20750ea2da1c09b4437d66eaa2b633ff3ccf572946f9be888d226f2dc10fc77d

Analysis

max time kernel
147s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20250619-en
resource tags

arch:x64arch:x86image:win11-20250619-enlocale:en-usos:windows11-21h2-x64system
submitted
02/07/2025, 04:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2025-07-02_abf0213dc29e2d4a4f1574048d5cf0a0_black-basta_ryuk.exe
Size 950KB
Sample250702-e2yjeassdz
SHA256 20750ea2da1c09b4437d66eaa2b633ff3ccf572946f9be888d226f2dc10fc77d
MD5 abf0213dc29e2d4a4f1574048d5cf0a0
SHA1 2031b5df6c62b730c6b0a49fe567021ac61253e3
SHA512 2f9ffbbec8b4e5333b490a03ad99812d8182f7cc9f3552a4e8e2d53488b83fd7683a0e54f3e193281f3662086bfb067a0b740a08d88d7c8ed39e55e691f6d2e7
SSDEEP 12288:V1MKv/gcgZwdVCHGYj0Dm7Yn/3z+5HNyFxlJzWDR7DZYgzNR26TN3zsqPCZ:VmGXpdG093z+ZaVWNl328NjOZ
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
5640	alg.exe
3840	elevation_service.exe
4896	elevation_service.exe
3356	maintenanceservice.exe
5004	OSE.EXE
236	DiagnosticsHub.StandardCollector.Service.exe
6012	fxssvc.exe
2852	msdtc.exe
2284	PerceptionSimulationService.exe
3204	perfhost.exe
1464	locator.exe
832	SensorDataService.exe
5840	snmptrap.exe
3544	spectrum.exe
1668	ssh-agent.exe
1484	TieringEngineService.exe
4772	AgentService.exe
1480	vds.exe
2392	vssvc.exe
5332	wbengine.exe
4508	WmiApSrv.exe
2196	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\e:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe

Drops file in System32 directory 29 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\{17A6A947-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db	spectrum.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2025-07-02_abf0213dc29e2d4a4f1574048d5cf0a0_black-basta_ryuk.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\77259482c57f2e9f.bin	alg.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	spectrum.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	spectrum.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\7z.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\chrmstp.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\133.0.6943.60\notification_helper.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_169593\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006d7692b809ebdb01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000aa4726b909ebdb01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000920b4ab909ebdb01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tif	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tiff\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dib	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ae86e3b809ebdb01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c66e2db909ebdb01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raw	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tif\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wdp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cr2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raw\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wdp	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tiff	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ico	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpe	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
3840	elevation_service.exe
3840	elevation_service.exe
3840	elevation_service.exe
3840	elevation_service.exe
3840	elevation_service.exe
3840	elevation_service.exe
3840	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
672	Process not Found
672	Process not Found

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5384	2025-07-02_abf0213dc29e2d4a4f1574048d5cf0a0_black-basta_ryuk.exe
Token: SeDebugPrivilege	5640	alg.exe
Token: SeDebugPrivilege	5640	alg.exe
Token: SeDebugPrivilege	5640	alg.exe
Token: SeTakeOwnershipPrivilege	3840	elevation_service.exe
Token: SeAuditPrivilege	6012	fxssvc.exe
Token: SeRestorePrivilege	1484	TieringEngineService.exe
Token: SeManageVolumePrivilege	1484	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	4772	AgentService.exe
Token: SeBackupPrivilege	2392	vssvc.exe
Token: SeRestorePrivilege	2392	vssvc.exe
Token: SeAuditPrivilege	2392	vssvc.exe
Token: SeBackupPrivilege	5332	wbengine.exe
Token: SeRestorePrivilege	5332	wbengine.exe
Token: SeSecurityPrivilege	5332	wbengine.exe
Token: 33	2196	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2196	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2196	SearchIndexer.exe
Token: SeDebugPrivilege	3840	elevation_service.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2196 wrote to memory of 2816	2196	SearchIndexer.exe	104
PID 2196 wrote to memory of 2816	2196	SearchIndexer.exe	104
PID 2196 wrote to memory of 6112	2196	SearchIndexer.exe	105
PID 2196 wrote to memory of 6112	2196	SearchIndexer.exe	105
PID 2196 wrote to memory of 5536	2196	SearchIndexer.exe	106
PID 2196 wrote to memory of 5536	2196	SearchIndexer.exe	106

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2025-07-02_abf0213dc29e2d4a4f1574048d5cf0a0_black-basta_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2025-07-02_abf0213dc29e2d4a4f1574048d5cf0a0_black-basta_ryuk.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:5384

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:5640

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3840

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4896

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3356

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5004

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:236

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:3600

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:6012

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:2852

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2284

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3204

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:1464

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:832

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:5840

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3544

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1668

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1484

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:3528

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4772

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:1480

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2392

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5332

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:4508

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2196
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2816
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2824 2760 924 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}
  2⤵
  - Modifies data under HKEY_USERS
  PID:6112
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2832 2828 924 {85EE815A-7738-4808-A14A-3AD87E32A3BF}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5536

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
Size 2.3MB
SHA256 7ca755081933b0b7b39efcf2d8ef2767fe654bcc3dd3eff02e8689d9f4c0e28b
MD5 4a4bc31612134335afad59561f3ad2d1
SHA1 6ae4d1492d9be572055e005b1e7d41924e668828
SHA512 5d7663473e466bd5de122c479e2c6616b265c83dee0a915fcbca1559450900b88d47f79f3c5fa2c335855e25501abcbeaeaea6699df0ef40f7a9299dd5529cf0
SSDEEP 24576:Ue0IW4NBgXnkHT3qDGZHka9JIemQsqAU77dYoi8/boGea093z+ZaVWNl328NjO7:x0X4/T3qDRmcQsqAU7BYYkGex+8qFM
MD5 SHA1 SHA512 SSDEEP

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 e1e78c70b20a6b8ea080dcff5880d554656879d69f3f76a04a02caaf60810056
MD5 adbcec9c0d815cc33cd7e83c15e017ba
SHA1 32563da4d6824389a665384d8384c7df94e2433a
SHA512 671b215a41669b8e0d15e9b491f94a06958e884395982c60b6b289a7756dfb9ba634f75e466720bb6caab52946b82dd8a2badf0991b2e24591de5ca2d0f2fa5d
SSDEEP 12288:G1XLsswWkxy2lRq2czAwCHGYj0Dm7Yn/3z+5HNyFxlJzWDR7DZYgzNR26TN3zsq6:kXYfDtczAf093z+ZaVWNl328NjOh
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 e3f561bd2b4be26356acaf1538b34d35ffd151eaf691b6625dc9d3d19434053e
MD5 8608aec55eddcb86356149a38528b647
SHA1 ad6d42b5d23562be24c20f8f7c2f73b5f7b02539
SHA512 9f3fa725e8a0cc7b05b9f2abcc953bb036c953cfe6988d8aff54becbdea5a40c5c1ff58b08edaade50f014057dbaeb03a93d871c1ac222a3f0a9e06aebc2707f
SSDEEP 24576:60Le5ji0hmxhrMy093z+ZaVWNl328NjOd:6Pji0Az2x+8qFM
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 516a281dd209f53ec1907400272f28098d5965e8894eac171a2ad2a9ba4646e3
MD5 752492d832985c2e9d2fdd04dc4541e4
SHA1 1d7ec1a44aa072ff0d459b73583fe07b3a2b39b7
SHA512 347490abd4bfb1b09be85bcf5d254af9f086bffc0ed7dd5c4b7e1ff42da41f639651a8ca504bd240e7da06bba613c627788ff0899191a44d68cac69ac23ddc02
SSDEEP 24576:Ga7/ezSC6vUyD/aqgrvWj6q8wyu0093z+ZaVWNl328NjO+:R/ezSC6vUzPv+Hjyax+8qFM
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 0ee7ce1901e219d4596f0e437f73a0d009c37b3dbb419a3255306c56803e0e23
MD5 b98bb896e09ed31adf6bd7af8831ccc1
SHA1 9592afc28288870b7ee93ea30fe12fee529e2ce1
SHA512 e7822dc9f0d2585d77241a1ba5b806930edb619d72a255035b75b09f0db480f29a7492ce7c17987a860d9f7cc0e903a0a43507fe6afe9fcb31e8c60256b811ef
SSDEEP 24576:FVbqPb88hv/l+Bz093z+ZaVWNl328NjO/4:FVO88hXl+Wx+8qFM
MD5 SHA1 SHA512 SSDEEP

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 28bbdd92e9d659a3b7daf283f9c3fbc531fe36e9442ccf62d93c0cdfb666733a
MD5 ce6268aa3fe99ee0ee98a4a1ca7c9bbf
SHA1 0d215bb8e2e165ae37a789bc9a692c36dc5060ee
SHA512 1cc5922ccd6e9a6d70c1aa9a48fc7e0de84a4dd75ab22a58fe90ce76e3dfdcc45551e700ec126b72e6807dd196d361944cbb1bed0b35a531da879024717dd903
SSDEEP 12288:6GlCHGYj0Dm7Yn/3z+5HNyFxlJzWDR7DZYgzNR26TN3zsqPCe:6GW093z+ZaVWNl328NjOe
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 b20e67f025684737c7e78a8decca756b6c3a5113da5aaf00bf30072aa433e07c
MD5 a9c187e34367701b67b0279d9c5bbfc7
SHA1 40a8d0a23172d65deb022d733374ee00a1585649
SHA512 c0bb459e221e878e6cfd027d51fd63d068261b7eb94d2bb1b37aac75b65998e83a9c3151caa610d669c1201e357c5557223137ab71f364e1abf39588ae61939b
SSDEEP 12288:YeBNUbTVO86UcCHGYj0Dm7Yn/3z+5HNyFxlJzWDR7DZYgzNR26TN3zsqPC9:YJIUb093z+ZaVWNl328NjO9
MD5 SHA1 SHA512 SSDEEP

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 1f06d166e09f5dc0f9268fc5d8818f7874c4faeb377f2d7e05dc79da57922c74
MD5 b784faad144abac3168d0b39461a4dce
SHA1 40c664f7486b37e52718253c6f61eb49a9245fea
SHA512 8937a79598d893dd34c83250e47800a83f5ae37f424864aadc294aeae54b1d9f8cca8dd414a476466038a28d33eb55abee691f497cd5989d88901cda1bb8c006
SSDEEP 49152:yQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THG:yQvGAdlCEL8c/WRNw5CA8qW
MD5 SHA1 SHA512 SSDEEP

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 178d9785f6a907c9fe7c2674898dbec49819b5e111f984eed22e1067c7e5dacb
MD5 9c63c4831bcfd76b270b4b5b612ce88f
SHA1 8fa80e61f77fc99a352d8bc407fb8f974e89ab0f
SHA512 75509e04abc3a5fd62e2df827291e76b641300e541a9f937747269da95808c8b8bb7167aeec5dc6aeb0e4977cebbd520dd05a4962123ae671e48eb98ae677eda
SSDEEP 12288:eAwSfxL/2Dc3mDLLmt0LDQewsAjyCHGYj0Dm7Yn/3z+5HNyFxlJzWDR7DZYgzNRs:DfewsAjV093z+ZaVWNl328NjOj
MD5 SHA1 SHA512 SSDEEP

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 34167c346aed28399f4d8198b3380074c3110dd9f0af84a2b82a9555dd69d9b1
MD5 68438e3af34ec9a540dc2e3970e884cf
SHA1 1b1e7f142c86b5ac012c6464458da7b68c7d247e
SHA512 81cf651bfb6e5e36798c797892dabaddf97c2a8257629488ad9fb24e246892f07a234b6b8e1c3fe887e269dedab6043b5e4c0bcb20a5e5562261ad9ce6523106
SSDEEP 196608:rUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHN8:rUEtQevvqc2W1cpV20I32
MD5 SHA1 SHA512 SSDEEP

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 17a86986aafb4097059d539c2713081a1974869fa214866e59d8b15578147865
MD5 b9c3234dc00945c4d4aa5dca09f29c92
SHA1 20534f0e290efbeb65351b489ab044d0a0173b70
SHA512 c1223b931b437cadc49fa4b2a3c242ce7a7d5103f331a8695f6ba76645af596b800f0814a70334b159f69b771f0c6700eafa890076e60266db163b096c643173
SSDEEP 49152:qCbRquA/m2yL5zifFiV+XenmE3/zGx+8qFM:foqHVjnmM8qW
MD5 SHA1 SHA512 SSDEEP

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 1c55b6bdb51dabc696658c3f6eb807de3883ad10704a459f9e091c38a63145df
MD5 0b04f1c266ae13abf80ab273d7b893f3
SHA1 6695fb5e3c4429872262ac154aa75f61857eb7d2
SHA512 9f2360086fee4c7e0aadd89943744fec7fcfa52de0f1cf330b940e744aa1dd3970098bbfc2f916ec4cdd7538a6eec3a1e260c95dbeff730f3030658dc426c8f7
SSDEEP 24576:3AhGL6IFoiwtA5l7S53w093z+ZaVWNl328NjOD:3AM5Foiq5nx+8qFM
MD5 SHA1 SHA512 SSDEEP

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 bc580813b04a031792e2409d5fffa8e3e83ad0bc93ea45c2c44173f1d2db6f4f
MD5 011eb0eca6bb527ad71c390e32afdd6e
SHA1 43a88aa57d3d7bf252e3b2ccdba005bbef61886a
SHA512 5df4d8e91f3f8483a4f8d09e0bb87e29eb4c9a159083de955c5a1bfb6c4ff3396ced246ce870c7317352ed2d1bedb260ab3d9e30fd78c965a218d915110a0ec5
SSDEEP 12288:nmw5HEjsChNEBFgl0WDm+CfCHGYj0Dm7Yn/3z+5HNyFxlJzWDR7DZYgzNR26TN30:mwuROWx093z+ZaVWNl328NjOr
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 59c8785cf2d70ea362e7d11ca52ceda176f77b3081d3b77ab42e443f7b042547
MD5 ee82843b22398af90cd45f81309a26cc
SHA1 91a5a4a0a4bd46bbf32c295475af2a8beeb2a26e
SHA512 43a4785af8264212b4ed0558f746d2ccc7db67ec677e6dd42ad0100bfa7fbfec4c751a35601cbbe434495d236e80234269a6a4a3c9e334042c105cd189a24c7e
SSDEEP 12288:AyZ1IyCCHGYj0Dm7Yn/3z+5HNyFxlJzWDR7DZYgzNR26TN3zsqPCh:FZua093z+ZaVWNl328NjOh
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\chrmstp.exe
Size 6.6MB
SHA256 b6e300a92132348ba5194fe064b743b20fef84865184ce30dd4af3065ec04951
MD5 fc2cea1d77d419009ae63b67e0f4bd29
SHA1 935a49d9e98898e22ed4951bd577f879261b3903
SHA512 e60dab6c85e542aab0639308d40b52747daa8f9dc1123ee93e3eda895f54e85b69daa96abb8ffab59dab00160a9d5b104589fc709ed13b8060532b35df1afbd2
SSDEEP 49152:PTEoba3y9bVILkmvguhO4NOP5PlcQKvfjBbPZi7H4mYwrjDDSNdihLuZykH8mYx1:Jut4LcLBbPk7H8SUY/P5h9k8qW
MD5 SHA1 SHA512 SSDEEP

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\setup.exe
Size 6.6MB
SHA256 e41d53c0438b58cc91f0bead9d3f6f8c2911636fe05d8b1f505ccca6a47149e4
MD5 7b86ffa7bba6717e9f310839136195df
SHA1 222b2922c22321272aa348a2fcc712d08b29ab96
SHA512 e2002b7f88ac9d892238b295daaa5d4c88bd8a399cb4a5993a49548132cd70f9d8e7dcb3afd8b1c95e017a5dc1dcb879ae2c78928aa7edd36bf4df3c23a502fc
SSDEEP 49152:iTEoba3y9bVILkmvguhO4NOP5PlcQKvfjBbPZi7H4mYwrjDDSNdihLuZykH8mYx1:aut4LcLBbPk7H8SUY/P5h9k8qW
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\133.0.6943.60\chrome_pwa_launcher.exe
Size 1.9MB
SHA256 331625ee677ddbd37c302de4a0c293469a91c12a0cae570ed4c2eca7925cd7cf
MD5 8876f140fe0a5448d1243df6a565430c
SHA1 0d26053684f21aba7520574e40c7696c6facab3b
SHA512 554db935ae44d664df32157e55eb1570c4d341b02d85e6279c789e71a349e86de9755a80f667de650036fd312e9df780a44c9d6bcaa58558064d33ffd636677d
SSDEEP 24576:4XHhwegnv8593atGFEtMUeRQt5iMaJgv4W2E4Psb093z+ZaVWNl328NjOH:4XenvGq2EtMUtLuXW23x+8qFM
MD5 SHA1 SHA512 SSDEEP

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevated_tracing_service.exe
Size 3.3MB
SHA256 820689409257b3a811a7859c1effb3371b11c0a419baf3f608cc9d7b4acdddfd
MD5 603f9ee367923baf26e5626910508dc6
SHA1 33d8e6db9c738ce0140d16c5b382e5f913350753
SHA512 c0d562415b1459aafa461e49f7d651a387d15937a0e44d63d69c8438dd963515a158ec8ab84560ea48bc80df5e54fa75719c94144f2a758969a702c2467bc8c7
SSDEEP 49152:OFKbxUEEhQ9gsfxp6MZEtEYVnNKkNmHNNlCX0cXz6GfpksGLP3/N6x+8qFM:GKKsnZEBSkNmHNNIhj6MpkJB8qW
MD5 SHA1 SHA512 SSDEEP

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
Size 2.3MB
SHA256 b9cfb49fc0e6dce26d2cc5443df84634759b7826a0a795885c04c0bcb3eb8840
MD5 e1a83a5b42444cfbb534adb443cd3036
SHA1 bdaa73966bc0e967b1f0e9f0c139cb92155b98b2
SHA512 949d28b7cafe7863b1816a92453cdb2daaf9f66cd62b6195596258232be35cd7e247414f2978bff57335adfdefe048ed1214d383a60ac8c6611fd4106b635c3c
SSDEEP 49152:j1xWevYkaNRxiCmSGAeA4msvxQtghSpOMx+8qFM:VHPSGC08qW
MD5 SHA1 SHA512 SSDEEP

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\133.0.6943.60\notification_helper.exe
Size 1.9MB
SHA256 f0be46155ece63dbc9b0c1637834e91346be1fa11957f2933acf74a1e59fdc10
MD5 435337c5d1ea82154349e2a4fff66a4e
SHA1 f8d583a1722effaf61bfa5467c9253ee8a930bc7
SHA512 721144526e63c10b3548fa7d0882e5c075227dc85d6c097bc9a220b5357101d1e76b4b66d75233cfcaa35c39d32789fc72b7b0da5957546c27eec6af80f47f32
SSDEEP 24576:EvA5Wwt59ZKNT4cQywprNzP8AcHUI8byGrXP3xvHr3093z+ZaVWNl328NjOY:EvAl59A9GJzXc0I65XPhvox+8qFM
MD5 SHA1 SHA512 SSDEEP

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\133.0.6943.60\os_update_handler.exe
Size 2.1MB
SHA256 c7aea5ebeb2b656bc5598ea3addf6f8f4a3679b9d546bdf7e3e27b5bb0e11ab6
MD5 664e22fea32689a3691b0ba43bfbe194
SHA1 babeff8f4ccf08e94bd6484025d4c277fe026fb3
SHA512 90a6842598eb9091ef31fd3cf7b887a9ee6c6be788ad1f7db79f2ef65a485e48067273774196613d130188ca746fc3f97135543601789586db30ef15d8d9906f
SSDEEP 24576:TXaeiwxNoUTbR1rVkGLqyrFvvPs9DxRq4YMKGWssUVpha093z+ZaVWNl328NjOV:TXZNoU5kqRZvvE9lDKGWfMhdx+8qFM
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 1.6MB
SHA256 c9033d7383dbbaeb840788eea44e1cdd648c9a6cb91b8f03472b326ad5f085c2
MD5 67d59508697e3b3804d5a3590104c0a8
SHA1 97129b3f60845319c8258316683296956a0cc503
SHA512 c04283c5571db6652f6daf34252988ea3877bdcfe47dcdf3a30075a26e1a62470fcd12bcd1962d98093cd346f57db0096d2f1e0837cc861f398ce9e4d5078507
SSDEEP 24576:T09xwCr/8dMJlrNs4ff/TdskLV+gvnZlg093z+ZaVWNl328NjOT:T0FrFp3n/T26V+gnx+8qFM
MD5 SHA1 SHA512 SSDEEP

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 512d20abe87e41d578706ea70aa2d63f2e6a790769f54ff94bf45609b3f515fb
MD5 9a25a6eeef6a41021fa667e53a20c484
SHA1 9598588888c9647848642a9124e1ed77da8d7df1
SHA512 e106dba23addbbb98198baf9997d6a0db84f50cc02a2b3799da8773ef8bba3bc4b7b596c5ac1c336e701f4f4f3d37bae3a8de527be6ad9f88cf2600ce0087d67
SSDEEP 12288:T9CHGYj0Dm7Yn/3z+5HNyFxlJzWDR7DZYgzNR26TN3zsqPCb:T+093z+ZaVWNl328NjOb
MD5 SHA1 SHA512 SSDEEP

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 33921c29dbce7f88e5ed864f9947a8d22cec7d42b910b34212f0fd9ae3fe4332
MD5 e107570442606b3719e78e755036c590
SHA1 28ec57d4c0bae4c22681c0af0848b51af3cab1da
SHA512 654b64fba045f283ef5c0732bf2b27cc8d02c151284769925d1a631d7ca8002aa67a427fa26dc940ac8772271d172dca99a1bad245127a53ad037374261392e3
SSDEEP 12288:7GCHGYj0Dm7Yn/3z+5HNyFxlJzWDR7DZYgzNR26TN3zsqPCb:7J093z+ZaVWNl328NjOb
MD5 SHA1 SHA512 SSDEEP

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 6811b18691db3f42579dc50c1799ce028f710e5aea19f0379b6fdda2b71e0384
MD5 e088a36a8daaa29642956ec29ebbeb21
SHA1 70ba91af4d2cea8330e5a99f0bd170aa48d0a6e6
SHA512 e7bd2e358823c88bd915860b080d6c4bcb23a3bc2671813df073cccc391f7936f195b6bafe0c55eb790b82faee6f95fadb4f3e7c4eca6995c7e2826468f750e8
SSDEEP 12288:oUCHGYj0Dm7Yn/3z+5HNyFxlJzWDR7DZYgzNR26TN3zsqPCb:oj093z+ZaVWNl328NjOb
MD5 SHA1 SHA512 SSDEEP

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 a6c5c81ba42616b2523049c293c164b4819e290fc632355ad15c72b3bee3bd32
MD5 a915b733d06c84a2cd199f6a7654fd0f
SHA1 a653b9b6271cc60c755dee0303c5a3a0944971f9
SHA512 412951af9aad3dd942b4b7fa6268b56ecc25c5fd2837bce3f9859f1bca1c3f96e67776f38e1a1bcd1b7b036dbcc3bd09903baf9e9917bcd3ee67abf3ea09bc80
SSDEEP 12288:WV7CHGYj0Dm7Yn/3z+5HNyFxlJzWDR7DZYgzNR26TN3zsqPC+:N093z+ZaVWNl328NjO+
MD5 SHA1 SHA512 SSDEEP

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 f3f2618f8a5abd24f0319d059cdb9e1024954080c2703cac084bdbedee140e3c
MD5 51deba0f3a6ea84312c293ca7c7a45fe
SHA1 ea287cf1384f2e2f942813bbfba7bfa6f5fb6039
SHA512 09bd89aee4e354f5c507edc505b4d20b5e4dbdd5be635ad727f8bd975a6083bf6e923d0c32bb02ac9b4c7e2335a81e8ee61aa1450fcb49cf4005d40ecbd84820
SSDEEP 12288:4jCHGYj0Dm7Yn/3z+5HNyFxlJzWDR7DZYgzNR26TN3zsqPCA:4I093z+ZaVWNl328NjOA
MD5 SHA1 SHA512 SSDEEP

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 7aaa1226f809ae69200ef8f82111b0e735f27f9d895a20f337c71fe203052aba
MD5 d7894747301ef7d5cc234f60b2d6a42f
SHA1 0e080daf4746db4c3f193d8b19ee2216d76ff667
SHA512 0170790bc1179af7cfbc2b77916ddfe3441d88a79b32ca91543cc6b36d5aa0ab6e62fd21c58fdcbdc704f8b9439171d1fd93ef7b03c35b5b7c261dc631059791
SSDEEP 12288:NKCHGYj0Dm7Yn/3z+5HNyFxlJzWDR7DZYgzNR26TN3zsqPCA:Nd093z+ZaVWNl328NjOA
MD5 SHA1 SHA512 SSDEEP

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 63c66ca979c480546d29ae301c9a0984c52cbffde447aacc7b33b11e628bc6bc
MD5 60db7a198d6fcba48c79d4e70d6435df
SHA1 f52d9c2d1e6e98c194d1a4a7c60a175aa3fc0482
SHA512 b4dc9ca855b8121a98f10afb565ca618e90d9b0c89fbc16db84e935d4908a6b428a658897fd669f94ba925357d1000dbe553281cdcba2ba3c491ba6f3b74709a
SSDEEP 12288:guCHGYj0Dm7Yn/3z+5HNyFxlJzWDR7DZYgzNR26TN3zsqPC4:gh093z+ZaVWNl328NjO4
MD5 SHA1 SHA512 SSDEEP

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 8d82b47943b810c45e937d73684e8a0a1d4f903c768047c0b7e33c90acddea21
MD5 09666a7912ab7170e2757fd4fb10e369
SHA1 213e98e0b4263aef1828bbe7643453b5cefaed7f
SHA512 ae8d222fd41540d905a8d72996bd267776c1484aef664a9286586ed010d30feeb5c2ba7c847b007f97db65035f05f699aa06c6d0ad26241c47d722697c296eda
SSDEEP 12288:/iZwbDzzFEoS2cPvymCHGYj0Dm7Yn/3z+5HNyFxlJzWDR7DZYgzNR26TN3zsqPCO:aZM3zFVSOp093z+ZaVWNl328NjOO
MD5 SHA1 SHA512 SSDEEP

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 b1500da68e3fd7acd58c47a046747d880dd87d0bac30a53a48bead3b8fa99da6
MD5 38589da1720b6d2c4f57438ff582e83b
SHA1 4223ca01b6ac3875aa8a44565e23629cc4da66b2
SHA512 26e3d72b3cbf1ed742bc35e584ba24b7e684f6c415c622ae568a3bc3eda439d956468f0321895e87f6d9d0771d10cc3d8bf6ba586d498287d5eea5dc148ce898
SSDEEP 12288:sJCHGYj0Dm7Yn/3z+5HNyFxlJzWDR7DZYgzNR26TN3zsqPCh:sq093z+ZaVWNl328NjOh
MD5 SHA1 SHA512 SSDEEP

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 537c7ff74a1ef17b6157e2ea7ebb97e832b7c2c5fcd0f8bad3cf75bb5fbd8361
MD5 51943a1ed14a599ff5916907b183a099
SHA1 2f8f82bf2d86ca4f1bdf0c5a02f3edd25abbdf9e
SHA512 b68d4e043c51abf0a1180023904206488b234fae29d9ad38a646349c703121d5fcaef85b9b70c77afe0129354bbf77d158c430c55573b1a882e251eeecb46a66
SSDEEP 12288:I1CHGYj0Dm7Yn/3z+5HNyFxlJzWDR7DZYgzNR26TN3zsqPCh:Im093z+ZaVWNl328NjOh
MD5 SHA1 SHA512 SSDEEP

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 973ea0f5c5b5ed4d4b31fbe4782c0ddf15f5ffe48168fa2928691e89a5ff1205
MD5 2bc06ee1e6f9efda6eeb37af86af7d87
SHA1 970362c7e0316ca575d654c5026de1b8b31f21ba
SHA512 02922f7492c7a69868c40751be3baf5a4a1dedc3c130f886e1a58f833dbd4fa804ea2a96668b0725c5dc179ce49c3a1f8a4ed7e4700e4766b60ebe039da2c947
SSDEEP 12288:fyPz5L8CCHGYj0Dm7Yn/3z+5HNyFxlJzWDR7DZYgzNR26TN3zsqPCn:Szyl093z+ZaVWNl328NjOn
MD5 SHA1 SHA512 SSDEEP

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 11e23355c684dadbe2995e263894294f8b3cd0b2ea4663a449280ca2bde3157a
MD5 32d2831fa178443642f5464486243104
SHA1 901f2c8f0e58d2adea383c331343fd81d66ed8fa
SHA512 e229c02bc8963bb8b2483e46af0ede946a0105ae48e727689b515b1119cf5a0ca3d66e7ac633993dbe515753866de072504c0b567304883f98a7d37beb0c2fd2
SSDEEP 12288:/JCHGYj0Dm7Yn/3z+5HNyFxlJzWDR7DZYgzNR26TN3zsqPCh:/q093z+ZaVWNl328NjOh
MD5 SHA1 SHA512 SSDEEP

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 d81aff1f02f073a5d7b181573c96fb15d1dd0d9b2942165f981f481a1b15c69f
MD5 d0c6352de9fc752ba75a8eb48850796c
SHA1 1844af5f60e011041f2a6f170c9219c82436c3ef
SHA512 40a112c341eff42b2acea72b45e3b6b71aa4a29a32df0ecccfff763d034539fac47736757effe636b8780a4f840b2930c167f66a3799a5d4dbb1007d50024336
SSDEEP 12288:PJCHGYj0Dm7Yn/3z+5HNyFxlJzWDR7DZYgzNR26TN3zsqPCh:Pq093z+ZaVWNl328NjOh
MD5 SHA1 SHA512 SSDEEP

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 6633176509fb53b03a1ae3f5f671bb1443366965a9606d571721f9bf2bab99c0
MD5 22e071e9b930e97e47cb708b46fc2ef8
SHA1 530735000f189af1d4986ec693b2ce2dc67813c3
SHA512 0871a115f18517129a01fb0d5852e0d69f740504b7986f7513c8ae06f8dcf3543eee751afc69537f8225738088b70c422633a24b11c6de7658f6d479f8b853bd
SSDEEP 12288:qyPz5L8CCHGYj0Dm7Yn/3z+5HNyFxlJzWDR7DZYgzNR26TN3zsqPCC:3zyl093z+ZaVWNl328NjOC
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 6cf6f67d0280131fbe844cbd53b7cfa818f9b8b30e3e313c1204d2a26d49098a
MD5 4624915c585158bdcb5db061100fa1f7
SHA1 13a801c00bc8a9d551dc5f04a23de30c0432f240
SHA512 7275175ccb2c66f954d91b07735a3330fbbd4441e1535d1a291768ed390bf204bd44ceb37ff0ff8a3efe0c5b6f3738f444c8a472a20e944394f8e4ec9aed67c0
SSDEEP 12288:3Cd91WYoaLHF3z0z04PDvhECHGYj0Dm7Yn/3z+5HNyFxlJzWDR7DZYgzNR26TN3h:yT8aLl3z0zDT093z+ZaVWNl328NjOq
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 dc37892dcb9b1a79228dc51722159f25a98705ac5e77370a1bb9ef23718014ad
MD5 aab8391a1451436d902e488b539a91ec
SHA1 57c60ba00fa0555fc256471d16138a59e7cdbed6
SHA512 1efa6810f9d6db6dbef9cfbff7567436d45426578b52e402cfa5ab82c0e25d6ed35fcfee63caf9edd2d1b22808c1f642eafd24f7833e6b022e4063c467d7382a
SSDEEP 12288:/i4e7+RdTfgwCHKy7GLbbdIvHCHGYj0Dm7Yn/3z+5HNyFxlJzWDR7DZYgzNR26TJ:/3rd9CHKy7GZn093z+ZaVWNl328NjOM
MD5 SHA1 SHA512 SSDEEP

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 53c313bd79debb9cf63e085a18038e89bbec7e9205ba788ccd9440e58a879949
MD5 319ffcae6aa6e173cae5301151ff1770
SHA1 04be9e89f436ceb5cb2d913bdb5b12f1a90c4c5b
SHA512 941a171220038b712a874996d89e5163115d9b9ee5e57995722310f962664354e1d5cab0bb8eba974184caefc0a92e1f6616860bf634f2b4a63c009b3b9daa59
SSDEEP 12288:30CHGYj0Dm7Yn/3z+5HNyFxlJzWDR7DZYgzNR26TN3zsqPCo:3D093z+ZaVWNl328NjOo
MD5 SHA1 SHA512 SSDEEP

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 cfa005a6b2f6beb0536d5f387414006e7f152b8be92d8c8df5ee18a1193c0d37
MD5 e7e0d9533f58495de4f42e8655b65bf9
SHA1 fc1ae2b70b7c97a8c1b239fd5c7a565749147b17
SHA512 a73deeb2777b613e8d26026c4ea28e614702bd6a25e3d3041d110a9f582a64f6b0e07d6394bd39864a7e6c334db2d8a3b38b59373ba8d8602cd7aca5772b0ad3
SSDEEP 12288:2iCHGYj0Dm7Yn/3z+5HNyFxlJzWDR7DZYgzNR26TN3zsqPCP:2F093z+ZaVWNl328NjOP
MD5 SHA1 SHA512 SSDEEP

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 1406458b10331540d9c16941d9217dbffd09aa32ef17ddcf7689cc50553ebf30
MD5 bee40114a02120a20bab948b2689d7e1
SHA1 a9028568f382e763c0121b1c88e086c4a8b1fffa
SHA512 102cacc8f118551a434aca873d3d3f352a074874a5fcb801329e1b151cf823c4d815ece67990b661428548b494007c97e33a3e0f2e6925940d82c0d7c37b050e
SSDEEP 12288:mHCHGYj0Dm7Yn/3z+5HNyFxlJzWDR7DZYgzNR26TN3zsqPCP:mM093z+ZaVWNl328NjOP
MD5 SHA1 SHA512 SSDEEP

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 283388cd6b87a2feaf86f358fda8156e80230d58bd9d0c6a4b4e9bca32349f7c
MD5 6a6794c775a93ffceea0427e9b5b96c5
SHA1 b19a3bf08c6c0a4fddd3b5d71a79f4e7f2b49a0e
SHA512 0b07cf01a8afbdd53c358836b8961c1bced884c136ccbae66dc0a4c0204869434f06d93d607ec429a3b7dcbc2bdfa5e3b16fdf9392bb665587700eda964c18b6
SSDEEP 12288:EJCHGYj0Dm7Yn/3z+5HNyFxlJzWDR7DZYgzNR26TN3zsqPCP:Eq093z+ZaVWNl328NjOP
MD5 SHA1 SHA512 SSDEEP

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 da99e3dcac49c30f13b7d5ea5ee4a5b6ea789067c8e1c808fc0f9e536c5a85fd
MD5 cb21da0429d1ba2f77329c0417aa0afb
SHA1 e33deb863a026eb1dac1c3f7f787f818e4a1efa3
SHA512 ee7c171c5b228afa3b032bb5a30162afb0944a9245f5fabe05c61547d2447ffe30c6678fb456be81b226bf5adb7e50704161eecac45ac1474e83a0d3dc893e6d
SSDEEP 12288:3psf5CHGYj0Dm7Yn/3z+5HNyFxlJzWDR7DZYgzNR26TN3zsqPC8:4a093z+ZaVWNl328NjO8
MD5 SHA1 SHA512 SSDEEP

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 aa4f32dfb689e3adc5bc37ad7322f7dce928f50274a7c730792d0299c9eec178
MD5 988c47a9fd966956ba28da27d91a666d
SHA1 bb70b09b43ba208a929375afc239d1411f6dee94
SHA512 3a44dab8d70415d3f8866fd870cc6ae6d5bbc0a649951b57c896c5597025a92c4739d49e4081f665dec0fade09bfdd24e51f11e491152f62153a0c8c315e8625
SSDEEP 12288:y0CHGYj0Dm7Yn/3z+5HNyFxlJzWDR7DZYgzNR26TN3zsqPCO:yD093z+ZaVWNl328NjOO
MD5 SHA1 SHA512 SSDEEP

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 c029e48d211f2ff5d3a2abdef44118c5a6c7117b7155417da5c64a5bba01f096
MD5 8810e55ba6b41d1a8a6a3a0db08e3dd4
SHA1 dcbc92134a13fb4db5c4b66782c9a89a7627037e
SHA512 fd54691ceba21002e6a42e0018dd4f86934cf95c8f7a4a5387056cd63eba77434a98c4194e3d56505ab425344e50af1c9cc9c336749717c7f0c6b86d11a30644
SSDEEP 24576:F8RMyNoSFw1d+rC4vrmRcGPiQEaiPnMRTCB093z+ZaVWNl328NjOr:aRZwQCyiHiQEaiPnMtx+8qFM
MD5 SHA1 SHA512 SSDEEP

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 676KB
SHA256 aeccb5e3896ea765374de5a18295346553e026f08c7f74b33ef7d7ff456f6ea3
MD5 5870f94188f60865da46892f3ae134b5
SHA1 417567c16e13fe3c82024d7aabaa485db77377b2
SHA512 8697ddbabb4e070351652e43bff1b2c3dbda86c89f780ce8fee08c75a9843d6836e177ca7a194b29cb21650047cfd7ff550eefaf97cf9841234541f1f99b5790
SSDEEP 12288:cbxA1U7KkCHGYj0Dm7Yn/3z+5HNyFxlJzWDR7DZYgzNR26TN3zsqPCz:cbxA1UGz093z+ZaVWNl328NjOz
MD5 SHA1 SHA512 SSDEEP

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 ce7638836ed3d4698e660a1b5f793c07a928df45d5226f12c331e00fc0aa261c
MD5 9495f4c35a2b44caaead46ec70e102fb
SHA1 5707605baf7fb0ccb51c0f4692644779e4e4d3c0
SHA512 c81eefb8faebc8c32ac62a8beedd98e9cdd719b80c0d65ae1e7169b1a36664f75c1b0f1176251891ecd08883e6b2a559af6a66314cfc975e6e2ca9dbd6acd7f1
SSDEEP 24576:2jsmP0yHaqrVqHra44KDzMsrnU093z+ZaVWNl328NjOt:2jRP0yHfVqzlAsrnjx+8qFM
MD5 SHA1 SHA512 SSDEEP

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 596KB
SHA256 89b97b51d15796b1cf94467911c3ab7f11944b15ba6ef598c4a6dced5b55743e
MD5 442d7b041077dbb2975c2cc4a56ab8e9
SHA1 bad260feff4148ef1533543c86aa2e0ef6a731ff
SHA512 644be63faddba37f2df5701499093c72ace8a6c3de5fdb96095973dce1bbdfa3d05ffd5bb117242083305714eb66e8e990035a7aedf12f9b8c9e00d61fd32c8a
SSDEEP 12288:jWCHGYj0Dm7Yn/3z+5HNyFxlJzWDR7DZYgzNR26TN3zsqPCX:jZ093z+ZaVWNl328NjOX
MD5 SHA1 SHA512 SSDEEP

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 940KB
SHA256 607441bf2c4c9c27dc2000dc376449f545a272d34811902fac5bf1e2fbdec477
MD5 92c8c580d1ee62b0796ad934555a32be
SHA1 5059aba2f16e73a14e4a6aa8441a2fbce55618d0
SHA512 803d1b3c518bdae5a9dbf28d68f8addf1090c48e14a3b21c1010e1ede2b4e9431ee15e3b5201fcec9961836f36b0c8650ea4018a0412b2a4459544f6825b103d
SSDEEP 12288:yObIA4LWO+vAYFTQCHGYj0Dm7Yn/3z+5HNyFxlJzWDR7DZYgzNR26TN3zsqPCk:jALBUT/093z+ZaVWNl328NjOk
MD5 SHA1 SHA512 SSDEEP

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 800KB
SHA256 ac3974c0876870d68ea7d42b6815bbde3ddf46f5774da2581ef8202d04cc939e
MD5 009da110826257a821c27991ea22fb04
SHA1 b1a6bb0e6470ca0b7aea40a6b48ea9b92058318e
SHA512 5cf1c47a362f7f35be54c996df98b64fb2e6b68464c573f57f72df8894fd5948fdf45cd1701035bb2aa8c1345a6fc714d43912a9f3c0d74b860858a3a6aedb12
SSDEEP 12288:470VmzIYNvUyBpFCHGYj0Dm7Yn/3z+5HNyFxlJzWDR7DZYgzNR26TN3zsqPC2:1fYNHA093z+ZaVWNl328NjO2
MD5 SHA1 SHA512 SSDEEP

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 e9880a61d0801d351a8606ae9fa790e05092e53473da1227249867c5e554bdc7
MD5 ebdd34298b09e21077586214b0eb83e9
SHA1 1b6d75661497acfd81ed61e1a29a4d26d68e665c
SHA512 6816f92f740000c2876398ddc2ec60d02376e9bc3ff767bb4b46409c4894655ae352239d9836f46d5265926e0b22f75b7a0eb4ac4d35582a447c7b017c843f9a
SSDEEP 24576:KnXoJjNYH84VVSNAApoEOW66aspcrcHBjSSKHPWdQwPF3hJ8ssmOc+XLxu+x7uKg:KnXoJJYH84VVS6AmETJas+cHBjSSKHPU
MD5 SHA1 SHA512 SSDEEP

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 186b6903a40e035923e6443ece8d6846ae7315f85a77f412cf0013dbc1811899
MD5 ccd700a5f3bb143cddb7471db50e0773
SHA1 278da244084265ead626ef7cf2f89de6474bcf53
SHA512 0c739e190e6bae4d011e85c9b2c9bd1df0586fcae462e8e7fef261e432ea1bce511734d3356cd47cf41b7298111cf3b7ee180cdef60ea6a4f6e2e0a7db4ed543
SSDEEP 24576:ov7Xbxd9Tuycf8M/TYlSuxrr2PCO093z+ZaVWNl328NjOL:oDLL9TuJ0M/TYj2PCx+8qFM
MD5 SHA1 SHA512 SSDEEP

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.3MB
SHA256 ddf3a27b6701315f54b8501ed41701ed064f5a02a39f8d42935737f37ac4dc24
MD5 5bce6166fc2672213c0d0e94952ed1a9
SHA1 33eeaeaebc08a9a96a6984caf7fdb6aa69b4db64
SHA512 47808c9114c10ffe98e8282efe1d2fee8b50d3a6afea36017da288272bb3050abd0f51351c9079aa45b88d07e7002d1078d1256bf8d419bf86fe22046f5abf2a
SSDEEP 24576:DegJgpwJOmPOHWAKZ8ZguIGyPsxr5Vin10w/093z+ZaVWNl328NjOa:DngOJOmPOHkMx+8qFM
MD5 SHA1 SHA512 SSDEEP

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 904KB
SHA256 d7b32be02230403096b48513c35ea672fb2323a2fea87d278806a26cd64a2cb5
MD5 c584d5e2f6e8c7196e4cb74949269809
SHA1 7eae0fa2cb2de44fe7ee122b43cc358c6bfe6cc1
SHA512 0f0832c69ab08b927b350f889a3d782c28b340f6cc419239c0e15a12eed5462c29ccffdaa68714103dc4f9240613130ca8a7b949b8f4fb777690d495fe2033bd
SSDEEP 24576:xLJnJiTk3R3waE4JrO5093z+ZaVWNl328NjO9:xLJnJK8R304lTx+8qFM
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 3b8faa8ab267727f103b5130ae86c9ef0af987444fe7bbb6a9d12aae64d0483e
MD5 80cd0ff71343413059a62e8c59525b40
SHA1 b5749d1268db510c0ac4cb71865f9546797b5849
SHA512 91770f820c540e10da19eae7990e950161fb62a079b9c665121c09e1ada1609cf4f831f46adfa4a788f667e335dbbbe6d7a784cd431948b83a95823484b7167e
SSDEEP 24576:JA9mqCceDQncA/BmlvLto8cFVr9og9P/Z6p3093z+ZaVWNl328NjOn:e9mqCzDScAZmlvTcFg8Ph6+x+8qFM
MD5 SHA1 SHA512 SSDEEP

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 676KB
SHA256 4084358604b403bc55778ee619989c22d4c71277593f840398d25a01aac37fa1
MD5 3317bb27b91cdcc803624f7323c4a85f
SHA1 a32201927e8e491967eab8eebe943d3366564319
SHA512 68b42249831f04bf6685da1e17d7a2490b081512a80341cf72e19dff13cca070db36b693cb9006ed80c3e9a31b90a1e52f0933c033492923d581d2c550a2aeae
SSDEEP 12288:glYJeXm5nkEUuEqCHGYj0Dm7Yn/3z+5HNyFxlJzWDR7DZYgzNR26TN3zsqPCA:glYJeXm5jUuE9093z+ZaVWNl328NjOA
MD5 SHA1 SHA512 SSDEEP

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 732KB
SHA256 38101bbe1adbf91786b09c1afc0fbd7e5b09ca2cdce2b0b69ab5aad88ab5d94a
MD5 3505fd87e320e42c291a53234c5844a0
SHA1 d6695cc0d3559721f907bd848dc60b666a88892b
SHA512 3af7317a10d36361685ae194051084f43f945e3ad15e886943c4c51a71a0bd7153bf77515c521ee96b600d5471d9dd2aba4ea008c1191f71d7767559dde8d4d1
SSDEEP 12288:wmu6ky/CHGYj0Dm7Yn/3z+5HNyFxlJzWDR7DZYgzNR26TN3zsqPC8:w7ty0093z+ZaVWNl328NjO8
MD5 SHA1 SHA512 SSDEEP

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 604KB
SHA256 5b8fdcadb16d7d01e55e51f6ead0a6ed84a2998b76512d93d37dfb9be7311e88
MD5 e260bb527f23a83b722b0b1743209812
SHA1 c07e1a0bd37bec7f00fdc71d01f16245593ad1d8
SHA512 35f9326388caa3643f7a39a37fcd55f47d3bbb6a3c7671ce925fe7693100ac46c8a3ad117e22aeecd93caa494b26b7c2be18054f9c534451e9295cbdad15cc8a
SSDEEP 12288:XPQCHGYj0Dm7Yn/3z+5HNyFxlJzWDR7DZYgzNR26TN3zsqPCa://093z+ZaVWNl328NjOa
MD5 SHA1 SHA512 SSDEEP

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 6f827a890cd3f32c0a7df997a225b9a6530fb38e8d14435814ae07ad09cc645e
MD5 37db67b9e73067a9b1444f0d42217e6e
SHA1 ba58603bc31eea9e5008a3acf2d1d565c28329f8
SHA512 09aef392233f2809d82cb13388345721c288e4d30bedd1925fcd6a8583f17b8e7eff8e1a34dc483449949a0c135925240fc30cc13ee54bd434616dec2028b488
SSDEEP 24576:0C+TyQIu93VAumZr7jmC093z+ZaVWNl328NjOE:0/TfIq+YFx+8qFM
MD5 SHA1 SHA512 SSDEEP

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 768KB
SHA256 908cd324bafc2f250951a82fd29a76fc693fdc4f25f12688b477d099523db094
MD5 a5356f72d9e28da2d78f056678316eff
SHA1 c80222d4c4dcff7934122a757badb744788d2bb8
SHA512 98c57bc181f9166528b16693c2d9fe49b940b1b0951aa99fe70ab25e1a2daf77f6c574a100084b2cf24f70d97ee615dec3eb882f6e167a167b0c4c2b77a0e842
SSDEEP 12288:QcyrWOstaa3kcscCHGYj0Dm7Yn/3z+5HNyFxlJzWDR7DZYgzNR26TN3zsqPCO:FLQikZb093z+ZaVWNl328NjOO
MD5 SHA1 SHA512 SSDEEP

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 11ca68d211cb0462392c2d26e9ec7eb46204e2bc3c9e57989d74a1d1a6dcd662
MD5 8c1942a066d14be8dfc58c4105d2a9e9
SHA1 7a70b1641d911c1154fc9020ce2104c4162ae009
SHA512 19a1e52c782af8ff394ecdc9273a00141002611c6961299bdf5b31c8bd86e69eff362a8a2ca12a4b67883ec5979c95cdb3c0f183339c85cb91b004d55dc58ea0
SSDEEP 49152:fpJFwrPpGyqWo6cbT2TZ8maJO35NPHXogsS7Q78ZGAvL9vnF35LWAPDx+8qFM:EpC7b4+80GTkl8qW
MD5 SHA1 SHA512 SSDEEP

Submit Download

StructuredQuerySchema.bin

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin
Size 414KB
SHA256 e67e330837a6b2f6d5f76815e7235a512b54b1c90f2ad62a3e9d142ae6939c8d
MD5 16b9618962f5623ca791a1366eee5708
SHA1 f0d257511952f075b2a0ec7d8e8730c3e464461a
SHA512 18e1d5a105b87fc72df94645685f5a8d3f593df2d3a9b8652b3b4a4ceaf92d3c7a67b0c08847186149dd608428cae8f1b3bc844bc7aacfc9e3219da823ca2fe2
SSDEEP 12288:vMUC7+vlk3n61mSkplXZ5RwmF9n4w/TSD:vXhl6V/i
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/236-233-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/236-240-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/236-234-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/236-358-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/832-312-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/832-655-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/832-459-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/832-315-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/832-306-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/1464-295-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/1464-302-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/1464-296-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/1464-427-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/1480-385-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/1480-388-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/1480-379-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/1480-651-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/1484-360-0x0000000000850000-0x00000000008B0000-memory.dmp

Download

memory/1484-520-0x0000000140000000-0x00000001400E3000-memory.dmp

Download

memory/1484-352-0x0000000000850000-0x00000000008B0000-memory.dmp

Download

memory/1484-359-0x0000000140000000-0x00000001400E3000-memory.dmp

Download

memory/1668-341-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/1668-519-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/1668-350-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/1668-347-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/2196-437-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/2196-481-0x0000000001C30000-0x0000000001C40000-memory.dmp

Download

memory/2196-497-0x0000000001EE0000-0x0000000001EF0000-memory.dmp

Download

memory/2196-658-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2196-513-0x000000000A520000-0x000000000A528000-memory.dmp

Download

memory/2196-460-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2196-431-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/2284-402-0x0000000140000000-0x00000001400CA000-memory.dmp

Download

memory/2284-281-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/2284-275-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/2284-271-0x0000000140000000-0x00000001400CA000-memory.dmp

Download

memory/2392-403-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/2392-394-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/2392-400-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/2392-652-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/2852-256-0x0000000140000000-0x00000001400BA000-memory.dmp

Download

memory/2852-266-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/2852-387-0x0000000140000000-0x00000001400BA000-memory.dmp

Download

memory/2852-260-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/3204-291-0x0000000000860000-0x00000000008C7000-memory.dmp

Download

memory/3204-287-0x0000000000860000-0x00000000008C7000-memory.dmp

Download

memory/3204-285-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/3204-415-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/3356-70-0x0000000001B00000-0x0000000001B60000-memory.dmp

Download

memory/3356-59-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/3356-72-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/3356-55-0x0000000001B00000-0x0000000001B60000-memory.dmp

Download

memory/3356-49-0x0000000001B00000-0x0000000001B60000-memory.dmp

Download

memory/3544-335-0x0000000000550000-0x00000000005B0000-memory.dmp

Download

memory/3544-518-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/3544-329-0x0000000000550000-0x00000000005B0000-memory.dmp

Download

memory/3544-337-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/3840-224-0x0000000140000000-0x000000014025F000-memory.dmp

Download

memory/3840-28-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/3840-34-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/3840-36-0x0000000140000000-0x000000014025F000-memory.dmp

Download

memory/4508-657-0x0000000140000000-0x00000001400C2000-memory.dmp

Download

memory/4508-419-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/4508-425-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/4508-458-0x0000000140000000-0x00000001400C2000-memory.dmp

Download

memory/4772-372-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/4772-370-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/4772-364-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/4772-376-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/4772-374-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/4896-58-0x0000000140000000-0x0000000140266000-memory.dmp

Download

memory/4896-45-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/4896-39-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/4896-225-0x0000000140000000-0x0000000140266000-memory.dmp

Download

memory/5004-73-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/5004-226-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/5004-62-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/5004-68-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/5332-656-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/5332-412-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/5332-406-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/5332-417-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/5384-0-0x0000000140000000-0x0000000140104000-memory.dmp

Download

memory/5384-1-0x00000000009B0000-0x0000000000A10000-memory.dmp

Download

memory/5384-11-0x00000000009B0000-0x0000000000A10000-memory.dmp

Download

memory/5384-13-0x0000000140000000-0x0000000140104000-memory.dmp

Download

memory/5384-7-0x00000000009B0000-0x0000000000A10000-memory.dmp

Download

memory/5640-23-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/5640-223-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/5640-22-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/5640-21-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/5640-16-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/5840-324-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/5840-318-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/5840-517-0x0000000140000000-0x0000000140098000-memory.dmp

Download

memory/5840-326-0x0000000140000000-0x0000000140098000-memory.dmp

Download

memory/6012-245-0x0000000000DD0000-0x0000000000E30000-memory.dmp

Download

memory/6012-259-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/6012-244-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/6012-251-0x0000000000DD0000-0x0000000000E30000-memory.dmp

Download

memory/6012-257-0x0000000000DD0000-0x0000000000E30000-memory.dmp

Download

memory/6112-529-0x000001EE27A40000-0x000001EE27A50000-memory.dmp

Download

memory/6112-528-0x000001EE27A40000-0x000001EE27A50000-memory.dmp

Download

memory/6112-521-0x000001EE27A40000-0x000001EE27A50000-memory.dmp

Download

memory/6112-531-0x000001EE27A40000-0x000001EE27A50000-memory.dmp

Download

memory/6112-530-0x000001EE27A40000-0x000001EE27A50000-memory.dmp

Download

memory/6112-522-0x000001EE27A40000-0x000001EE27A50000-memory.dmp

Download

memory/6112-523-0x000001EE27A40000-0x000001EE27A50000-memory.dmp

Download

memory/6112-527-0x000001EE27A40000-0x000001EE27A50000-memory.dmp

Download

memory/6112-525-0x000001EE27A40000-0x000001EE27A50000-memory.dmp

Download

memory/6112-526-0x000001EE27A40000-0x000001EE27A50000-memory.dmp

Download

memory/6112-524-0x000001EE27A40000-0x000001EE27A50000-memory.dmp

Download