3409a97aa009c08e43abcfbd0ade4358adc89c76545116803271e83cc6d1b663

Analysis

max time kernel
150s
max time network
153s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
23/04/2026, 05:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-23_e740ce5f9b323b00e318a1d2da819888_icedid_njrat_ryuk.exe
Size 2.7MB
Sample260423-gcdttahs5p
SHA256 3409a97aa009c08e43abcfbd0ade4358adc89c76545116803271e83cc6d1b663
MD5 e740ce5f9b323b00e318a1d2da819888
SHA1 81ca6156c14f9bf8d2e2a6f0aa8ee49117a9a403
SHA512 b8050fb25bcf9fe5b7fb43204c9258934ba188ae01a8ad5807670c5393121205cdbad9f2ea17b6922f057c5db7d2bd6a4d78599856cec54d0aaafb5c8f4f0ed1
SSDEEP 49152:dHLBUcQ/lFTjN41WS1SZBnHTAshQ/lFTjN4:F92Lm1cNzAjLm
TLSH
T16ED52258E7A494F9ED2B423C88628906E77378891B64E7CF17984B291F373E50E7E740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
3100	alg.exe
3212	DiagnosticsHub.StandardCollector.Service.exe
2080	fxssvc.exe
1752	elevation_service.exe
3752	elevation_service.exe
464	maintenanceservice.exe
3396	msdtc.exe
1748	OSE.EXE
788	PerceptionSimulationService.exe
220	perfhost.exe
3240	locator.exe
2392	SensorDataService.exe
2396	snmptrap.exe
1700	spectrum.exe
1904	ssh-agent.exe
4940	TieringEngineService.exe
3836	AgentService.exe
4788	vds.exe
3168	vssvc.exe
3688	wbengine.exe
2068	WmiApSrv.exe
5104	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\e:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\spectrum.exe	2026-04-23_e740ce5f9b323b00e318a1d2da819888_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-04-23_e740ce5f9b323b00e318a1d2da819888_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-04-23_e740ce5f9b323b00e318a1d2da819888_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-04-23_e740ce5f9b323b00e318a1d2da819888_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-04-23_e740ce5f9b323b00e318a1d2da819888_icedid_njrat_ryuk.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\{17A6A947-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db	spectrum.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-04-23_e740ce5f9b323b00e318a1d2da819888_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-04-23_e740ce5f9b323b00e318a1d2da819888_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-04-23_e740ce5f9b323b00e318a1d2da819888_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	spectrum.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-04-23_e740ce5f9b323b00e318a1d2da819888_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\7682368789fac755.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-04-23_e740ce5f9b323b00e318a1d2da819888_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-04-23_e740ce5f9b323b00e318a1d2da819888_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-04-23_e740ce5f9b323b00e318a1d2da819888_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-04-23_e740ce5f9b323b00e318a1d2da819888_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-04-23_e740ce5f9b323b00e318a1d2da819888_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-04-23_e740ce5f9b323b00e318a1d2da819888_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-04-23_e740ce5f9b323b00e318a1d2da819888_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-04-23_e740ce5f9b323b00e318a1d2da819888_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-04-23_e740ce5f9b323b00e318a1d2da819888_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-04-23_e740ce5f9b323b00e318a1d2da819888_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-04-23_e740ce5f9b323b00e318a1d2da819888_icedid_njrat_ryuk.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-04-23_e740ce5f9b323b00e318a1d2da819888_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-04-23_e740ce5f9b323b00e318a1d2da819888_icedid_njrat_ryuk.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-04-23_e740ce5f9b323b00e318a1d2da819888_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-04-23_e740ce5f9b323b00e318a1d2da819888_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-04-23_e740ce5f9b323b00e318a1d2da819888_icedid_njrat_ryuk.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-04-23_e740ce5f9b323b00e318a1d2da819888_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ico\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d5e7a78fe3d2dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ico	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008c47e88fe3d2dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fa35b68fe3d2dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9926 = "M3U file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.crw	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dib\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.txt	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001984c48fe3d2dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9933 = "MPEG-4 Audio"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002ee32390e3d2dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000011411b97e3d2dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
3212	DiagnosticsHub.StandardCollector.Service.exe
3212	DiagnosticsHub.StandardCollector.Service.exe
3212	DiagnosticsHub.StandardCollector.Service.exe
3212	DiagnosticsHub.StandardCollector.Service.exe
3212	DiagnosticsHub.StandardCollector.Service.exe
3212	DiagnosticsHub.StandardCollector.Service.exe
3212	DiagnosticsHub.StandardCollector.Service.exe
1752	elevation_service.exe
1752	elevation_service.exe
1752	elevation_service.exe
1752	elevation_service.exe
1752	elevation_service.exe
1752	elevation_service.exe
1752	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
688	Process not Found
688	Process not Found

Suspicious use of AdjustPrivilegeToken 16 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1776	2026-04-23_e740ce5f9b323b00e318a1d2da819888_icedid_njrat_ryuk.exe
Token: SeAuditPrivilege	2080	fxssvc.exe
Token: SeRestorePrivilege	4940	TieringEngineService.exe
Token: SeManageVolumePrivilege	4940	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	3836	AgentService.exe
Token: SeBackupPrivilege	3168	vssvc.exe
Token: SeRestorePrivilege	3168	vssvc.exe
Token: SeAuditPrivilege	3168	vssvc.exe
Token: SeBackupPrivilege	3688	wbengine.exe
Token: SeRestorePrivilege	3688	wbengine.exe
Token: SeSecurityPrivilege	3688	wbengine.exe
Token: 33	5104	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5104	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5104	SearchIndexer.exe
Token: SeDebugPrivilege	3212	DiagnosticsHub.StandardCollector.Service.exe
Token: SeDebugPrivilege	1752	elevation_service.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5104 wrote to memory of 3880	5104	SearchIndexer.exe	106
PID 5104 wrote to memory of 4484	5104	SearchIndexer.exe	107
PID 5104 wrote to memory of 464	5104	SearchIndexer.exe	108

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-04-23_e740ce5f9b323b00e318a1d2da819888_icedid_njrat_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-23_e740ce5f9b323b00e318a1d2da819888_icedid_njrat_ryuk.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1776

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:3100

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3212

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:2244

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2080

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1752

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3752

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:464

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:3396

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1748

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:788

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:220

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:3240

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2392

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:2396

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1700

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1904

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:1604

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4940

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3836

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:4788

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3168

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3688

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:2068

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5104
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3880
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2648 2824 924 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4484
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2624 2792 924 {85EE815A-7738-4808-A14A-3AD87E32A3BF}
  2⤵
  PID:464

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 15f0f832bdb4463fa018244b75dafd5ad9de749ba0cd769a2d8f6e753a010a5c
MD5 d43688818d2fd900d93e6b4894369024
SHA1 90f4e4237b1200420c588b4229712774d9daaf04
SHA512 d711f270f24faefcb8b33782c1c288a61214ec4f2dce7d795643b6ae936a70e830ec92040539bd4e8f943db70d15a8ae151b9eeac8a9577545b122eaf07c7ec0
SSDEEP 49152:pb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnVQ/lFTjN4:/3q6HjBBLm
TLSH
T111D58D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 2d140bf2c769d3978ba2d394313f98707a0743248d34d0c5b97606519971155d
MD5 0ceb9f5bb8a60d50f64cb48ebf008ea3
SHA1 0dfd093b0dd182bd3cd4728e888a96d024457a06
SHA512 9ebb5593a031f2bf2c7ce703c1adcdbd1f552df5d248732cab75621aff94d20ebfee6b38a370fd7a3c2b4db9b8d43b4038c6c8194b56f4ccfccbaf1ffa82035d
SSDEEP 12288:Q1XLsswWkxy2lRq2czASGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWO:GXYfDtczASnQ/tbw/2Mkjy6Fr7g0oO
TLSH
T16065F12877E448F9ED67827DCCA28502EB73788547A0E78B03A495295F373D85E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 0d9abab1697eda5db6f51a9a186e97a5f6dd047e4c27ff5a1a18291520e0d833
MD5 d8a897d07dee0fedf7820031c0047425
SHA1 3318710553e4f5bc395c62e478f0147a39f99b28
SHA512 1772746a96c2e791a2aef17861eab7479d112c8afd38bd571f72e5cddadea51ab1376b3e074bee18381cb5fab2badbb5aae43427b3c7675c3c921f5093f3c7d9
SSDEEP 24576:00Le5ji0hmxLrM9nQ/tbw/2Mkjy6Fr7g0os:0Pji0AlUQ/lFTjN4
TLSH
T189859E15F6748735D073C0B9C5D2A68AEE7230825B308ACB4286D77C7E677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 df6b2ed06f0e62a5e572915ff4cd20a1bf45e2d55f1c50a778f67985e3df9593
MD5 a62705a6752049a77b10b3da2a663d3f
SHA1 75d01e068422a4a873c3d9ea410c8c017d1b7c92
SHA512 35d79c88b07a10f077c67ddec9e1ad3f946ad8b45c3761cd116d3bb468ac6f46ce163b7b5d772b4d12ac8328b70432f472e2ed8af3c26c5514f24dcbdda7cb1f
SSDEEP 24576:ya7/ezSC6vUyD/aqgrvWE6q8wyuDnQ/tbw/2Mkjy6Fr7g0ox:V/ezSC6vUzPvxHjyAQ/lFTjN4
TLSH
T1AE755D25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 ced16dc9f5557a95a8e649117c425c3269e1bc90e81d6b6c60fef15bb94f2c1c
MD5 fd03656cee19ab4a1206b4c0a42ca179
SHA1 983c85d774b23e8cb5e08789eba558f8f3c6b7d0
SHA512 38ad80131833d5a237a33c3848f2f92821c92cf17f76b2ba706943b4850b0390ccf385e9878d8742ad14ca99f1f36c9dd627d295c7f5fb482bbc5ea2fe5ddf98
SSDEEP 24576:eVbqPb88hv/l+6GnQ/tbw/2Mkjy6Fr7g0oK:eVO88hXl+5Q/lFTjN4
TLSH
T163559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E777E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 808b2ce02e0878842def2c7c88705f731ca92bdd7debc4eea428f7b9c35f2022
MD5 514ba00f9d9c7b8b45a121bf281ea352
SHA1 f4c7c5435e53e257161ff1b777c8eace7a37aa09
SHA512 60662319da76c39a24cc6086b631613732de2949f3f7c68e96d8855ccf4c3e83b6606c4ae4e2f0bc62dd5cdca2e174b1b561ee4839ffca26101ca5fa11893122
SSDEEP 12288:6zhGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWt:6zxnQ/tbw/2Mkjy6Fr7g0ot
TLSH
T18C5523696A14F897FF2B06B15CC384826B7B0EC1BFD4A74E6B44362D857C39446DB381
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 c5eabbfacd7a440e1fd63506912728348fc0a2109c125629fb9d6c4488679aa7
MD5 b8f8acf201d176283e59ead58e8f269e
SHA1 9a89afcd38556ce92d18623e86ae148b914bc1f8
SHA512 2f5688d7e4cd65dbbf7b1d5439c4d75a86a23a08dd309c7c5c48474b0a7e43f9aeec3aab34948fc0dd8bb2b60dbab029d465b3b8af7dd64a771bd30b447b024f
SSDEEP 12288:7eBNUbTVO86UOGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW/:7JIUOnQ/tbw/2Mkjy6Fr7g0o/
TLSH
T19675CF3BAE28FCD2C67E4DB85A918640D77278704F61A3CBD164830EDE276E01E7AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 f109f26186f7c613156463ef9d2ec32b0f5737a197ad6739cd8e265e1f6635e7
MD5 691612e204ae82989d46c8f8e1297e5d
SHA1 ff91425e5dc24ec205cc4e87218525081f9f15c2
SHA512 1ac100c1585d08b585e5186d6cac51cc4a46eeb4e72b1657ef44c19c26d7d137c7a6db6523ba8b86f4b2e5afa57f19af16d836a6df76b8c63b8a407c5a9b62cc
SSDEEP 49152:XQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THk:XQvGAdlCEL8c/yRNw5C4Lm
TLSH
T155267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 de9df8f9b4aa69be16196d5168d994d7c3b0520a363e5275539a3906dc866891
MD5 1a9c6ee7bb2dfa5be0271143373a3e5a
SHA1 2d482c548269d9b71dfd5204b75a6712fdfdb445
SHA512 9713bd9997f1fdd3dcc41c5314253c67414a708b7886a36bfafc59ba78ff021978f3572fefd65d65969cc1e64a0afd17aae85a0d6c8647a88760a6e5cf5fcad6
SSDEEP 12288:9AwSfxL/2Dc39DLLmt0LDQewsAjEGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg1:uQewsAjknQ/tbw/2Mkjy6Fr7g0oH
TLSH
T10E75E031FE74E436C77F0DB61B22C706583D6A604FA11AC3E3A84A9D59342D22776B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 3d910046770ec3424396d8df0c56d26929d289774cf2a3f28c8e1ad2e9cfc3b4
MD5 79f3236eb8788a01ad36f44fbcdcbab3
SHA1 747c6d14f4b4fe7f6cc87c27e6f6648fb46cbf84
SHA512 03f70c425417f70a4a52cca018cbfbb361b8f0b813c042537b50034ebb98e676c303c685a1ed55272e8c9175482c1f6589283fe4d77fdadb97936e72f06d13b8
SSDEEP 196608:QUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJH/L:QUEtQevvqc2W1cpV2EI32
TLSH
T1B6474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 d7b2d5b327a06df37f3289249b37121754e054a8e0333ada078aced6caff8a83
MD5 5a05b3d0a321b502e76ad605025123cd
SHA1 be5c0cac58cc5e63e0888c8cb2c244bf248168c6
SHA512 0eefacb942b5106d57b76be740de97b8739340dccdcbdda3084d1d13d139fc78cbb348ec8040fafc89a96d1cb13ad931f77fe3d733391a4478906d9c84556fc4
SSDEEP 49152:FCbRquA/m2yL5zQfFiV+XenmE3/zEQ/lFTjN4:SoqtVjnmELm
TLSH
T18BD58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 9419cdf5e4647f73c43da72929115443f68a091785238462af8ebd82df53d3d0
MD5 9cc3f8d40bb6edc3fa9d1448a92c0497
SHA1 1d7dd99aef70bb0a5d73015b3b7dfcc23819d2c3
SHA512 446a7eb23e38e7155e0c7d73278fa3f88018921c8edd91c54540592244cee2f8243bfb3ac7c9a7850f1d62a527fd892060384e42b36c4fd08959e5ce21abe629
SSDEEP 24576:TAhGLJIFoiwtA5l7S53vnQ/tbw/2Mkjy6Fr7g0o/:TAMyFoiq5fQ/lFTjN4
TLSH
T11835AD81E7F955D4F5B3AAB899B68171EA77BCA65E31C20F2250D11F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 330137da7f51150578f7eec77dfa37dc053fbce478e12679685dbacb97e4b674
MD5 f0e924db14a0c82a5e47a519b88f6987
SHA1 7fa3252621ed11c41a5474621d4b4c342bbef739
SHA512 8a142e5305b49eadcc08741187ae129030f61208b8a4c78e87a2f3a9d61ddfcf5f5a046184fe0063b2bada4f8a640909d6e8eab1808befbbbf7bd523f680a7e6
SSDEEP 12288:Gmw5HEjsChN2BFgl0WDm+CzGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMP:fwuHOWgnQ/tbw/2Mkjy6Fr7g0oO
TLSH
T1CF65F14A36A45CF9EA6742388993C136F7B3BC422A61DB1F1760C65B5F373606D2EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 8d65aaa610025267a1c183acaaedd3a6c0ab1b59543f7c7170347afffc2fa523
MD5 00153bf53ab3d9f994df1d26fa1bff4e
SHA1 66650c20072d8560fba732a3b0e492ede7c64463
SHA512 f79c0471a641ff06aa0cb50dcfc32a1ad50a9e1c05941aad3a08265554ce9810955507f370b612934d87dc7cd61bf331d0b75d3cb4bfc9ab2014339708f26e12
SSDEEP 12288:6XZ1IyUGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWk:yZulnQ/tbw/2Mkjy6Fr7g0ok
TLSH
T1B555126937A4B0FAE6674278CCE28646E773388267B183CF275402695F3B7D11E3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 cb52e6508ee8355e84d8bd2d582b1bda23ba6686e8d027dbfb39366b63cf5777
MD5 db9e2d9ef6005d18cb6aaff599c36e75
SHA1 7f3858727da760b223acdcb258ee879dc7cbac31
SHA512 3966cad72c40b60325c44fe854c8605919f1c764934227c61ff6a13339ad6cade25678eef1c799cb2dc139700031ff0809e8d265e031027443bb239baaf59093
SSDEEP 49152:Xj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Um:mQRQyi36YOcPQLvw2gAf+PN3bLm
TLSH
T152667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 912a9db718815a4ed4dc947382ecedbcb021e236661d6a5292023c029293b8ee
MD5 3a8139759b91835a38f3c6f21e60a01c
SHA1 423947a39c7db39733e501e0c5639cc80054e677
SHA512 86a4ed47e904d151f88fc6395fe9fe69a2277b789d0dfba442155aae3cd9d94fe3a934fd9a71e98dcef1ce61d0b02e3a5d2e24ae8579a05649c303cc5e47337c
SSDEEP 49152:Bj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Um:IQRQyi36YOcPQLvw2gAf+PN3bLm
TLSH
T116667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 743c517514357fb1ca30a9553976874749a85d06f34663fca4392a65c4d52dd8
MD5 04364677fc31a9f1be505f984766dfec
SHA1 985be297a2237894045391a9c0c094070f299af2
SHA512 f74ac39e291525a188cf85bcdf57497edb761839eb54742f3b9a057b850a7c08bd71acdbaa23ccf260ba942b09d28e323beee750cdda741897706efa1dbd6d87
SSDEEP 24576:vwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0VnQ/tbw/2Mkjy6q:368Qg55nhheWu7PNU3/UQ/lFTjN4
TLSH
T14BB55A33B2F600A9C44DE1769F46872196D27C75CFE0E3DB8505721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 9cfb83c3ef54f80cf16cca3664bbc440236abda02ac5451c3ac6156f5c4d23f8
MD5 b3dca6fc19bc407c8353eb6f55c0df65
SHA1 d17c44944affc9837b55531bfea68168bfe4986b
SHA512 f77c34836b2406fc89f0c86d03cd4ac25a5f8106fd0a86e02323115f44114a8c56c387052a04ec2410be195764fff86531aa4ce07d65ed13bd29106974d007d6
SSDEEP 49152:h3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99I:gy5112gYy5azzVvL69nLKnhZoLm
TLSH
T1F3167B13F29910E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 90405fa761975d398d60eb1bf903885aaa900cb0f30874dc5f878ce42b626276
MD5 c01ad3a8124d23ea61b9f3e0e7d2078c
SHA1 045583af0eac714f5a272306ca9d1a27ac8c66ae
SHA512 748320ef92e5e009b9c750459f914e9687624043c3d927aa53b8b524123a0032f494f70e3a4bb8423081fbbda99990eeadaa4a2a40ffe9dcf257fd0a1f1fe857
SSDEEP 49152:ZB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glCQ/lFTjN4:Pu6JmVxd2dNLm
TLSH
T147D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 cc00c3875dfd3f3feb858e0b18a5c507545d8d53435b66218309bbf5625f1441
MD5 6ac4f1c1a06ca5fe04c68a515404acbd
SHA1 3cfb06e31304b0cfb16e5e1b50f027b34524fcf1
SHA512 b3e43f0d4ee50c77333d47cbb7f2e1d9824757cedfc1054547b16a5081a23e6d03da109bf85bd555c576d1267d6231815b917f98b137cb2ca5be5da2a593ad22
SSDEEP 49152:V1hpsNoJpF1A6UU44CwH7R4xkQ/lFTjN4:VmifPbR2Lm
TLSH
T163B5AE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 ab83332762fc66fbf5d6c4691b52844a8c64dea6d11c6417e477b9c5e44986ea
MD5 83987ae4de3f77679f5eb1f7a6ba0bee
SHA1 d30703d0fa9f620b8b54a87c5cfef01634b47c2e
SHA512 f69013e5524b49f0b15951e29ca47ed9584fefe58bc558a36aece75ed03e24d7b38f0710dcc1d8149713802d0d681d6d88a646791254c72b2689b885f5222032
SSDEEP 49152:XSuZQIY0Be2KRRVtOnks6NMHq/Q/lFTjN4:N5dKTi610Lm
TLSH
T19EC5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 fdec8e88e04d526a1d999d4ea0c6d0fd631090380c02f6d5df34183c19ad5724
MD5 efdf27c377df4f0dd15567a33ac507f4
SHA1 668b562373b751fdc57764cabbfc813317d8167c
SHA512 f9790738c0568dc60575604b6b26765230b925acc0201340f1de6047456debc7c14318740b24c10d9cbb70b82dd29fe478e198ec3a0703fd3cb908683e6991b4
SSDEEP 49152:ThtSn8EApI0figngiDn0AP5wAQ/lFTjN4:SX2iyphaLm
TLSH
T12795BE13F2D940E8D05ED178C7468632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 d9d572b65e201e11e9a0fb98485f7ffb23270e87414cecf59957b1c0c8da03e1
MD5 864675b411e3bd881e87ccbb3e1094bb
SHA1 95e9d434a17f9fcf2a78e8768dd7556296d783e3
SHA512 cc9aaa7862a75a6593ce1a8075f179363a71b75f1eb6b0cfa77dc55bc18e91812bced3b128e967a196abf8c2ed9dfd59536de6398fce8958a946b9960b0deb96
SSDEEP 12288:YLGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWc:Y7nQ/tbw/2Mkjy6Fr7g0oc
TLSH
T1205523697964F98BFB1706F18C828182A77F0EC6BFD1938F77482129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 933b5e9c641b839b31776dfdf6c12eb8191d84762c4df74ba1a7276ce0ece74d
MD5 e2ae07d958e5a01fa7b624ee957e4941
SHA1 9400b495f7976ef124f47f10db121f8e1e211c23
SHA512 14757197a494ee7904e7c8210e34dcdd8543179694d1fbc2a866783f6d98a05dbf7b74a11520f53ff3ba3d4e60a3bf06cc25c8f3580949f919f5c29fd5c0d81c
SSDEEP 12288:0WGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWW:02nQ/tbw/2Mkjy6Fr7g0oW
TLSH
T16B5523797964F98BFA1706F14C828182A73F0EC6BFD1938F7B482129967D39416CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 48a3d65080f15d12ff562d89bba0947c101ca7a3d7276c7c680e2d93a171a27e
MD5 1aed9cbfdce2ff43467d318178832db8
SHA1 4dbe6b386732f6d71a66bff0bdea7cc204af9931
SHA512 bd5138b7cca8a8c7a038417783d18c865997e197b127cae2299f544f265692b95f66aebfe56a9b19bcc6292f8caeea7cd08fe29e23d35f36498fc104377a538f
SSDEEP 12288:zcGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWW:zcnQ/tbw/2Mkjy6Fr7g0oW
TLSH
T17C5523697925F98BFB1706F14C838182AB7B0DC6BFD1938F7B482128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 5e5a91f621bc5c6a10c68d0c719b81c3dcc8bee73151eb324bd44be2dc0d3814
MD5 25a1075eb9b66149371576c4b60c3c41
SHA1 8ecfd03387fc693214064db9eeab9b6ab08a22c5
SHA512 f71b8b7995f396f9c47bf76145f83775adcb9ab05491af28b4cec38e00a0bfc4ec31d21de8a4f7ebf0d7eb82a8f81a7b61367033b27046be48dd2ce862f8c4b6
SSDEEP 12288:TVBGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWZ:3nQ/tbw/2Mkjy6Fr7g0oZ
TLSH
T17C5523693A69F4C7FD2742B4CC938142E77B3DC5BBA1A38F6B04111D4E793D41AA9B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 2e4b4be3007e1e0319a21cb9bc331f35b004a1d80a00c4af9f8554f5f5457eab
MD5 22991c2fa65902e47e4e11d1cd10d374
SHA1 a97d2eee1eb29bc765419ef044a45e49741bf70b
SHA512 8233a027fcaf2242dd772874d1f60760ace864b2bb571025437756147c63b93344e499f1f3bca859376d9c39c2b768a922d57de17e85835001b4d0131d545699
SSDEEP 12288:MpGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWp:M5nQ/tbw/2Mkjy6Fr7g0op
TLSH
T1795523697925F98BFA1706F14C838182A77F0DC6BFD1938F7B482128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 76c5b109143b8b84d5c1a005a79b415bae42f611eb2fa1548b8872b16d21226f
MD5 154f50ffdebc020e819206419e4f9773
SHA1 f4b0eddeb693d1974856253a747e280ac29b438a
SHA512 24cbe614e382c3bce660e9f27f991b2fd673fce7f24dba1ba72798ce7ef0bacee977883fe15a27188aa913492d6cf80db88cb5e041f4f600626291452282c8b8
SSDEEP 12288:hyGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWp:hynQ/tbw/2Mkjy6Fr7g0op
TLSH
T1C95523697964F98BFB2706F14C828186A73F0EC6BFD1938F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 cc75fa685802426f9b8ebb4f4e8e8c1763317d36aefec24975df8a8abdd57528
MD5 95263d3b2e2e16cbaff5d5a75d5d3866
SHA1 257799dd639e89d0cc641825d01407da323891a8
SHA512 b8ff629bcdfabdfbec606e8e0a7ffc5611f347a182f008f0d69895eda2cedcb55dff78f50ef2b5b09896296aca0628b6af3cb1e0be20a3d3ab9b29d90cda5f42
SSDEEP 12288:j+GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWR:j+nQ/tbw/2Mkjy6Fr7g0oR
TLSH
T1815523697924F98BFB2706F14C8281829B3F0EC6BFD1938F7B481128967C39416CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 be3a85b6aaec9d77cceb5cb34f997f2aae6ccf4bfb38b57dcbdddf383981b25c
MD5 e4b290cc6845c106df654e50e17b5b46
SHA1 dc0263a52a3a72a475c8299a2bec735b82bc8c97
SHA512 97c8cdfcad582891112666132d8ca8f82af066a692076edd4789553b65841e84aca51fe7ebfade4a215ae2d0e9b5f7fe03ff563154317b2d30b4086f747c192e
SSDEEP 12288:piZwbDzzFEoS2cPvy2GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWg:sZM3zFVSOWnQ/tbw/2Mkjy6Fr7g0og
TLSH
T1EE7501A5B35058F9EC67423ECC528906D7B27C5A1BA0C71F13A8362A5F373A01D3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 528caa5da7bb9d4f0673025909cc41644fda0ea562ae60f7f27f9bbfb7d1af36
MD5 8d07813aa6d244f062c520c6f05330ca
SHA1 16985115dc6a5f582229894527f56b6f46b6a3dd
SHA512 9064c0d1f4151f6ccc4cf182ea6b646ec230d21e83359bd968b3a29ed4d13b3e87659907aff10c5c4c1afa7f082be3d83606136673cbe151840d8bac6f5a3ecb
SSDEEP 12288:KvGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWY:KPnQ/tbw/2Mkjy6Fr7g0oY
TLSH
T1E35523697964F98BFA1706F54C8281829B7F0EC6BFD1A38F7B4C1128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 f75aa78934af16b1f74b740a01e5e0f026662208f886c25999e246b75ea328b6
MD5 389f3644692d825028376676f926c55f
SHA1 cbcb086a6e64d62744bc2818509860d16a511d10
SHA512 1e1e63f2b722fb26e6eadd5f1144c47527a6e56df14efdde8d3d005136534560a3348cd98c401fb2123b20950f9ba1196e83cdd04c2c83862a4426072609a6c5
SSDEEP 12288:/jGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWh:/TnQ/tbw/2Mkjy6Fr7g0oh
TLSH
T1035523697964F98BFB1706F14C8281869B3F0EC6BFD1A38F7B481129967C39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 fef3f2b838caadead8c44e186836cd298cc8ed6260de673931fd7f5d9b228b81
MD5 f9af460bdb0e3c26a3ed75b940dd12eb
SHA1 e7d88c9ba4e0cecbd479a0927947e589e7173900
SHA512 c0f114f1f18cba235b338462920436969906bd73289d7f71ecda66cccb80ec3b1b4710db05fa67962a5840772cce8d768d053b00a8c4bd740c476f2048e79e2f
SSDEEP 12288:byPz5L8KGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWX:WzyKnQ/tbw/2Mkjy6Fr7g0oX
TLSH
T16C65021777A170FAE537427888920A02F77678725B609B9F2754037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 3aa3bf150659f9bf765027b9cba60a351d1f826bf5c9e5ef242f6bbb5fd0cfda
MD5 700f414088ae805c668445c0057cb54d
SHA1 09c08636db72f5e714d1c36569fe10efaf732e75
SHA512 f1f40ea1d1bff4cac47147a563135bfced7b7cafd4db80619b47a2c3b41e5b4a33a7071f2b16dd50f8a088ffeb7e2f412b729d5181f233ff40954c3887d462d8
SSDEEP 12288:3vGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWx:3PnQ/tbw/2Mkjy6Fr7g0ox
TLSH
T1F05523697924F98BFB1706F54C8281829B7F0EC6BFD1A38F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 6e949f7be9b6dcc400a00f6214ef6d9c67b80c351d34c2eccb80676e067dfcd3
MD5 992a7a19010142fb1cc322845576ad19
SHA1 6f04be03c897e164eb70f25dbb5b7c1556963e9f
SHA512 636c1183f19eac3401294d6a8a8418879b32dd5b9328f778acf616ea0f23ff2eb3cd3c79549ec57005e2ab2fc3fcb18a32ef41a7cb9bb2172eb6fa0a478ad778
SSDEEP 12288:gvGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWj:gPnQ/tbw/2Mkjy6Fr7g0oj
TLSH
T15F5523697964F98BFA1706F54C8281829B7F0EC6BFD1A38F7B4C1128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 efdd5cc7866b78ead057755d7cafdc52332c1d95d5f9d074e786a5f061900eb4
MD5 b25481368f64ae95ac5bc6c04a67560e
SHA1 07b6e19dc93b1cfbf3a0106843c8bb728647f440
SHA512 27ab327b15d75fe5dbed11ba6c3fc5443cf8d14ecb748b69111471e5194b97bb54cf2c42e25173cdc61a673d1abd3a99ee9dc0d4067b9dbcbf040ef6b8a4f067
SSDEEP 24576:LCUfpvPDv4Ex1hfe7i8WVq2lIGU8lrtGUJLPuwvAKnQ/tbw/2Mkjy6Fr7g0oa:LCUxPTY+8Wg2lIL8lrIUJLWwnQ/lFTjG
TLSH
T1BA65AE1EA3EC0896D4BB813589518A06FB72782E1B32D6CF2160C33D6F27AD55E75F06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 0016c3e90576e53c84f55cc48eb20dd049b883909ad4526fbc6a2f4c2ff373e2
MD5 e2cac53d4a1a6445ae4e51eb5a9c5ebf
SHA1 58ebf5f64ad06437fd425c1667853c44d0833ca2
SHA512 bf61622e27ba20299ce8a8c2332b91798692b8c7142e339b937a492ecab8844514b30834d5aab430ae2e499bf65955bcf5b4b2d3796b3437904ce55f15fa05ca
SSDEEP 12288:IssfFGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWu:mlnQ/tbw/2Mkjy6Fr7g0ou
TLSH
T1C165F119E29852E9D12E1275CB828641B3373C9597E1D3CB67C0F53E0F7A2905EEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 8edc419914b4267f6866b9b8f17d67cb051090585d7cd23b77b09e252e074211
MD5 f724fae8b9f337cbd006d6e3d039615d
SHA1 ac021769311b735a19e7d5dbb9a89068490bb5e5
SHA512 16a50b9a0899487b3495271a36e88bb155eec31bdeafda29597c5cba569c9fc732938eb3d8a02027bb1d555d6ca1ea037d6d5534c543d3716182b1792c0beaad
SSDEEP 12288:92GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWh:9WnQ/tbw/2Mkjy6Fr7g0oh
TLSH
T1A45523696668F94BFA3B06B048928111673F0EC5BF91D3CFBB04226D953C3D41EBA785
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 e33dd6e7bee7bb4363def288e82554467ee29a34da0b303e56d2b8c4dcb5dfef
MD5 f3aec0db47e1eb2ef79de2e1afb23b86
SHA1 9653b3ca035ec4e9acadad8e6778e7c8f365f887
SHA512 8310c3d79de0652821452e4b0bcf22b322e674563f1dea1768ee2462503eba896dfd6effccae71f374e55911ee4842c8ec4d37122b81d584a2b5768dea3eb706
SSDEEP 12288:fbxA1U7KGGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWm:fbxA1UGmnQ/tbw/2Mkjy6Fr7g0om
TLSH
T15055123E26AC24E6F636927D88D28106D3327C56676193DF2584823E4F3BBE41D76F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 f8b2fa21a2157ee772cdea1a38584fa12c6cbab0c135d158e218a5e74ca97074
MD5 63111633d4beca60514bcbd157688c23
SHA1 477b67c8807887d466ef5df3644cf431f7f0a7cf
SHA512 3718b8d542e295f95c1cc865023ba6290c83daf4e7658914d16000de6519e9cd174ec1809d258f6dc5716b288ff62638f9a642869f44a4475584f49d36232b1b
SSDEEP 24576:qjsmP0yHaqrVqHra44KDzMsrnfnQ/tbw/2Mkjy6Fr7g0o5:qjRP0yHfVqzlAsrnfQ/lFTjN4
TLSH
T18045AF2EF2B910B9D8AAD176454107B5BB71782D1F209BCB0170C234AF1AEE85F35F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 327adb815e7b0d56b69d0d38248d7b3a7730aac830b6e4f62a803b1fc409f328
MD5 61a587b0202873f447892c56e4524bd9
SHA1 e98927347e42a704d2f8eaabdfc6886793948638
SHA512 e73eb3c0e4e21862f978827f30ee7a7a5b3c798cf23a21cb7b39c765dd3520e0dada5ff4ab02065e417be68b0cf645dfeba0740d86077a6b900dddec796a8484
SSDEEP 12288:IMGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWaG:IMnQ/tbw/2Mkjy6Fr7g0o9
TLSH
T16A5523697654F98BFA2B06F548828142673B0EC17FD5A3CF7B482229967D3D40AF7780
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.6MB
SHA256 b769dbcec441ca57e6951306e922edbdef3c772445c5d43c79797262c31b0adf
MD5 28598257403106941b226728d19a3280
SHA1 87571ff7245c3509044940fb4a4cc6483183e722
SHA512 3a34d55ce7bcfb7780dd988a17400d6622fc0f7c93fd25533b463d612ea8184a0c1ace1bb4274fb2cf0d8ce0a37bc34f9776c940a9438635bfa63d60997b8eea
SSDEEP 12288:1Ob4A4LWO+vAYFTSGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWd:ywLBUTSnQ/tbw/2Mkjy6Fr7g0od
TLSH
T1B075F155F7A450F9E92B813CC8A28616E772789D1764E7DF03A84A691F333E14E3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 77404e9d8dad70ebbd05d4dd1764a4a5befa64f18700396dfa858d668a30a36f
MD5 9ed084dd339ca6e10735e767553bb574
SHA1 e164239e7e6d15ffc9c0695f80f898aa109f33ba
SHA512 bb88d3cfc7abf93f176d5f596dd69d6b46b55ed6bd8d8ea918ff56145d94a8d3b69f6257052518523adcd1c97a9a9191803939fd1b2965405c5a83bce29ac130
SSDEEP 12288:r70VmuIYNvUyBpZGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWq:UKYNH7nQ/tbw/2Mkjy6Fr7g0oq
TLSH
T16C65F12E62AD1CE5E53B91798AC38209F2737896175193CF05A0827E1F37BE87D3A741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 4d309436eee6de60ac47dd0a713138c5d3d2bdeca3fe85e3e6b408a6c5cd62b7
MD5 94be99f27749ebc917df8554eb0acd54
SHA1 f0b4bf64d7088377d13ad8a6e2a9d36809d99c8b
SHA512 52c873c048a62147125eef87e1f5c36ea3e6d548a037a8d4fcfad87a90fbdf998cf055c1287de291bd057ad718a71b48dd369e5c2f4b4dcda37244260a3c8685
SSDEEP 24576:nnXoJjNYH84VVSNAApoEON66aspcrcHBjSSKHPWdQwPF3hJ8ssmOc+XLxu+x7uKd:nnXoJJYH84VVS6AmEcJas+cHBjSSKHP+
TLSH
T1C265BF6EA2BC04E9D5BBD17DC5C24506F5B278621331C6CF026082BA7F27AF55E39B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 94ff2f38bd1bbd25127a74f6a88b0e344d75c9f2b54039fbed1c5946b25dc853
MD5 bad371b01ef7fe87e434571c88b4dea0
SHA1 4d4475602310420288428744c59baa977b289c56
SHA512 c60e2efab1f588ef4aad85f89b3a48f26254241d69012adba70d554b20be02f951a5297326ab7e8227b9b2833023a4a93c9e1145a3f4d05efba8e9b5e8552130
SSDEEP 24576:Tv7Xbxd9Tuycf8M/TYlSuxwr2PCRnQ/tbw/2Mkjy6Fr7g0oK:TDLL9TuJ0M/TYW2PsQ/lFTjN4
TLSH
T1C7858D5EA3EC52D8E47BD6BD85A39046FAB2B895273081CF1250856E1F23BF05D3DB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.3MB
SHA256 fbbeb462cdd8960b8e4dfba60a6663885ccd87dc52d8cd571cc3312e4b9a1011
MD5 93fa26e1a36b41a648fcaeb4933e4c30
SHA1 99084ee475a4e66ce162c0807e2b71445735eb85
SHA512 381c5690431236cb104abfeaaf5c520e0e37586a8d525288b0b386c4b78d3c9163ce53fb4b5d0e8b6474028dd25057a2688ab1b06f911889bb25e95b7d400fb1
SSDEEP 24576:TegJgpwJOmPOHWAK+8ZguIGyPsxr5Vin10wSnQ/tbw/2Mkjy6Fr7g0o6:TngOJOmPOHhSQ/lFTjN4
TLSH
T1F755BF3FB7BC15D5E03EC17D8A928916F6B1786613255ACF0550827E5F2BEE42E3AB00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.6MB
SHA256 c399f71d30e1263d479848cf7ae22615b148403998ecc3a7f4f654ad7e0a75a0
MD5 d68482cacd30054145876346149bd43f
SHA1 cdbeb8e9a01b57ea448f0fdc35f4becc2b30dd4f
SHA512 e9069ababfa2d0fd6f1b99b79fed32ee39bfa7a9aacf2e045e1042f884ae477eacc9878a4179e40aae35b6237970205197948c17a70a13c1a4ac7ff9804682b0
SSDEEP 24576:ELJnJiTk3R3waE4JrOsnQ/tbw/2Mkjy6Fr7g0oJ:ELJnJK8R304lPQ/lFTjN4
TLSH
T16D75D03CD2A810E9E477C2B481561756FF32346D2B216ACB29B4D5353F22FE06A79F48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 f50286500d10f9687f4c0a7a73502d237c1dcd12e8a68fed0188a2e9926efa53
MD5 632ef7f241b2fe65dd29b2f49a30f5f3
SHA1 99f7c617ca1c08779c9fdf5f86b2b32ec313e974
SHA512 71a048a3917cb18808cb1b15c038b9559183fdaa1f55c581b4c094446a89859e479e3b758fc49cb80a5b6dc54a8d042fdd4f7be8e715c65b71f7ce212b39d066
SSDEEP 24576:OA9GqCceDQncA/BmlvLto8cFVr9og9P/Z6panQ/tbw/2Mkjy6Fr7g0oO:Z9GqCzDScAZmlvTcFg8Ph6QQ/lFTjN4
TLSH
T159955C15F7EA5298E8B3CAF1C96294159B337C409B34F7DF0A80CA6A1E32BD1D539B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 c8cfaf4e3097ba977bac4e8236c76f57316082810032ad5129b9eac6ed747d45
MD5 e7c22d4df35f9903253696a299a862a9
SHA1 2535ee551b5fa174610b3b38d4f880de692fde13
SHA512 9ce4cf460ff7fb048d0aa9f65882e5753408ad964d2306714718918893798b6a330f0dfa0363c9339c15f082108be04e921261e54e20aa35c58ed805efa051bd
SSDEEP 24576:clYJeXm5jUuEinQ/tbw/2Mkjy6Fr7g0oo:clYJeXmRUuEiQ/lFTjN4
TLSH
T19755126D366CB0E6E22F41B988924545E372B4A1275163EF52D0C27D8F7B7E41E39F80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.4MB
SHA256 93bc3d3ac3729c06c0be44c7f77dadd53c7d9397bc364d791ec34e6b5b8fe257
MD5 56ef46dfa82e44530dcb1721eee14c25
SHA1 2bc3a0b127f7adebffd09526ac8a20aad1cec88b
SHA512 a64d98b432ffb935ac77bdff80567904b47d1dc377627534b4d72ef26c4611e6df83a03b1274914238183adedc9d9126f0288a2213f97d7e922234a1c07e6da9
SSDEEP 12288:FFu6kyfGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWz:FUty/nQ/tbw/2Mkjy6Fr7g0oz
TLSH
T10A65121833A4B4D9FA7A0678CDA381819F3A7C50AF5093DF66C0E23E5E3A3D46975B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.3MB
SHA256 621214f563e0d7065c1c134298b1b3c434b64c1616eeb4c7af053bd7924af05c
MD5 48907a01b12d865e09e93b9b3b03b078
SHA1 cd0b4302b847f89e12182e2b39eccec15d0e2d87
SHA512 0f00a908378ff2759251e0afd0b7d4a8e16bda6aded188c113553a8c1ecda017adea52dfef26647e70e5629f5bd43f2b550cb015fa05210218e9e2aa369ff235
SSDEEP 12288:+PSGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWb:KSnQ/tbw/2Mkjy6Fr7g0ob
TLSH
T19755236C2664F49BFE2706F448524142A73B1ED17F91A7EF3684A139CB7D3D01AB6B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 21eba599cedc54c236aca15b9a037eb389e40bb0ba8256b3b6388e830c8003c7
MD5 0fce5712fe9cf52c959b340beab0c690
SHA1 7c5f3409d60894bd8c30e133126e4c5d639c3a5d
SHA512 f157f2dc4812fcbff7f70fa721d78c37de833c9185af40286f3bfed6ae69615bbc06e9b52abfec041fdd5ce1e25b8d45494618c2b2c1a6e8181d4192f8ceff1e
SSDEEP 24576:OC+TyQIu93VAumZr7jmFnQ/tbw/2Mkjy6Fr7g0ob:O/TfIq+YFQ/lFTjN4
TLSH
T129558C1DA7E91DCAE276C675C8A34493E633B872137186CF2044C07D49AEEE8AE74F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 a5f03da15e5bcce9cd5665bf8bda5216416088eab5c46a70fe2d39648c77bf38
MD5 81b29cf8e3ae398bdde64e25b60962d2
SHA1 7bd1381130aed7eb77a4cf9c8970c0feb9321dde
SHA512 1abc3d71d8ca043e0005e1a7d816364b0f38efb9c517febfc503d0fbe85f6d4149405d79585433903ac9ebbb2b5485d7b09d58df87625cbcafb9165f88ebefce
SSDEEP 12288:PcyrWOstaa3kcs+GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW8:2LQikZ+nQ/tbw/2Mkjy6Fr7g0o8
TLSH
T1C065F11FB3AA10A6E56B827C88824142F7B37471575263DF1290C77D4BBB2E97D38B81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 4a2cc7fac164552e28b1eed57f9a6cbe84171d43adfccd3e3cf59b0188f08b03
MD5 34c65cdaa1424ada61752bdf0a83b996
SHA1 bf8f574e95227b4158d2713ab0f504e7da7c7e95
SHA512 2f3519fd5593719ce198cf0a57f886b3c9dc990755080f0e33848265b15955d6f3f16233f4ef96cd5368b6e02270217057b021feef7f52fc3da6bdbde8f4a5ff
SSDEEP 49152:kpJFwrPpGyqWo6cbT2TZ8maJO35NPHXogsS7Q78ZGAvL9vnF35LWAP/Q/lFTjN4:lpC7b4+80GTkLLm
TLSH
T1B5A57C3DE2B810ADD9AAC375C5461665EE71382E3F2015DB01B0C578BF1AEF19A38F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\system32\AgentService.exe
Size 1.7MB
SHA256 bc427d5181f9a51c5a1d0df9bc139fff8f4b56b1196b338952ad7a763e575200
MD5 cea615767dfec131a703f39889ce10e1
SHA1 083cfdbb2a50d70cd5d5aef07215688c42787a7c
SHA512 9dd190e8571fc18ca0b1bffb24c5619a40be3c77366f17bb0dfba815e9846e7315d3fdead92e442944d455f112ee19c2fb3c5da7e0a991dd9b58bb823200f84b
SSDEEP 24576:G8RMyNoSFw1d+rC4vrmRcGPiQEaaPnMRTCEnQ/tbw/2Mkjy6Fr7g0oe:/RZwQCyiHiQEaaPnMdQ/lFTjN4
TLSH
T12185B01E62DC46A5E0BAD2B8CDA74407E6B23816573197CF1290C27D1F37EE45E3AB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 c99c23e04ee59b8ea5f13675e4df1813581984db7f4afce9a1307dc46ca6d31d
MD5 b6165292d5f29aa5532c6c31e884b5a5
SHA1 ca267104ad5c47fbd30fc040ebd3f6c2aaad3429
SHA512 17fd8db0e66635b005017a8f2c5aa803dc34a519f3a57eae3a8f217ebe202a13b622f5e374a990a5e0702e7cffb152afac7ffcf9b3ee1f3407c0864ab16ed644
SSDEEP 24576:fSAwJPE1IDAo+4Kt+l44135UQHnQ/tbw/2Mkjy6Fr7g0oO:fqPCIo4Kol4/QHQ/lFTjN4
TLSH
T12555B02AA7F956E5E17AC7B4D663C501FB733822133163CF5290813E0E26AE85E79F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.6MB
SHA256 3b1375d958089fc9142b397a2f4118ddc18a4eab289609b520221f725432e217
MD5 8157f16ba4495c5a1ac239c8f4f7bccc
SHA1 8339c1e9d5e3bf9326cd5d95f880479f81aab52c
SHA512 3b8fe6a6376a972a3916d25f8fb0f4eef61a6eb605df74c2f12fd5594090e0fcf4ad79c92dc729c502dfa6d1d7ad0c2ac37023e6564bc7fa7ac8477ceab7fac9
SSDEEP 24576:YyLXPLcf94tXnQ/tbw/2Mkjy6Fr7g0o3:Yy7PoetXQ/lFTjN4
TLSH
T1DB75E03EE66C08E5E53AC27CC6A38506F672389D037166CB1A9491791F7BFE46939B00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StructuredQuerySchema.bin

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin
Size 414KB
SHA256 e67e330837a6b2f6d5f76815e7235a512b54b1c90f2ad62a3e9d142ae6939c8d
MD5 16b9618962f5623ca791a1366eee5708
SHA1 f0d257511952f075b2a0ec7d8e8730c3e464461a
SHA512 18e1d5a105b87fc72df94645685f5a8d3f593df2d3a9b8652b3b4a4ceaf92d3c7a67b0c08847186149dd608428cae8f1b3bc844bc7aacfc9e3219da823ca2fe2
SSDEEP 12288:vMUC7+vlk3n61mSkplXZ5RwmF9n4w/TSD:vXhl6V/i
TLSH
T124945F36BF88CB22C59A15748897C01A2E30A7C49E04CF6B73DC513CFA576685FBA359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.4MB
SHA256 b3fa62f4e8d91847468251bf29e047a64dad109ababff87e4b0ed34266897ee4
MD5 bdb321468126f62fe751e931b13dc93c
SHA1 d17dbc0ac300c587cd10bb37f3b5bfc36d293241
SHA512 c11b057afa8fe478634b6f318b78b881f06c6b1450105a9a4125b1a4617177497f050c3ef6990d88de958e408fc156c2db6bce8068469218c702b518f01c0466
SSDEEP 12288:f9lyvj3IkxjbBzuGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWQ:fWv8qjpunQ/tbw/2Mkjy6Fr7g0oQ
TLSH
T11A65125E66A4B4D9F53A0274D863811682727CB227A4ABEF76C8D57E4B393C0953FF00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/220-114-0x0000000000990000-0x00000000009F6000-memory.dmp

Download

memory/220-109-0x0000000000990000-0x00000000009F6000-memory.dmp

Download

memory/220-151-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/464-65-0x00000000018F0000-0x0000000001950000-memory.dmp

Download

memory/464-74-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/464-76-0x00000000018F0000-0x0000000001950000-memory.dmp

Download

memory/464-81-0x00000000015C0000-0x000000000175A000-memory.dmp

Download

memory/464-82-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/464-71-0x00000000018F0000-0x0000000001950000-memory.dmp

Download

memory/788-224-0x0000000140000000-0x0000000140175000-memory.dmp

Download

memory/788-102-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/788-96-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/1700-125-0x0000000000550000-0x00000000005B0000-memory.dmp

Download

memory/1700-155-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/1700-131-0x0000000000550000-0x00000000005B0000-memory.dmp

Download

memory/1748-133-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/1748-92-0x0000000000570000-0x00000000005D0000-memory.dmp

Download

memory/1748-86-0x0000000000570000-0x00000000005D0000-memory.dmp

Download

memory/1752-51-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1752-43-0x0000000000E70000-0x0000000000ED0000-memory.dmp

Download

memory/1752-416-0x0000000000740000-0x00000000008DA000-memory.dmp

Download

memory/1752-413-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1752-49-0x0000000000E70000-0x0000000000ED0000-memory.dmp

Download

memory/1776-251-0x0000000002C30000-0x0000000002C90000-memory.dmp

Download

memory/1776-0-0x0000000140000000-0x00000001402CE000-memory.dmp

Download

memory/1776-1-0x00000000020F0000-0x0000000002150000-memory.dmp

Download

memory/1776-237-0x0000000002C30000-0x0000000002C90000-memory.dmp

Download

memory/1776-247-0x00000000028B0000-0x0000000002916000-memory.dmp

Download

memory/1776-246-0x00000000020F0000-0x0000000002150000-memory.dmp

Download

memory/1776-17-0x00000000028B0000-0x0000000002916000-memory.dmp

Download

memory/1776-259-0x0000000002930000-0x000000000293C000-memory.dmp

Download

memory/1776-16-0x00000000020F0000-0x0000000002150000-memory.dmp

Download

memory/1776-244-0x0000000002C30000-0x0000000002C90000-memory.dmp

Download

memory/1776-260-0x0000000140000000-0x00000001402CE000-memory.dmp

Download

memory/1776-9-0x00000000028B0000-0x0000000002916000-memory.dmp

Download

memory/1776-79-0x0000000140000000-0x00000001402CE000-memory.dmp

Download

memory/1904-225-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/1904-138-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/1904-144-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/2068-421-0x0000000140000000-0x000000014016D000-memory.dmp

Download

memory/2068-222-0x0000000140000000-0x000000014016D000-memory.dmp

Download

memory/2080-42-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/2080-38-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/2080-39-0x0000000000970000-0x0000000000B0A000-memory.dmp

Download

memory/2392-153-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/2392-415-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/2396-154-0x0000000140000000-0x0000000140143000-memory.dmp

Download

memory/3100-272-0x0000000140000000-0x0000000140155000-memory.dmp

Download

memory/3100-22-0x0000000140000000-0x0000000140155000-memory.dmp

Download

memory/3168-420-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/3168-220-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/3212-28-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/3212-341-0x0000000140000000-0x0000000140155000-memory.dmp

Download

memory/3212-26-0x0000000140000000-0x0000000140155000-memory.dmp

Download

memory/3212-33-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/3240-152-0x0000000140000000-0x0000000140141000-memory.dmp

Download

memory/3396-80-0x0000000140000000-0x0000000140165000-memory.dmp

Download

memory/3688-418-0x00000000006E0000-0x000000000087A000-memory.dmp

Download

memory/3688-221-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/3752-60-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3752-54-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/3752-61-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/3752-414-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3752-417-0x00000000014F0000-0x000000000168A000-memory.dmp

Download

memory/3836-158-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/4484-448-0x000001728EA20000-0x000001728EA30000-memory.dmp

Download

memory/4484-426-0x000001728EA20000-0x000001728EA30000-memory.dmp

Download

memory/4484-440-0x000001728EA20000-0x000001728EA30000-memory.dmp

Download

memory/4484-439-0x000001728EA20000-0x000001728EA30000-memory.dmp

Download

memory/4484-441-0x000001728EA20000-0x000001728EA30000-memory.dmp

Download

memory/4484-437-0x000001728EA20000-0x000001728EA30000-memory.dmp

Download

memory/4484-436-0x000001728EA20000-0x000001728EA30000-memory.dmp

Download

memory/4484-435-0x000001728EA20000-0x000001728EA30000-memory.dmp

Download

memory/4484-434-0x000001728EA20000-0x000001728EA30000-memory.dmp

Download

memory/4484-433-0x000001728EA20000-0x000001728EA30000-memory.dmp

Download

memory/4484-443-0x000001728EA20000-0x000001728EA30000-memory.dmp

Download

memory/4484-442-0x000001728EA20000-0x000001728EA30000-memory.dmp

Download

memory/4484-444-0x000001728EA20000-0x000001728EA30000-memory.dmp

Download

memory/4484-423-0x000001728EA20000-0x000001728EA30000-memory.dmp

Download

memory/4484-447-0x000001728EA20000-0x000001728EA30000-memory.dmp

Download

memory/4484-446-0x000001728EA20000-0x000001728EA30000-memory.dmp

Download

memory/4484-445-0x000001728EA20000-0x000001728EA30000-memory.dmp

Download

memory/4484-424-0x000001728EA20000-0x000001728EA30000-memory.dmp

Download

memory/4484-425-0x000001728EA20000-0x000001728EA30000-memory.dmp

Download

memory/4484-432-0x000001728EA20000-0x000001728EA30000-memory.dmp

Download

memory/4484-431-0x000001728EA20000-0x000001728EA30000-memory.dmp

Download

memory/4484-430-0x000001728EA20000-0x000001728EA30000-memory.dmp

Download

memory/4484-429-0x000001728EA20000-0x000001728EA30000-memory.dmp

Download

memory/4484-428-0x000001728EA20000-0x000001728EA30000-memory.dmp

Download

memory/4484-427-0x000001728EA20000-0x000001728EA30000-memory.dmp

Download

memory/4484-438-0x000001728EA20000-0x000001728EA30000-memory.dmp

Download

memory/4788-226-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4940-156-0x0000000140000000-0x000000014018E000-memory.dmp

Download

memory/5104-223-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5104-231-0x000000000A520000-0x000000000A528000-memory.dmp

Download

memory/5104-185-0x0000000001C30000-0x0000000001C40000-memory.dmp

Download

memory/5104-201-0x0000000001EE0000-0x0000000001EF0000-memory.dmp

Download

memory/5104-169-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/5104-175-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/5104-419-0x000000000B800000-0x000000000B99A000-memory.dmp

Download

memory/5104-422-0x0000000140000000-0x0000000140172000-memory.dmp

Download