3409a97aa009c08e43abcfbd0ade4358adc89c76545116803271e83cc6d1b663

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/04/2026, 05:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-23_e740ce5f9b323b00e318a1d2da819888_icedid_njrat_ryuk.exe
Size 2.7MB
Sample260423-gcdttahs5p
SHA256 3409a97aa009c08e43abcfbd0ade4358adc89c76545116803271e83cc6d1b663
MD5 e740ce5f9b323b00e318a1d2da819888
SHA1 81ca6156c14f9bf8d2e2a6f0aa8ee49117a9a403
SHA512 b8050fb25bcf9fe5b7fb43204c9258934ba188ae01a8ad5807670c5393121205cdbad9f2ea17b6922f057c5db7d2bd6a4d78599856cec54d0aaafb5c8f4f0ed1
SSDEEP 49152:dHLBUcQ/lFTjN41WS1SZBnHTAshQ/lFTjN4:F92Lm1cNzAjLm
TLSH
T16ED52258E7A494F9ED2B423C88628906E77378891B64E7CF17984B291F373E50E7E740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 24 IoCs

pid	Process
5068	alg.exe
4764	DiagnosticsHub.StandardCollector.Service.exe
5196	fxssvc.exe
5224	elevation_service.exe
3964	elevation_service.exe
2832	maintenanceservice.exe
3768	msdtc.exe
5948	OSE.EXE
624	PerceptionSimulationService.exe
2752	perfhost.exe
6116	locator.exe
1216	SensorDataService.exe
856	fxssvc.exe
5912	snmptrap.exe
2112	maintenanceservice.exe
1740	spectrum.exe
2692	ssh-agent.exe
4000	TieringEngineService.exe
3016	AgentService.exe
440	vds.exe
4020	vssvc.exe
5012	wbengine.exe
4588	WmiApSrv.exe
3452	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 36 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\dllhost.exe	2026-04-23_e740ce5f9b323b00e318a1d2da819888_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-04-23_e740ce5f9b323b00e318a1d2da819888_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-04-23_e740ce5f9b323b00e318a1d2da819888_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-04-23_e740ce5f9b323b00e318a1d2da819888_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-04-23_e740ce5f9b323b00e318a1d2da819888_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-04-23_e740ce5f9b323b00e318a1d2da819888_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-04-23_e740ce5f9b323b00e318a1d2da819888_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\9625d35d958e99e9.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-04-23_e740ce5f9b323b00e318a1d2da819888_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-04-23_e740ce5f9b323b00e318a1d2da819888_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	fxssvc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-04-23_e740ce5f9b323b00e318a1d2da819888_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-04-23_e740ce5f9b323b00e318a1d2da819888_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-04-23_e740ce5f9b323b00e318a1d2da819888_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-04-23_e740ce5f9b323b00e318a1d2da819888_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-04-23_e740ce5f9b323b00e318a1d2da819888_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\msiexec.exe	fxssvc.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_83296\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-04-23_e740ce5f9b323b00e318a1d2da819888_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-04-23_e740ce5f9b323b00e318a1d2da819888_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	fxssvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005af780c1e3d2dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000009eb97c2e3d2dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000023bc85c1e3d2dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000018e2abc1e3d2dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007b74a1c2e3d2dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4764	DiagnosticsHub.StandardCollector.Service.exe
4764	DiagnosticsHub.StandardCollector.Service.exe
4764	DiagnosticsHub.StandardCollector.Service.exe
4764	DiagnosticsHub.StandardCollector.Service.exe
4764	DiagnosticsHub.StandardCollector.Service.exe
4764	DiagnosticsHub.StandardCollector.Service.exe
4764	DiagnosticsHub.StandardCollector.Service.exe
5224	elevation_service.exe
5224	elevation_service.exe
5224	elevation_service.exe
5224	elevation_service.exe
5224	elevation_service.exe
5224	elevation_service.exe
5224	elevation_service.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found

Suspicious use of AdjustPrivilegeToken 41 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4864	2026-04-23_e740ce5f9b323b00e318a1d2da819888_icedid_njrat_ryuk.exe
Token: SeAuditPrivilege	5196	fxssvc.exe
Token: SeAuditPrivilege	856	fxssvc.exe
Token: SeDebugPrivilege	4764	DiagnosticsHub.StandardCollector.Service.exe
Token: SeTakeOwnershipPrivilege	5224	elevation_service.exe
Token: SeRestorePrivilege	4000	TieringEngineService.exe
Token: SeManageVolumePrivilege	4000	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	3016	AgentService.exe
Token: SeBackupPrivilege	4020	vssvc.exe
Token: SeRestorePrivilege	4020	vssvc.exe
Token: SeAuditPrivilege	4020	vssvc.exe
Token: SeBackupPrivilege	5012	wbengine.exe
Token: SeRestorePrivilege	5012	wbengine.exe
Token: SeSecurityPrivilege	5012	wbengine.exe
Token: 33	3452	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3452	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3452	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3452	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3452	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3452	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3452	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3452	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3452	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3452	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3452	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3452	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3452	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3452	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3452	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3452	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3452	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3452	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3452	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3452	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3452	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3452	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3452	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3452	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3452	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3452	SearchIndexer.exe
Token: SeDebugPrivilege	5224	elevation_service.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3452 wrote to memory of 5540	3452	SearchIndexer.exe	123
PID 3452 wrote to memory of 1292	3452	SearchIndexer.exe	124

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-04-23_e740ce5f9b323b00e318a1d2da819888_icedid_njrat_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-23_e740ce5f9b323b00e318a1d2da819888_icedid_njrat_ryuk.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4864

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:5068

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4764

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:3040

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:5196

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5224

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3964

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2832

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:3768

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5948

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:624

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2752

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:6116

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1216

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:856

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:5912

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2112

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1740

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:1960

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2692

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4000

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3016

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:440

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4020

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5012

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:4588

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3452
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5540
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:1292

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 0575c07c984c426a8f938e143f0b88f32054c876f32c9fbbef68456137ea1b71
MD5 e36727ca42dddd89808d617f52875cba
SHA1 a612b100a84e484b9c6d51d4f474d79d95ba866a
SHA512 2386f147606e7a66e4a970ff810ab1119ab32dea54053294103921b1661d4c176df2a9db3ab9a337f90c20b9c73a5f5afa0f93262554445a20e22586a65dccee
SSDEEP 49152:bb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnDQ/lFTjN4:p3q6HjBXLm
TLSH
T115D58D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.log

Path C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log
Size 3KB
SHA256 de88e353828e1b2ef29715fd6559dea7f390b7d4e58166c2fc336253ac753b17
MD5 c67491fed4fabd9a8a8f5afd651b30dd
SHA1 218765b238aff0dcc401f869e456d35bdb652b93
SHA512 dfc4890a0d4bcb039ee7f45b94628254ce3f2e71bfa902d7ee8d588846bb2ced68271a34ee9a2d6934d25c1dcc76ddb81200825f75cdabc4e2e5b879614550e1
TLSH
T16851AE66037EB9760886EFA4EDE9BC96674E310C64ED50B52356EEBC18F44C9E5C3320
MD5 SHA1 SHA512 TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 2.0MB
SHA256 781481d6925a4b5ec08fb7fa791fd0d7f97a37289a1cde3b7057150510869c16
MD5 40b98c3a23fcfc8b208a2f6b40f8f376
SHA1 b6244fbb856519fc70faa497400e8a6ac7e19670
SHA512 ec9639e96a11d4d48e7aebc4d7d141c6e38736548a671cde78de3e346952d40a5b0ef06b72d8030a525bb50608499dd3f557d2e20abd01ddcbffd20cd6304073
SSDEEP 24576:RXYjDtczAonQ/tbw/2Mkjy6Fr7g0oCYp8SXdo8ke5i5Xh6wnBLTHTAcZQ/:gtcxQ/lFTjN47WS1SZBnHTAsi
TLSH
T1DCA51228A7A449F9ED574238CCA18405FB73789187A4E78F03A49A295F373DC1E7EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 2.6MB
SHA256 01a789e5a5da392448bb4eded1bee630d42f0b8aacb62bbf6a7fb1d90bf4b5de
MD5 1f349847ee2cbb69878a671976f241c6
SHA1 0aa5dbb7a424b8dbebb2a91ff827008f7737835f
SHA512 7b127b393e2ea397f07a243183aaab79fa73a7d66c91a77e841e64db20ac989d9b832cf131a595b6bad333459b923be2151521e6f7562b037db3db6c4c3dc883
SSDEEP 49152:0tcxQ/lFTjN47WS1SZBnHTAsNQ/lFTjN4:0fLm7cNzAPLm
TLSH
T175C5222867A489F9ED574278CCA18405FB7378818BA4E78F039496295F373DC1E7EB81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 751dc0f9f687f8546e7f0b182755fe0a6744ec2592e5e5f0f5eaf9033c0d25cb
MD5 6c6be74a64611621d6066070f1013512
SHA1 874239b8471fe00e55f382e022fa92eacd852479
SHA512 a6e46781db468f8d24041bb630d2c3676a2144f334ddfc4fe7f48162a6cd411422e4bd049b5cfb164f6f1431f6fa68f6753a3c21b624ab93b8dec8dfb3e4a767
SSDEEP 12288:L1XLsswWkxy2lRq2czAoGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWC:xXYfDtczAonQ/tbw/2Mkjy6Fr7g0oC
TLSH
T13F65F12877E448F9ED67827DCCA28502EB73788547A0E78B03A495295F373D85E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 7a6b4c747a1722c632d30ce89192cca68e3f5cc45f3c5e28ef64a41e897ec758
MD5 ebe3862ad1b2a85b8bcfb5a531dc1be9
SHA1 9b858c682a5094589111a214a2c66bf06c8a5c59
SHA512 bc2032b16d5ae98b53821bc92db4291caa4691ba6fb7cbadb25f0f332b0ba6f1e491c09f57bbe31a95bff357f42554135e0356abdaee243d69214ebe6616fd81
SSDEEP 24576:V0Le5ji0hmxLrMenQ/tbw/2Mkjy6Fr7g0o/:VPji0AlnQ/lFTjN4
TLSH
T18E859E15F6748735D073C0B9C5D2A68AEE7230825B308ACB4286D77C7E677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 baef5fb88322fb443c9a17c6c549601b201f8928d59c45df47848f62726c37af
MD5 7405bb259a8a735c9f1dfc8227c151b8
SHA1 e5bffeb836eeb53b2525afd8efe29691668222a0
SHA512 a1e7c926ec639c38b00799c7bb85807cc63afaf0666b6ea040bc89f14b0341271ac346bcfaa67c203e5a19328b2fe29e914eacbae9bf0179626f29eb4fc410cf
SSDEEP 24576:Za7/ezSC6vUyD/aqgrvWE6q8wyu4nQ/tbw/2Mkjy6Fr7g0of:I/ezSC6vUzPvxHjyDQ/lFTjN4
TLSH
T1BD755D25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 7db5fe5fe6054589a104fb20948d6583f2538457a9f2b069667df55b5ebfe6d1
MD5 3d834b09c9331cadee08d04cfc861dd8
SHA1 8f4d9899be1db925d748d53d7b5582865537bd74
SHA512 08a9c08ecf31b44a171c3cae1bb4349ef4569d24e4b753c3351acb5b317e67d25d6273fddda88c65e88a19706729c379783040bc6e577050b1630da7b4bcd917
SSDEEP 24576:bVbqPb88hv/l+61nQ/tbw/2Mkjy6Fr7g0ok:bVO88hXl+KQ/lFTjN4
TLSH
T1FA559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E777E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 ec170004031f945d2133a1bf53b1fbd17b4cc1fda503453de948f1ea4f8107dc
MD5 b6c48f45215a90ac74f49c508fe1af58
SHA1 5cdd12b27d9a32cabb8e5ab390dfb66484c9bad8
SHA512 65c855c8daf6233f49f89f47ea471546d162af7f1c8fccb2824da9414aab9a129ee709a696ca67d98c04bf392324897f68af3b775be6687d3b60a042b60a4bfb
SSDEEP 12288:QziGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWc:QzinQ/tbw/2Mkjy6Fr7g0oc
TLSH
T14D5523796A24F897FF2B06B15CC285826B7B0EC1BFD0A74E6744322D857C39446DB385
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 18f011080a3270e2f32fc477bbffd6e76644d2b5e13dd5630e983531be89b5f1
MD5 27717554906e1b501591ffd4981fdf16
SHA1 84ab92d37792853de009c28a1205745b6b12dd44
SHA512 4b6c812d0beba41a7c20b0b68e7e068c46f6d95fc97434a36d93a84f008074bf430f63a4619b65cfe3f1b052f227c513735cba3a8334d61e0e29849a3f31152e
SSDEEP 12288:HeBNUbTVO86U9GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWv:HJIUdnQ/tbw/2Mkjy6Fr7g0ov
TLSH
T1D275CF3BAE28FCD2C67E4DB85A918640D77278704F61A3CBD164830EDE276E01E7AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 cd33b509b0157d3b0acdd91f34d4e2da1146161b0ba44ea98ffee1eaeb260a0e
MD5 1810efa52223825b58303e742f94b723
SHA1 3834c58a3444bc21c9f092da36b0835d9c4b77ed
SHA512 c3dc2be679052e6da5a10542034feb3fe3830c1dc0b4a4669be94334d26a6d7ad9761e0be847c083051ae9b0f2fd3c7ee507147576acca01578aae794672ba99
SSDEEP 49152:gQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THF:gQvGAdlCEL8c/yRNw5CLLm
TLSH
T1AF267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 3c469b7d4e53ae1b948ed80939a4afee122fd68ed3162732a8060fe6061c3302
MD5 e96280bbb2559236b09d4970fad8c31d
SHA1 d4ac0b7cb37fd536bc670b79f3b1ab9877d6eba0
SHA512 063fc02065653e7eeb021e935e8e2a8102d49cce5f4c53fadafa5dd6ba4d6ae8beb0472c2e611d9b664e2889137049a066335625ef3e1b131b2d189667fc0573
SSDEEP 12288:wAwSfxL/2Dc39DLLmt0LDQewsAj3GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsgJ:FQewsAjXnQ/tbw/2Mkjy6Fr7g0oj
TLSH
T15875E031FE74E436C77F0DB21B26C706583D6A604FA11AC3E3A84A9D99342D22776B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 8de292b45f1e9fb1a2e1570838c294fd98ef905a74ebee5af5a21cf384e6cb8a
MD5 ffe1450c9856ab60d4040972ae95a084
SHA1 df11acef788f153872d6ef75cc7a30256eb30b87
SHA512 2c4042fce63e34d257f6736fc4597349ccaeaeb3eddb683472d79939be885e7918c691ac17c1b46d313a334d36db7db5a93918886c1f4cd8af96f79bf4953bc6
SSDEEP 196608:EUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHEL:EUEtQevvqc2W1cpV2EI32
TLSH
T1A3474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 560ed1a2855b90d666fc9e320c051bbfc3979169072fc6a5a390ad13964d5b0b
MD5 8264d88a4a05ea7e57207dd916a720cb
SHA1 e56022b403d2c0dadc8039b205be2e714bb4d17c
SHA512 10f7e89b13815539338c94b3863bc26a53c4c8700e1da53cd681b60f43f3343c3b5efd9565aaf7b51f62125496cb22859db0e87c861b1219d0d7e97774f07e4d
SSDEEP 49152:CCbRquA/m2yL5zQfFiV+XenmE3/z3Q/lFTjN4:HoqtVjnmnLm
TLSH
T1A7D58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 e036ace1c7c783379fbaccd07906ff34eba480d45eb1c2f6628e575cea10feef
MD5 2a0fe20f325b9d8c206ed930ffcf4060
SHA1 ae20b44c90c1e96a78a573b9d6cd4c2fab480ba5
SHA512 e8cdcd1b86adb07fcc28677550a5ee35b5c3581a0bf751f5c75e9c70c060559fbc54835876bdc8cee6bb33b66f992b549211d5fb8e9589b09cc7f1473b779be9
SSDEEP 24576:VAhGLJIFoiwtA5l7S53UnQ/tbw/2Mkjy6Fr7g0oC:VAMyFoiq5kQ/lFTjN4
TLSH
T13F35AD81E7F955D4F5B3AAB899B68171EA77BCA65E31C20F2250D11F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 61fdcd7e5a7dab8e3392ddde02c7fc5054ceee027c5ae1358e2e700ac5fb12ce
MD5 5322dee5a7cfbbcc90c6b522d4cea91d
SHA1 b0f47c3350cb942ddf93639a519144e1b2de1552
SHA512 44f2983eb9eed63bdc4dbe1f4e45c3c6c03cd4fc9944fa220442c6a1c20755de671ab07b118ca3efe9d61f490fddb0db589c799277fa6bfbf4cda26f8d57f67d
SSDEEP 12288:Emw5HEjsChN2BFgl0WDm+CxGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMp:hwuHOWGnQ/tbw/2Mkjy6Fr7g0oI
TLSH
T13965F14A36A45CF9EA6742388993C136F7B3BC422A61DB1F1760C65B5F373606D2EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 340a79499ba2f89f0f4fb51d7ea723af5ca2ccf59e06e6b836fb0bdbb58d3f3d
MD5 d52720ae161771e029dd820af0c45cad
SHA1 b7fa7421e4f86089f5be3a2b565ccfe5d8667341
SHA512 8347b61916cbb7349859bf7fcb0027524e0bd8e2ab78f55eada5eeda80b4cf4ef3715176fa0501b493f6c51a6ca6e5a901518aa0e023f9f8dee813d816fc32ac
SSDEEP 12288:fXZ1IynGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWI:PZuGnQ/tbw/2Mkjy6Fr7g0oI
TLSH
T18355126933A4B0FAE6674278CCE28646E773388267B183CF275402695F3B7D11E7A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 beaaec4d976afa092e51eab654cca0659e33097c70ac9a881b2d7d3eda20fd58
MD5 6d899dc6878bca93f1f1748dde34dfd3
SHA1 29d0acc84f625c477892dbd7c1226e385c0a5135
SHA512 6ad09833fbbf256da2055846c0ef262824d1f2620a723eede0a4827b3f45f3e57f0dfa0ebc3bedb760435bcc89a818310c94a27759ed938373ee0677c92ce72d
SSDEEP 49152:rj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Ux:6QRQyi36YOcPQLvw2gAf+PN3uLm
TLSH
T1BF667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 860f881369f5c172ce03dbfc539e7c3c1f972ac4afc900d0f851303b4f3a34e9
MD5 0c13218617053ff890de605f52e8c83c
SHA1 347a9557ee1215a10517e44325d6132fa57450c9
SHA512 1119b165bf17c8903b9d5a38529f8e1218a8b92f0cac094972580a8958925c77e146b5f9b44a566e0e7deb159a7e311487a3cdb47aec17927b6b827d3c07da8f
SSDEEP 49152:lj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Ux:8QRQyi36YOcPQLvw2gAf+PN3uLm
TLSH
T1D8667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 ccef8824f23f84b2fe4b17aee9d9a063d11928fd2b0f4201940688f890e28762
MD5 c5f542d1e746c0cf9e9433e0d96c99a8
SHA1 eee7a00dfa318ccb25e9231c46578d3fedbdb27e
SHA512 90eb2e020377104a8fe4140b0296913bc125712999aa311dfe73c49922fe7645790970ba32ea10033ef1029afc3d2c10ee75869567c6937d0f7ebdcfcd8b1433
SSDEEP 24576:PwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0WnQ/tbw/2Mkjy6S:X68Qg55nhheWu7PNU3/nQ/lFTjN4
TLSH
T195B55A33B2F600A9C44DE1769F46872196D27C75CFE0E3DB8505721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 881407455c690d070d0520a786175d6d88d86fc2872a50ac8bf8b7e276f11473
MD5 2d4760ef5332a90bdaba18251cfd4f53
SHA1 09fc8f8a268df3748bc423f1608b42eab75becd5
SHA512 5c8c578b9aa4bc7ebc7da5b5c948e5e93ce4c24b3e8e66474fd39d8d9b512602f784a8ad97b65b779201542ca824ce50d978784090e2da9f8c6d6529a29a124e
SSDEEP 49152:h3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99f:gy5112gYy5azzVvL69nLKnhZtLm
TLSH
T124167B13F29910E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 5394dd5c3035634ce47a765e1768bc98e103bbc7eb8735942c912820d23e1bd5
MD5 f86b411bc8df364e5612a5268f12ab8e
SHA1 abe37c742eb7bd042a7584ce8310d2a8a1b756f5
SHA512 9daf136d2111bbc2b9918af9bf19a88713f39d112b39655d5dc33be2b7e721cf6e7c597e3cbee2759c5ae78778af98fe5228ea0ebe44139a32e6b1f6d13243c4
SSDEEP 49152:fB+taZ3usBWOBr4tEGT0bqx0z+n217aau1gl4Q/lFTjN4:hu6JmVxd2dbLm
TLSH
T166D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 668d8d31dcf10e60d44b716f8420eb49a7ea30295a30d6f3456ef8ed74b15b2b
MD5 550abaf7ab519a264c76bf49e446794e
SHA1 f07f35764ba09d399eebc496e37f6ce9897ebb88
SHA512 bd1b6d39f61ab1c225f9ea7974a4dfa85081837fa3e81d47f2e7cbdf84f5eedfaf441f80ca3aad163bf6cadc1f6f55258ffd44ed27d7283602e2c01fc0b86a96
SSDEEP 49152:i1hpsNoJpF1A6UU44CwH7R4x9Q/lFTjN4:imifPbRnLm
TLSH
T15BB5AE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 673fcec0c962122b7ad995b37f50e9445f4ca8da1377b1f87d8d65d018dd8679
MD5 41188c31d13ef3e91429e176f8922651
SHA1 014af6ebe0f9915045c8fab76ac211b0ee2b729d
SHA512 f5bc1df6d1243d0a6a3db2f1f77e0ef4ae845bbb8fa8e1bc973280d37e9036ac97ce78b28e094dffd067f480e861cbbcba50317683a8e4c1e689379f54a14bb2
SSDEEP 49152:MSuZQIY0Be2KRRVtOnks6NMHqGQ/lFTjN4:u5dKTi61RLm
TLSH
T192C5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 1228ead3a68e4fa8a3bc58a3e6aff90d362ea73cf733fca38b3ec5fdecaf4271
MD5 cf762b674527586133bfc746dac1204d
SHA1 fc9b8faf7326da77e23e17178715fad078a67180
SHA512 822ec595838e55f82524fafa18a94d9e1e8e05ec07e48a265adbc60b646530b56c120c00bfc58fc1e415f058f28b1bdabeb7f6c25e24a83259d3b7f5df69540e
SSDEEP 49152:whtSn8EApI0figngiDn0AP5wRQ/lFTjN4:hX2iyphTLm
TLSH
T1DA95BE13F2D940E8D05ED178C7468632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 a2d04da9e0da2287c70a0c6fa7ed01721748ee9c556a37b38038086e7ecdc2a0
MD5 962769bb13bc54c247c1aeeafa19ac25
SHA1 5f642a41492a5fbcc3896ca61d0b7b04fd3b6c3f
SHA512 4e6c26fc6e63e1e4ff83def764dfc550d06eee1a8910534cd9c10d8d7170c99607fcc6081c30c93b4127c6573a7b55c71a085f9f608860c141b3e6943ea09e0c
SSDEEP 12288:vKGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWG:vKnQ/tbw/2Mkjy6Fr7g0oG
TLSH
T1B15523697964F98BFB1706F18C828182A77F0EC6BFD1938F77482129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 00bb8de85f26d45ca795ba3decf266f09157981f46721320f190ed7a5d0fde26
MD5 51e27dbce887804ac26288877ee2c654
SHA1 4d055163cbf16cc9fdcbf389b3040449a9dc2bb1
SHA512 a28a6b6682613398a895cb41ef267ce2b3bad6dd0cdfc2abb1e8ee8b5268e6e07458c49abfa7656174982679d0cb8f62dd3ec1a565b5ab9053a218197c4d406c
SSDEEP 12288:jLGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWG:j7nQ/tbw/2Mkjy6Fr7g0oG
TLSH
T1325523797965F98BFA1706F14C8281829B3B0EC6BFD1938F7B482129967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 241fbed22f6e1a2599ac254618eb1a842ee0c3ef031f96d804c2e67cea2d1160
MD5 f1cd622adb0a9702a369d94529ec750a
SHA1 8e82017d2741b79a0502ff10c36dd99a111f27ad
SHA512 cb15564448ec3e5d4e15e0f436e531c6ea741b835be23f0387561e2246e703c64e66833b0a59a0fb0f032b8c9d75fa1325381f55d40047b7ef731e1cd5c99882
SSDEEP 12288:8lGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWk:8FnQ/tbw/2Mkjy6Fr7g0ok
TLSH
T11E5523697965F98BFA1706F14C8281829B7B0EC6BFD1938F7B482128967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 bb718108ff761c2568da9070eb55477dc4d177bf4ecd4f4cdbafa7e9a86d641b
MD5 e0c8021b2bc6290df71f3ae740feccc4
SHA1 4cbcaa4692d0985794506e6852e206909f16358f
SHA512 7c062390ecf5f5fb255e75edf574d78dedb0cdcae394db132cdc030070d3562ea9e1544d7d9ef5d20123a01b97912ce35a13926194c839960f9c6e4d57e2b437
SSDEEP 12288:YVUGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWr:VnQ/tbw/2Mkjy6Fr7g0or
TLSH
T1785523693A69F4C7F92742B5CC928142E77B3DC1BBB1A38F6B04111D4E793D419AAB80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 86e3ea8793d178bf0805fee9eb6386682bac5c3ab5599012891b32da75c9e796
MD5 b88d2bbc4f8a327ee285e8ca40224e26
SHA1 5e3c4f26e168464c3e70e337f45e66ebf1d1ded7
SHA512 3ef83edc779fb76728689d4407d38c358e0531e2bbbeb98323b0b7f506d07e6a8b2637969542f0b63af642bad6e9098f6a24c4704a932c55d1ae92f43b532795
SSDEEP 12288:hsGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWt:hsnQ/tbw/2Mkjy6Fr7g0ot
TLSH
T1095523697925F98BFA1706F14C8281829B7B0EC7BFD1938F7B482128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 215e90dfb01058eb6f7695b8eca50e23c13ae15c8d54b1dd5140041bc1d80bed
MD5 57db2dbaa2c9fa4dffb143049b1cbdfd
SHA1 b6e1c24c4a618f75050f999ed1cf88f63ec4919a
SHA512 42b74d3997fc8e116d69ae0b1045ff418657c57093ec630ef6a72ddc89672693cbfa9d572dec9fb9f1f6e7d93f3eba01a1a838ae58a6a390b3ade3d7ca3627fa
SSDEEP 12288:ffGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWt:f/nQ/tbw/2Mkjy6Fr7g0ot
TLSH
T16F5523797965F98BFB2706F14C8281829B3B0EC6BFD1938F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 c25c77a1f7bea3514b138ca022806173766f57ef5ecc61b906ccbfae08d238ef
MD5 a5a330f085be40981574eae01235bf0d
SHA1 f7a49d3c52eda28666603a0b1b137faf47c156d7
SHA512 fbb6585988432a31495057b12616488b6520ddfa25d56ebde3daa76d1fd704f140ec4bdb6d82f5dc94366d59cc10a77fcac52640d45410ff4dfbe0d3d1310928
SSDEEP 12288:jDGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWj:jznQ/tbw/2Mkjy6Fr7g0oj
TLSH
T12E5523797925F98BFB2706F14C8281829B7B0EC6BFD1938F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 2620e38136665bf360c412bb1e3086f4eab71e13b6a4dc4e04e77b61fe36f341
MD5 a913fc235b46e74fbb0564eabf34be8b
SHA1 14ede2370686b8c5bd847336198c7cff6e1bb071
SHA512 c6abacccc820a9856be72e6e58600ab111309592f641cf95a5f25adb94143a68ca5fc6f91fdcd2fa5432d66e9c1a0b42fb859e8b4a054f9d6c8dcd5a24eb8359
SSDEEP 12288:8iZwbDzzFEoS2cPvyrGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWd:fZM3zFVSObnQ/tbw/2Mkjy6Fr7g0od
TLSH
T18E7501A9B35058F9EC67423ECC518906D7B27C5A1BA0C71F13A8362A5F373A01D3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 fa871da3cae39d57bc93e51956b53ac92ac524a4aaded62d11cb323e020e6612
MD5 cdacc6d14498c739b3405f99e24894e5
SHA1 dee1798d34890825fa364a20903dc5fda9a89766
SHA512 a3efd9b3a5d5e2301c9169a25692d5b84f0b55eead0bf07855b7ad5513e4f89bb98e516e0ecf184f986d0a97f3ea6abaa44993497a76d34904fc8d6cb7773847
SSDEEP 12288:yWGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW8:y2nQ/tbw/2Mkjy6Fr7g0o8
TLSH
T1EA5523697965F88BFA1706F54C8281829B7F0EC6BFD1A38F7B4C1128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 88a2a5a11a876a0120c2a096f984241c44c2035c76dfb935408699bb02eb700c
MD5 cb7ca4baec4f512c3fda4a6e13e253f9
SHA1 886b8ead4acad47a9e7d188f9ee542e984b12b17
SHA512 6b1ee24cc3821b27e5f67fa243ae250c1a422c6c61336c7a7f5c8f9f9f032d31b905ee4b990ae31533cb917e61694fe84cef120c573f3cca2e0c29427314b519
SSDEEP 12288:gSGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW8:gSnQ/tbw/2Mkjy6Fr7g0o8
TLSH
T11A5523797965F98BFA1706F14C8281829B3F0EC6BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 b3f35996abae91083694f6d9ab377f388a1ea89b0b12aa68605beeb9a3107544
MD5 a8d75f849e28ebe577f618bfa6287802
SHA1 849f40511dd74bbfaf5681c0b7bdc264cb2e4618
SHA512 a3ea093c07deb46fb1670c7e39ace6572d72f1874f7af9c0627fb1078cec456bef926627ef91ffcc8d2a49a103c2618cd0423b563e424d6f474478b5f08b3ee9
SSDEEP 12288:nyPz5L8nGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW2:KzyHnQ/tbw/2Mkjy6Fr7g0o2
TLSH
T14C65021777A170FAE537427888920A02F77678725B609B9F2794037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 11555bd7f41f178d30c10df813d837f2fe3a0092a227a44f15b23ba49f2ae5ed
MD5 b2c0fbc004f1d0b1ed0c265517743b35
SHA1 6f8b44e1fa41d870725f9bf6bb8b59e83af1819a
SHA512 7e3f934eb17eb3a2ae530aec94873b50de85fd4cc31858a50c006dce107e2eca4468588e8a918d2055a06501c7b6c7768b79b92a5479b61524186661f721a047
SSDEEP 12288:zssfmGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWw:fGnQ/tbw/2Mkjy6Fr7g0ow
TLSH
T18965F019E29852E9D02E5275CB828641B3373C9597E1D3CB67C0F53E0F7A2905EEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 766e76c4623e65458d89f0ae24ccf1cb8729026b11e2510b7055f8d055e0147c
MD5 2fb189bcf341bd93ca4449749f6ced88
SHA1 af9974a83425db1f2881e787219f9a687005703a
SHA512 e29fded20bdfb95db05be51970b763c5623d17d38e1634d97d09961c91b75908891f0d84c1921c52ed31de08420abb06b0a9bc2cdd612d859c8fb75db541570e
SSDEEP 12288:bjGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWI:bTnQ/tbw/2Mkjy6Fr7g0oI
TLSH
T1DB5523696668F94BFA3B06B05882C151673F0EC5BF90D38FB708222D967C3D40EAA745
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 e447f8121af13428cfa1db5e2f42f4434c0893465a92bc17b0b9d5c43a13b05e
MD5 673e8f2603044f2362c1831c107233ca
SHA1 74867c8b5944f6d6f7cc196cf00a19fb193b8ff6
SHA512 7e9f46f7538fb2967697e0430a318f9431a31d1405dc7317268d716b733c923f7cae631086aba69672fe7d18c97af700dde741eb5c19d560148605b32ce82667
SSDEEP 49152:/a0h2GEkuAe73q3pp46zwwQqQ/lFTjN4:/a0hNYG4JwWLm
TLSH
T184859E1E67EC82B5D0BAD278C9A6814BE6B2B4261B3156CF1150853D3F37EE44D3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 1dd37a293a1c05442c94d0998ce799b8c3c900fa15545ef4b6559138bb2e5041
MD5 c3d45b4225fd236a738bbcde67cb11e3
SHA1 b34c31fb23688978275ae2fb2918e64ac1a27c29
SHA512 a69be2584ee77ebb463f87d233e1e8372edd3d9c1a6e5c96efc3861a979e1a5324b34fe6cea15fcf82d204f73647b37b5bff13e0cfc1dc9d86d9ccd10e61e28c
SSDEEP 12288:7hbHjfXOGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWc:7hbHjPOnQ/tbw/2Mkjy6Fr7g0oc
TLSH
T15955027E26AC30DAF63692BD88928546D7327C552B11A3DF2381427D4F3BBE40D79B81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.8MB
SHA256 0bfe01b4df9e306e4ec3f5bde0f3841ea457eb08ff38239a4367d9f89132abd8
MD5 30212fbd272f63f240210429b89136eb
SHA1 47a8cc38dbd11d90b423238c5c37091267f1ff3f
SHA512 8de35359ff0b27443f6d100f6c73c36cec04750b6d2bb1b5c3d65b75d6baea05eb968cdc2287c285c6859320e4eaf955606608ca7507a3a1580f68ddd3c181fc
SSDEEP 49152:irgnaTk46pSR/GQ/lFTjN4yWS1SZBnHTAsi:icyLmycNzAz
TLSH
T13C85E02DF2B910B9D8AAD236450147B5FB72782D1F209BCB0170C538AF1AEE85E35F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 1e061a1b3dc9ef8656df1c2159510553ee37a06e23e2dac307f65d4acd368364
MD5 f6d8fc32207ece4f3d7b76f3698c68ec
SHA1 e7843edfd8860b1f10145007afc003f92e0792eb
SHA512 3d96490e13d14f22a128caf86875964cd70af2626acf7e9e8f8e135b8ece421ac9c75fcffa4c8ec11be3754a43a5ebb820913427432059a08234e16a0d11ef0e
SSDEEP 24576:g3YgnJcRTk4yti+R5dBR/GnQ/tbw/2Mkjy6Fr7g0oV:gIgnaTk46pBR/GQ/lFTjN4
TLSH
T11345BF2DF2B910B9D8AAD236450147B5FB71782D1F209BCB0170C538AF1AEE85E39F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 8311881f392b583abf240301c4ca61a8b29c2efddc942bd5fd1ef4279bfd3c8b
MD5 beb9fec200f7d5cd10dc39065bcf0f70
SHA1 7ded7603c2da6ded8237b214929a8e386b72b1be
SHA512 c4fe22845630145172fa0727784774deffd3e513c6d3380fb141d31a45ca107acdf8842f047c4e2df986717ec6c6df032f6987dd929f83712e8883b1c9084cec
SSDEEP 12288:s3GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWh:sXnQ/tbw/2Mkjy6Fr7g0oh
TLSH
T1415523687614F98BFA2706F54C838146673B0EC17F91A3CF77482229967D3D41AFA780
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.6MB
SHA256 45697ebff4dce2fd9882541c4597a83e5e3593d593b0b31843086d4e6bfc99c6
MD5 e6348dc0f82dc758d606f49ce7bf034e
SHA1 114ca410c39ceaddc55cb9db69aced6c1f818746
SHA512 9d61590c50b6b6f4634947c132270c182585b0ec681c681eb394aef212f54c69242df6d15f6dd9e19b231d124b2a07fc602ae76219d8dd6b7d336b9cc4e05027
SSDEEP 12288:mOb4A4LWOsvAYFTbGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWx:PwL3UTLnQ/tbw/2Mkjy6Fr7g0ox
TLSH
T1DE75F155F7A450F9E92B813CC8A28616E372789D1764E7DF03A84A691F333E14E3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 cdb2383647c30b2a8a039dc43989edaf7546d54c753fffcb56a76a09ad5cf489
MD5 684fdf7a77947f56c23b11dc4e941ed3
SHA1 3528fa40ce8ae0b275717d5f135db8cc871f715b
SHA512 3d5826a7638fd6482bb48770ea003cbff3a468cc1178fe15b99d0b0d850bfd27862ed49362507a3b28984713840ac0a83a2e501016433baf6edfc7865a62f44e
SSDEEP 12288:LpFtCOcGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWY:IOcnQ/tbw/2Mkjy6Fr7g0oY
TLSH
T11E55022D36EC60E6E536527C8983820AD37278961B6253DF0780817E5F7BBF81C7AB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 483272d47d549aa2219e42fb61acb18836b04a0d63e0f2a5d843b0f03185da0a
MD5 b3ef4d84750b39e302561eb3533e49b1
SHA1 ab0b585d05ef61e360ae7c9c5d616c7e5b58ea61
SHA512 2e77d64e418f59f826d3192a7a14848a8c6d78fc1a2e52ade34687480c36f5f98012786bb75a56e371d9aac040c41a8dcc091caf3e6cf3e6a7ee9455e245a0c9
SSDEEP 24576:B7NM9YqZqmWMUkPjZM48Mv6bEhsEnQ/tbw/2Mkjy6Fr7g0o5:B7cBWMpPjN8DbEhVQ/lFTjN4
TLSH
T12A659E2E6BAC81D5D577D13DC9E28206F6B2B4611B318ACF1152833E6F37AE44E36721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 bb56eee42438806371f32ef6bca8e925e5d7663e23b75f1569550195e56b8e1b
MD5 b017bad1da2ea9448b9ab8aa6769269d
SHA1 2bdc5a830d3b9a7465ac0c3a79276520d9e1fc6d
SHA512 7b614732d7399bb485c9f25294466ac2d0089fbff88e3fea8a1b9926f7e271dc2163f6648d40bc309ac81bc3008ed49496fc9f114e0356790b59eee19ba696b9
SSDEEP 24576:QW6BApg2YuyuNDYTabvcdvNYf8km15nQ/tbw/2Mkjy6Fr7g0oG:QF2YuHNETovAvNYf8kmDQ/lFTjN4
TLSH
T1DC857E6927ED80A4E0BBD27D45B7D246FAB2B8511B3056CF0255862E1F33AF44D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 047d8d3df9e46d6312e9e1f537bb3d24383d2e80399b7554d89e5d9dd32969a9
MD5 b51f65d3532b88a246ac5593118470dc
SHA1 2ff241a191ebc66e54f7e25ebce334ec7d2e4e8a
SHA512 d2b5e060163380146ec3124c22a80aa7187b43e5ee3b36b01e1a15e172db2f4d06b1a29a87cbf475dc859fd13ee8196852ec725462657eec78421805c5ba8a8a
SSDEEP 24576:iAFs06+Omlf3NXEbTownQ/tbw/2Mkjy6Fr7g0oj:bFs060lVXuNQ/lFTjN4
TLSH
T17C65AF2F66AC00D5E07ED17D8997C91AF7B1746307255ACB0260863E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 0e684b6c0fbe4d98139760c3cc49c13c37b53df41a5f30fe33e7b2e83fc58647
MD5 de9b19ae1ae5f14ff3d101d3b1cb4a5b
SHA1 0183f9d48886620ab1fe7a15100e2a89fc42128d
SHA512 f7790436e0de5aa35ee50bc935e7129090cf38504416fb4860a04de2bdf85b24a94893af446802142bba20674bd6615de38a640f1b4239bd0d15a7be889eef69
SSDEEP 12288:/CJnJ5D3VkrqzxEGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWM:6JnJ5D3WaKnQ/tbw/2Mkjy6Fr7g0oM
TLSH
T12B75D03DD2A810E9E477C2B4819A1746FF72386D2F226ACB2864D5357F22FE05979F04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 72b2aea828e29905f1d5ca1df4123c2e090ba57e72c476f09f72ed321c5ebe48
MD5 785b4ecb8056e713d0d8932b959a02e1
SHA1 cacd8ea89b430aa62c4cfc4117b19b1149d90ed3
SHA512 dca20f8f28067bc8020f14cd59e8e64a78f02f84ab96e139a6a05b2c4b0fccb5d17a1a61424b27222f14053ab7479b062993bfd5488256bb45a8b8fe36b31b07
SSDEEP 24576:WEPghm6/7IIXdwcXrif7qQncjlP65i3Vu9nQ/tbw/2Mkjy6Fr7g0oP:xg06DIKdwc+eQnSt65aVQQ/lFTjN4
TLSH
T124955C16B7EA5294E8B3CAB1C96291169B327C509B34F7DF0AC0C92E1E33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 df711814b025edf3cddcc9e01c5dbbfd1508d070b2fa7bcc1c0954d0d9e59782
MD5 eeef81b9e910d54bc6d24103e5638df6
SHA1 ac58a5aaa44f17402b070fbdfbd66f219f05d515
SHA512 8ad5927e870e45b34ff50677d143b013e98ac31c4b1dd8338d6df4b5f33acf17b9027d4dcf8eb8837834f1a3d1e12e5f06509f884efc6e102448781f1b698b8d
SSDEEP 12288:yEP3RSxGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWyY:xSBnQ/tbw/2Mkjy6Fr7g0oyY
TLSH
T19E55126D37ACB0EAE52A517D84918145D373F4A16B5267EF2680823D8F3B7E81E3DB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.4MB
SHA256 aa6732fb1275ba4b89662dc74049c66f0be70471ac00c443bd48652a7195f08b
MD5 3c6cd208e483683e11bc49eea42bf281
SHA1 ae3df1fdc8202f131ba74d4d19d3ba2cc10f9c9a
SHA512 8bdf33a36efed96c2fe0e7b0997c46ce56cae4d5ddbac1edd49f6da28f4b9b715fc36c22b85cfc000646fed8b3028de44903e9a41fc224510fdc48203fbb6a3f
SSDEEP 12288:Fjky+GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWd:FIy+nQ/tbw/2Mkjy6Fr7g0od
TLSH
T15B6512187398F4CAFA7A06788DA381919B367C506F2193DF6280B23E9F3A3D45D75B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 4202594044557c1ae6f882f43908931cb4c15d115bc5429acb407f7011ded216
MD5 559620bb71631802a3926a6c0f88ebaf
SHA1 d4d1d3a0140f5393caa2175f1eda5d30be69ae0c
SHA512 02d5abf52a2239b5b2374cb418d7bfbc2b2ed230b567330914e76f083b91b1d736ae8866f41993aa27548fa2900198d45c21b63e06b978ee64d489c53f413bc0
SSDEEP 12288:00MGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW7:fMnQ/tbw/2Mkjy6Fr7g0o7
TLSH
T1C955236C2625F89BFE2706F448928542973B09C17F9163EF36846239CB7D3D416F6B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 2d2b98127908344b1a4e9a73f787958e1f1a2f0bc758d55e634c7ceb815e5c32
MD5 cdcfca78194b33e71498272ca84f26fb
SHA1 7141df6d7a8e2a85b57ac4ea7d796e9ab19feba4
SHA512 0477d06254a55d73f6820760a129c4009de85f2ba019ff29f4fb320feb1cec6a21100dffe1ae98172ed4d1986581a5a01be530a5ccd6bb673e9f10f05e1cfc97
SSDEEP 24576:mQ9MxZKdcz9dw38nQ/tbw/2Mkjy6Fr7g0on:mVKZ8Q/lFTjN4
TLSH
T182558D2DABE9199AE177D27594A240C3A633B4311B31D6CF2448D03D4D7BEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 e86f170a068f1b24026a260ffef8bd198bc3b89fd6c57c0cf568e85286362682
MD5 d98abcf97d73a47fc006f982cc407108
SHA1 573dd5e6ae078ab6d0bc6bc9b0425657cf7e5edf
SHA512 80c28431232d2b1c5a32c4dd9e12929da3517306bb50b92fe55370be069c02022c5e26c57968337396ad2864e704045e2136a1190f64921cef7b8b05cd710b17
SSDEEP 12288:KyoKo20Rple9pZGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWD:KyocSAppnQ/tbw/2Mkjy6Fr7g0oD
TLSH
T13765E01FBB6990A2E136813C88818745E773B4706B6263CB6681C33D8F776E87D39B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 99430641de7d52c3791d42fa029048b77e58333bc79c9ee20a40250a30fc3231
MD5 7aa7892731aa72a65d9a5697ff18d0b5
SHA1 66663683f5ef585979be186bd9260d843626ff9d
SHA512 395d82c3b6448aecd8934c6c1e98707426aa6b6b2512c7d46e43d20ccb63e61c2e78c5d9b044f4dea53033139a63c2b48d044d3d47906a6fa2d6fdb210cd3e07
SSDEEP 49152:nWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKpQ/lFTjN4:f0zuNIALm
TLSH
T1AEA57C3DA2BC00A9D8AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.9MB
SHA256 01ebfafa4f413cd74d11f6b4e8601ea52068b4097253b0e63b2f3a999b8358f6
MD5 a4ea180bac7df1ba6e1a54a8d4419888
SHA1 4bb399e4aaa3c9c6353c4d7416f891d1077f26c7
SHA512 de30e10b73a7a48775776ec31fbd306553cb83f9375672e9dc26a95cb8e7b418e4492fad8f1ab4fd9694072db05ef9c8dacf8df8862f928827355eb3d43b1b75
SSDEEP 49152:NTDxR+N5YzTljM8Q/lFTjN4WWS1SZBnHTAsi:5u5TLmWcNzAz
TLSH
T1DA95D12EA7F845E9D17E86789A238502FB727861073193CF42A0C17E1E7B5D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.5MB
SHA256 b5f1a2a197c15b01b42314dae0801688682c2d20baeac4005f54ccee2e6aa78f
MD5 ba014e630323c38aa3266bec803f0198
SHA1 885190d5ea5c1453c441c919d3438f4d5d47760c
SHA512 da5f945de46e5029aca5a4aee917731259fa4e36436e11d7dc74e08bcb3e59ea907c664159131d4807d6374f67698c5674a123b7a9c892d856829f03eca16641
SSDEEP 24576:/TMdOz0FFS+1mSLVnQ/tbw/2Mkjy6Fr7g0oK:d0K+1mSLVQ/lFTjN4
TLSH
T1C975E17E636D14E5E53BC27D9A438906E67334620322A6DB0690C17D2F6BFE4397EB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9625d35d958e99e9.bin

Path C:\Windows\system32\config\systemprofile\AppData\Roaming\9625d35d958e99e9.bin
Size 12KB
SHA256 484971ddc5d56d612987e63c885fff3495c2c44478f27bee77ba3411dfe78ac9
MD5 6e2fb6803a0ed42cdb184aa4a81ca74b
SHA1 bfceb2dd2ae6af05ff92e20658288559aa0a384e
SHA512 268b8d1e9bcef6c626f94a321ba5678c9017596f86f8b60f74958cc376068a5cc6d7460df590cf38055610c6c0f980b068d391191e185d706f80cee733519b0e
SSDEEP 192:YwlZ6rrqXMdgMx8OeJyecynLkvuSj9GAWRpQcpg8Rbv4K6nFDfARA8o:YS6fq8lBl2nwvuS4AudDFgK6nFDIA8o
TLSH
T19C42B0B9DEC1CF125E916F096C76F9684C7AB3C140CE9ABA872A69FAD16049A94C4008
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.3MB
SHA256 80923b6765901a7e1f766b3f485a463831a5f32dfb979af8c96b962c52ce1853
MD5 e70170dea1e7aa43f8212c1daf2a8ad0
SHA1 f983c74fb681e607eac76f58c4a6e67912ce4a06
SHA512 6547a36ce8f6cf674c60349128c1b4bb345d24816b2b81ea1181f7a7aed071f992412ca57a3e59016303cacedebae36866b809d7468971f9ab77e75cf3b5f0d9
SSDEEP 12288:n4ToGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW4:ConQ/tbw/2Mkjy6Fr7g0o4
TLSH
T14D55122D23E8B4DAF93352B48962414697327CA2276167FF36C4C63E8F3A3D44979B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/440-525-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/440-411-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/624-99-0x0000000140000000-0x0000000140156000-memory.dmp

Download

memory/624-358-0x0000000140000000-0x0000000140156000-memory.dmp

Download

memory/624-109-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/624-103-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/856-226-0x0000000000D00000-0x0000000000D66000-memory.dmp

Download

memory/856-147-0x0000000000D00000-0x0000000000D66000-memory.dmp

Download

memory/856-156-0x0000000140000000-0x0000000140432000-memory.dmp

Download

memory/856-318-0x0000000140000000-0x0000000140432000-memory.dmp

Download

memory/856-141-0x0000000000D00000-0x0000000000D66000-memory.dmp

Download

memory/1216-378-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/1216-376-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/1216-135-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/1292-495-0x0000022102CC0000-0x0000022102CD0000-memory.dmp

Download

memory/1292-501-0x0000022102CC0000-0x0000022102CD0000-memory.dmp

Download

memory/1292-494-0x0000022102CC0000-0x0000022102CD0000-memory.dmp

Download

memory/1292-510-0x0000022102CC0000-0x0000022102CD0000-memory.dmp

Download

memory/1292-509-0x0000022102CC0000-0x0000022102CD0000-memory.dmp

Download

memory/1292-499-0x0000022102CC0000-0x0000022102CD0000-memory.dmp

Download

memory/1292-514-0x0000022102CC0000-0x0000022102CD0000-memory.dmp

Download

memory/1292-504-0x0000022102CC0000-0x0000022102CD0000-memory.dmp

Download

memory/1292-506-0x0000022102CC0000-0x0000022102CD0000-memory.dmp

Download

memory/1292-492-0x0000022102CC0000-0x0000022102CD0000-memory.dmp

Download

memory/1292-500-0x0000022102CC0000-0x0000022102CD0000-memory.dmp

Download

memory/1292-508-0x0000022102CC0000-0x0000022102CD0000-memory.dmp

Download

memory/1292-511-0x0000022102CC0000-0x0000022102CD0000-memory.dmp

Download

memory/1292-497-0x0000022102CC0000-0x0000022102CD0000-memory.dmp

Download

memory/1292-503-0x0000022102CC0000-0x0000022102CD0000-memory.dmp

Download

memory/1292-513-0x0000022102CC0000-0x0000022102CD0000-memory.dmp

Download

memory/1292-505-0x0000022102CC0000-0x0000022102CD0000-memory.dmp

Download

memory/1292-493-0x0000022102CC0000-0x0000022102CD0000-memory.dmp

Download

memory/1292-516-0x0000022102CC0000-0x0000022102CD0000-memory.dmp

Download

memory/1292-512-0x0000022102CC0000-0x0000022102CD0000-memory.dmp

Download

memory/1292-496-0x0000022102CC0000-0x0000022102CD0000-memory.dmp

Download

memory/1292-515-0x0000022102CC0000-0x0000022102CD0000-memory.dmp

Download

memory/1292-517-0x0000022102CC0000-0x0000022102CD0000-memory.dmp

Download

memory/1292-502-0x0000022102CC0000-0x0000022102CD0000-memory.dmp

Download

memory/1292-507-0x0000022102CC0000-0x0000022102CD0000-memory.dmp

Download

memory/1740-210-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/1740-379-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/1740-201-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/1740-207-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/2112-216-0x0000000001AD0000-0x0000000001B36000-memory.dmp

Download

memory/2112-169-0x0000000001AD0000-0x0000000001B36000-memory.dmp

Download

memory/2112-220-0x0000000140000000-0x0000000140513000-memory.dmp

Download

memory/2112-182-0x0000000002800000-0x0000000002860000-memory.dmp

Download

memory/2112-176-0x0000000002800000-0x0000000002860000-memory.dmp

Download

memory/2112-218-0x0000000002800000-0x0000000002860000-memory.dmp

Download

memory/2112-175-0x0000000001AD0000-0x0000000001B36000-memory.dmp

Download

memory/2112-195-0x0000000140000000-0x0000000140513000-memory.dmp

Download

memory/2692-399-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/2692-491-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/2692-391-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/2692-397-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/2752-118-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/2752-119-0x0000000000840000-0x00000000008A6000-memory.dmp

Download

memory/2752-374-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/2752-124-0x0000000000840000-0x00000000008A6000-memory.dmp

Download

memory/2832-76-0x0000000002220000-0x0000000002280000-memory.dmp

Download

memory/2832-65-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/2832-72-0x0000000002220000-0x0000000002280000-memory.dmp

Download

memory/2832-66-0x0000000002220000-0x0000000002280000-memory.dmp

Download

memory/2832-78-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/3016-405-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/3016-408-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/3452-485-0x0000000009E60000-0x0000000009E68000-memory.dmp

Download

memory/3452-579-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/3452-432-0x0000000001770000-0x0000000001780000-memory.dmp

Download

memory/3452-448-0x0000000001A20000-0x0000000001A30000-memory.dmp

Download

memory/3452-422-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/3452-489-0x000000000B9D0000-0x000000000B9D8000-memory.dmp

Download

memory/3768-81-0x0000000140000000-0x0000000140164000-memory.dmp

Download

memory/3768-315-0x0000000140000000-0x0000000140164000-memory.dmp

Download

memory/3964-194-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3964-61-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3964-52-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3964-59-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4000-402-0x0000000140000000-0x000000014018D000-memory.dmp

Download

memory/4000-498-0x0000000140000000-0x000000014018D000-memory.dmp

Download

memory/4020-412-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/4020-574-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/4588-419-0x0000000140000000-0x0000000140171000-memory.dmp

Download

memory/4588-578-0x0000000140000000-0x0000000140171000-memory.dmp

Download

memory/4764-34-0x0000000140000000-0x0000000140154000-memory.dmp

Download

memory/4764-35-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/4764-26-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/4864-9-0x0000000002830000-0x0000000002896000-memory.dmp

Download

memory/4864-159-0x00000000032F0000-0x0000000003350000-memory.dmp

Download

memory/4864-186-0x0000000002830000-0x0000000002896000-memory.dmp

Download

memory/4864-184-0x00000000032F0000-0x0000000003350000-memory.dmp

Download

memory/4864-80-0x0000000140000000-0x00000001402CE000-memory.dmp

Download

memory/4864-17-0x0000000002830000-0x0000000002896000-memory.dmp

Download

memory/4864-0-0x0000000140000000-0x00000001402CE000-memory.dmp

Download

memory/4864-16-0x0000000000900000-0x0000000000960000-memory.dmp

Download

memory/4864-165-0x00000000032F0000-0x0000000003350000-memory.dmp

Download

memory/4864-189-0x0000000000900000-0x0000000000960000-memory.dmp

Download

memory/4864-211-0x00000000028B0000-0x00000000028BC000-memory.dmp

Download

memory/4864-212-0x0000000140000000-0x00000001402CE000-memory.dmp

Download

memory/4864-1-0x0000000000900000-0x0000000000960000-memory.dmp

Download

memory/5012-575-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/5012-415-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/5068-117-0x0000000140000000-0x0000000140155000-memory.dmp

Download

memory/5068-22-0x0000000140000000-0x0000000140155000-memory.dmp

Download

memory/5196-39-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/5196-62-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/5224-48-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/5224-152-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5224-58-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5224-42-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/5912-157-0x0000000140000000-0x0000000140141000-memory.dmp

Download

memory/5912-377-0x0000000140000000-0x0000000140141000-memory.dmp

Download

memory/5948-324-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/5948-91-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5948-93-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/5948-85-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/6116-375-0x0000000140000000-0x0000000140140000-memory.dmp

Download

memory/6116-128-0x0000000140000000-0x0000000140140000-memory.dmp

Download