f6935dd132d206ac5b9952422bcff69e370d6778854e9b9c6790982a2bc0d51e

Analysis

max time kernel
150s
max time network
129s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
15/04/2026, 12:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-15_08ca31335d14f65104725c5ca1f32174_icedid.exe
Size 1.4MB
Sample260415-p3spnahs8x
SHA256 f6935dd132d206ac5b9952422bcff69e370d6778854e9b9c6790982a2bc0d51e
MD5 08ca31335d14f65104725c5ca1f32174
SHA1 468128a18f876c31add3d74a0aa4208cc6417ca4
SHA512 0fadf17ac8403fc4d0363e9f126c98de58dc5aef839da199b44a2000d7aede2275b6b8cff541e971fce6e81cc228e6aafb5d4df4a412abbdaf43a2ca6266bd48
SSDEEP 12288:7AmZXuYN34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2il1:7AhYKSnnrFb4PM4MYgLxEVyGLz
TLSH
T16E65EF667A9440F9D4610D308661EBADA325BC29D8174F4B32907ECFFFF2AC58E15A31
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
5152	alg.exe
5172	DiagnosticsHub.StandardCollector.Service.exe
1736	fxssvc.exe
3292	elevation_service.exe
3388	elevation_service.exe
764	maintenanceservice.exe
5260	msdtc.exe
5988	OSE.EXE
1500	PerceptionSimulationService.exe
1740	perfhost.exe
5068	locator.exe
5624	SensorDataService.exe
5992	snmptrap.exe
1816	spectrum.exe
1996	ssh-agent.exe
2112	TieringEngineService.exe
1384	AgentService.exe
4236	vds.exe
1728	vssvc.exe
5000	wbengine.exe
5740	WmiApSrv.exe
2896	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\e:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\alg.exe	2026-04-15_08ca31335d14f65104725c5ca1f32174_icedid.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-04-15_08ca31335d14f65104725c5ca1f32174_icedid.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-04-15_08ca31335d14f65104725c5ca1f32174_icedid.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-04-15_08ca31335d14f65104725c5ca1f32174_icedid.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-04-15_08ca31335d14f65104725c5ca1f32174_icedid.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-04-15_08ca31335d14f65104725c5ca1f32174_icedid.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-04-15_08ca31335d14f65104725c5ca1f32174_icedid.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-04-15_08ca31335d14f65104725c5ca1f32174_icedid.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-04-15_08ca31335d14f65104725c5ca1f32174_icedid.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-04-15_08ca31335d14f65104725c5ca1f32174_icedid.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-04-15_08ca31335d14f65104725c5ca1f32174_icedid.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\{17A6A947-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db	spectrum.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\9c8a25e3da180f68.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-04-15_08ca31335d14f65104725c5ca1f32174_icedid.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-04-15_08ca31335d14f65104725c5ca1f32174_icedid.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-04-15_08ca31335d14f65104725c5ca1f32174_icedid.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	spectrum.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-04-15_08ca31335d14f65104725c5ca1f32174_icedid.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-04-15_08ca31335d14f65104725c5ca1f32174_icedid.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-04-15_08ca31335d14f65104725c5ca1f32174_icedid.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-04-15_08ca31335d14f65104725c5ca1f32174_icedid.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-04-15_08ca31335d14f65104725c5ca1f32174_icedid.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-04-15_08ca31335d14f65104725c5ca1f32174_icedid.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-04-15_08ca31335d14f65104725c5ca1f32174_icedid.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-04-15_08ca31335d14f65104725c5ca1f32174_icedid.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	2026-04-15_08ca31335d14f65104725c5ca1f32174_icedid.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-04-15_08ca31335d14f65104725c5ca1f32174_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	2026-04-15_08ca31335d14f65104725c5ca1f32174_icedid.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	2026-04-15_08ca31335d14f65104725c5ca1f32174_icedid.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-04-15_08ca31335d14f65104725c5ca1f32174_icedid.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2026-04-15_08ca31335d14f65104725c5ca1f32174_icedid.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-04-15_08ca31335d14f65104725c5ca1f32174_icedid.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2026-04-15_08ca31335d14f65104725c5ca1f32174_icedid.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-04-15_08ca31335d14f65104725c5ca1f32174_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-04-15_08ca31335d14f65104725c5ca1f32174_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-04-15_08ca31335d14f65104725c5ca1f32174_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-04-15_08ca31335d14f65104725c5ca1f32174_icedid.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2026-04-15_08ca31335d14f65104725c5ca1f32174_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-04-15_08ca31335d14f65104725c5ca1f32174_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-04-15_08ca31335d14f65104725c5ca1f32174_icedid.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	2026-04-15_08ca31335d14f65104725c5ca1f32174_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2026-04-15_08ca31335d14f65104725c5ca1f32174_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-04-15_08ca31335d14f65104725c5ca1f32174_icedid.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	2026-04-15_08ca31335d14f65104725c5ca1f32174_icedid.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	2026-04-15_08ca31335d14f65104725c5ca1f32174_icedid.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-04-15_08ca31335d14f65104725c5ca1f32174_icedid.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dib\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001ee16644d9ccdc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000068c18945d9ccdc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f1751e45d9ccdc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e9935844d9ccdc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c147d145d9ccdc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wdp	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.txt	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a73a2345d9ccdc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tiff	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpeg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.txt\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000056a08d46d9ccdc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d016de44d9ccdc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cr2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wdp\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.crw	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cr2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
5172	DiagnosticsHub.StandardCollector.Service.exe
5172	DiagnosticsHub.StandardCollector.Service.exe
5172	DiagnosticsHub.StandardCollector.Service.exe
5172	DiagnosticsHub.StandardCollector.Service.exe
5172	DiagnosticsHub.StandardCollector.Service.exe
5172	DiagnosticsHub.StandardCollector.Service.exe
5172	DiagnosticsHub.StandardCollector.Service.exe
3292	elevation_service.exe
3292	elevation_service.exe
3292	elevation_service.exe
3292	elevation_service.exe
3292	elevation_service.exe
3292	elevation_service.exe
3292	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
684	Process not Found
684	Process not Found

Suspicious use of AdjustPrivilegeToken 16 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4328	2026-04-15_08ca31335d14f65104725c5ca1f32174_icedid.exe
Token: SeAuditPrivilege	1736	fxssvc.exe
Token: SeRestorePrivilege	2112	TieringEngineService.exe
Token: SeManageVolumePrivilege	2112	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	1384	AgentService.exe
Token: SeBackupPrivilege	1728	vssvc.exe
Token: SeRestorePrivilege	1728	vssvc.exe
Token: SeAuditPrivilege	1728	vssvc.exe
Token: SeBackupPrivilege	5000	wbengine.exe
Token: SeRestorePrivilege	5000	wbengine.exe
Token: SeSecurityPrivilege	5000	wbengine.exe
Token: 33	2896	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2896	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2896	SearchIndexer.exe
Token: SeDebugPrivilege	5172	DiagnosticsHub.StandardCollector.Service.exe
Token: SeDebugPrivilege	3292	elevation_service.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2896 wrote to memory of 5500	2896	SearchIndexer.exe	104
PID 2896 wrote to memory of 5628	2896	SearchIndexer.exe	105
PID 2896 wrote to memory of 2568	2896	SearchIndexer.exe	106

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-04-15_08ca31335d14f65104725c5ca1f32174_icedid.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-15_08ca31335d14f65104725c5ca1f32174_icedid.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4328

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:5152

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5172

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:3172

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1736

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3292

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3388

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:764

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:5260

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5988

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1500

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1740

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:5068

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5624

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:5992

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1816

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:1636

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1996

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2112

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1384

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:4236

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1728

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5000

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:5740

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2896
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5500
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2980 2960 924 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5628
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 3036 3016 924 {85EE815A-7738-4808-A14A-3AD87E32A3BF}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2568

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 456a957bf90aa89f824aac88c3d55e4a3d5560f51c082c4f29f0c21dcb34a2cd
MD5 11ad5d8a4de4440b7e18f602dd631bd1
SHA1 71b189ad836c0df89030d01ec8c2d231c277ad4f
SHA512 63b270f92de12c492b1ba559741bc430cd58dbe0b75aa628ac5f7e3f50e7e1e1324d38c8a56de1b0a0b8b092e5d7e26a99a56269cf2a9991014d760f656ce0df
SSDEEP 49152:Tb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnij4MYPVyGLP:x3q6HjBYVD
TLSH
T1D4D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 e13f9457e121d9483f2528f91359fb7a53f4140bf64e828d72acd4091885c4db
MD5 ff63496e934ab099fa63a89dd396f0ac
SHA1 6165d71c51071920e53062941263f67cf9172fa0
SHA512 1c57925a6c92b3579df35bf74b361dca531570788ef56cb87cf13d1782e16f405035759850db35e9a6f6d95b3676c8d01a23dcc234af6b6a096ef646ffc1f998
SSDEEP 12288:+1XLsswWkxy2lRq2czAT34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9n:MXYfDtczAsSnnrFb4PM4MYgLxEVyGLV
TLSH
T13065F12977E408F9DD6B8278C8A28555E733B8518760F78B03E499662F333C85D3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 56180b522bf510065e08724a141a77e9a709213b9c177728731dd84c9a6793d5
MD5 ad2d6db65dc3915ed219c17996af7993
SHA1 5cea99cde350dca562194749674a5a6025090775
SHA512 cfe15da999fd7c69010cdf339e33a2b3a3b1be75b7913683ecf108224c6b3e4efe0b450d2b6304d4a0188e161b42287f68215f43902b6ecb0d0a4225b395e1b4
SSDEEP 24576:i0Le5ji0hmxirMhSnnrFb4PM4MYgLxEVyGLR:iPji0Acpj4MYPVyGLR
TLSH
T163859E66F6788375D073C0B9C5D2A68EE97130825B308ACB4286D77C3F676E68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 48563ac000205c6ff92982baa82a17abf24630ebbbebbe295322e7539dd33d0a
MD5 6b0142bd7e9e54f86f6a421b1ba352d7
SHA1 8537818c338dd12a56193ac2f50844ac1471a1d5
SHA512 a79d6c5d1dd2efb70e5eb1e6e24bb3f0dadb106231c94a5b73e8873262ce558d711ee0ee4670c9f08f905bf48b740d7f5aadbf90d99cdb5127a855087af49fcd
SSDEEP 24576:Va7/ezSC6vUyD/aqgrvWE6q8wyu3SnnrFb4PM4MYgLxEVyGLE:c/ezSC6vUzPvxHjyNj4MYPVyGLE
TLSH
T17A755C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 2b1afa12c0cf4c61a3887c6d91fa737fd95366a748fec0630534405e7a9c5f69
MD5 9dfc82805c8372ed63d0063136643c0c
SHA1 bdff7f6272633671c5d73cc4f94a2f0b0f6ed18e
SHA512 f9ec9f3a7d97a0063a64c9a8c98fd0617f4b8284fdcd728e4956021616967b4f3f1ea7001f5a7b2f8f598a851cf538899b66a69db9855023572b0e4d1ca4158a
SSDEEP 24576:vVbqPb88hv/l+64SnnrFb4PM4MYgLxEVyGLF:vVO88hXl+Oj4MYPVyGLF
TLSH
T12D559E66F5B48331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C3E677D6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 d42a8a1e11440d19639c79f4694fe9d6d2c5173094c08ab9e4bd5a3f574d66c9
MD5 4bccdaf48a2328b2b17c86d9e235b954
SHA1 f33506850e64228fcf5e3037fef8c9641cdd383b
SHA512 9a18764ed3c1e79161ae54737aec9c66644d8dc252a536161781f504fd8c27e25c3ce8f1995125fad5ebc7b76a1aaa0937ce3373eb5f089cab38511f90ab4428
SSDEEP 12288:ORm34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilf:ORdSnnrFb4PM4MYgLxEVyGLZ
TLSH
T18D4523A62BDC10EACFAE15B0D1B96AC8E6057C61F875B20B6750785B3A3F20DD891313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 f0f7e2a069949603442beb982615af11c72e6e8a48cb607da4d335333ea1c9a2
MD5 886bfc301f8bb304df8a5629550879e0
SHA1 1bf2277c71b4a5fafff961d6c7919fe24b5a441a
SHA512 ef0ffe596245115d6f27a461bdce873a3f4b97170d48b0caf26fc661f22791d9a9c282dc7c22e4d50ff6eb50de576f025b828bf7415266ff02b516da476e70c7
SSDEEP 12288:NeBNUbTVO86Uv34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilH:NJIUwSnnrFb4PM4MYgLxEVyGL9
TLSH
T18A65DF3BEE28FCE2C67E4DB856918740E77278308F62A3CBD164820E9E235D55D76C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 854c13a4878db54e0a6101925d6d4ada464a6453c29f7eeadeaaa5f48132873a
MD5 ea8a37dd2ec8ba8a9fe2112e5c915730
SHA1 b9a361310608228868569195be8e0c185a3eb7ec
SHA512 39365ee74260fe529ecc10ab86195e1c0d9935d45438efc0842fbf7b241c2b674eca2ab3677545e7e3b5a56fca13280b09dfcc8c8240a984eba3b739d1550e11
SSDEEP 49152:fQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THR:fQvGAdlCEL8c/yRNw5CdV+
TLSH
T156267C656BF880F5E0A7E174897AC6B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 736e742db304ad68a75d156d1fe3ac0d9c08d36dfdf0970aef34309411697237
MD5 35befa1a9ebb0ff0208b31e616487a19
SHA1 97b75ead8e9a73f8a1b149081bd086761b8c465d
SHA512 6fe8af144e641140c53bfea91ed4ecc8d70b015cd868a6a776b3cd2b3b4034f4a7f919c565ee8b185f7687b33eb998180d5d6e793892afc1af0fa0b5586cc08e
SSDEEP 12288:+AwSfxL/2Dc34DLLmt0LDQewsAjZ34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAn:jdewsAjeSnnrFb4PM4MYgLxEVyGLk
TLSH
T1FD75E031FE74E036C7BF0DB21B36D716542DB9204B612AC3E3A89D9E59342C22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 9769ccb928d841e5128719264fadfc8e19d957b4227f9587b9a636e26d2da5e4
MD5 95fd1bdef42bd7864880f565365ac63d
SHA1 6520e29f9ae28fca4e042a3ac15bcabb25ef5476
SHA512 809bdf2a1be5116e8881012dd909085538ce12dedab1fc0e0b488630753b8a0b48da59889739abe22888960e0639ad28bc7c708ca07edbe1c77d08806a73d740
SSDEEP 196608:SUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJH:SUEtQevvqc2W1cpV2EI32
TLSH
T109474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 83f07431bd188126f1384913cd11e10951f7eb2342be6e97637e9bcf532fdefd
MD5 632a497d4c9642806b807d31b5f20077
SHA1 97c212d65b24bf648c0213add004dea3e5589265
SHA512 9cd7a58d2639f0b8f5198571e619382be1161ea8950543c55cdead5d3a9c5328bdda4e568c7a087c0211bfe60acff426beb95f800f49656e94807b0757bbacfb
SSDEEP 49152:PCbRquA/m2yL5zQfFiV+XenmE3/zZj4MYPVyGLx:IoqtVjnmxVt
TLSH
T189D58D0976B8C1E4D1F6C77886A2C647F37178158B31A7EF4266461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 54487c5d99b5efbf2475e96aa6d43fbd07f88ad51e63b13332f68593e2c15830
MD5 7395dd6dbb3cf7756160922b592f043b
SHA1 e5c030719ca4a64452ee2ba125de15da52d64128
SHA512 6897dc7133b76b148c8dd17227b46d027de6cd94f49fc33c24b966adf64c09cf1a331d8af65e355b965416195526d5ce7d9b17ee21b2aa11763edc681230917b
SSDEEP 24576:eAhGLJIFoiwtA5l7S53rSnnrFb4PM4MYgLxEVyGLL:eAMyFoiq5kj4MYPVyGLL
TLSH
T14635AD81EBF955D4F5B3AAB899B68170EA76BCA65E31D20F2150D10F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 40bdac262b3e0671c41f1c7ec534cd79adc7f03fed34a8092d7f8f17ae2b520b
MD5 624f828468914acdb7ef0fee6b4ebb0f
SHA1 1c5b2297c1dbeedc0a4b47a343a1939b8b03bcf6
SHA512 bbcaa15c93c1db9f4e1d43011cb83baa2bebf2479d906ea7800f86251efb3ed36997f1a6670a7494fdcb68905652dd74518d21bb5e5628b8e2a043281e326825
SSDEEP 12288:emw5HEjsChNVBFgl0WDm+CM34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyq4:3wuoOWySnnrFb4PM4MYgLxEVyGL6
TLSH
T1F465F14637E81CF9EAA74238C5978535F7B2BC122A21D71F1760C65B6F37311AD2AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 02b6c3c3a2354b3784a1282055dedcb213e3a84850445670cc54a1f53f5cada4
MD5 8ea855bd64a9b5a26f82a30884f2c534
SHA1 d4b38162d2b764d8923fd166f9cbc3c9115699a6
SHA512 bb7e707dbc83ea2d3aad9303b264abd406d934d91c452d010801242b6c0fbb1b20fe1c479299299e5ff3775213a0400f388933fe16dbfbac37de273605ef96c7
SSDEEP 12288:cBZ1Iyp34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2il0:qZu5SnnrFb4PM4MYgLxEVyGLW
TLSH
T17B5512AA37E820FAC6AB4274C4F55688E3327862B77293CF1650655A3F37AC55C35332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 79de3bc181d63af03a12c0de57eba7f1d0612edb6c10943edabc5bb1ed69089c
MD5 f97994c3967743992c09165d3917a2c6
SHA1 62b84101d7f43821860dcb2ec9ce321057ecf1c6
SHA512 398134c5cae7cce090135c1686988bcaf3f7478d1384d4274c479039264aa4291499f528bf4cb2ecf2ec67cc383e066ff6bbf4e604e002071deb947dcdd3be40
SSDEEP 49152:Uj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UY:LQRQyi36YOcPQLvw2gAf+PN3kVH
TLSH
T1A8667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 f086756325cac52d55aac843d2aabcff083cdddcf1cd7edbce08cf26b2869805
MD5 9987f4279a3cadf578b43441c121c3a5
SHA1 1290f8d060fb0a343fc76b198d425d5e5d927747
SHA512 023d8ff0bad32631c00adaac67ea11afad3f072943726f21a9ba9578192e2930fad557bf98b9264f7c9974c52d509f605d4b0bf926d724a9e5a91483d2e80540
SSDEEP 49152:sj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UT:jQRQyi36YOcPQLvw2gAf+PN3kVM
TLSH
T1AE667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 62e9394b4f046a72d687f3493781ae9b63b35c12528da0290bb12bdc9cf61928
MD5 f0723a90b5dc188c86e172a611c01f78
SHA1 619dfc988f739046087c5626f12c06cd92c97fc9
SHA512 714b07254c2c5d8dcde29336c6e08d70882aa5a2cff6395bb1c933709943acc5a6ffee3e91f5f158a77948592275c311693261d38a834b8b3afbe5926c3a5489
SSDEEP 24576:fwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0pSnnrFb4PM4MYgV:H68Qg55nhheWu7PNU3/pj4MYPVyGLC
TLSH
T1D0B54A33B2F600A9C44DE1769F4A972196D27C71CFE1E3DB851172061BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 72935d6030eefba92ce51617c9f0c7465c8b3e69943ce363549bb342f3827a04
MD5 d2547a5d84efc66960ed6b2683cab963
SHA1 7d54c904c433cc5fb3afeeda7685ff99bdc95a9e
SHA512 fbacd66a35dd4bea9702621bc35ae4859e1e8639a08f279010d29c0dc1c96f0ce4f445bc799392a695d412bee8c3a2e5fbc6291b4ff4f21582e3c11b18b5f813
SSDEEP 49152:n3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99i:Ky5112gYy5azzVvL69nLKnhZHV3
TLSH
T11A167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 90098fa6b2a2bf6f454260565e5476dfb0ad6d5cc3581047e10de2ef72cde01b
MD5 be0af55087ccb6dfa97bfcbec2e58dfc
SHA1 14cb9904eec709f2542addbaa67e01127223b7b9
SHA512 4dc3704c827b6e05c4747f9ee9450efbe636e1fd7a3801c346150d32cb538da8715d0ec164ff83f99dc4fa3901691f4c7877e7da73fe9e57df87dc1897f924db
SSDEEP 49152:GB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glPj4MYPVyGLB:0u6JmVxd2dMVd
TLSH
T154D59D13F1DA01E8D06ED478974A9233FA62BC490B35B6DF0A9072562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 fb30b39d6d10f6e0d79cff3e2eea96375de3c26da901d2e2260739f81a4aa0e4
MD5 55c0abbf7ccc2e73a609b373eb4b107c
SHA1 9c0da8b121a38e1d91cf8b0039b5ce08d63eb0bb
SHA512 c65101bf71005afce42980a82cb5d7f74f8cc0a6f27016c03bb1d95b25bb641188fcda3f57437ba8014094eeeaefc4aef1bbaf694f5276bd3084b015ca460e72
SSDEEP 49152:91hpsNoJpF1A6UU44CwH7R4xjj4MYPVyGLC:9mifPbRxVu
TLSH
T149B5BE13F2D900E8D06DD17887569232EA62BC460B34B6DF0A90B7962F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 2330b86849503f759371549aba404ffa080a8804a5220a3b44baacf51cbb8960
MD5 e39d3bf4ac00ba2344955e8e04438601
SHA1 44b15107bf36110aac4d4b57f97879c1a50640e1
SHA512 90627a056c77e8978b30b18bcb4709781882774ed48299a1451b1a40af87df30e33d95277d65aea8c1b85c5fad3d3ec0a8ed88a85ac0e95c60527c9ae833e73a
SSDEEP 49152:xSuZQIY0Be2KRRVtOnks6NMHqyj4MYPVyGLz:f5dKTi61DVn
TLSH
T160C5BE13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 9c75c24ba38c83ecf7b3d87d90d6da35c12cb35a16611655acbaf2a62f0aab20
MD5 30aa43f1bf5cd3c5eeaec7adc6716cbe
SHA1 6ca0c93f8ea69be577c825184f8550506b450104
SHA512 4a8cb9355966e9ef7d5ada0c17c8e7d5777eaa3e1a5407c4bc3c816e064dc93cb07f86f93edf9afbc3430890a34d6905f46d1f8d4a814c2796bf3fa5f7444a9f
SSDEEP 49152:QhtSn8EApI0figngiDn0AP5wfj4MYPVyGLr:BX2iyphVV/
TLSH
T1C995BE13F2D900E8D05ED174C7568632EA62BC160B39B6EF0A90B6561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 eb90f7b0f2ef7027fead313373acd36a321faa650d78f3713902c39221cf9a98
MD5 bd0ad37aa6bd5aaff5e7ccc34b26aa0b
SHA1 1efa35ef6b984c821696fc1501b3771b4d6eecb7
SHA512 921452031629d7039e82a7182f5ac11648c0199dc8e7916f2ac4a2ebdd91df16384f0cb5ffc3e0769e9db79d8b9aa9efeabf6f9d227012f5160960a8bc30ff0c
SSDEEP 12288:V+34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilz:V1SnnrFb4PM4MYgLxEVyGLB
TLSH
T1674523A62EDD10EFCF5D16F0C1A566C8E2097C62F976B20F7B4574073B3B20D6892662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 dc3e95a7ccde7dba76f65ac39be31f9238ecab7af2f7827561231ddaadaca227
MD5 90010c4c954041dd1f3fad03b3a261c7
SHA1 af494ed0219d37f5b2c9eacd6b02d553bf501165
SHA512 954555e0e14147d31d0c376a47d49349051b8b9cc5b84598bcf72f0594b3881952fcaad2aede53767bdf041c744bbb771cae65b70d90f1c82e8b5801842f34c6
SSDEEP 12288:bd34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilz:baSnnrFb4PM4MYgLxEVyGLB
TLSH
T1634523A62EDD10EECF5D16F0C1A566C8E2097C63F976B20F7B4474073B3B60D6892662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 098dcfc6f593d0cb2f18da85abb175d32eee0da4911d66d4ceab769877962543
MD5 2261ed209f44a0e110cbb53e5d04dff8
SHA1 3c8d904c366b54827f62f848174fd5890df8604f
SHA512 5305fd1bb1871191932c15279a135ecd472f1d370f04b366f41e1255a8297ecb5d3a374cafcb72d7d2fc95d56ad26aa67b8f5a85d60dfa1f43245e32b88f3702
SSDEEP 12288:cn34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilz:coSnnrFb4PM4MYgLxEVyGLB
TLSH
T18A4523A62EDD10EECF5D16F0C1A556C8E2097C63F976B20F7B8574073B3B20D6892662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 2279b1da85dd2df5a5ca4c7ab976697a052a247de202d722734d84f714f12235
MD5 fb5911269fb943ec12a5bedff5c97fc5
SHA1 429b683fe6e2b4837c7d772361b1126f9aef3ef5
SHA512 1960c956ac4fde9e18eb0e26892030c4c2a74edb2c977db70e1630e5d5d7315ca29d824948122d79b19697a21dc62ff9a9f7b18807880096ac44fef056d47ac6
SSDEEP 12288:yV434XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilQ:ySnnrFb4PM4MYgLxEVyGLW
TLSH
T1F74523662BDD10DACE6A96B0C1B556C8E225BC61FA72B35F6740381B3F37348AC71721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 b347f2dc14540c43a3b3638405474c652686bb3e299b6dcd7bd327fb3db7f4d7
MD5 028e5b69630545b6a855ccff8a7b62ab
SHA1 2fe3dbf21456c02a5a6623e6347e7050dbd313e9
SHA512 391dba5c9408d90dfc2e2da49de92af15df27e6f29f22a7a8047e5e50be71366a15e82f09cb0ec0a9aa73aa700a56068504af4b47289027317960c7801ed33c7
SSDEEP 12288:LA34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2il7:LTSnnrFb4PM4MYgLxEVyGLZ
TLSH
T1AC4523A62EDD10EECF5D16F0C1AA56C8E2097C63F976B20F7B4574073B3B20D5892662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 51310ef4c8f2a890363a726df9880ce48bed7cd7cb1b0bddfe7327685333c012
MD5 84e3afd4c9d095986b5625b05201895b
SHA1 530a4460d9d3c082e5a4f2160166d2f44d9d3c86
SHA512 8622ea45a5b6c96ee7d364b19d7bde4b97dc8c29532e1420f021add271913ef10c8eb18876c533074dac9f4fbcc9eab88e61e1053f3c294b809408814c20f1eb
SSDEEP 12288:kR34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ild:kWSnnrFb4PM4MYgLxEVyGLb
TLSH
T1574523A62EDC10EECF5D16F0C1A566C8E2097C63F976B20F7B8574073B3B20D6891662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 bdedc40d1fac6544453e569c79579c184498ab4e853de49396a1974e681f99a3
MD5 3c260c01f9b99947cde5272b3e69e964
SHA1 de39a625c73a5700f374783fc5ef932af658ad86
SHA512 aded5e25e86e90404e951a7ec255167b04af1c7e2e0fa11831a04c9fa937d27c13c3de3c73f4530d0b17221f22b21352f2cc645fcf9691fc99aa788b4ff6f540
SSDEEP 12288:Fl34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ill:FiSnnrFb4PM4MYgLxEVyGLj
TLSH
T1C84523A62EDD10EECF5D06F0C1A966C8E2097C63F976B20F7B4574073B3B20D6891662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 6d3d4d20e5ac5e48eff4b00d17e773b499e00503832eee6d6a2838b4015896a7
MD5 213cdc7173f0b18d3084f8cc09b84637
SHA1 76fcf84911d7cfd5fdca00314d38341be557938a
SHA512 8be2b737ff9af44d3ab2245d7957270b608b81c787d621d585dd9a206894e54bb67cc32a03f954be8e1d46cbe901b6e15ff1725d2dd5b1854472e335732606a9
SSDEEP 12288:0iZwb6zzFEoS2cPvy934XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2K:XZMSzFVSO6SnnrFb4PM4MYgLxEVyGLb
TLSH
T1DC6502A5739418F8DD67823EC9658945E2B27C265B70C61F13E4362B2F333911C3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 446f9f640a597c1dc86dfebd578e539554efdd74e1099ba273b8dad92aad0c18
MD5 99cb11ddf95f9ce2348d6dc8ce295e37
SHA1 abb5ddc1cf0a2b3caeb2f6f6f2787bcdb96f1d14
SHA512 7735be21d5d2e6ab7523052d3acb79b14e00a09f4007b9e64372f70835b1ed5e0e6941fe876df2b5e93cd906ddc6c94e5cf7c03e4fe3c56aecd3aa10a9e24ec5
SSDEEP 12288:oa34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilX:oJSnnrFb4PM4MYgLxEVyGLp
TLSH
T1B24523A62EDD10EECF5D06F0C1A956C8E2097C63F976B20F7B4574073B3B60D6892662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 1efb9d0eab99fdea40c3c6a21cfbd28c8b2510c63f824db2c39942fd25a64952
MD5 395d330d55a67904cb0e4ff2eb44b6c3
SHA1 67b8b706250a8720dcfa3878c3d00c21ac5c4068
SHA512 60f85e051290f486183e019ac4346e383f15d9ff64a440840edd09ee9c529cd0f3647abce0c1720b516a0614905ea39b359af5faaf9214b0f65ee4a8e40e2985
SSDEEP 12288:0234XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilE:0tSnnrFb4PM4MYgLxEVyGLG
TLSH
T1494523A62EDD10EECF5D16F0C1A966C8E2097C63F976B20F7B4574073B3B20D6891662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 e07f1730c0cf76b41f36ec4a935a47236f5160f52085a8cb7739063c7ae78b26
MD5 5c681a0bbc0d6bcefb73fffd1b0beb7d
SHA1 24d1c6598cb12e11fa21b587ee778912d32c961c
SHA512 3d88c1d5af8fe9ffd8d1873283e7d514fe5554e70416f77dbd5c6a632b39f0a5fd9f31166c0b5cb71c58c94a39de1399ae2baddf6c5fe10c126ec02ebe1d2745
SSDEEP 12288:jyPz5L8p34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilW:OzyuSnnrFb4PM4MYgLxEVyGLU
TLSH
T16C55025737A530FDC67A8274C4A21A45F336B8329B309A6F279016773F372849D7AB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 41d05a416193f5828de8796634a6cba436408088e219355b796c7def106f2994
MD5 ba2d16c26547950f0c65022db1f2716e
SHA1 3b3ff4de6192c2ffc472072b83a2dfef6c38c384
SHA512 218b76297d4ad2ea25576240dc109da2c708c221c5d8ae8628ab93811bd1a7e58581de03c47197f1d65a189295119ac4e2e11f4c88524ab6a720885d53d1fc61
SSDEEP 12288:Za34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilZ:ZJSnnrFb4PM4MYgLxEVyGLv
TLSH
T1894523A62EDD10EECF5D06F0C1A956C8E2097C63F976B20F7B8574073B3B60D5892662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 6dce2d6dfd2dff951644b46e234bf5d939720921205745bcc69ca88b7350743a
MD5 ea41a04896fb8a51b62e6c3772697a7e
SHA1 a4f44b67590e034a0d8c29d5ddc1461ffc9a94e9
SHA512 3a2c3b11e6a866f4266e249927631420ce1eeb7833864b6d3b93a73c6de1b30f3f7aff3aac4db45f74cf7b2b55abbee9b5413076442d375aedf91341cb04c97a
SSDEEP 12288:ua34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilZ:uJSnnrFb4PM4MYgLxEVyGLv
TLSH
T17E4523A62EDD10EECF5D06F0C1A966C8E2097C63F976B20F7B4574073B3B60D5892662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 ff17d2f8610c1daa9dd5623ea2b3cbf62dc2841db69677486503f59f27e7dc40
MD5 2c842b02e68997550449ed2011c3517f
SHA1 7c3e861735a173dd32db53dd8d3f389c824ca101
SHA512 f747a69bc0c5fb0ac926da8d99242d812560c6ea0b1ac7a2fb36617242d7b7c9c71211f4742e60c3bce4cf9aece2b154a9510d5e9a6b117e4cccf1f748cc4a3b
SSDEEP 12288:NyPz5L8p34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2il7:kzyuSnnrFb4PM4MYgLxEVyGLB
TLSH
T17E55025737A530FDC67A8274C4A21A45F336B8329B309A5F27A016773F372849D7AB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 3f9845347b73f4a2f6dcfe2ee21d979d9fab34aec0bb97af1484f93fc7333ec7
MD5 40f2c20d559e7719195d541525285272
SHA1 54cf1cc0ed765b061d111c7b708b1a510ed1439e
SHA512 b9540977c690a1955a20f52eff565090cc428ca1b8742c07eca23d4f92aacfbcd6aabc6a72443624e6cbc2688c9e854e3d4f2bbbf9b83d3ec4e8bf56123b4490
SSDEEP 24576:ZCUfpvPDv4Ex1hfe7i8WVq2lIGU8lrtGUJLPuwvAUSnnrFb4PM4MYgLxEVyGLy:ZCUxPTY+8Wg2lIL8lrIUJLWwcj4MYPVI
TLSH
T14365AE1EA3DC08D6D4BB817589518A06FB32782A1B32D6CF2160C77D2F27AD95E35F06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 3a914596bc3e8e4fa6bf1c4bb4f02c1985e0ac421d80ede3051adb54441fc811
MD5 b28a4895d7cee7363a6c13969123afef
SHA1 cbbe0fc89e6b85b3f41b692b4ea9b1a36f39686a
SHA512 49096dafc627f690c28a3ba26b299e7045c6fee3928e2de7416e10239ac71ba5c77aba739bac02bc4a8e5b67740c4c4b9a4017442db1e6661faa4056f1d279db
SSDEEP 12288:bNsfK34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilM:Y5SnnrFb4PM4MYgLxEVyGLG
TLSH
T18E55F15AD29801E9C56E6271C3565A84F3237C21A7E1E3CB67C0F43E2F366849DEA713
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 e8bbabf8aa8273409f6bc0af3dcdf0f79381ceed02b52c2741d1cf66576ae64b
MD5 dacb0fb457b3c8b211d2af543e75577d
SHA1 876e5a77bbea46fa1dc3d478ccb8d2716dddbdfb
SHA512 3a9d64ce25c712fd040fd49bbbcbd0a93d2d738915d81b64758cd35a3ab86660268e174e4888fceae86f8fffaf8bc987220741d85fa67cf68b9da7ad8f74814d
SSDEEP 12288:sH34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilF:sISnnrFb4PM4MYgLxEVyGLL
TLSH
T1A24523726BDC14DACEBD16B080B99698A20DB821FF71F18BB740744A363A6C99C71713
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 0c335b3231bf5fc286bdfea0f9ae6f2913078e6385e6b78a8ea1d77d32d1bd93
MD5 48f8c5e6396f869835a3484e55f8311d
SHA1 a56494a92cb2f20930d8e8cc68780161fb83ac97
SHA512 7c8affcd14f9a778ce0c57f131c8057bd50b767a4352f74f656c9fffc87bf6a1b4a13d3fdbb014a2a7ccdf19e74edd4bc5d441226c3552bc20c92adb87737bbe
SSDEEP 24576:T8RMyNoSFw1d+rC4vrmRcGPiQEaaPnMRTC+SnnrFb4PM4MYgLxEVyGLq:gRZwQCyiHiQEaaPnM6j4MYPVyGLq
TLSH
T14285B01E63DC46A5E0BAD278CDA74407E6B278165731A3CF1190C27D1F27EE49E3AB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 41c6f5c6e7d3bb4fa17bc79af9e3c5ec5ddba39f4b6c047272628544974b8208
MD5 1863538728566b3f876b2dc1043b7a79
SHA1 3f4d547be7b3b1d2d4e7b4bf2482e36db8e70d7a
SHA512 c8423aff05a35904bf32a8815a8378146d05d45eb05e1ee42c7d4d94f1499622fa254bbaf40e5c1b1f22d51365e7c186c6a037ecdddce2889e5bdf40b7955f80
SSDEEP 12288:nbxA1U7KX34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilu:nbxA1UGYSnnrFb4PM4MYgLxEVyGL0
TLSH
T1E655127E26EC14E5E67A9574C5D68249D331BC22A731A3DF21C0913E2F3BAD85C31B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 1a6e4e16fcf484cc93db30d869e346dcb84c6ce07b12637b37b0d1e75e4dd37f
MD5 040ccd2e1220e6ecd6e495c5a5edc3c3
SHA1 ba897e75c208e272717b109ca0d83ffc2e8e6ae5
SHA512 11454a1197d1078096a81e4ae8f357e84a183b724306f5def485df97c4827e29acf4164930884d70d87ac5fa01cc8f4a4ac88ab81ca3375fd9068092c81708d9
SSDEEP 24576:BjsmP0yHaqrVqHra44KDzMsrnbSnnrFb4PM4MYgLxEVyGLV:BjRP0yHfVqzlAsrnkj4MYPVyGLV
TLSH
T16445BF2EF2B910F9D8AAD172454107B5FB71742D1F209ACB0170C635AF0AEE89E35F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 6c8954937769fa607e026e0925dade87b6c3aed57d182006215cf414277e8397
MD5 391d659acf4e6f32626c0c13e913b564
SHA1 8943e62a507630740eaca2b2f340af6043619ae6
SHA512 4aa078156437a1026c23aa281ee893edc20bd231e88878d3a02aec3267076d97cc198d95823cb57b0f80f062e20b801e653accbe224b6f2c25d26b30a1a6a9e7
SSDEEP 12288:zx34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilC:z2SnnrFb4PM4MYgLxEVyGL8
TLSH
T13C4523A62ADC10EECF6D56F0C1A956C8E2057C22FB76728B764074173B3B68D9CB1712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.5MB
SHA256 ab102bc2353420c2071261a0c3fe221b69affae3279bb1023851179c472a41e5
MD5 3f0f79382850aeac358cb620eda22ddc
SHA1 5a2aa84d9e9f0c5f5f58d2c880ae9340e054ab90
SHA512 4a43af6ab41f5beb3d9fff32fd65104c5b9fd47cd7660116a9934078183020d53fa2cef260a62590786c5e3a0edaa01214303fa018d89b22b39896808d926371
SSDEEP 12288:aOb9A4LWO+vAYFTT34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2il7:LpLBUTsSnnrFb4PM4MYgLxEVyGLN
TLSH
T1F2750155F7E800F9DD7B8138C5A28A16E272B85D1764E3DF03A84A662F233E54E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 577dd980265ec97c3f7c9f79540da1418535599ab7d3b718f67b48db7157b0d3
MD5 0116866d1998183d2ec5810079f094c4
SHA1 3e35d3a1ce891308a1b907b1f4955cdf1637026f
SHA512 f2732dd1659a6d01930b5ad6e53c02031fbd6748026a5a86f23b1a3bb3fafe4459cf32d14f94d34bb61afe45252f2449c70f507fe1512078349e69004ee1acde
SSDEEP 12288:T70VmvIYNvUyBpu34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2il2:crYNHfSnnrFb4PM4MYgLxEVyGLM
TLSH
T1C865F12F66AC18E5D57B9179CAC38249F27378625711A3CF05A0827A1F27EDCBC3A741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 974f206a01ffdc8ec065dadceca50b92abf165be371901974089a7f910751b4a
MD5 3d517a6b72c57dcfdfa1c7490c5c859c
SHA1 a80d7cb23db9fc8777291c41718c2a3de23ebae9
SHA512 b980ce8df5aa8deca577f202c5da10f45a633f95332f898c171d8a8eb5ec7d89f6ced5028135b8f001734a8abbe603984949aa06123886623ae94976dbb14ffb
SSDEEP 24576:8nXoJjNYH84VVSNAApoEON66aspcrcHBjSSKHPWdQwPF3hJ8ssmOc+XLxu+x7uKd:8nXoJJYH84VVS6AmEcJas+cHBjSSKHPt
TLSH
T16F65BFAEA2BC04E8D5BBD17DC5C24506F5B178621331D6CF026182BA3F27AF56E35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 8cb58e0127192b17e29b4ca9370f17f93a00db014d3cad8ee2dafae6824cb2d3
MD5 b86c0ecb04aba35f174e419e202b7b05
SHA1 97e8e8a77135c9952eb9170c3d6593c32388c8f2
SHA512 91ad9b7c60e7e68c244fa18a851c389ca033204bb3c60ee8b7bfe4106ab408d06455c12df4c149953018506ad8ceee6211274ef85da22d31b38e58cc9f5c0771
SSDEEP 24576:Lv7Xbxd9Tuycf8M/TYlSuxwr2PC9SnnrFb4PM4MYgLxEVyGLw:LDLL9TuJ0M/TYW2Pxj4MYPVyGLw
TLSH
T1F3858D5EA2EC42D8E47BD6BD85B79146FAB2B855273081CF0250856E1F23BF05D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.3MB
SHA256 4552265d71325bd442f6b9bf7dca4c78892c81edc34bbbb3102ec7933df7383f
MD5 5946adff478cdc682541d2fcb315955b
SHA1 1f689f51cd0c604cc487ff27f7ca1b728752812b
SHA512 cf4122fd468b83a6c5fb61ff6ba47a552240c5a4d7d2cfb709f64021f090da9f4c90bba143d8039e266217683a97a23de245b029427c47b66bcead94dc3720d1
SSDEEP 24576:wegJgpwJOmPOHWAK+8ZguIGyPsxr5Vin10wsSnnrFb4PM4MYgLxEVyGLW:wngOJOmPOHhfj4MYPVyGLW
TLSH
T16855CF3FA7BC15D5D03EC17D8A968906F6B1782213356ACF0560827E1F1BEE46E3AB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 e0893caf9b027f87d1ad305c65ac5011c983cd03bb780716d5246e51a377d7fa
MD5 a4c245f97c31b6b7fc320c5076614a41
SHA1 2b8df65b2b6be30ff6a7f831dc093f0d79a9e789
SHA512 796c6849ed88e89a9d0ec065bc302cc16a98e1570949df3fa44ef67117bb11e723dafec9c3581e9f84721503d219b96e16c88da6eca964c41fae782d75c0c63a
SSDEEP 24576:OLJnJiTk3R3waE4JrOWSnnrFb4PM4MYgLxEVyGLU:OLJnJK8R304lUj4MYPVyGLU
TLSH
T12F75D03DD2A810E8D4B7C2B4815A1B96FF31346D2B2169CB69B4D4313F12FD0AA79F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 0ce75926578620b44abf290762bf911f33ab8af1549e86134b2a4a44ee44b1d0
MD5 7da2642edc2faa8679e1a366c275ab3d
SHA1 5b44f2da60298b58b04030ece59b438ad47c4f16
SHA512 e72c8c0220f1e42368068fa0c79a1d40a9cdd4d339d0b5deb59132bb224f34a6920c91e41d127efb361777f9d6464131c8752e8b7796897dd0c9b3de3e76737e
SSDEEP 49152:G9GqCzDScAZmlvTcFg8Ph6dj4MYPVyGL+:4lVy
TLSH
T17F955C15F7EB5298E8B3CAF1C96294159B327C509B34F7EF0A80C96A1E32BD1D934B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 6280cd27246704a6102bd0c4722f3d29f7459a3e967741fc18605cf745e2c72a
MD5 b2895ea5d535927176101947d261b778
SHA1 548fe098de9de6d5dc7b3b78d51c0a60acbda370
SHA512 f59f5b79c684c6ba24cb44c3dd9cef5f28832f001decadc32bc513d11eeb921456cc97d2cfd49a5b409a83185a3c6b447af497e2309abced59ba8474ae0dd240
SSDEEP 24576:klYJeXm5jUuE8SnnrFb4PM4MYgLxEVyGLE:klYJeXmRUuEvj4MYPVyGLE
TLSH
T1B655126D3ADC30E9D66E9174C1A24A88E331F472A71273EF52E0D07A1F27AC96D35B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.3MB
SHA256 c933d7d23af32e838e7db143bc35053979cf8c6f0a094f36988a12a2a272244b
MD5 92f128d882bef4909891d7867c24f3f2
SHA1 e9aa46d0029f85fc4bcc870909692d84be87ca42
SHA512 466d088312bbbff088374333604a20e2b112b90fe5d7fcad6823d6413ea61293c8463e9f200587b1da5b2d671ae95e3d792d41e9b9e3a0b6ba91b432ea8230d8
SSDEEP 12288:Swu6kyo34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilt:SVty7SnnrFb4PM4MYgLxEVyGLj
TLSH
T11455125527D820E9DAB90670C5A242D4DA25BC21AF21A3DF66D0F52F3F377C8AC71B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 bd2b65c61685214a1b8858399a3f161048f4c5bc871875700df074ee39b65c02
MD5 40f8c2ff3bd7dc3f9b5e390a23661199
SHA1 0a9960fee5072ecd5981870ee1d9440492778b9d
SHA512 55c3bf9412ecec75c252d5789b8b02661337901945d848c7a2a38643338b062483b67127ef2340e07c047ff5a018eb14bd05e2db659e6310b811055577b36301
SSDEEP 12288:HPT34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilH:vsSnnrFb4PM4MYgLxEVyGLR
TLSH
T1BC4523BA2BDC20EECE6915B0C17656C8E2157831FB71715F76D0B4363B3B28998B1B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 a5aac96cadcbed840d23c0850d1a0d058e36eed6dc75e0e7a2ec2cf99e132e48
MD5 c84a6bd78c70f27b48c64cf322458a55
SHA1 1ee6ee6e5c9c3add82ebe1cfc9e14714f03f4625
SHA512 221c26db4ab8314333e382c8c17d2cf26e7aef80b136c4e37d59c99c987b0ea651a9d5b65f81d7aa2438822758e79fa9c79cd844b473604febaa7711b3c4aac7
SSDEEP 24576:bC+TyQIu93VAumZr7jmZSnnrFb4PM4MYgLxEVyGLZ:b/TfIq+YSj4MYPVyGLZ
TLSH
T1EB558D1DA7E91DCAE276C675C8A34493E633B872137196CF2044C07D499EEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 88014ab0aaff7d49b7cf87d94b23bc34c34854e2ab56eba2fccb68bd6c2e39a7
MD5 ddf7458ac2d870eb836badf37db5aa43
SHA1 0ddf696af348705a9692d819239e2beb78d28417
SHA512 09d11db79ba814872f6f9406a37be8587064fb6d705708273d6471c4894e8a38e2341cc96780d0e02d45c49fc5f14963ef1baf0a60868e8893df6c580bb8b623
SSDEEP 12288:vcyrWOstaa3kcsf34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilC:WLQikZgSnnrFb4PM4MYgLxEVyGL8
TLSH
T13F65F10FB7AE00E6D5AB8278C8954245F6737431972263DF0290C77A1F6B6E9BD38B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 ec27d875d4907a8431098a591b5ec199697101f1482ccd0f212e1d239f758725
MD5 d83a5909bebd1c8e977d2e71e8dd167e
SHA1 6839582f958880ee7c28c453a86d8ea3eebe23db
SHA512 be35bb87748bb7145b0148f5e052f2034b6e50fef4b8dfd0ba87f1f42c1130bb063ff197bb5c95a111e7191a0bef605bb66529a7c581cc7a8c0d106679a82fa4
SSDEEP 49152:WpJFwrPpGyqWo6cbT2TZ8maJO35NPHXogsS7Q78ZGAvL9vnF35LWAPEj4MYPVyGL:jpC7b4+80GTk+VD
TLSH
T1FDA57C3DE2F810ADD9AA8375C5461665EE71382E3F2015DB01B0C578BF1AEF19A38F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 b73dfd3efe96cb595e5dcd2d27046c1dd1664db8e08d19e44c133ea5849b8ab5
MD5 492eaa4bd7971ca469abc91438b35956
SHA1 1335b641e79ce32e74d1996272b472b1dd8efba6
SHA512 38d1bdf92b79cc3a3faf19a1e9c7b7fd87c751fe3e1d9ec4c2a73d8e34865caeaa8d9476e0b8d8ffb753991df499843e79799e89f971ee7fcebe2665bf0378e6
SSDEEP 24576:6SAwJPE1IDAo+4Kt+l44135UQzSnnrFb4PM4MYgLxEVyGLh:6qPCIo4Kol4/Q8j4MYPVyGLh
TLSH
T11B55B02AA7F946E5E17ACBB4C663C601FB727822133163CF5290813E1F169E85E75F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.6MB
SHA256 fcffe03eb83ea539d1e08f1dc1d4a4334230724e8ff5ab4eecaac0fbb486cd44
MD5 2a810355aba3c6fc195f98db5ba3aa8c
SHA1 785c6eda43e99806d5953a2469337952627090e5
SHA512 329e51ca65009d71d90353942974377ffeef27dd0bbc210765b2c980963f047173c2430c8a16fd41571d4417ee9e932ace55e28c21bd180d0ae0b23249cb6a1d
SSDEEP 24576:jyLXPLcM94tDSnnrFb4PM4MYgLxEVyGLd:jy7PoLtMj4MYPVyGLd
TLSH
T19775E13EE76D04F5D57AC27CC2A38506F67238AD033166CB15A0947A2F6BFE46939B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StructuredQuerySchema.bin

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin
Size 414KB
SHA256 e67e330837a6b2f6d5f76815e7235a512b54b1c90f2ad62a3e9d142ae6939c8d
MD5 16b9618962f5623ca791a1366eee5708
SHA1 f0d257511952f075b2a0ec7d8e8730c3e464461a
SHA512 18e1d5a105b87fc72df94645685f5a8d3f593df2d3a9b8652b3b4a4ceaf92d3c7a67b0c08847186149dd608428cae8f1b3bc844bc7aacfc9e3219da823ca2fe2
SSDEEP 12288:vMUC7+vlk3n61mSkplXZ5RwmF9n4w/TSD:vXhl6V/i
TLSH
T124945F36BF88CB22C59A15748897C01A2E30A7C49E04CF6B73DC513CFA576685FBA359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.4MB
SHA256 7338608688149336e706c1461f87192ec5e39a10172a9e028c91ba4c3ba8d29a
MD5 6fd788badec5b77d88f8cf6eb5d76fc5
SHA1 e67cbed222716299d8e6396362b80515836fbde4
SHA512 d7c60a8c44637aec6e8c553e8be7740220ac8d5e323053f21ea7719ebebb395b8ced92ef5d3079aa8e7f9ace23b081d3ca48f2a79cdaf54dd32a1dd1d15efee0
SSDEEP 12288:H9lyvj3IkxjbBzP34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilV:HWv8qjpQSnnrFb4PM4MYgLxEVyGLH
TLSH
T10765126E26E820E9E97D4270C1768298D131BC726775B6EF31C4E87B1B366C4D83AF11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/764-67-0x0000000001AE0000-0x0000000001B40000-memory.dmp

Download

memory/764-65-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/764-62-0x0000000001AE0000-0x0000000001B40000-memory.dmp

Download

memory/764-69-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/764-56-0x0000000001AE0000-0x0000000001B40000-memory.dmp

Download

memory/1384-150-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/1384-152-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/1500-222-0x0000000140000000-0x0000000140209000-memory.dmp

Download

memory/1500-96-0x0000000000670000-0x00000000006D0000-memory.dmp

Download

memory/1500-90-0x0000000000670000-0x00000000006D0000-memory.dmp

Download

memory/1500-125-0x0000000140000000-0x0000000140209000-memory.dmp

Download

memory/1728-159-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/1728-416-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/1736-32-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/1736-30-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/1740-131-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/1740-105-0x0000000000960000-0x00000000009C7000-memory.dmp

Download

memory/1740-100-0x0000000000960000-0x00000000009C7000-memory.dmp

Download

memory/1816-129-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/1816-122-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/1816-116-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/1816-326-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/1996-141-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/1996-135-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/1996-367-0x0000000140000000-0x0000000140241000-memory.dmp

Download

memory/1996-144-0x0000000140000000-0x0000000140241000-memory.dmp

Download

memory/2112-368-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/2112-148-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/2896-186-0x0000000001C30000-0x0000000001C40000-memory.dmp

Download

memory/2896-418-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2896-167-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/2896-183-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2896-219-0x000000000A520000-0x000000000A528000-memory.dmp

Download

memory/2896-202-0x0000000001EE0000-0x0000000001EF0000-memory.dmp

Download

memory/2896-173-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/3292-34-0x0000000000850000-0x00000000008B0000-memory.dmp

Download

memory/3292-43-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3292-41-0x0000000000850000-0x00000000008B0000-memory.dmp

Download

memory/3292-155-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3388-45-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/3388-51-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/3388-158-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3388-54-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4236-414-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4236-156-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4328-9-0x0000000000460000-0x00000000004C0000-memory.dmp

Download

memory/4328-370-0x0000000000A90000-0x0000000000AC1000-memory.dmp

Download

memory/4328-369-0x0000000000460000-0x00000000004C0000-memory.dmp

Download

memory/4328-374-0x0000000140000000-0x0000000140210000-memory.dmp

Download

memory/4328-71-0x0000000140000000-0x0000000140210000-memory.dmp

Download

memory/4328-8-0x0000000140000000-0x0000000140210000-memory.dmp

Download

memory/4328-0-0x0000000000460000-0x00000000004C0000-memory.dmp

Download

memory/5000-181-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/5000-417-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/5068-126-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/5152-130-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/5152-15-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/5172-17-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/5172-25-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/5172-26-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/5260-184-0x0000000140000000-0x00000001401F9000-memory.dmp

Download

memory/5260-72-0x0000000140000000-0x00000001401F9000-memory.dmp

Download

memory/5500-419-0x000001F108820000-0x000001F108FCE000-memory.dmp

Download

memory/5624-127-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/5624-415-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/5628-427-0x000001BE24FA0000-0x000001BE24FB0000-memory.dmp

Download

memory/5628-451-0x000001BE24FA0000-0x000001BE24FB0000-memory.dmp

Download

memory/5628-457-0x000001BE24FA0000-0x000001BE24FB0000-memory.dmp

Download

memory/5628-458-0x000001BE24FA0000-0x000001BE24FB0000-memory.dmp

Download

memory/5628-456-0x000001BE24FA0000-0x000001BE24FB0000-memory.dmp

Download

memory/5628-455-0x000001BE24FA0000-0x000001BE24FB0000-memory.dmp

Download

memory/5628-422-0x000001BE24FA0000-0x000001BE24FB0000-memory.dmp

Download

memory/5628-423-0x000001BE24FA0000-0x000001BE24FB0000-memory.dmp

Download

memory/5628-424-0x000001BE24FA0000-0x000001BE24FB0000-memory.dmp

Download

memory/5628-425-0x000001BE24FA0000-0x000001BE24FB0000-memory.dmp

Download

memory/5628-426-0x000001BE24FA0000-0x000001BE24FB0000-memory.dmp

Download

memory/5628-454-0x000001BE24FA0000-0x000001BE24FB0000-memory.dmp

Download

memory/5628-428-0x000001BE24FA0000-0x000001BE24FB0000-memory.dmp

Download

memory/5628-430-0x000001BE24FA0000-0x000001BE24FB0000-memory.dmp

Download

memory/5628-431-0x000001BE24FA0000-0x000001BE24FB0000-memory.dmp

Download

memory/5628-432-0x000001BE24FA0000-0x000001BE24FB0000-memory.dmp

Download

memory/5628-433-0x000001BE24FA0000-0x000001BE24FB0000-memory.dmp

Download

memory/5628-436-0x000001BE24FA0000-0x000001BE24FB0000-memory.dmp

Download

memory/5628-437-0x000001BE24FA0000-0x000001BE24FB0000-memory.dmp

Download

memory/5628-435-0x000001BE24FA0000-0x000001BE24FB0000-memory.dmp

Download

memory/5628-434-0x000001BE24FA0000-0x000001BE24FB0000-memory.dmp

Download

memory/5628-429-0x000001BE24FA0000-0x000001BE24FB0000-memory.dmp

Download

memory/5628-439-0x000001BE24FA0000-0x000001BE24FB0000-memory.dmp

Download

memory/5628-438-0x000001BE24FA0000-0x000001BE24FB0000-memory.dmp

Download

memory/5628-440-0x000001BE24FA0000-0x000001BE24FB0000-memory.dmp

Download

memory/5628-443-0x000001BE24FA0000-0x000001BE24FB0000-memory.dmp

Download

memory/5628-442-0x000001BE24FA0000-0x000001BE24FB0000-memory.dmp

Download

memory/5628-441-0x000001BE24FA0000-0x000001BE24FB0000-memory.dmp

Download

memory/5628-444-0x000001BE24FA0000-0x000001BE24FB0000-memory.dmp

Download

memory/5628-453-0x000001BE24FA0000-0x000001BE24FB0000-memory.dmp

Download

memory/5628-452-0x000001BE24FA0000-0x000001BE24FB0000-memory.dmp

Download

memory/5628-445-0x000001BE24FA0000-0x000001BE24FB0000-memory.dmp

Download

memory/5628-450-0x000001BE24FA0000-0x000001BE24FB0000-memory.dmp

Download

memory/5628-449-0x000001BE24FA0000-0x000001BE24FB0000-memory.dmp

Download

memory/5628-448-0x000001BE24FA0000-0x000001BE24FB0000-memory.dmp

Download

memory/5628-447-0x000001BE24FA0000-0x000001BE24FB0000-memory.dmp

Download

memory/5628-446-0x000001BE24FA0000-0x000001BE24FB0000-memory.dmp

Download

memory/5740-185-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/5988-85-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/5988-79-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/5988-221-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/5988-88-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/5992-128-0x0000000140000000-0x00000001401D7000-memory.dmp

Download