVXueXvYMLprznyDSga9
MD5 SHA1 SHA512 SSDEEP

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 885KB
SHA256 109ca728371363b6c0db3b536d5c2ca3d6e1c16e39c18324c108b1d76276e948
MD5 8a9a86522f73912110c1acac35108b49
SHA1 aac6668048aa4b27f31d1ab5fd5b490c718bd4c7
SHA512 95e34bfa0e02d62ab79af69b126ddcbbbf300f6b5617853ae6ceb8ace373102df3b1a0053fd15314f529f82f4292d8aeb11d78c0a11b3aa922a326a9e132f111
SSDEEP 24576:DJnJ5D3WXeX7bHsMQ4/O6yMLprOInyT/Swl8Mi9:DJnJ5DGXeXvYMLprznyDSga9
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 c9f3a0e88bb515454e5dc8ccc2a6594f1e841917dc51199225690acce4f17287
MD5 0b3851d1937023fbeb3417a639777dc9
SHA1 dfe434a17350f2d87ad484fadb7ae95fe10c0a58
SHA512 3c6a845c13c9ece0029aeab5f86233f71ec4d4297d46ada16ca06fe097e14bfd900b0c8791589c3ce1a3433371a25117f7f17754e94771d7fd720807cb538e0b
SSDEEP 49152:Qg06DIKdwc+eQnSt65aVUXvYMLprznyDSga9:xKXvYCp3nyG
MD5 SHA1 SHA512 SSDEEP

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 661KB
SHA256 53cae03874be0901db815c7036170e7c49abdaf369dbe0d54ceb477276691bd2
MD5 24e45703b9363e4f7d980235c3557494
SHA1 0bb7f35b1df043bc053f1f46f6726a0738c36835
SHA512 9b4f5e959d3101a6958c713bb352948946ad463a55c9418b54ab89695a1db4d44ad13a73128a55b7fa78143f604b844635581683ad97e87a38a80bf733e1e08a
SSDEEP 12288:MEP3RnYLD7bHVKMQ4O4vSjNsyMLpRNO2FLzTGT/SRel8lkEoiqAj:HnYX7bHsMQ4/O6yMLprOInyT/Swl8Mi9
MD5 SHA1 SHA512 SSDEEP

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 712KB
SHA256 8a4df4223c4a8b748147e0411cae43d12627ee082ba118fb50bb59a7d3b46367
MD5 c71f8203bc91a8fadc653990657c04ae
SHA1 bf195e1d428b3b511417c847e08ac916556c9505
SHA512 aad1a513b5166fc087684e14fb87965b143fd961a39780be65b362b1f76371d2540ba25be7e6b4eabcbcceaa0eda97faf6dde341efae2fbfbbcdf36fd928a319
SSDEEP 12288:fjkybLD7bHVKMQ4O4vSjNsyMLpRNO2FLzTGT/SRel8lkEoiqAj:fIybX7bHsMQ4/O6yMLprOInyT/Swl8Mg
MD5 SHA1 SHA512 SSDEEP

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 584KB
SHA256 f42d2ce03e13ee3dc84ab33c8c3bc70ba468106a3623ebbec69882cf2114d0ab
MD5 84e400fba0acc849d17df371006b4aa8
SHA1 8457f846015dd40512c0423af80b462d2ed2d5f6
SHA512 48530b4d18ea0b8af67af65fbbe64631cebaa6fdd84e8b3637efadf1d5ce3d804b4ba4a2d53dc6ef1f75951fd787831d5023fc7bffac049342db7d60809e12f3
SSDEEP 12288:tydLD7bHVKMQ4O4vSjNsyMLpRNO2FLzTGT/SRel8lkEoiqAj:MdX7bHsMQ4/O6yMLprOInyT/Swl8Mi9
MD5 SHA1 SHA512 SSDEEP

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 a5af21c205dac6e73bb025c56f6de309ee412350f48286132c9547cfa87ba2cc
MD5 1cc0088bd11ed029180b809104e4de5e
SHA1 13274d466a7bdde6d6cf5e865171876ffda3704a
SHA512 935ee4d86ca86fcc52fe752249acde61d249696e323d609fa1cfa3b8258686f8079af9eb6b785b758152cba6c53d328e39a03e6a55ac83836d06cc7b4bb73dd7
SSDEEP 24576:jQ9MxZKdcz9dw3QX7bHsMQ4/O6yMLprOInyT/Swl8Mi9:jVKZQXvYMLprznyDSga9
MD5 SHA1 SHA512 SSDEEP

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 772KB
SHA256 5a0a6d7d5bef8d55e73b5c0830b6800236bd3ea2255ac7d2beeb0c5babe06686
MD5 e6fb51ccb635af83ea38cdc4d93c8148
SHA1 c2cbca0cc1a019fc151d034845e96e7e8ed859dc
SHA512 2129156e5c5088ca52415be4561725e7fab6931da873a4d82812979f9ef82d474ad60ba397c1dedaac6b21ad3ea5e2fe3b613e440c4a9216598041b4af58d5cd
SSDEEP 24576:kyocDApvX7bHsMQ4/O6yMLprOInyT/Swl8Mi9:ZocDApvXvYMLprznyDSga9
MD5 SHA1 SHA512 SSDEEP

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 3b9bbdfa739811274a874e3e8da2b25495cb26f73a2ac31304574da73a654d7e
MD5 e3ff47391cb37e100e4aac2cd4f2a096
SHA1 d3f80062ba13b64fe60e621b7da4342fec62898c
SHA512 1f524a6650bd866f56a22bb70cbdbba6729ca88e06969297f70fab067255a190adea7d4453a7d5464189e7479f635ea6e04feec668a4751b82bd3df139cb5dfe
SSDEEP 49152:aWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKvXvYMLprznyDSga9:c0zuNIJXvYCp3nyG
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 26628a6de8f5a456043f267c8ec5edfbba27be56f7d391ae653ecdca4068d7e4
MD5 a6f97a563fbdac30aaf71a9fb66d892d
SHA1 5e890f7eed40aca5dd84480463aec78718b07a3b
SHA512 3d4f8cd92e9287915616af24302f60b79479b35cd6d63178726708cfafb272e998ff0eb1a00061dae6f088c19baa7911672c875155391cd7bef85079fdc74ba9
SSDEEP 24576:p1QT7EcpfxR+N5AWAz3ooiYtjMqbYX7bHsMQ4/O6yMLprOInyT/Swl8Mi9:8TDxR+N5YzTfjMLXvYMLprznyDSga9
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/60-52-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/60-53-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/60-242-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/60-44-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/372-266-0x0000000000BC0000-0x0000000000C20000-memory.dmp

Download

memory/372-260-0x0000000000BC0000-0x0000000000C20000-memory.dmp

Download

memory/372-324-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/372-256-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/412-329-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/412-457-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/452-452-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/452-313-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/1088-56-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/1088-55-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/1088-62-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/1088-66-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/1088-68-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/1460-29-0x0000000000400000-0x00000000004B0000-memory.dmp

Download

memory/1460-0-0x0000000000400000-0x00000000004B0000-memory.dmp

Download

memory/1460-6-0x0000000000630000-0x0000000000697000-memory.dmp

Download

memory/1460-8-0x0000000000630000-0x0000000000697000-memory.dmp

Download

memory/1460-1-0x0000000000630000-0x0000000000697000-memory.dmp

Download

memory/1532-238-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/1532-23-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/1532-17-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/1532-16-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/1552-459-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/1552-338-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/1768-290-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/1768-449-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/2236-38-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/2236-40-0x0000000140000000-0x000000014024B000-memory.dmp

Download

memory/2236-32-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/2236-241-0x0000000140000000-0x000000014024B000-memory.dmp

Download

memory/2348-316-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/2348-318-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/3192-251-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/3192-247-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/3456-333-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/3456-458-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/3516-287-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/3520-325-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/3520-456-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/3692-271-0x0000000000570000-0x00000000005D7000-memory.dmp

Download

memory/3692-270-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/3692-328-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/3976-455-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/3976-321-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/3992-302-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/3992-451-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/4420-237-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/4420-12-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/4508-320-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/4508-252-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/4600-332-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/4600-280-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/5080-283-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/5080-450-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/5080-337-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/5092-76-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5092-78-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/5092-70-0x00000000007E0000-0x0000000000840000-memory.dmp

Download