532fb3b38a5d93ef65f8dfad280c72974e45d62bf672f074f9445c75bb9aa284

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
08/06/2024, 19:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-06-08_845e2b31575fc0b09d34d13b967eb138_bkransomware_karagany.exe
Size 1.5MB
Sample240608-x18bbsfg79
SHA256 532fb3b38a5d93ef65f8dfad280c72974e45d62bf672f074f9445c75bb9aa284
MD5 845e2b31575fc0b09d34d13b967eb138
SHA1 feda4e7d83299be1c3d348eb46097b4c2477fbb8
SHA512 0593630675ca6bdff396e38b7a6ae9115747c426cb422a78b3308066825951148aec8b36044fd1566027c38ae627fe99d97a62162d0f2ac5dca342858fe14970
SSDEEP 12288:8vXk1lUNU1FBtfcPKcOYRLbzQkbL+Qg+H5oeIj5RLLB+lOakPprNFzSRY:4k1D8S+LbzQkWWbCzLLB+lMP1NFzSRY
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
2152	alg.exe
3200	elevation_service.exe
4540	elevation_service.exe
4880	maintenanceservice.exe
1688	OSE.EXE
4576	DiagnosticsHub.StandardCollector.Service.exe
4956	fxssvc.exe
4328	msdtc.exe
1524	PerceptionSimulationService.exe
3052	perfhost.exe
2516	locator.exe
960	SensorDataService.exe
1664	snmptrap.exe
4580	spectrum.exe
1180	ssh-agent.exe
4680	TieringEngineService.exe
3968	AgentService.exe
3520	vds.exe
4620	vssvc.exe
5036	wbengine.exe
2900	WmiApSrv.exe
2220	SearchIndexer.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in System32 directory 30 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\dllhost.exe	alg.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	alg.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2024-06-08_845e2b31575fc0b09d34d13b967eb138_bkransomware_karagany.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2024-06-08_845e2b31575fc0b09d34d13b967eb138_bkransomware_karagany.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2024-06-08_845e2b31575fc0b09d34d13b967eb138_bkransomware_karagany.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2024-06-08_845e2b31575fc0b09d34d13b967eb138_bkransomware_karagany.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\3057b1ded590e271.bin	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	alg.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdate.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateSetup.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	alg.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006b34961ad9b9da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000005fc5c1ad9b9da01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cae6871ad9b9da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000260f701ad9b9da01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009171181cd9b9da01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005036771ad9b9da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003d797d1bd9b9da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c6488a1ad9b9da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000b71721ad9b9da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
3200	elevation_service.exe
3200	elevation_service.exe
3200	elevation_service.exe
3200	elevation_service.exe
3200	elevation_service.exe
3200	elevation_service.exe
3200	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
660	Process not Found
660	Process not Found

Suspicious use of AdjustPrivilegeToken 42 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2252	2024-06-08_845e2b31575fc0b09d34d13b967eb138_bkransomware_karagany.exe
Token: SeDebugPrivilege	2152	alg.exe
Token: SeDebugPrivilege	2152	alg.exe
Token: SeDebugPrivilege	2152	alg.exe
Token: SeTakeOwnershipPrivilege	3200	elevation_service.exe
Token: SeAuditPrivilege	4956	fxssvc.exe
Token: SeRestorePrivilege	4680	TieringEngineService.exe
Token: SeManageVolumePrivilege	4680	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	3968	AgentService.exe
Token: SeBackupPrivilege	4620	vssvc.exe
Token: SeRestorePrivilege	4620	vssvc.exe
Token: SeAuditPrivilege	4620	vssvc.exe
Token: SeBackupPrivilege	5036	wbengine.exe
Token: SeRestorePrivilege	5036	wbengine.exe
Token: SeSecurityPrivilege	5036	wbengine.exe
Token: 33	2220	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2220	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2220	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2220	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2220	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2220	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2220	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2220	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2220	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2220	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2220	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2220	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2220	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2220	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2220	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2220	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2220	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2220	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2220	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2220	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2220	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2220	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2220	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2220	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2220	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2220	SearchIndexer.exe
Token: SeDebugPrivilege	3200	elevation_service.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2220 wrote to memory of 920	2220	SearchIndexer.exe	119
PID 2220 wrote to memory of 920	2220	SearchIndexer.exe	119
PID 2220 wrote to memory of 3456	2220	SearchIndexer.exe	120
PID 2220 wrote to memory of 3456	2220	SearchIndexer.exe	120

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2024-06-08_845e2b31575fc0b09d34d13b967eb138_bkransomware_karagany.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-08_845e2b31575fc0b09d34d13b967eb138_bkransomware_karagany.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:2252

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:2152

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3200

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4540

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4880

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1688

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:4576

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:728

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4956

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4328

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1524

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:3052

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:2516

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:960

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:1664

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4580

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1180

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:2056

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4680

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3968

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:3520

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4620

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5036

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:2900

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2220
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:920
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
  2⤵
  - Modifies data under HKEY_USERS
  PID:3456

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
Size 2.1MB
SHA256 0430c4e797ae89a1ad30d1e96313e0efccc18834612c81f9085fa4e8a4b78ef2
MD5 7d0f489c19e30e192347a37977180d02
SHA1 4fe8024c5e3d60e35a95019384846c797880e8e3
SHA512 6690b37e91ef2cfa16c9f28647298429ed814f1a34288c5a16cabefb6a6a4304a83309a4e6927e8bb22ba056ee933295458095d043f6d795321162e0e98c9a62
SSDEEP 49152:zuYk3H5koUXfTqkkYLO/W2buywzMbOX+T7z5L8FD5nb2LLPrFmRY:zPfTqi90bX8F1b6TwY
MD5 SHA1 SHA512 SSDEEP

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 37a6983e2fbadc5646d1616e6c2c22a1152551cd71a6fc9d16b9a66793519ab7
MD5 9192b3c99170e9201bddd46df9a78d26
SHA1 ac9fb7e64fc2227973226b080899fbe1b7052cbe
SHA512 831f8bc67d13243aacd812e835ddc30f27cf697a56320b1831c93f39e3dd4664d9881e9488e5bd18654d276ab2da8abe5fb0f916cddac1f42437b04f89cd1275
SSDEEP 24576:PiTnBsuEM8S+LbzQkWWbCzLLB+lMP1NFzSRY:USuV8FD5nb2LLPrFmRY
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 12cc850ab5679cfa8a418decc9301f2dfc4a8c01b59e3a33583bd45fc6199ed4
MD5 ffa4aeaaa8f2c885e522d7062e9d60f4
SHA1 27e0de3302c2e4ae5add5797f8fc122a72be70f3
SHA512 439f437c89c4d2e6e08bbc2efd5c271b16e0451f05c3720e869d0550b6f2278e1da9d14e4d11e1570ad8b6be342941b392959ae955212c31de7622fe9a1692e0
SSDEEP 24576:X+gkEHfh4Cog8S+LbzQkWWbCzLLB+lMP1NFzSRY:ugkE/Sq8FD5nb2LLPrFmRY
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 8741739334431f72eaa6bad1e9a0780bbfdf89d0fec15755dfd5d80b6c57ff14
MD5 bae6501c1b2bb85cb7643311ddc15f55
SHA1 757cb31709679b32d86b55f9cddb7fada84eb621
SHA512 82829a75bc7abf57f17a043edd4958e8122326d4c7c28bd41ca920ffcd94cbd43adfe4486922e91b1b48d443257336fefea8efca31220808fb71d2c949bde9bb
SSDEEP 24576:PBpDRmi78gkPXlyo0Gxjrv8S+LbzQkWWbCzLLB+lMP1NFzSRY:ZNRmi78gkPX4o0Gxjr8FD5nb2LLPrFma
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 0ad56e11cafb9e08d099f32f4e6dcb5d51fa988fc85d499cf38207350fff75d4
MD5 2ea32e686f806748ce6d776babe92e79
SHA1 aee7951812d485893c3325c51f8e62a56a6e005a
SHA512 ca16d04c7671670f7ab7398487a5a5f1c64e5ea5237dbf07ca1c4fb80848105b0e904f35b6c6669cbee1e26d14f79d852aa6ad29e1dd776799f09c8a3c886833
SSDEEP 24576:8LOS2oyPIXVg8S+LbzQkWWbCzLLB+lMP1NFzSRY:E/yT8FD5nb2LLPrFmRY
MD5 SHA1 SHA512 SSDEEP

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 559c061e4e0ce144fb08f4573ac4ead2fea6a3cb3dc9ac5ef80b759820b7c975
MD5 0da8c3dfd0a5bdf381613f0385b6838f
SHA1 c6fbd67fba5d2748aa93188225ab5639b32577c4
SHA512 4f28384840e8e587f5c7df0fba2d907f305dbe3b9858fdd84c145ab747c570f11461cbc78edfa569155c7315f125e1c732eaa5b7309b6ea458161d89293144b8
SSDEEP 12288:ntiUNU1FBtfcPKcOYRLbzQkbL+Qg+H5oeIj5RLLB+lOakPprNFzSRY:ntK8S+LbzQkWWbCzLLB+lMP1NFzSRY
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 e5c06f061de4bd8977d0a4298b8a59d9c00c1041208f296535a65e7f8dc29f0d
MD5 65fa13ab7a570e4aac67bcc1a2ad127b
SHA1 83f9dc58b6b5b5c3ea779e2c81eb1460b6f264ab
SHA512 a76f28e009e0f3ac8270c7f086e32e3a0022b2f8957d1eb7452556ca07a9d066d796f6ca9a118cf8ac091350b876a0d7ecb0d70a0f95b4e798d6fbb31d9fa846
SSDEEP 24576:xJIUR8S+LbzQkWWbCzLLB+lMP1NFzSRY:xJIUR8FD5nb2LLPrFmRY
MD5 SHA1 SHA512 SSDEEP

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 4d7c9aa68cf2d5e24bfe17887b17111af2a565332da2062a6c7ab734fa2cfcc6
MD5 c674de77d7ed322991b7b8ed036041b7
SHA1 56ceb396150233ddaa518a1be402a50720ba0ce7
SHA512 174f378d96c25b5f80aabe2fe1f83d8a9b47c7b7b9788cb32b4294f55fe4b421d0f1747780797e9a2ed9c0b2e06e3d6a381f0f3d6a50e3e5c635cdd4c2fb57cd
SSDEEP 49152:3QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THL:3QvGAdlCEL8c/yRNw5CU8F1b6TwY
MD5 SHA1 SHA512 SSDEEP

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 fe730f651dea769c4ab4984631c4e3b6415592083989c7a719a23a2bf2ea2af4
MD5 3f7e3e50bfa9e76b19dc9e909e9cfc7e
SHA1 b31213dd0d3895d1e2e809e58190d30642bac238
SHA512 dfbfefdf59dc50fbf52a8f85f01036dd5a504250f99577a8f0571b5e83fda1f6c877edcc4829b3113ca874927d15c577668555b37eb607be0371c5a1aa3a0a1d
SSDEEP 24576:f7ewsAjX8S+LbzQkWWbCzLLB+lMP1NFzSRY:jljX8FD5nb2LLPrFmRY
MD5 SHA1 SHA512 SSDEEP

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 19c82f6bab6af1af4d3fb8fce70b45e335dcdb7b91c06fd4999f0abfb1166d0c
MD5 b4e85f5597e6596f7c858965050c1293
SHA1 050500eba6055ba5c6bb69d7de651b1d875db3bb
SHA512 7cfb327d244aec0b159f486c543f57698ef7597a9a1081bf4af642d93fa3a33dfbc824cf46000a6cebae486981a7bfed4315cfb33eb408ad2c1c1f7dde026657
SSDEEP 196608:5UEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHkFZnY:5UEtQevvqc2W1cpV2EI32kZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 d3ea24a01c87216b00a58de34a73ad0223ee5faa6a77d7a68fcf4a7b58312814
MD5 e5d0fcda5f57ae3e9a89d0ec5a607d10
SHA1 888036f343640ce5f3dbc0216e5fa8212a20f37a
SHA512 06f022f80b1f3bf04a5ae164c475214a5428a9332cc10a8c27dd56a9772fa22565fa885783ad26a5bf21ba10ff308df46bb0e66498e9bc67b13bbb0b2d6a78c0
SSDEEP 49152:1CbRquA/m2yL5zifFiV+XenmE3/z38FD5nb2LLPrFmRY:ioqHVjnmQ8F1b6TwY
MD5 SHA1 SHA512 SSDEEP

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 983d56a10546cb923e1e1a6c97328318defc87085b342ae1dcaf085a0c95324c
MD5 653e7662934d3d12fa7d301f545a5b2f
SHA1 127186c2cfc8195f71c9c62c3f61dc08dedc0d0b
SHA512 0016b552c304a0096f7a367e2b702d4f92848a26fe745ece7802cd7b1d80ac2a4ab3bcb32b6760fafc1321e38ebf6a197bfafe0e63d0069a1b446e8512a61ee1
SSDEEP 24576:jAhGLJIFoiwtA5l7S53w8S+LbzQkWWbCzLLB+lMP1NFzSRY:jAMyFoiq5A8FD5nb2LLPrFmRY
MD5 SHA1 SHA512 SSDEEP

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 8eea4e36b22c86dc842032859b2ae3448f63006cac86b85ddce911a3bc57295f
MD5 173e84aaab1280802f8340350fd6af0c
SHA1 0ffcca23fccb63b9f3516c9018ef9cdf582a0695
SHA512 97348dc2674419fb6ac21c9a7ba430ad71f6ee0ccdcf805a76d42f99036cb6f02a0021ef3fa89278f4c64cb3166938af6cea9bd9a9dfe6ac3ed3b1a65745eac4
SSDEEP 24576:BwuSOWT8S+LbzQkWWbCzLLB+lMP1NFzSRY:Bw9O88FD5nb2LLPrFmRY
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 3d43681a9f0ddf17549cadec414394630a31ac6a733d539de4a896732c063345
MD5 a1677d51d854de5b62228bda9cf36380
SHA1 1014fac2b6e3c2e450a3ac884e3a42af81af7e2b
SHA512 9fcc37fd5cfa428bb2d684efd110d9cd69136e83db064a3730e869f5ec34c0771fe3cfb07721f7d52f94e3d0457ffe73faeaca6b8704e89485c9cbe37c5afcbc
SSDEEP 12288:8jZ1IyxUNU1FBtfcPKcOYRLbzQkbL+Qg+H5oeIj5RLLB+lOakPprNFzSRY:IZue8S+LbzQkWWbCzLLB+lMP1NFzSRY
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
Size 5.4MB
SHA256 f442248b74be1703f84a0c9bcf762583d2f48c0cea41003864bc45144cd2b65c
MD5 a79db416abff91b982befdd8723d5018
SHA1 25cc641bcab14fca17cd62eaf7811afcb50e8eac
SHA512 3e49a1e2de569ea7247bfe7387183d189506cb3b5c852f02b4254df44a35b91af1f49549049b0a8c576114bd672f7b874ea4b25e4c9e25f8d3f324d9c5a62b3c
SSDEEP 98304:RwfhY7g/rLd7yYA3awr341gI8F1b6TwY:z78yh3FZnY
MD5 SHA1 SHA512 SSDEEP

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe
Size 5.4MB
SHA256 415913040a5bde3cd6ff8dee898769806928e8490ab1373d3ff7ca8fc47e945b
MD5 d1bd961b2398e82c87ca0d4644af3f12
SHA1 88220eb1c8b77e31efade60cca7830c53e40b901
SHA512 ba70945c51579e6a1b4930808e9fc9d60f017cbdbdf6c7969c9f333e7c32bf6d6f6e6c3aa87aa25e7ad473d9b642424ce454f6bb0771310db7af121a7d098e81
SSDEEP 98304:dwfhY7g/rLd7yYA3awr341gI8F1b6TwY:f78yh3FZnY
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe
Size 2.0MB
SHA256 fc4df2eee97601266164658b0399aefa67fe9984aa995cbc73e74a50d1f1876c
MD5 9e278b27d21f68db6192ecc89ad15d54
SHA1 c539944d792092f8f95901daba74a214b37d1e61
SHA512 9863a0ebbd7a5f5ca067782bef0628d92c3caa97d4d86d830767030b26f0cf8d44d0a3e01440c63bf02429a516274e36c84b0af1701ff84df1ac83603428377b
SSDEEP 24576:xcTyYv0FteQU+5I2kjgD6iQacAT8S+LbzQkWWbCzLLB+lMP1NFzSRY:xuXv0Ftpn5606zOT8FD5nb2LLPrFmRY
MD5 SHA1 SHA512 SSDEEP

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
Size 2.2MB
SHA256 487f0d4d5c0109b87cf9d4071ac3892ee9c8d9e619c504c35351bff49d0f4676
MD5 97979da0f57bf310a932d23db4089779
SHA1 db80880b94cf69431dd491abb8fc8e54b41584d7
SHA512 d9166344097a8e4ab7a7cdeb85903973493b7d0b895988efd8c65051786ec7286477095a6fd8b818eed38aa13afd24ccc3b6da5fc81ade4b35272fc35e982ae4
SSDEEP 49152:fy7mTd0GxN8jyynxHjXKUyn4GVcbDSKrNTxX8FD5nb2LLPrFmRY:KmYeyxHjWjMTX8F1b6TwY
MD5 SHA1 SHA512 SSDEEP

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe
Size 1.8MB
SHA256 95c074af277d7852a475fc3abe52daefb29411c6a0be6c48de9b1f60f1afa062
MD5 ef0494faf804f67aa4d8ef7eb678652c
SHA1 6c3e2f9838da5d35844a877983963b6f653d8f05
SHA512 385f31ad3721030367f6ce9bf5fa6791317f0a340acd8aa0422b17d18bffc1c8b806bf0cd086f7af27b573f02ed7bb89a453fbc1a4a6b3a4bc4f01665f14586e
SSDEEP 24576:o6drZn1WEci182IEUeNbJeRgUebgW816m8S+LbzQkWWbCzLLB+lMP1NFzSRY:oWnDci18yNNUgbYL8FD5nb2LLPrFmRY
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 1.7MB
SHA256 888a49a46143791d60f9c3e9f9ef581efec0d6f17a75becbe733a84c3888c4f0
MD5 0ea7e625abdd261f6411e70eff5dab0a
SHA1 17c93f3a4075ee83cf2e2cd850e00de5edd62932
SHA512 77243cc2be759dc84566dde36cb2cb6791c45245a032908b35a1559b5a14fe82cf02ca0daa048469216f03c5b25fcdeffbaa1950b2288de0fe3aa468ed301595
SSDEEP 24576:fk5lHW5EzMZupO80G2reD+melRgTTv/1nyV8S+LbzQkWWbCzLLB+lMP1NFzSRY:/izMZm0GhamSoe8FD5nb2LLPrFmRY
MD5 SHA1 SHA512 SSDEEP

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 5407f2e1f9cc84f8d6bb96e0fdd251b57f9b8ee1f68599917f63780450860198
MD5 0d3e5a3c99af95438391263aab81ecd7
SHA1 6858f8c036ac419024701615d9bb7382670c10f5
SHA512 809ff594b9336eeae621c9642428576752bdaf610b1ad6d7c838f604923739699175cd8dd6abd529a5ac0b50f1a09fa9d59ce829cd60227c6cdee2e368ede617
SSDEEP 12288:g6UNU1FBtfcPKcOYRLbzQkbL+Qg+H5oeIj5RLLB+lOakPprNFzSRY:gi8S+LbzQkWWbCzLLB+lMP1NFzSRY
MD5 SHA1 SHA512 SSDEEP

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 b8e3e3d37d8cd56cf2290dd6ee63e929f6e8907c19adc80c9d583ad1c2ae1818
MD5 04b74d125191b1e9b9e24c246b8a2e9d
SHA1 3f11f7db4cfaef3ccfbec113d50d8d6ed00825f6
SHA512 2961477c3cb06b8c65b7cd25ab29684523ce65390b9cbe3394e6f6cebbaf9c215e122d585b01d0ab4852e2ef64d59c4fa10d72e8bfbdbcae3093d9f44372429e
SSDEEP 12288:adUNU1FBtfcPKcOYRLbzQkbL+Qg+H5oeIj5RLLB+lOakPprNFzSRY:a78S+LbzQkWWbCzLLB+lMP1NFzSRY
MD5 SHA1 SHA512 SSDEEP

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 bbeea9cd536e06ec515302cb8822b99c59bd714b8e12b4ecd8b0018ec2476032
MD5 b18a24c33e04a850a79d9d93e5ed5d93
SHA1 0e81e030cb184bbf25a31f4e600bec73afbfad63
SHA512 f4fb2317340973c8863c2e532ce57485d7f57dfe98db900245f5a647d7be4679f741946ba608db332de636b0f7fc2370bad05b3860bff032be8b8294bc6b2cc7
SSDEEP 12288:1DUNU1FBtfcPKcOYRLbzQkbL+Qg+H5oeIj5RLLB+lOakPprNFzSRY:1J8S+LbzQkWWbCzLLB+lMP1NFzSRY
MD5 SHA1 SHA512 SSDEEP

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 d5a8971ada82e15462eea6e324fbe9c2a2274f1a2a0d62618b1774537fc49e4a
MD5 3d2b53f304e9fe94fd5e350a8e074756
SHA1 5c02079e7b233c09bbdeae0ca15bdeb33e4a7ad2
SHA512 8c9c065addc3d8dcb56cb719f6eb217ab4914c03bdc794670241a1b8af758770f8c598ab17ffcfc203e79ccaba5f740124ddb81958a02f8e3d122be6ed9396de
SSDEEP 12288:AV4UNU1FBtfcPKcOYRLbzQkbL+Qg+H5oeIj5RLLB+lOakPprNFzSRY:B8S+LbzQkWWbCzLLB+lMP1NFzSRY
MD5 SHA1 SHA512 SSDEEP

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 a6604582917073c5e0797da70d6454d3695da7ea7fb50bbfff8960a9472a31c9
MD5 33ef14e522051a7b8099fb060dec0255
SHA1 673391a7de544795c197ccae23a907fc8ef93239
SHA512 64dc40a77ad2ef69ee41879470927014054cf5dda18bb7c7525566dfebe3d074611123b9ebde7d146946c6609c2a1ba41f757ebca094fdf314cd5ea288c0bb26
SSDEEP 12288:wgUNU1FBtfcPKcOYRLbzQkbL+Qg+H5oeIj5RLLB+lOakPprNFzSRY:wY8S+LbzQkWWbCzLLB+lMP1NFzSRY
MD5 SHA1 SHA512 SSDEEP

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 990328f934446c033c10200953779b3b80a647a69ec96b172277bd182e0c03b5
MD5 6389830386087f85b25031629e1e08c1
SHA1 826c682138affa0788cd5c32ddc4b3306c132a30
SHA512 90909a3a4a20ead7672a1562e064a432e9b067619083e13d0e5ab676f941cc24edfc0ffbb2a48b1020a2b2dd6aedf9a30195c30709a8f3d4ee17e9ff295f27f2
SSDEEP 12288:25UNU1FBtfcPKcOYRLbzQkbL+Qg+H5oeIj5RLLB+lOakPprNFzSRY:2v8S+LbzQkWWbCzLLB+lMP1NFzSRY
MD5 SHA1 SHA512 SSDEEP

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 509f690ec3d3d8dcd4e27ab490a383a473ae472cadd279df664b51766930d1e3
MD5 615172cbe2d330bbf3db980852a758e1
SHA1 0c86f7e3016376f85388937ad95b4bd0a7c1daab
SHA512 a0898fc985d7b8404c99483b6dfcde3b9f0ed2354cacfe7bd87e820537575896624c396c07fc5cdb328b6a88f86526e2ed7408486851015013eca0a04cdb9b82
SSDEEP 12288:VFUNU1FBtfcPKcOYRLbzQkbL+Qg+H5oeIj5RLLB+lOakPprNFzSRY:Vj8S+LbzQkWWbCzLLB+lMP1NFzSRY
MD5 SHA1 SHA512 SSDEEP

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 6c9fa132ae01db3907987b8f9996a5dd3be166f0bc13c4851c706eb8524dde99
MD5 604f35ffdef4e93096cb6bbfdd6474bb
SHA1 4ff5bb153adc3eb36d293b33d0169c212ab3736e
SHA512 2ece6ad436024215ac464a10a34e49d520347c584e0fe398898d8797862416435d3bc0056a79d70e287df7869ba5c19cd337f5472293669f5e8794198c2f5db4
SSDEEP 24576:SZMEzFVSOb8S+LbzQkWWbCzLLB+lMP1NFzSRY:SZMEzff8FD5nb2LLPrFmRY
MD5 SHA1 SHA512 SSDEEP

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 cc82452eae3f2f33c6d6ecd94ed03f8e2339d5c56ef9080799c2e0e748aa69d5
MD5 4d601439721df49d1acaab3f122c1dd6
SHA1 4e153759ae42bd5281ad80173d999ceaf744b06a
SHA512 6da94f54038403489a2c17041346d8a47f855f61c55153a133386c7426e525140e704aaa0550d8cacb33b33fb147970cceb2dc36aecf023ced4e9b424d0a3df1
SSDEEP 12288:YeUNU1FBtfcPKcOYRLbzQkbL+Qg+H5oeIj5RLLB+lOakPprNFzSRY:YO8S+LbzQkWWbCzLLB+lMP1NFzSRY
MD5 SHA1 SHA512 SSDEEP

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 ae640fa8d3794923e250618b3e7209d1a4032f46328cec60e363b6906a712d4a
MD5 aab32d14d557141dfda5a64a909c5d1f
SHA1 6e23d5ec2c0ca58a7516010fa41075239144b35c
SHA512 3c9f2cc757c4b2d4b6258d28ca217444f8a3e6b01b5f878c772c9a0d3e1f7851ee9f07639f776136d1c64b5d26818930f70c7b30d59015559bc581533a19cedf
SSDEEP 12288:0SUNU1FBtfcPKcOYRLbzQkbL+Qg+H5oeIj5RLLB+lOakPprNFzSRY:068S+LbzQkWWbCzLLB+lMP1NFzSRY
MD5 SHA1 SHA512 SSDEEP

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 c3e05c4dab4f3d09c4f8bda77bc908f8e2dc33c1867c88ad3779cdc45f9c2984
MD5 6a3c602a04e1c75f542e6f61fa9e4060
SHA1 fcb59692ef55ad7defa8247d4297092da7fbe2d5
SHA512 5c25cd45e4df2aa21d3f78c517716a5f7db73a9e6cc62f7268a9e32a954119966b8025690b1645cc47b84afa906cc6fe79b74674154473de39e68f87079399aa
SSDEEP 12288:0yPz5L8xUNU1FBtfcPKcOYRLbzQkbL+Qg+H5oeIj5RLLB+lOakPprNFzSRY:tzyH8S+LbzQkWWbCzLLB+lMP1NFzSRY
MD5 SHA1 SHA512 SSDEEP

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 6ccbf54441da25a302c55c5f06c56a86536e5f752e70295b1db1da0610d321d5
MD5 e18e405bc325fa156f1a4ab8abd4f78b
SHA1 99ee62669aaa44b6da792ce243ccc86c7d722a56
SHA512 4e75fc111c827b09fdc019c71a4341488f7d9d8ce1ab61a2a2272ad503b3c7118adc07385b0af98bf20a524d0bdf2ff316cb43328b52c3ebc9416972b4eabaf4
SSDEEP 12288:peUNU1FBtfcPKcOYRLbzQkbL+Qg+H5oeIj5RLLB+lOakPprNFzSRY:pO8S+LbzQkWWbCzLLB+lMP1NFzSRY
MD5 SHA1 SHA512 SSDEEP

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 d90ef7ed7e883137d144586ddb290bb09b2a035b1234332dc6e1d814cffe69a4
MD5 f26e73e126e52df6e6c52ecca59c8ae4
SHA1 a0b5e9039f500f3067e42e7c9a415a3d64133c3b
SHA512 16f8891044d1526760e9dbf6286555b5571d752ae43d1fa5c6609bed1a0e644c809d224389effea5b8e37f384617f21a5adf55f2005bacb32c3b81d8d4df9c3a
SSDEEP 12288:TeUNU1FBtfcPKcOYRLbzQkbL+Qg+H5oeIj5RLLB+lOakPprNFzSRY:TO8S+LbzQkWWbCzLLB+lMP1NFzSRY
MD5 SHA1 SHA512 SSDEEP

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 213e93ead024c8039aaa21e1546b580a319e74dfdcb37b850b503b7558ea1d17
MD5 f615257d0907fe83f4c4952fa3ca8e14
SHA1 8de1165305d40e920841331e9df9f6b3c726f806
SHA512 28a9ce27ae358c1b70646985bd832622a23ff55f1fbbda0ab89e302efa9cc652e7f7c7e16b559b24fdf17b74f7551dd1da250610da98d7c9d69d24ad2f966f00
SSDEEP 12288:1yPz5L8xUNU1FBtfcPKcOYRLbzQkbL+Qg+H5oeIj5RLLB+lOakPprNFzSRY:czyH8S+LbzQkWWbCzLLB+lMP1NFzSRY
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.7MB
SHA256 fd7ef14986c28198929ddc78e0cb57d94467df2c35554dbb400516c739b02bb5
MD5 8d0f0b9c11c7cf063a748f2bbe2699c5
SHA1 4a833eabb6d4ebcfa8b9efa3c0b58c9f24444842
SHA512 cc2e02aa78cbae2240d051b195aeb43c093f7f9f0da79b97fac9cf99f2bb6bd24c23af35105c983e437906edfaa7bd6483ab60f216f916639cecdbcb8d22b8b3
SSDEEP 24576:jTdaLl3z0zDZ8S+LbzQkWWbCzLLB+lMP1NFzSRY:jTwLljk8FD5nb2LLPrFmRY
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.9MB
SHA256 5f075b94a449045909f8a77cb97d63174b73755e7302c20b88ddcc07217fd34e
MD5 8b8435b01c6804a4c2e3749c90f1c261
SHA1 e95b77bc1f2838961468af52b1bb644ad9afa637
SHA512 b4642fa19356228860a2d7017b78a9bfd3acc1850750661d7ab005247b1865b795a7e7e53c5dfcd100982e2c6c38dc1ae6b55a9adafbaecb60baddd4832f179d
SSDEEP 24576:/35d9CHKy7GZd8S+LbzQkWWbCzLLB+lMP1NFzSRY:P5d9CHKyaf8FD5nb2LLPrFmRY
MD5 SHA1 SHA512 SSDEEP

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 c6c23e0e8ec020fd78806af5e51f37b3fc5888f147b11887a46bb05397d7958e
MD5 a2109adbd80cbfb67c38697b0c6c3455
SHA1 1dab78d2236578408885da5386cc5a1928bde6b0
SHA512 2ebe62e75686e2ecea621f58bd8a0907887d9458cfb55330d05dc9bb609e46ae769452c503e36fd9210df977ee584f3c866b3ec0ba1b5f89d1beebc006eb58f7
SSDEEP 12288:KjUNU1FBtfcPKcOYRLbzQkbL+Qg+H5oeIj5RLLB+lOakPprNFzSRY:Kp8S+LbzQkWWbCzLLB+lMP1NFzSRY
MD5 SHA1 SHA512 SSDEEP

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 223b34c93b06e7aab2cbaf554595920ceb9b4ab345172308ed24b715025b8811
MD5 19cbd3c41bd75e79fb92bebb6f1a1c0d
SHA1 a01c818f9aac14326b5dd6a36755850fe4369546
SHA512 cb6d2c40563fc2a6342f3b7d32882779faff4062b8fb3ca7102e3819957abb5efe75bbe3b6ab45525f52549685096f02a23401bcbf60913433928bf64a1dab07
SSDEEP 12288:9RUNU1FBtfcPKcOYRLbzQkbL+Qg+H5oeIj5RLLB+lOakPprNFzSRY:9n8S+LbzQkWWbCzLLB+lMP1NFzSRY
MD5 SHA1 SHA512 SSDEEP

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.4MB
SHA256 1b242f8cedf82bbbab02cf3964a28bb901def49019d8a59f5685d9fc4bcea84c
MD5 345a36deeaf5076faedfc33c525d9465
SHA1 2ca993692854f7b816a0bf70a584885d5ac9377c
SHA512 77fe2832359bbfd872f51eee0fd33bd910d0ff89995bb6a20287920b0de25a042ddb77dbe595d4c4d5cb0d7784f9a54f4f7ac142330959b9f3fe86a1a0a82010
SSDEEP 12288:XcUNU1FBtfcPKcOYRLbzQkbL+Qg+H5oeIj5RLLB+lOakPprNFzSRY:XM8S+LbzQkWWbCzLLB+lMP1NFzSRY
MD5 SHA1 SHA512 SSDEEP

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.4MB
SHA256 ef5bf578407cb5974d5bed25818e764198ce133e5ced78c939629fe9a03e5bfb
MD5 d137822551c42fc6a28503a587fc5fd5
SHA1 0239f77bc0c44214c06948c54f4bf4a565c150d9
SHA512 eea1042e5849896ca69e3a0c59677fb72108ebd15e466f29e0a4de6123c5d079b7301b618ede69e0cfbc0b19fa4dfec1b9c193b20368f9d44bed0ab3b70afd7d
SSDEEP 12288:AeUNU1FBtfcPKcOYRLbzQkbL+Qg+H5oeIj5RLLB+lOakPprNFzSRY:AO8S+LbzQkWWbCzLLB+lMP1NFzSRY
MD5 SHA1 SHA512 SSDEEP

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.4MB
SHA256 ffd6bf40f5f4873030ebc5bd349c9187b280490992d86ad583b34b768c00aad5
MD5 07b585d127c5c7ea44d4d8f065438b5d
SHA1 3c4d7f7c7a3112a008231301fe21ec4d53752979
SHA512 dc448ec3c4ccd1912d2b76b52efdffc668155afb7d67b305a7d4fad6b452ee1bd1f052b8791b1cf994212d8bb601f37a81635a3ea03fe3992e41a0eacf85c498
SSDEEP 12288:djUNU1FBtfcPKcOYRLbzQkbL+Qg+H5oeIj5RLLB+lOakPprNFzSRY:dp8S+LbzQkWWbCzLLB+lMP1NFzSRY
MD5 SHA1 SHA512 SSDEEP

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.4MB
SHA256 78f2907985f869a57bfbcf0857ba3e03600c44db759c36d993465224fca284b1
MD5 6b0446c033cfcd9284c5e94e556d7517
SHA1 d92d78828b1585f76af99d347f3fc8579512785b
SHA512 37618c520194f374755c43b5f9b084c64a6e1f462b99e580b7182ca2fb5fc1c41c5239e1de2105690431a157eca9fc416c28d372d1cb02b81c003d66ead9eea2
SSDEEP 12288:CGUNU1FBtfcPKcOYRLbzQkbL+Qg+H5oeIj5RLLB+lOakPprNFzSRY:C28S+LbzQkWWbCzLLB+lMP1NFzSRY
MD5 SHA1 SHA512 SSDEEP

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 e67f92dcea53fc80a12babe5840f21e40bccf7e6f7b2f9b7d0643e566e8cfbc6
MD5 f473ea8c07d7dda0e0130b119fc9df11
SHA1 397a3fa96bc1735a85c693f119c82a510acfe10b
SHA512 47eede8f4c340b6242e7c431323b3afdaa9e6a52fff541a9c6b41930b105e38d56694f90d3d7ad12939c20c296e37c1296380482dece524b1be7d431367d4091
SSDEEP 12288:GUFmDDLPUNU1FBtfcPKcOYRLbzQkbL+Qg+H5oeIj5RLLB+lOakPprNFzSRY:8t8S+LbzQkWWbCzLLB+lMP1NFzSRY
MD5 SHA1 SHA512 SSDEEP

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 ec7a3eb984870c11d02061f87255852792e9683147d97dfd5dd1ef274da9dd46
MD5 a201caecc2df942b32a49b0fef58c107
SHA1 c46b3c660a8992ce747fa2e8e5535782e0c4efb0
SHA512 dea9ffdf33ef78f5e382b06adf6dd73be9f0c99371f6ee84020c2d5120429c94e75f6329160e9b8a43944ee721c3e9d04ab9ae3f65f7b10090737386015d38ac
SSDEEP 12288:FlUNU1FBtfcPKcOYRLbzQkbL+Qg+H5oeIj5RLLB+lOakPprNFzSRY:FD8S+LbzQkWWbCzLLB+lMP1NFzSRY
MD5 SHA1 SHA512 SSDEEP

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 324562e045bb969319904306024e0a25962f5fe289ccb32916fed529059ac4b6
MD5 12a6ae269d5a7f987ecc741f631bd949
SHA1 0fb54ee055b4ae8c7edd2a54e2a11e7e01cdf4d1
SHA512 f0ea067ce3962a41323ff525f3e645bb7ff08884608c7a3e3bda3d347a67576b15ae5dfdc628785ee8c69161b93159d4537b61223fed09b0b778f80ee95c0cb7
SSDEEP 49152:Da0h2GEkuAe73q3pp46zwwQp8FD5nb2LLPrFmRY:Da0hNYG4JwC8F1b6TwY
MD5 SHA1 SHA512 SSDEEP

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.5MB
SHA256 2a35dee7adf906a3163c9be258eaf2c584a58d640578bf7a6f57ae776a160d95
MD5 77d923a931fb3187d37b270118c8b124
SHA1 6534d024485e4d4f4c7eb91cac37e077141364d5
SHA512 27bf35acaa68b93f7c662916f278b2d3435c0580f9b300592d8a45aeaf2521ce1ac58882b76d0bde28b05310b7800c1f0595071cccb8d2e079f3b317edb14194
SSDEEP 24576:ghbHjPe8S+LbzQkWWbCzLLB+lMP1NFzSRY:ghbHjG8FD5nb2LLPrFmRY
MD5 SHA1 SHA512 SSDEEP

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 d8dbde29182ae0cb1ac21b50b57f8f08508fc12c77115dff3a9075824736c697
MD5 8c9a6efb452c6f5bd2895506931fcd9b
SHA1 1eb35b1b4fdf909a2393f19d4d167df075dc705e
SHA512 1386b2dc02d5dcbf430ff6fc3e9faf4e63275be84b12258257bf332147f11662967150fe42cdabd1b0ba91ca3d81787bf4e9d96c0cc4855e051a6d1dd36517fd
SSDEEP 24576:X3YgnJcRTk4yti+R5dpR/28S+LbzQkWWbCzLLB+lMP1NFzSRY:XIgnaTk46ppR/28FD5nb2LLPrFmRY
MD5 SHA1 SHA512 SSDEEP

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.4MB
SHA256 082f5779ffcc23793b3b9ae8379bdda13fd4a3ab93313f73df3bb5694735da07
MD5 e88ec2cbb4e2465377687fe11212968d
SHA1 b3da751234f6504ff41d561a4798f9859b1883c9
SHA512 8e32a00cfd2a38dd1d16d0828903db92d3dbbf04e3807feeeee9b5dcaee28f0a903eaa78f74d1c41128b102e868bb1799a330e07c89d6849e496182d9a49361a
SSDEEP 12288:WpUNU1FBtfcPKcOYRLbzQkbL+Qg+H5oeIj5RLLB+lOakPprNFzSRY:Wf8S+LbzQkWWbCzLLB+lMP1NFzSRY
MD5 SHA1 SHA512 SSDEEP

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 68098e426fc965fce919fbd8f1be43c9c26bc7da26a5de7e441af11b0ec47a70
MD5 d017ab230dec22b002de3ca7f909ec00
SHA1 c79b4a01321c6c0f0d6a83c781eef9a91c476d7b
SHA512 658e112a7994a651975a9f5becab4dcffc26987d084f52723c105d4632933f9c1651e2eb54ecbb9570d1ff57d3821f47d80e83362cdf13deef769064704b7aa3
SSDEEP 24576:rfL3UTc8S+LbzQkWWbCzLLB+lMP1NFzSRY:rfL3U48FD5nb2LLPrFmRY
MD5 SHA1 SHA512 SSDEEP

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 9b419d44354956d474a1ee3cad469ac56f19792ab69221bc9c2247402765bf28
MD5 79250909d39ad5fe5888e78ac3f4da97
SHA1 7c4114c6829fefa263d7e775f67bd94cdae2f33d
SHA512 6dc5dbce0876aba46d359cfad14b614aa4ed7a851f3198cfaa8414c37c7685294acaa37d51918da45556c9fa50b87dcc0f5a070674f3cd36c9c994c634fcaac0
SSDEEP 12288:XpFtfOgUNU1FBtfcPKcOYRLbzQkbL+Qg+H5oeIj5RLLB+lOakPprNFzSRY:9OY8S+LbzQkWWbCzLLB+lMP1NFzSRY
MD5 SHA1 SHA512 SSDEEP

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 f680a27ac0659c5261186b013213c7bda1081d7a7156f6b7ec15665eb72551a7
MD5 c633c2806e2d4cb5caac3dec1071f7a9
SHA1 d517909079bba6c98638b2ad94c27e5e6b72b906
SHA512 7e22152fc8522064f171fb44a4351c9347d634d558a7aa4e5e45fa1b49644ae29a69eb1fb81bb9432f12e7d169358db1b2797f8a33f18b11fb0d8e062fb2ce1a
SSDEEP 24576:f7NM9YmZqmWMUkPjZM48Mv6bEhsT8S+LbzQkWWbCzLLB+lMP1NFzSRY:f7cBWMpPjN8DbEh+8FD5nb2LLPrFmRY
MD5 SHA1 SHA512 SSDEEP

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 3a950874215df6d494b408f1c95a4afb3bcd8be42c342cfbfa85d1dac235e32f
MD5 94be2d71798f7c7e032a30aa341793ad
SHA1 ce94b76e5f4f8eec4ff338ac2b46a31610ee9b13
SHA512 f1e999ffe551ca423462a1bae66ffde1987da59f6f374e1482f49d4b3e8a49c1298e20c283b951badad034dbbcf4f11ec1da3721b4deab6e40a9be95b09747a8
SSDEEP 49152:BF2YuHNETovcvNYf8kmz8FD5nb2LLPrFmRY:E6tCf8kY8F1b6TwY
MD5 SHA1 SHA512 SSDEEP

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 6ee67da846dfc8b44128b37d2bcb356751f5c158cf9437b96c5489767b3ed0b2
MD5 d03624647678481b7acbd2543698d128
SHA1 c4e3d8db76344912c4ab705fb9529ad32541eee2
SHA512 8bbb76f43c030a169d16460f2ec6143ed69303d7ff6ab6cccda37e1abd4b7208fd7d1b063f1a296417f29abbff6ff6716ed321249e15fbd2a48ba0cbeb19fc3c
SSDEEP 24576:vAFs06+Omlf3NXEbToE8S+LbzQkWWbCzLLB+lMP1NFzSRY:4Fs060lVXuJ8FD5nb2LLPrFmRY
MD5 SHA1 SHA512 SSDEEP

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.7MB
SHA256 e0459a6e52b86cd6029150a46bbc5334fdde31ec9448f227555788423ea71000
MD5 179b23a54e9b4fecc8416c3b340c60c4
SHA1 1504d833c2a920a5f0fa2e12580ae928f2fa11d3
SHA512 9836c8742b86ac431a9c400261a4211854cc5cf58756ad096125e29f698359d26119dda98e787c3e10b478355be9e5a5f998634097d6292609c1192409abdb64
SSDEEP 24576:QJnJ5D3WLJ8S+LbzQkWWbCzLLB+lMP1NFzSRY:QJnJ5DGLJ8FD5nb2LLPrFmRY
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 4f3f64898e888bbb1bc6c1ccade387215153660b43e43775a534cb80e72463cc
MD5 115b6ae1691c41ebf7579a2cedde5a63
SHA1 060567a6b124a9a0cc4a78f43c3492816657a4f9
SHA512 d50dbb32c68155ffdc954cab801eff5d396c3628694e0e360ddba3187ec7b692d415692f58e312d30473b1d6ccca02dfc368fca07ee0cd42b1a650754235eb5f
SSDEEP 49152:6o06DIKdwc+eQnSt65aVn8FD5nb2LLPrFmRY:7d8F1b6TwY
MD5 SHA1 SHA512 SSDEEP

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.5MB
SHA256 0f4542b59e5173a161766a3a379ac7d7bd814fd17cba18b8584ac9b71cd33893
MD5 f6d4473f5e7b9ae8ee9925ff8dc624f7
SHA1 37d64600a3fb836cae12b4e820ab2ea177650f89
SHA512 05342311e82dda87543a2ea46e938635d6f26b5de489a90cd01340142337204b09c9b55e82151e46bacf747cbbc20e2aad35e3af95d46063ac77cc8343a2c6d4
SSDEEP 12288:xEP3RBpUNU1FBtfcPKcOYRLbzQkbL+Qg+H5oeIj5RLLB+lOakPprNFzSRY:iBf8S+LbzQkWWbCzLLB+lMP1NFzSRY
MD5 SHA1 SHA512 SSDEEP

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.6MB
SHA256 36b49c71a12e0fd5b43687319d5146e057c003a99ea08df5cdcb6e8fb233cf34
MD5 b745c02f037a99fb214d384c4ebce5bd
SHA1 a9b6d8fffede2510e9229ad95621d53b66292e43
SHA512 28f78cdbfb6b6091e35c987f055b26ff70f93f9a9be2b2c21894fccc49f9347328d36d8f710dce0608d3956bb688f6d449c3d26355d8777b8d3522182138fcfb
SSDEEP 12288:tjkyeUNU1FBtfcPKcOYRLbzQkbL+Qg+H5oeIj5RLLB+lOakPprNFzSRY:tIyO8S+LbzQkWWbCzLLB+lMP1NFzSRY
MD5 SHA1 SHA512 SSDEEP

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.4MB
SHA256 39022b57593f7fb7522dec1d1d9272af1472406b98f313fa093cd482ea96d3a7
MD5 581b331532d586a4683dc63592ae329d
SHA1 d7398ea8f2696aeea7eb6a7ff76da2fdeee8007d
SHA512 79f17f8fe94dda3f0205e1d0dc6d7075f365c293bc8a97091f4a0d95dc621d470ed50a96b6ce7e4654eef06da8696b70d81e171b8e0434a33873ae9f345edbef
SSDEEP 12288:PrQUNU1FBtfcPKcOYRLbzQkbL+Qg+H5oeIj5RLLB+lOakPprNFzSRY:zI8S+LbzQkWWbCzLLB+lMP1NFzSRY
MD5 SHA1 SHA512 SSDEEP

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 4ef57c8bb0734583b993a600a14035883e068f25575bfae7ed287b7ee4b4c9ed
MD5 6d3bff1a7b890a7b34b5540309b917ac
SHA1 7aabe9b7cd8affeb5eb3fd3ce9c7b80ef726e616
SHA512 1f7d1b73569da42c6baa258c8182b1d79e87bbed01c68f1903d7404d78887a1447fd98422c045be0d5eb714526c3cc825f0581cbd04a9ab0b8eba21b4b4f0324
SSDEEP 24576:iQ9MxZKdcz97w378S+LbzQkWWbCzLLB+lMP1NFzSRY:iVKX78FD5nb2LLPrFmRY
MD5 SHA1 SHA512 SSDEEP

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.6MB
SHA256 0d00695bab2178e31c92f28e5a69a03b82bdec135a28f9cee439f099bb6f2806
MD5 1f88ed55c88cdf64e960bd2d1067bb6c
SHA1 67e188ddca0957a602d3adb744df7ed3bbb595d4
SHA512 3fb17b509b8ff6712cc8a74cd66a65a211d71f84ab769bec15ebfdc9bec4123ea8d32235363c26a5137901cb686ba0ed3d41dce5594d1bce2bccc6cbb5f6674a
SSDEEP 24576:YyocbApq8S+LbzQkWWbCzLLB+lMP1NFzSRY:1ocbApq8FD5nb2LLPrFmRY
MD5 SHA1 SHA512 SSDEEP

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 47b81fd79f4c7af2fc078e80f3dfb1aa4e1310690500157497e6d362199870c6
MD5 852a4d3332567637d57cc79399abb7cb
SHA1 d2309ded5c0ecd2f7bc57f9ee13a6096e847d0cf
SHA512 5ae59974eb98750ff83ed9b5ecb862096933a7912a131536105f991d0247b6392abc13d83a0ad9875fcbe2ede7c3e5f828efcaa60fa436e940b36b3661bf880a
SSDEEP 49152:iWcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIKq8FD5nb2LLPrFmRY:U0zuNIm8F1b6TwY
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 65917bfa8d83366a46a103ee7736cd03fec49cb8507aa3ada5e99068c8756968
MD5 989e5ff5c559946f3538e48458e8172b
SHA1 0e63545bf3b00e9b3a3a07f74e1f1905ef2a62a3
SHA512 2ed7c243aae2d1bb6e7c64cadfbcb7f3ecfeeb8f3b37dec98a52dc85bb9aaa7cd140f1888f2f04e885c09c1f7d3c74ab0a95408729079cd40ffcd45283f580c9
SSDEEP 24576:V1QT7EcpfxR+N5AWAz3ooiYtjMqbf8S+LbzQkWWbCzLLB+lMP1NFzSRY:QTDxR+N5YzTfjM68FD5nb2LLPrFmRY
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/960-315-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/960-622-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/960-435-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/1180-350-0x0000000140000000-0x00000001401E2000-memory.dmp

Download

memory/1180-623-0x0000000140000000-0x00000001401E2000-memory.dmp

Download

memory/1524-398-0x0000000140000000-0x000000014018B000-memory.dmp

Download

memory/1524-283-0x0000000140000000-0x000000014018B000-memory.dmp

Download

memory/1664-538-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/1664-335-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/1688-238-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/1688-64-0x00000000004F0000-0x0000000000550000-memory.dmp

Download

memory/1688-73-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/1688-69-0x00000000004F0000-0x0000000000550000-memory.dmp

Download

memory/2152-17-0x0000000000600000-0x0000000000660000-memory.dmp

Download

memory/2152-233-0x0000000140000000-0x000000014018A000-memory.dmp

Download

memory/2152-11-0x0000000000600000-0x0000000000660000-memory.dmp

Download

memory/2152-19-0x0000000140000000-0x000000014018A000-memory.dmp

Download

memory/2220-631-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/2220-436-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/2252-6-0x0000000002320000-0x0000000002387000-memory.dmp

Download

memory/2252-1-0x0000000002320000-0x0000000002387000-memory.dmp

Download

memory/2252-25-0x0000000000400000-0x0000000000590000-memory.dmp

Download

memory/2252-0-0x0000000000400000-0x0000000000590000-memory.dmp

Download

memory/2516-304-0x0000000140000000-0x0000000140175000-memory.dmp

Download

memory/2516-422-0x0000000140000000-0x0000000140175000-memory.dmp

Download

memory/2900-630-0x0000000140000000-0x00000001401A6000-memory.dmp

Download

memory/2900-423-0x0000000140000000-0x00000001401A6000-memory.dmp

Download

memory/3052-294-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/3052-410-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/3200-36-0x0000000140000000-0x000000014024B000-memory.dmp

Download

memory/3200-234-0x0000000140000000-0x000000014024B000-memory.dmp

Download

memory/3200-28-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/3200-37-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/3520-627-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/3520-387-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/3968-384-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/3968-372-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4328-386-0x0000000140000000-0x0000000140199000-memory.dmp

Download

memory/4328-268-0x0000000140000000-0x0000000140199000-memory.dmp

Download

memory/4540-48-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/4540-237-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/4540-40-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/4540-46-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/4576-250-0x0000000140000000-0x0000000140189000-memory.dmp

Download

memory/4576-242-0x0000000000580000-0x00000000005E0000-memory.dmp

Download

memory/4576-248-0x0000000000580000-0x00000000005E0000-memory.dmp

Download

memory/4580-338-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4580-619-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4620-399-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/4620-628-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/4680-361-0x0000000140000000-0x00000001401C2000-memory.dmp

Download

memory/4680-624-0x0000000140000000-0x00000001401C2000-memory.dmp

Download

memory/4880-51-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4880-74-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/4880-57-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4880-71-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4880-60-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/4956-253-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4956-266-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4956-254-0x0000000000530000-0x0000000000590000-memory.dmp

Download

memory/5036-629-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/5036-411-0x0000000140000000-0x0000000140216000-memory.dmp

Download