9870bbf4b352de578e218bc92f2e7876be39fd8806c2767fce80ff3d526ca0b9

Analysis

max time kernel
150s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/04/2026, 13:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-23_216db6630e4d0949ed2db8cbd103e121_icedid_njrat_ryuk.exe
Size 7.2MB
Sample260423-qpsceaey21
SHA256 9870bbf4b352de578e218bc92f2e7876be39fd8806c2767fce80ff3d526ca0b9
MD5 216db6630e4d0949ed2db8cbd103e121
SHA1 29e28af2e9e1756427104a99ae5c9131e228e0a3
SHA512 fa2639caabb0679b46d3cad5af986dd4807b8bccda56c80007cc1f0dfe547503cf9117fb34359f5db4fc377a8d0fb38cc8c29ccf86808327f87afce3f06ba1b0
SSDEEP 98304:n/SdSHnHJP/D88S6p0WgmoLMJTq5SSDntdDpbRZy:ZXhp3HTwSintdDFRo
TLSH
T1E9768D23F3A541D9E0AED278976A9332A972BC854F30B2DF065036651E75FE06B3C721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery ransomware spyware stealer trojan

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
660	alg.exe
4724	DiagnosticsHub.StandardCollector.Service.exe
1276	fxssvc.exe
1572	elevation_service.exe
1256	elevation_service.exe
4316	maintenanceservice.exe
5840	msdtc.exe
5512	OSE.EXE
2236	PerceptionSimulationService.exe
2424	perfhost.exe
5104	locator.exe
932	SensorDataService.exe
1588	snmptrap.exe
5148	spectrum.exe
6012	ssh-agent.exe
3468	TieringEngineService.exe
2268	AgentService.exe
2184	vds.exe
1828	vssvc.exe
1660	wbengine.exe
2248	WmiApSrv.exe
6056	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-04-23_216db6630e4d0949ed2db8cbd103e121_icedid_njrat_ryuk.exe

Drops file in System32 directory 32 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-04-23_216db6630e4d0949ed2db8cbd103e121_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-04-23_216db6630e4d0949ed2db8cbd103e121_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-04-23_216db6630e4d0949ed2db8cbd103e121_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-04-23_216db6630e4d0949ed2db8cbd103e121_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-04-23_216db6630e4d0949ed2db8cbd103e121_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-04-23_216db6630e4d0949ed2db8cbd103e121_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-04-23_216db6630e4d0949ed2db8cbd103e121_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-04-23_216db6630e4d0949ed2db8cbd103e121_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-04-23_216db6630e4d0949ed2db8cbd103e121_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-04-23_216db6630e4d0949ed2db8cbd103e121_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-04-23_216db6630e4d0949ed2db8cbd103e121_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-04-23_216db6630e4d0949ed2db8cbd103e121_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-04-23_216db6630e4d0949ed2db8cbd103e121_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-04-23_216db6630e4d0949ed2db8cbd103e121_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-04-23_216db6630e4d0949ed2db8cbd103e121_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-04-23_216db6630e4d0949ed2db8cbd103e121_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-04-23_216db6630e4d0949ed2db8cbd103e121_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-04-23_216db6630e4d0949ed2db8cbd103e121_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-04-23_216db6630e4d0949ed2db8cbd103e121_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-04-23_216db6630e4d0949ed2db8cbd103e121_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-04-23_216db6630e4d0949ed2db8cbd103e121_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\facce933fd664f35.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-04-23_216db6630e4d0949ed2db8cbd103e121_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-04-23_216db6630e4d0949ed2db8cbd103e121_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-04-23_216db6630e4d0949ed2db8cbd103e121_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-04-23_216db6630e4d0949ed2db8cbd103e121_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-04-23_216db6630e4d0949ed2db8cbd103e121_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	2026-04-23_216db6630e4d0949ed2db8cbd103e121_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-04-23_216db6630e4d0949ed2db8cbd103e121_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-04-23_216db6630e4d0949ed2db8cbd103e121_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-04-23_216db6630e4d0949ed2db8cbd103e121_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2026-04-23_216db6630e4d0949ed2db8cbd103e121_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	2026-04-23_216db6630e4d0949ed2db8cbd103e121_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-04-23_216db6630e4d0949ed2db8cbd103e121_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-04-23_216db6630e4d0949ed2db8cbd103e121_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-04-23_216db6630e4d0949ed2db8cbd103e121_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-04-23_216db6630e4d0949ed2db8cbd103e121_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-04-23_216db6630e4d0949ed2db8cbd103e121_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-04-23_216db6630e4d0949ed2db8cbd103e121_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2026-04-23_216db6630e4d0949ed2db8cbd103e121_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	2026-04-23_216db6630e4d0949ed2db8cbd103e121_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	2026-04-23_216db6630e4d0949ed2db8cbd103e121_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-04-23_216db6630e4d0949ed2db8cbd103e121_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	2026-04-23_216db6630e4d0949ed2db8cbd103e121_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	2026-04-23_216db6630e4d0949ed2db8cbd103e121_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	2026-04-23_216db6630e4d0949ed2db8cbd103e121_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	2026-04-23_216db6630e4d0949ed2db8cbd103e121_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-04-23_216db6630e4d0949ed2db8cbd103e121_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-04-23_216db6630e4d0949ed2db8cbd103e121_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	2026-04-23_216db6630e4d0949ed2db8cbd103e121_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-04-23_216db6630e4d0949ed2db8cbd103e121_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-04-23_216db6630e4d0949ed2db8cbd103e121_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	2026-04-23_216db6630e4d0949ed2db8cbd103e121_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	2026-04-23_216db6630e4d0949ed2db8cbd103e121_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	2026-04-23_216db6630e4d0949ed2db8cbd103e121_icedid_njrat_ryuk.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-04-23_216db6630e4d0949ed2db8cbd103e121_icedid_njrat_ryuk.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d8e06cea47d3dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cde777eb47d3dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ef4ad7f347d3dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f3ec1aeb47d3dc01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000038d864eb47d3dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002eb13eeb47d3dc01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000019ff4ceb47d3dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b6cb3dec47d3dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe

Suspicious behavior: EnumeratesProcesses 46 IoCs

pid	Process
4516	2026-04-23_216db6630e4d0949ed2db8cbd103e121_icedid_njrat_ryuk.exe
4516	2026-04-23_216db6630e4d0949ed2db8cbd103e121_icedid_njrat_ryuk.exe
4516	2026-04-23_216db6630e4d0949ed2db8cbd103e121_icedid_njrat_ryuk.exe
4516	2026-04-23_216db6630e4d0949ed2db8cbd103e121_icedid_njrat_ryuk.exe
3800	2026-04-23_216db6630e4d0949ed2db8cbd103e121_icedid_njrat_ryuk.exe
3800	2026-04-23_216db6630e4d0949ed2db8cbd103e121_icedid_njrat_ryuk.exe
3800	2026-04-23_216db6630e4d0949ed2db8cbd103e121_icedid_njrat_ryuk.exe
3800	2026-04-23_216db6630e4d0949ed2db8cbd103e121_icedid_njrat_ryuk.exe
3800	2026-04-23_216db6630e4d0949ed2db8cbd103e121_icedid_njrat_ryuk.exe
3800	2026-04-23_216db6630e4d0949ed2db8cbd103e121_icedid_njrat_ryuk.exe
3800	2026-04-23_216db6630e4d0949ed2db8cbd103e121_icedid_njrat_ryuk.exe
3800	2026-04-23_216db6630e4d0949ed2db8cbd103e121_icedid_njrat_ryuk.exe
3800	2026-04-23_216db6630e4d0949ed2db8cbd103e121_icedid_njrat_ryuk.exe
3800	2026-04-23_216db6630e4d0949ed2db8cbd103e121_icedid_njrat_ryuk.exe
3800	2026-04-23_216db6630e4d0949ed2db8cbd103e121_icedid_njrat_ryuk.exe
3800	2026-04-23_216db6630e4d0949ed2db8cbd103e121_icedid_njrat_ryuk.exe
3800	2026-04-23_216db6630e4d0949ed2db8cbd103e121_icedid_njrat_ryuk.exe
3800	2026-04-23_216db6630e4d0949ed2db8cbd103e121_icedid_njrat_ryuk.exe
3800	2026-04-23_216db6630e4d0949ed2db8cbd103e121_icedid_njrat_ryuk.exe
3800	2026-04-23_216db6630e4d0949ed2db8cbd103e121_icedid_njrat_ryuk.exe
3800	2026-04-23_216db6630e4d0949ed2db8cbd103e121_icedid_njrat_ryuk.exe
3800	2026-04-23_216db6630e4d0949ed2db8cbd103e121_icedid_njrat_ryuk.exe
3800	2026-04-23_216db6630e4d0949ed2db8cbd103e121_icedid_njrat_ryuk.exe
3800	2026-04-23_216db6630e4d0949ed2db8cbd103e121_icedid_njrat_ryuk.exe
3800	2026-04-23_216db6630e4d0949ed2db8cbd103e121_icedid_njrat_ryuk.exe
3800	2026-04-23_216db6630e4d0949ed2db8cbd103e121_icedid_njrat_ryuk.exe
3800	2026-04-23_216db6630e4d0949ed2db8cbd103e121_icedid_njrat_ryuk.exe
3800	2026-04-23_216db6630e4d0949ed2db8cbd103e121_icedid_njrat_ryuk.exe
3800	2026-04-23_216db6630e4d0949ed2db8cbd103e121_icedid_njrat_ryuk.exe
3800	2026-04-23_216db6630e4d0949ed2db8cbd103e121_icedid_njrat_ryuk.exe
3800	2026-04-23_216db6630e4d0949ed2db8cbd103e121_icedid_njrat_ryuk.exe
3800	2026-04-23_216db6630e4d0949ed2db8cbd103e121_icedid_njrat_ryuk.exe
3800	2026-04-23_216db6630e4d0949ed2db8cbd103e121_icedid_njrat_ryuk.exe
3800	2026-04-23_216db6630e4d0949ed2db8cbd103e121_icedid_njrat_ryuk.exe
3800	2026-04-23_216db6630e4d0949ed2db8cbd103e121_icedid_njrat_ryuk.exe
3800	2026-04-23_216db6630e4d0949ed2db8cbd103e121_icedid_njrat_ryuk.exe
3800	2026-04-23_216db6630e4d0949ed2db8cbd103e121_icedid_njrat_ryuk.exe
3800	2026-04-23_216db6630e4d0949ed2db8cbd103e121_icedid_njrat_ryuk.exe
3800	2026-04-23_216db6630e4d0949ed2db8cbd103e121_icedid_njrat_ryuk.exe
4724	DiagnosticsHub.StandardCollector.Service.exe
4724	DiagnosticsHub.StandardCollector.Service.exe
4724	DiagnosticsHub.StandardCollector.Service.exe
4724	DiagnosticsHub.StandardCollector.Service.exe
4724	DiagnosticsHub.StandardCollector.Service.exe
4724	DiagnosticsHub.StandardCollector.Service.exe
4724	DiagnosticsHub.StandardCollector.Service.exe

Suspicious use of AdjustPrivilegeToken 43 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4516	2026-04-23_216db6630e4d0949ed2db8cbd103e121_icedid_njrat_ryuk.exe
Token: SeAuditPrivilege	1276	fxssvc.exe
Token: SeRestorePrivilege	3468	TieringEngineService.exe
Token: SeManageVolumePrivilege	3468	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	2268	AgentService.exe
Token: SeBackupPrivilege	1828	vssvc.exe
Token: SeRestorePrivilege	1828	vssvc.exe
Token: SeAuditPrivilege	1828	vssvc.exe
Token: SeBackupPrivilege	1660	wbengine.exe
Token: SeRestorePrivilege	1660	wbengine.exe
Token: SeSecurityPrivilege	1660	wbengine.exe
Token: 33	6056	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	6056	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6056	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6056	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6056	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6056	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6056	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6056	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6056	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6056	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6056	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6056	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6056	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6056	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6056	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6056	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6056	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6056	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6056	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6056	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6056	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6056	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6056	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6056	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6056	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6056	SearchIndexer.exe
Token: SeDebugPrivilege	3800	2026-04-23_216db6630e4d0949ed2db8cbd103e121_icedid_njrat_ryuk.exe
Token: SeDebugPrivilege	3800	2026-04-23_216db6630e4d0949ed2db8cbd103e121_icedid_njrat_ryuk.exe
Token: SeDebugPrivilege	3800	2026-04-23_216db6630e4d0949ed2db8cbd103e121_icedid_njrat_ryuk.exe
Token: SeDebugPrivilege	3800	2026-04-23_216db6630e4d0949ed2db8cbd103e121_icedid_njrat_ryuk.exe
Token: SeDebugPrivilege	3800	2026-04-23_216db6630e4d0949ed2db8cbd103e121_icedid_njrat_ryuk.exe
Token: SeDebugPrivilege	4724	DiagnosticsHub.StandardCollector.Service.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4516 wrote to memory of 3800	4516	2026-04-23_216db6630e4d0949ed2db8cbd103e121_icedid_njrat_ryuk.exe	85
PID 6056 wrote to memory of 5080	6056	SearchIndexer.exe	111
PID 6056 wrote to memory of 5760	6056	SearchIndexer.exe	112

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-04-23_216db6630e4d0949ed2db8cbd103e121_icedid_njrat_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-23_216db6630e4d0949ed2db8cbd103e121_icedid_njrat_ryuk.exe"
1⤵
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4516
- C:\Users\Admin\AppData\Local\Temp\2026-04-23_216db6630e4d0949ed2db8cbd103e121_icedid_njrat_ryuk.exe
  C:\Users\Admin\AppData\Local\Temp\2026-04-23_216db6630e4d0949ed2db8cbd103e121_icedid_njrat_ryuk.exe --crash-handler --database=C:\Users\Admin\AppData\Local\Google\GoogleUpdater\143.0.7482.0\Crashpad --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=143.0.7482.0 --attachment=C:\Users\Admin\AppData\Local\Google\GoogleUpdater\updater.log --initial-client-data=0x2a8,0x2ac,0x2b0,0x2a4,0x2b4,0x1405e8e44,0x1405e8e50,0x1405e8e60
  2⤵
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3800

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:660

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4724

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:4916

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1276

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1572

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1256

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4316

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:5840

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5512

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2236

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2424

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:5104

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:932

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:1588

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:5148

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:6012

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:2252

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3468

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2268

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:2184

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1828

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1660

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:2248

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6056
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5080
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:5760

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 f960a564cb6584b357b1bcfd4423a0fca46a0dfddc609036335c8f3c4e5b1b3e
MD5 ca5424b8a8a0368d1a3e46643dfd7de9
SHA1 ee75897a4b81e0d972ccd93879e64f3b4c09a534
SHA512 7223abb7a7e332d02ad18945902dfdd7ec2fee82fe437cf99677e7a1943b8baec72943b8132ca6b3c06975c1294fe6d272dc71f0524a446c93abe3a2b7d221ef
SSDEEP 49152:3b+632BuPkFKRrdE6ohmstBhuXjfS4LWxn05SW6H8DS52tdDpbRZy:l3q6HjB55SSDntdDpbRZy
TLSH
T1BAD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 a081678803d1adb33a62e6fb59876694e829a662e293fe60a3e9e86571fb2b0e
MD5 dc0dc41f7677331c9a884a5a0d00cc76
SHA1 338367d1229f99a1f09b38769742e410e409f2b6
SHA512 29d3ab81b5786d3e7b37a0216ea10842adeca5090f4d9e7f7437e0d30c184a5bb60c6fd49d295fcb5754d8446ae10423f4340d4ca422d8aab5673c32a803f4eb
SSDEEP 24576:2XYfDtczAt5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:1tc25SW6H8DS52tdDpbRZy
TLSH
T1FC05022873D008FAED6B8279C8B28511EA33B8954760E79B03F495664F337C95E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 61758fc6c785108c116ec95bc231a02d81a8e3e029d8d6cf34531645c1d71d81
MD5 99e5c21c73ef517cd523835392159aa4
SHA1 009a5715f512bcf63b1bc0e09820e1bc88229cbe
SHA512 e3500c93f67780a12da2348de399f427bccec6bebd653eec8e3c5d463918e27306d6e88c519445c0f69d196e770261570f00f8867b5c45719982cf39738296cf
SSDEEP 24576:J0Le5ji0hmxirM85SSiVw6uAX8DS52tpz9ZRzbPmSZyo:JPji0Acz5SW6H8DS52tdDpbRZy
TLSH
T111359E55F6748332D073C0B9C5D2A69EE97130865B308ACB4286D77C7F27AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 c5c943c1c583a04b0fc4e98c8beb4d4200df41ae89bc062377f6e041c91b2824
MD5 f823707a65862fde8e66b86d7ba9afc6
SHA1 7833378cc973b4905485898a37a6f4d131d67219
SHA512 6fd41ee731851e1b1726716e17daa1ed80bb78f968b3104f81e93f322ee4b81cb140d40389390738b0d13bf94b8360c7ec95c6337750d4c355876485fab2b840
SSDEEP 24576:Ta7/ezSC6vUyD/aqgrvWE6q8wyum5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:+/ezSC6vUzPvxHjyX5SW6H8DS52tdDpO
TLSH
T1FC755C15F5788323D0B2D0BAC5D6AA9AFE3230465B3089DB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 eced4bb9fcf6f16bbd0ac76115797839ec07a39659e66c544090368226ee5d1d
MD5 44cb3ec79b0bb652e6c7f4b991ba88e5
SHA1 5991b605b7227fe703d947ace0e66f56ee4d0438
SHA512 40bdfd05c25d848afac9ba3b031f67641f90cd5ba67cbe6d9200e2a28e396113772439fd5d0727ab3463340e255d8ce5de6cb398ce4a4be06445c571a70162ca
SSDEEP 24576:KVbqPb88hv/l+6p5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:KVO88hXl+Q5SW6H8DS52tdDpbRZy
TLSH
T134559E65F6748331D073C0BAC5D3AA9AEE3234425B318ACB0246D76C2E67BD6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 b2d030a8cf20b90bbb4b11dfcd1526bfadef43d9cedad629cea36bf353ee74ab
MD5 8591599a5b5abc4de606647eafc9aa83
SHA1 0e76cb2f92bf31717e02002b832597cee8c75793
SHA512 790c9c8a78d7c2064a1d8794975fadda211a8d6c731eb7c8aaf5185fea520da97b4ea10237c4d1c1e67f3ea57e95e86bfed26cc1496092a2d2eb666bc7d8e0c1
SSDEEP 12288:1RI5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6B:1RI5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T1C2C423C4479030A7E31F0AB3F1FA96D4DA18EDED8408663B4E717687CA3998FC576426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 eb6f33e12a098112ec7e6a0c1a7bde1724a37c331b3377253c4b74530d78d339
MD5 006e7f04fc35e386d7f86feb3c0317a2
SHA1 856372778414a42eeb054731ed3728422e2580a4
SHA512 4af5f1e72acb48e3e7095c4f3c6c91e7bfc87787bebdb2dab4ea92ccf8c0f615586ef9adab2594526ecb32fc5b81140f9722baa90ede6bb0f79c8556cd26b5ff
SSDEEP 24576:5JIUx5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:5JIUx5SW6H8DS52tdDpbRZy
TLSH
T18A05DF7BEE28FCE2C27E8DB956918640D77278704B11A3CBD175820ECE235E54E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 d59e6a3d7865bc965e6010de744f5c9d1cd8027c22ff3f64c51b4b536ef68bd9
MD5 f449844b9a1c9206ce7a9417fcddd5c9
SHA1 adab4f1489cf7ce1e6fba455732b9a4480b1f1df
SHA512 a3c1cb172ad909def0689b5cdc8597071eda1a8edbb22b71a3dee99c8e6536c492f72803ba361424be7d1f26b85267a7e0f3f3a7e64943635012ecbe6869c199
SSDEEP 98304:RQvGAdlCEL8c/yRNw5CW5SSDntdDpbRZy:OvyEYc/y3w8MSintdDFRo
TLSH
T137267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 6a50b6118023c48d7240de84e7ef7989166e48dbacd97d12a2ad13d969d97171
MD5 0fda2de229db00a84c450b289af1fa55
SHA1 edb688336a9113f67413de4213c9a24fd8d1300f
SHA512 135cf77bccf7a52a371fee31e55a53715dfe56b35242b1a777970615893df133968234233513158b01b0550ca57c56547a9a4fb82ea6d9052ba66e662e5cd19f
SSDEEP 24576:3dewsAjj5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:Nljj5SW6H8DS52tdDpbRZy
TLSH
T19C15E030FB74E037C37F0DB21B76C716582CB9604B511AC3E3A89A9E99342D26776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 83f64720fc7d5af8a41954fd3267bf0ca4b7719eb8674db34c8350a9a92dc452
MD5 869fb6cd827f915bf0f3750e47162617
SHA1 0c56161dddc307b13ad9068462e6807ec59eb364
SHA512 f7880f133f7ed9f6983e945de0efa32136059299f99bac1c7ef5856f4867b7931907bf6ca381a8840d451977332a8a0831edf4664ea3f046a67dcebb67a57210
SSDEEP 196608:xUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHNSintdDFRo:xUEtQevvqc2W1cpV2EI32UedDFRo
TLSH
T1E2474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 c1c3d65c0d233852588802af31c886cc7cc5d66815001f1ce49d3035e493ae0d
MD5 2d6e28f546874509d2925552d54e2253
SHA1 7abf31ade100eb00f17b7204e306caec30df876f
SHA512 039cf55c08265d7621aedc0822ec4d8a150096a89e3c989d748702b6f9fc104101fafed19985834d36a8fc6b0973ba4f074f5ec1b4e084acda141cc841c91770
SSDEEP 49152:yCbRquA/m2yL5zLfFiV+XenmE3/zD5SW6H8DS52tdDpbRZy:Xoq2Vjnm65SSDntdDpbRZy
TLSH
T1AED58D0976B8C1E4D1F6C77886A2C647F37178154B34A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 b79139241fc86c7caf1a32e0cf63efa840730390a365b433ba60686267a9ebe6
MD5 861f1dd3e0e893019c1cc5dcc8972cfa
SHA1 db5cda76c1ac030272f2a43014cf16534d203eb7
SHA512 a59814338eb508a424834e8f23fb314481bcb9029b2e0e594f6adf6a1ad5c5889eb4f62875d0e3027ae090f25e9e3034f5d1ffbe94405465682ca66a3436e433
SSDEEP 24576:HAhGLJIFoiwtA5l7S53a5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:HAMyFoiq5q5SW6H8DS52tdDpbRZy
TLSH
T19F35AE80E7F955D4F5B7AAB899B68570EA76BCAA5E30C21F1160D11F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 f3f97a716a2be3b2a09f8e05cbe344b353711e99f64ecd03f94e204abe6b8b40
MD5 82f7eabcd9bd4c4ef600e01faa95602b
SHA1 da291e6987b8445af7074a00ccbecca69bc830e9
SHA512 3219419e7bb0d508cdba63cb10921dc6dd504a5b543c7a531e418908391f4c67002b5b95664710f50bcc92baa972b3c703ece885901bbb3086b4fbc4c13f26e4
SSDEEP 24576:CwuoOW35SSiVw6uAX8DS52tpz9ZRzbPmSZyo:CwDOu5SW6H8DS52tdDpbRZy
TLSH
T16E05F14533A41CFAE96B4239C597C136F7B2B8162A24D72F0760C65B5F37252AD3EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 4899e88719f45d0a22f6da77c684fac907e3da262b84bd6a0f00c0c235fcf69d
MD5 0a7a2bab4cbb8456d4bd05a0daf1ecc5
SHA1 d3536dda8af3c91ab8afffa508801aff849e45c0
SHA512 67ae056dcbcd43b9531996fda1522313253b369ced696cd6d2be4616d5ecd39186f633867e80289ec3b6e7559976f59fb6c87f022fbad38e64e04ac4b07170d6
SSDEEP 12288:hBZ1IyT5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6l:PZuk5SSiVw6uAX8DS52tpz9ZRzbPmSZP
TLSH
T144E4128923E030FBE25B427AD9F58685D771B4A6533443DF0A60429B5F33AC65E3A732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 b847148907ab8d93f3b520ec1e5f6beecfe6afab59c1eabadb41aac5ee779194
MD5 eba0467f15e5a475337227c0e42327d3
SHA1 4f7da8ba092318fdaf8127a0981825aa5ff72fe3
SHA512 97ba6955806a16e36715627905339cc34fb8d418cd2e6b2810b3d6ae6a4b10235b8a969cf1d3a361944f7f3cebca55013d59a625729a41b120fc82a85d1f6652
SSDEEP 98304:OQRQyi36YOcPQLvw2gAf+PN315SSDntdDpbRZy:VQyiKayX+PNXSintdDFRo
TLSH
T1F9667C43F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 59ab5caa21b9c3bc00d946e973605e7b41059690e6ad38973f0ee48dc1ba01ad
MD5 3d5c3c295319810bf3641b395b1f5287
SHA1 8097dd20b2f73195f6a885ae74f7a76ae381fce7
SHA512 7526417392bee375589491a696fa2bdc557b42bec50aabd2b5adeed947e77e095549f56325d1938e70934d7c18f6c8b71cd9d78d6e4e53e1ff37056cd1bf30e6
SSDEEP 98304:LQRQyi36YOcPQLvw2gAf+PN315SSDntdDpbRZy:6QyiKayX+PNXSintdDFRo
TLSH
T191667C43F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 3a1973d90fc7680c086ced588bea39acb50d3ff93c4416b94e296ee45b4d5a81
MD5 a6126d4d36bca7e401d1194e85e04f97
SHA1 6214928e64ffa6e91460856883fe507c0ec67233
SHA512 fc665201c0ebcbebb5406c13355141df3d46187ed716eaade7b57b5ae0fc42fa8ac2d3fe779558440af2f1856a7d64d7c6de4ef9be60195ef9b1f670349a2c3f
SSDEEP 49152:668Qg55nhheWu7PNU3/z5SW6H8DS52tdDpbRZy:othWRc/z5SSDntdDpbRZy
TLSH
T176B54933B2F600A9C44DE1769F4A873196D17C758FE0E3DB8551720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 1c29e94cb438f028101054958a76e11a3b2adaabede7548b1ff1337e35bcc051
MD5 9c1e3827ca9362434e568ba9d089328d
SHA1 7daee26376ac5e14501c091aaa2d3b707123b7bf
SHA512 f639eb8e55fc3b182cf74ca2ed6d8eff2b6226c0d197cc92cb46f0949ad6b3f3d3eef0b117b3a263f1710a414387345ca168f86d55884a909a500a5d40ee9ba8
SSDEEP 98304:Uy5112gYy5azzVvL69nLKnhZI5SSDntdDpbRZy:VLIHmWh4SintdDFRo
TLSH
T1E7167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 15d5f9a1a2e1ed5fef44a40b2e82239bccaed91d7954c397756e6f8c7805cc5c
MD5 b1fe96ac5a1eeb5a94e0e8644ee57340
SHA1 833e438b8b2e436974e17020079f9e328197a0a6
SHA512 5b5bdaf167168144a9a763e13b4ef1c65dbb34619ad592278988f3e170ef5537b6e6e0921aa517c52e2f7141df4b322a2ab4b8cdd2ee53d21f9a34ef3b105658
SSDEEP 49152:SB+taZ3usBWOBr4tEGT0bqx0z+n217aau1gl95SW6H8DS52tdDpbRZy:gu6JmVxd2d95SSDntdDpbRZy
TLSH
T12BD59D13F1DA01E8D05ED479974A9233EA62BC490B34B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 d2513208c532222a221bf2a8f793e1cc5cfa3e250e62ef344f7ce7c3113ad454
MD5 fe1de01542d7170cf91b8acf0b9cb215
SHA1 3d3f956a2d0d8f0132024969acf0daa84c622ab5
SHA512 afbc978df4e405455c915c6dd294572962ed412910bb6a9fed0eb9db6ed64ca2fe8ff8c1c6613e22fa53f558ca0b07b78c1f59dc58ace138f10a4c4c0dc45aa0
SSDEEP 49152:J1hpsNoJpF1A6UU44CwH7R4xR5SW6H8DS52tdDpbRZy:JmifPbR65SSDntdDpbRZy
TLSH
T153B5BE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 c7c046147d5be0072e7f42d04f7130acb55e6c43af9fccf5adb9e2db1190342c
MD5 ac4013ad86653f65d393c07b2c010633
SHA1 9af76921ce8bb56421231ee11ed343b46eb745f9
SHA512 74db6bbe585d759b4355eb6960154ee53f866d906fd7ef0e285d67da25eee34c9050ca43497593db7d1e5b0987adf5461d2cceee07c12c33acfffc3e0902d194
SSDEEP 49152:jSuZQIY0Be2KRRVtOnks6NMHqk5SW6H8DS52tdDpbRZy:B5dKTi61k5SSDntdDpbRZy
TLSH
T19DC5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 555a3089cbd310081cb8ec55215f9c924679d52daf4c7da1670607fbfdb59c00
MD5 1365d7d839ef44aacce9f89fa75410ca
SHA1 2e8cdc1a0b2855a511ed48ddb4eff416b4602522
SHA512 ffde7a89c8f4aea41bb62ab5ec6f5a07c446cafc1c4b03067f5e0f195ebdfce33c5308b0c13449e1fd256a257e9bbea65e1aff28426997e1c3d7c6414b439ee7
SSDEEP 49152:uhtSn8EApI0figngiDn0AP5wt5SW6H8DS52tdDpbRZy:vX2iyphO5SSDntdDpbRZy
TLSH
T15E95BE13F2D900E8D05ED175C7568632EA62BC160B38A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 467299abaecdb63f353cc23ed7496c58e56ecee35b310bb9a00e88015c478a35
MD5 91e805861e33a3a1de9c6581408b2888
SHA1 a0983fe45e8ca56c3ab107f15730b340e440fe45
SHA512 fd1191d20436fba66ddd2780d2009e533e57415b6a9671daa523df7a9e8323a79ad19ab6d8419a01603e31b3a8525b802471a73948bc200967852a226c917e28
SSDEEP 12288:5Q5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6B:5Q5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T12CC423C457A121EBE30E0AF3E1F686D4DA0CA6EFD408623B5F716147CB3598F467A429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 b2657d1a08387708567bdd93e4c7b204478d5e495bb3bead1ac3cfe527f8ff17
MD5 2d8e531acf600ed7514b69167ca8371c
SHA1 b885a5d8874cb52ea5847b8341c79b97b22b1e0c
SHA512 9747c18b66f5742575a41f98cf030f18078b3b928738d0ac4ec0ebda65035a655004ebdb0baa9b1a7136587f44766f464f97ac5e982ebe359e5304cc068bf38b
SSDEEP 12288:XP5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6B:XP5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T1F1C423C457A121EBE30E0AF3E2F686D4D90CA6EF9408623B5F716147CB3598F467A429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 667e4b38096215c6aba782c4fe0d2844ea70ec5342f283ff768ec690f41c8519
MD5 839de29d1a6aff98aa98e4043bcfe865
SHA1 8335423cf95fd3fefebd84b173c155a79033528a
SHA512 fc378dc14f12c08831f9c02f8b4d2ba761e1109bb21a85ab451197c4aba8e73aa72fcb0ef3031b34c8aceec489bd47ce38d42c2eebdb17cd5478add82930f687
SSDEEP 12288:Z55OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6B:Z55SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T1D8C423C457A121EBE30E0AF3E2F686D4D90CA5EFD408623B5E716147CB35D8F867A429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 a8dcf5d4f2a802290dcac3bb82bf6d301f57dce619345be16075ed400ece9dce
MD5 e628683d147ff2caa9063b0eb8a23900
SHA1 dbaa5d2b0e9a608fd229f4066c3b8b152f22ed70
SHA512 012734890e04c9171f4e79e0c8384eedaf929cca1624215f4404c556b66ccbade705ca23462badc60f147a5b238a4f0d517735ecb8c5b8c88dd8c9608ba4a80a
SSDEEP 12288:CV65OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6V:n5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T124D4238417A120E7E61E86F3D1F682D4E628F8EED524637F4F20054B8F31BCB9935A25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 e8a1f2e3d12f47dcbfaa489b4b7004a50c0de9b4414d759be93c70ce97bfe2a6
MD5 5daaa5ccf21695c14b5e4d7e34e803e0
SHA1 8f3fed99305910a8722034f711f25aca8fd442ff
SHA512 5b5954164c7f784eefac958a6bae32af3e54040ba6bef1193b91f567ff14f1a08d76b60fe86fec0f40b6683bddf314f3805d1a871e18bf9bb6d637e57b5999ae
SSDEEP 12288:vS5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6M:vS5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T15EC423C457A121EBE30E0AF3E2F686D4D90CA6EFD408623B5E716147CB35D8F467A429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 a7ff28564440a4147715062aeafb9eede70c984f57d96a2c3e41340ac151b509
MD5 b3e4c6e2348d59a405deb5d9ad517ddb
SHA1 84e12deb19bef7b7c3d9e8550872fa061bbe95d7
SHA512 12c1a55975e6d1a7b76c9a806fc711be84a23117bfed4559bb65368671a0bfee91fe495ff26c5a620506387cd35f5773522c95b6f476f3aff9ef6e228d0da818
SSDEEP 12288:Kr5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6M:Kr5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T1C4C423C457A121EBE30E0AF3E2F686D4DA0CA6EFD408623B5E715147CB3598F467A429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 a8a142fe41953086549b0ebe61884064d0fe21a9720494dbac11383ec6c9bb87
MD5 bf722276b9d79690294ceeea9453c39f
SHA1 186c620c238f557f6c2367fb6e0a5d54f31a7df3
SHA512 caebbcb18204f7fc06fd8e52aaaacf5a41797d95ff6f795e5ca0ab38d131e38785e974897a190571c75613aa05a72f5709091504f491277447df945509b4aff9
SSDEEP 12288:GH5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6A:GH5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T1F0C423C457A121EBE30E06F3E2F686E4DA0CA6EFD408523B5F719147DB3598F4276429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 cfe984cfa930dc30212f75e7786c61ea7c64951ce5c6e71dfb47836af139982c
MD5 2e56c2f5ffa9a08f4074d7f8b0e945fe
SHA1 2b33c23bcc604f83175524755747941ce28de404
SHA512 f374b37fca5f6b9257d442c9c2eb46f0f12598caff94c42c7f95b8d37f1a552395706aff8f8f91331ecd879dbb3d624b7fe5aff44c7c4eb1ad687a56b0205d21
SSDEEP 24576:cZMSzFVSOv5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:cZMSzfb5SW6H8DS52tdDpbRZy
TLSH
T1C0050294B39018FAEC67823EC9658945D6B2BC5A0760C62F07B436675F333920D3EF69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 2e789242d5cdc5668dcd5ee0b41d0e83510bfe345d12d9712565d268f98585e9
MD5 f050cc70f40d2434e04e4f253c5251ba
SHA1 0560f827dc636fa445ca996910088f54155a24f2
SHA512 e2e962bd37aaa95da366a662c1b7d2ab809fee8bc2afb31d0a4f2269d0191d1eb9b1a9e195fc245b6e4ff2284365cfebfe06e621032d0ad38f471a3dcac9fb8f
SSDEEP 12288:aU5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6M:aU5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T1A0C423C457A121EBE30E0AF3E2F686D4DA0CA6EFD408623B5E715147DB35D8F427A429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 3e1010f8b26a9bc7174b49309e145d0c552f7b596cbd212e286669be7b758124
MD5 bbbbad86f29db5efa138b5e2d94089cc
SHA1 912f523be1044bd7fe38fea993117495c5bb1a19
SHA512 b4acd5abed0532b8e357dd64f02ca4c2c9dab5d75013a95d7b5e3f487870007c680964d96cdc9e8f794ef45fd83441279f5482400b4d38298ee4eeae917f0d14
SSDEEP 12288:545OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6M:545SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T1B2C423C457A121EBE30E0AF3E2F686D4DA0CE6EFD408623B5E715147DB3598F427A429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 6f4a4495b5083189d0f21e11457dc647233a3a13f1179788e6627bc087e51d20
MD5 dee8a99a41231879acb0b62d9d9ea9dd
SHA1 b3ab22f4adad0b7c6bd0e076d07fa5b0256f2525
SHA512 07e0bd92e0f7ac1a5c2588b467f6b67f015123725646dbeef8b2a5193f5c739838be0c65079e0b1cc414175eb61fe217832e5b4fa7e2fbe03b57b5f6a2a4cec8
SSDEEP 12288:AyPz5L8T5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6P:xzyT5SSiVw6uAX8DS52tpz9ZRzbPmSZP
TLSH
T173F4024773A130FAD12B8275C8A20A41F775B87647209ABF1BA007775F376D19E3AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 8c739b2233f1344ce16d5bfd37e9d3dbfc4b61b5a1b57410c1ec7b1e28519877
MD5 552256d088092565b4efc625b99a94d3
SHA1 9db59cc0791c31c08d39a7f7c97106e6f8263050
SHA512 275da10adcdf61df7fa6f7df011556d23b8a36325fe3944900a59326acf89d17c8e5c35677f921787926b1654eb1b75b0c756222778f4fcd0ba52127f4b8db32
SSDEEP 12288:3U5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6x:3U5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T1FDC423C457A121EBE30E0AF3E2F686D4D90CE6EFD408623B5E715147DB3598F427A429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 e5fd0bebff5dd493be622206a89d14a161562d8be7297c8fb10ae256ee07311a
MD5 96e5121f9cf54f7b39e4ebe079dafbba
SHA1 a230e46f3aad32e6d1253c7342843f9353abc7e5
SHA512 010b07b2c088c854b6ac5325af15ccb81d1b0b1163d3b44ac0a8b938bee21a20232bc42f9c06eb789aab3171883b3a45415a85713504a007fbe1e392040018fb
SSDEEP 24576:UcP4mcvIjkGOxhKP2l71nNKbrh/8KBM5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:vP4m4IpOO67W8KW5SW6H8DS52tdDpbRo
TLSH
T16465BE2DABDC0096D0BA917886658A49FAB1742E1F3286CB1160933D3F77EE54F35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 f607087e530dd254a84e5a2444f5425dd8192f98f059a2b623694bbd5a6530b8
MD5 d9bcc1339be7638f9a04db7c20eabe18
SHA1 69a4609471c4b4466a9d275efc297772da5c4918
SHA512 e30ea6350290446b5b0e9a4533788fa28c32510dfbaaf600a8c9a1631558b72464508ee3f62789eeb41f81e8f032ce72a6220b1065929fd34cd4b58f5340cf58
SSDEEP 12288:2Nsfk5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6Y:/k5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T19FE4F149D29412EAC01E5276C7A64680F3277C6983E0D3DB5BD0F53E0F366859DFAA13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

updater.log

Path C:\Users\Admin\AppData\Local\Google\GoogleUpdater\updater.log
Size 2KB
SHA256 d1083a66afbcef0bf74b6fde6bc1fa694b7094c456f6a3d2cd8a24671e9f0368
MD5 21667f0188b5e2f6438562409e8e4163
SHA1 6039c695888078948303d8a9d47e002708be22f6
SHA512 3dd84305382ea0f0b0372b6acaaf171da473a6f3e9b819a00974b6f9afe9d5da5f089508dd06a203a52beda2ce5f170f46a5ea4ce5ed0053e5127a3db67e7d2b
TLSH
T15E410FF233C7C43B9010ADAB2D60515F93550A029B87612576CDD52CF0CB96AFFEE20A
MD5 SHA1 SHA512 TLSH

Submit Download

facce933fd664f35.bin

Path C:\Users\Admin\AppData\Roaming\facce933fd664f35.bin
Size 12KB
SHA256 e5f76e0c87bb7a73252dfa635cdf60ccb30b98b48600ded2192252dfb78d967c
MD5 1ae76431c30dcc432eb507753888f784
SHA1 749709fe9b43649f471a685b6385decb514e0d12
SHA512 a6d521af6ff63fdebd1be683e12b18566887d25a08fbbe184be01a9cc5911522901c75805fb8e8f0f619228812846247c6c9ded343b0f810d61163f325a1c205
SSDEEP 192:KqDXe+4Z67/Uksma2I5+Vk4RxD3t73zYe9DfeZ5n0kLl5lx2t6Yoe0OQq2/1U1:a+Pky8+nxt7EeQZ5nL572tQO9CU1
TLSH
T11D42C039BB2A4453F0C7E60CE1B952588F4AF404D525FF0C8AED119D23BEC7A196281B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 4fe6ff7e27ff8deac15095ec19ddf551f29f531eff4988f7cf436cd174bc35fb
MD5 b3397b95c5eaa7dd9001ca01ac58c021
SHA1 c4b726f9fafc461828f9fa9c0c3551ef597402bc
SHA512 bde56e9de0e3c128a7ee0f80f013671e03eff10c3b68e25b9bee82422119814f82ad7909927236491608cc6169cd58774f03f81a6a32116867046100fee904ad
SSDEEP 12288:HE5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6t:HE5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T196D4238453D46597F22E1BF3A1F6C2B4E60CF6BE8904913BAD6052478B34DCBCD3652A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 db3facea35ecc8322a3d46fa8bf4747b84e71e19a27c5dec3df1b2ed272bd86e
MD5 3a270ef55516833d7228f71416ed0530
SHA1 fd28f0f4cb7dbcd39a7273848b12b254bd5bbbf8
SHA512 b04a1f5b0a589da4e3430c46dfcc3d3b84eec6bc9c21852ce877e06340c0c9f66ca27d7f54a4171079e4572284574b335885febe6d8dfc54689802a858b965d8
SSDEEP 49152:ka0h2GEkuAe73q3pp46zwwQS5SW6H8DS52tdDpbRZy:ka0hNYG4Jw75SSDntdDpbRZy
TLSH
T1DC85AF1D67EC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37DE84E3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 659KB
SHA256 269e88b096f23c6ddf988e9c514122a903734bc8bc1ffe6cd23d0e1e5802cdb0
MD5 3b1a0b883789e5586dc2e1acaf3fbb8a
SHA1 a991af4ab1c73ce6992a283b640514e7dbfe1649
SHA512 db7a497c22f132e2d228fd22f57557f4d9c769bb20982bcb3045d0b260208dc4d8303f8fac6080dcbf40cc8300e0362741a964aad09b845697a1a2dd42922bd2
SSDEEP 12288:AhbHjfXf5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6L:AhbHjPf5SSiVw6uAX8DS52tpz9ZRzbP/
TLSH
T1F2E412AD13AC20DBF13692BE91A68646D730B86A071093FF1BD1827A4F37ED94D35E11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 69d666b1886354b6c23446ff0c6b9e70a4d55526acb63b23d8a1b16d4fbf8727
MD5 5c2c8e1fdc67a2ee57cdf5b6de47947c
SHA1 c8625f92baf21d108f07ec8bc42539c14b157acb
SHA512 0ab72d02f1a297bdbc43b9f13abbce523b0a98c9fd5737393ac6f0c51d535bbfe282acc169e4bf2b5359e3dca828285f0ce8f9ad4992b389ce38da5ebc49d85a
SSDEEP 24576:F3YgnJcRTk4yti+R5dBR/35SSiVw6uAX8DS52tpz9ZRzbPmSZyo:FIgnaTk46pBR/35SW6H8DS52tdDpbRZy
TLSH
T17E45BF2DF3B910B9D8AAD236450147B5FB71782D1F209ACB0170C538AF1AEE85E39F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 578KB
SHA256 18bd42a60f28099e021257dc2fe8becc2fe7a957bf8bf34aa8668fc34e5704b8
MD5 5b4eaf94febb1c8dcfc9e3b9f251fdb1
SHA1 ff3a503ef339b4bec1a5702e2480bd385da9a3a7
SHA512 3da9a67d7efdc3dfc001329d7876b06908c8ec25a450d00358a5516e9e8e41b79cd9cab24a9202e6dbdff38c586706ff0260892fe91da55feeeea6ea63d860ef
SSDEEP 12288:Ro5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6a:Ro5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T1C4C423C4539135EBE20E0AF3E1F686E4D60CB6AE861822FB5D71A147CB35DCF8636425
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 940KB
SHA256 141cfa785835c01b24dd4936a0bc55a317165e5441bce564b81aad7667aeb8dc
MD5 b81660b32397f2c494eca1c432767275
SHA1 9e378894ab3243e38649e2d3f75587480ad7c603
SHA512 7460f6015e34344f7738cb491b8c801552a6a89be22da65a171a5c23965a3a4c88e8ef52ad627e6debb22a57798d834599f0a58435fe9a08e62ca688220a9be5
SSDEEP 24576:JpL3UTt5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:JpL3Ux5SW6H8DS52tdDpbRZy
TLSH
T132250154F7A400FAE96B813DC5B68616D272B49D0324E7EF07A84B561F237E64E3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 671KB
SHA256 ccdd6896f08c72a37da471bd20cb07ee56ef9916de310ed615623f15c6b8e8c3
MD5 8a61ec33e9c58dc03efd16e72b62ab7e
SHA1 5ce5009080e52f69552677c519beaaa0b0675301
SHA512 d8bd94a9e90b413fa9f61566c32e0d58830384a9f27821f469aada10200a1492d652e8ce01ec5967c70f866af69f760865c635225a088bb9b5a4ea465cbbed80
SSDEEP 12288:WpFtpOR5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6x:cOR5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T13EE4025933EC20E6E13A917E95A2834DD771B466071053FF0AE081AF4F77EE95C3AA21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 3937fafd8f666a62231091945eefe344aa13f0462c06963c7217211b1a9ca7c5
MD5 23a093a06bf0c375218f0164a3f40814
SHA1 ce0c759ff1f5c0ffa1c2060b0925eff5df78f833
SHA512 754de21ec8ef1539b42fcfd98de34e42890185a6736ef5002101e2a18df6aca9c351c0ce59bf366ffec7eef57314995af532689dd1226bba3067654f1ec12d31
SSDEEP 24576:j7NM9YqZqmWMUkPjZM48Mv6bEhsU5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:j7cBWMpPjN8DbEh/5SW6H8DS52tdDpbK
TLSH
T1B865AE2E6BAC81E5D477D13DC9E28205F6B1B4611B318ADF1162833E6F37AE44E36721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 ab8cd9d1273b89131274978ff7bdb34cc343ed1f0c33fdcafe9aeea412ee3a7f
MD5 40e9beda29efe62761423c0e7d26689a
SHA1 ba8b49c87607f6e47ec838dba7945ad5d3b9af4f
SHA512 e4f458ad19bce33da1e9792aabaa36183ca4c1d53bad057006b828b4aff354a6cea442781b18aacf064626ed77e47ef084dedcf780ec0c7569622523d69d6bc5
SSDEEP 49152:ZF2YuHNETovAvNYf8km05SW6H8DS52tdDpbRZy:M6BCf8kR5SSDntdDpbRZy
TLSH
T1E0858E6927ED80A4E0BBD27D45B7D246FAB2B8511B3056CF0255862E1F33AF44D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 1062802f768bbb594368339443cba31e6d75d3cc26662f01ad2a2ba143f51865
MD5 a9da7da335d192372e6394d8ab1ce317
SHA1 b67e1091d87ab2f1b186a262e385f4354c9c8e92
SHA512 9e32943081377786f466cbd09df21d8670ad92f286d9fd3e42a9e5d13bc43238e5132ccfce7f1bb7719e75db1bb8f4810e2ed20ee4b67aa97ac4001c12c9b9b9
SSDEEP 24576:NAFs06+Omlf3NXEbToV5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:CFs060lVXuy5SW6H8DS52tdDpbRZy
TLSH
T1AD65AF2F62EC00D5D07ED17E8997C91AF6B1746707255ACB0260863E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 885KB
SHA256 f8f1a3ff24643a02a88fbb3a2a719d7b1de48f4565214fa60543eabef8b55855
MD5 b5160bd6eb69a3b02ca22a2fbfc79ef8
SHA1 d9a0086836a67d71db42b9f7c074747ad8809481
SHA512 4bf82dc8b47811559a9d91598c213dc3feb000741c80ec2949cbaa34fbdd7f5d29413a8722f7f0abe0e5a2405c627aec83f36860de0f7ef606b6cf72407577e1
SSDEEP 24576:cJnJ5D3WXy5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:cJnJ5DGXy5SW6H8DS52tdDpbRZy
TLSH
T11315E02CD2A810E9D0B7C2B4819A1795FF72347D2F216ACB28B4D5357F12EE09A79F14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 1665d396d274712e36f28c666fa4220e77e256ce2327f8fb38dc1c8d2eb5ee77
MD5 306b8e0fabb1494ce1b861f5b8a06c78
SHA1 feba87fb5fe02b30e88d4c7aad21c4cd4ba6d9e8
SHA512 a0972cfd033fefa37d202b14137a0b3a8a0aa4ec88468dd2a53146749ac482c16a5aca66656f61bd1421b923f5fe7b56a1dc3f8d66a27802530a2f3ab4cfee4c
SSDEEP 49152:Eg06DIKdwc+eQnSt65aVQ5SW6H8DS52tdDpbRZy:1+5SSDntdDpbRZy
TLSH
T111956C05B7EA5295E8B3CAB1C962A1169B327C509B34F7DF0AC0C92E1E33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 661KB
SHA256 65353d3c20fb044d659ba14a6c3829682f5bcd036b8e7d15ebadaa674f39dd67
MD5 ee6b8e6c8ef83e26c3653cc73baef16e
SHA1 f673621114dc825097517079d91acc01e8db43dd
SHA512 b65bb12f31a49a6825a8eb07b574f1dacc44ada3df41f41d28214b16ba6d2b51eec026dd18a321408daf0ca79246453337f395b9725b8a3498218b735ffd525e
SSDEEP 12288:eEP3Rna5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6F:9na5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T13DE4129C27AC70EBD12A917A91A18644D371F0B5571027FF0AA1C23F8F37AEA5D39A10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 712KB
SHA256 ea47f7fe3958a08d45f67d9df2c5cb08bbaf81bfc81a3cbfe589c02130489b9a
MD5 784ed8a8a350aa00fe4207b9f34f9071
SHA1 4525b541e85620755692a7527bc2edfb31484e84
SHA512 d99d8f749196c58a767a36f67febbbdf3387595d80dc4068fc20131d87a2f66c3911dad0841d0c17f7d9c0a1697c70849c27371b258384ea50f715aa0d00ed71
SSDEEP 12288:CjkyP5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6h:CIyP5SSiVw6uAX8DS52tpz9ZRzbPmSZP
TLSH
T19EF41244239420D7E66E0676D6B382E0CA38FC705B1053FF59A0E22F9F36BD69935B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 584KB
SHA256 a30ef46f44f2883a69e6f6e7a2e8ad4f0be47c8d5340a49ce7d7430277c04064
MD5 195d3676e83dfc112bdcf13d9abe2d80
SHA1 db38da12f7d0213081500d6e48a48cfa4608a901
SHA512 c40f3bd68b98c4377d5fb4a6c668ba2fc34e70f68486fbe2497828dab93208d8e60b7dfec7efb8c28f4eb2cab2fafffe2d1e8f03e5ecee44e88b90305f1433bf
SSDEEP 12288:myB5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6O:PB5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T12CD4238813A131ABE60E0AF3E2B68AD4D618B1BE571425FF1DF0E167CB359CB8176C15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 3ec93d390457c3b917cf936f7c759ce2bc0f8b0f3d8d4b562550e95310f54cc6
MD5 fb8e429f09c42f621324082fabd26171
SHA1 c4b97f97a6ab3472dc14edef104f72cb2235724b
SHA512 76b74ea1040f96f02b77784933acbffbf2ccb7cefb640b47e3d92f9844d43bd0a450b25aa32518b843f9c39976b04ce50b1791392d6ef0129f653f826f98a11b
SSDEEP 24576:KQ9MxZKdcz9dw3c5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:KVKZc5SW6H8DS52tdDpbRZy
TLSH
T1FC558C2DABE9059AE177D275D5A240C3A633B4311B31D6CF2448D03D4E7AEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 772KB
SHA256 54cef007073cc9ec90800a5fecc24342581365d7d2be51284bb6a5695296e9eb
MD5 68c9c43fc5b601bba86419cf5dd816f9
SHA1 6d399ef3d23d498d872bc4f0c143c3646587819b
SHA512 5ace90fd52badf2d0766edc6ff982913338c872611429f46b2a514b86c59294dc1fe7b2c8bd21598eece2b22886a47df1d18ff42b2b2ce06de937c0593a15a3a
SSDEEP 24576:xyocDApj5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:cocDApj5SW6H8DS52tdDpbRZy
TLSH
T194F4E05FB7A940E2E126823C89858345E773B0745B2163DB5A91C33E8F27AEDBD34B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 dd5c0ddf7ab00bbda4daaf24e22dbafc0b5925d94367ce93647567a683643c63
MD5 7c1deb481720634fd8f3dd212034316b
SHA1 c15658ae59f7e2c7b66a43df839ba43498f0d4ac
SHA512 e062d1adc01380c03d73b5e3855389afe73a3affccd495e25536aeeae3e4294c2e15e185c954b1c2892c6ef34ae7ea1d51c618667a2a3ec2076a6e7e62b7a510
SSDEEP 49152:eWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKj5SW6H8DS52tdDpbRZy:40zuNIt5SSDntdDpbRZy
TLSH
T11EA57C3DA2F800A9D9AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 4f1f294f8f3bbd234a796a8ceef0bfc22653702f86dfe561d51ca562cba487cb
MD5 3582a6455da6ce654838bb5b990a69a3
SHA1 45be3bb9ecc87ff9723fa5d7b2b87e0b2f49a205
SHA512 f58defb6fa31c50d66ced5c8ad9a530a55ddb608b66b6a6db437defbb25ffa6c85cde39019ab26886dc634a961990d3db6741beb9cf53b80617a4c42bc15109a
SSDEEP 24576:51QT7EcpfxR+N5AWAz3ooiYtjMqba5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:sTDxR+N5YzTfjMR5SW6H8DS52tdDpbRo
TLSH
T10A55B02EA7F815E9D17E85799A23C512FA727821033193DB42A0C17E1F3B9D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 877KB
SHA256 96bb08e5653320dc702e58e3572b9a6ead5df3e382e46c52b6015c20915d781c
MD5 497bd4341c7a2e394ec10b59e025b8f2
SHA1 59016b8e0b3eec83e3e5708f2942107b84c9070b
SHA512 f8e0877be3595fd6b14428f7eb0af538248f3cee1f2c4587c2801e9583300bba6de7a2163bd45ea582e86b87398446cd0162a44fadfb9c7963b5cce21168906c
SSDEEP 24576:1TMdOz0FFS+imSL65SSiVw6uAX8DS52tpz9ZRzbPmSZyo:v0K+imSL65SW6H8DS52tdDpbRZy
TLSH
T12615F17E63AD14E6E43FC27DD6538906E6723466032166DB06E0C17A2F5BEE4793EB00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 635KB
SHA256 2017de249cbefb66252306af7021e07b1a87fe9db4fcc2f1244ab265f6a48beb
MD5 87a757cb7cc62c760c2f173a12b97697
SHA1 0faa903f74cc10000fd68b704f7a6d74dd2d1dc6
SHA512 8a36c56dd0d12de2d5ac7e7765a89678780bc6091a4c7d1e8ed0676577942ac5752261ea49685cfbeafcd737e6703b57d5c73a9b1d81f9ebb320cf3d606a5231
SSDEEP 12288:24Kt5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6r:Et5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T1B2D4124C13E430E7F12A56B6D6B64295C630F87A131466FF2DE0C57B8F36ACA8539B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/660-22-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/660-169-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/932-376-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/932-171-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/1256-65-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1256-67-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1256-372-0x0000000000D60000-0x0000000000E0C000-memory.dmp

Download

memory/1256-366-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1256-59-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1276-46-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/1276-44-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/1572-54-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1572-361-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1572-48-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/1572-55-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/1588-173-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/1660-182-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/1828-396-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/1828-180-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/2184-177-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/2184-395-0x0000000000BB0000-0x0000000000C5C000-memory.dmp

Download

memory/2236-100-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/2236-113-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/2236-106-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/2236-373-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/2248-218-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/2252-394-0x000002B7A2860000-0x000002B7A290C000-memory.dmp

Download

memory/2268-155-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/2424-120-0x0000000000750000-0x00000000007B7000-memory.dmp

Download

memory/2424-115-0x0000000000750000-0x00000000007B7000-memory.dmp

Download

memory/2424-375-0x0000000000CC0000-0x0000000000D3A000-memory.dmp

Download

memory/2424-170-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/3468-176-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/3800-98-0x0000000140000000-0x000000014074F000-memory.dmp

Download

memory/3800-20-0x0000000140000000-0x000000014074F000-memory.dmp

Download

memory/3800-10-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/3800-16-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/4316-70-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/4316-77-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4316-71-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4316-81-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4316-83-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/4516-6-0x0000000001F00000-0x0000000001F60000-memory.dmp

Download

memory/4516-19-0x0000000140000000-0x000000014074F000-memory.dmp

Download

memory/4516-1-0x0000000001F00000-0x0000000001F60000-memory.dmp

Download

memory/4516-28-0x0000000140000000-0x000000014074F000-memory.dmp

Download

memory/4724-30-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/4724-220-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/4724-40-0x0000000000680000-0x00000000006E0000-memory.dmp

Download

memory/4724-370-0x0000000000B60000-0x0000000000C0C000-memory.dmp

Download

memory/4724-32-0x0000000000680000-0x00000000006E0000-memory.dmp

Download

memory/4916-371-0x000001E19DC00000-0x000001E19DCAC000-memory.dmp

Download

memory/5104-221-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/5148-137-0x00000000004D0000-0x0000000000530000-memory.dmp

Download

memory/5148-174-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/5148-393-0x0000000000BC0000-0x0000000000C6C000-memory.dmp

Download

memory/5148-131-0x00000000004D0000-0x0000000000530000-memory.dmp

Download

memory/5512-109-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/5512-89-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/5512-95-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/5760-386-0x000001D612A50000-0x000001D612A60000-memory.dmp

Download

memory/5760-381-0x000001D612A50000-0x000001D612A60000-memory.dmp

Download

memory/5760-407-0x000001D612A50000-0x000001D612A60000-memory.dmp

Download

memory/5760-409-0x000001D612A50000-0x000001D612A60000-memory.dmp

Download

memory/5760-408-0x000001D612A50000-0x000001D612A60000-memory.dmp

Download

memory/5760-411-0x000001D612A50000-0x000001D612A60000-memory.dmp

Download

memory/5760-410-0x000001D612A50000-0x000001D612A60000-memory.dmp

Download

memory/5760-406-0x000001D612A50000-0x000001D612A60000-memory.dmp

Download

memory/5760-404-0x000001D612A50000-0x000001D612A60000-memory.dmp

Download

memory/5760-403-0x000001D612A50000-0x000001D612A60000-memory.dmp

Download

memory/5760-387-0x000001D612A50000-0x000001D612A60000-memory.dmp

Download

memory/5760-377-0x000001D612A50000-0x000001D612A60000-memory.dmp

Download

memory/5760-378-0x000001D612A50000-0x000001D612A60000-memory.dmp

Download

memory/5760-402-0x000001D612A50000-0x000001D612A60000-memory.dmp

Download

memory/5760-401-0x000001D612A50000-0x000001D612A60000-memory.dmp

Download

memory/5760-379-0x000001D612A50000-0x000001D612A60000-memory.dmp

Download

memory/5760-380-0x000001D612A50000-0x000001D612A60000-memory.dmp

Download

memory/5760-385-0x000001D612A50000-0x000001D612A60000-memory.dmp

Download

memory/5760-400-0x000001D612A50000-0x000001D612A60000-memory.dmp

Download

memory/5760-399-0x000001D612A50000-0x000001D612A60000-memory.dmp

Download

memory/5760-398-0x000001D612A50000-0x000001D612A60000-memory.dmp

Download

memory/5760-405-0x000001D612A50000-0x000001D612A60000-memory.dmp

Download

memory/5760-382-0x000001D612A50000-0x000001D612A60000-memory.dmp

Download

memory/5760-383-0x000001D612A50000-0x000001D612A60000-memory.dmp

Download

memory/5760-388-0x000001D612A50000-0x000001D612A60000-memory.dmp

Download

memory/5760-384-0x000001D612A50000-0x000001D612A60000-memory.dmp

Download

memory/5760-390-0x000001D612A50000-0x000001D612A60000-memory.dmp

Download

memory/5760-391-0x000001D612A50000-0x000001D612A60000-memory.dmp

Download

memory/5760-389-0x000001D612A50000-0x000001D612A60000-memory.dmp

Download

memory/5760-392-0x000001D612A50000-0x000001D612A60000-memory.dmp

Download

memory/5840-85-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/5840-369-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/5840-374-0x00000000006D0000-0x000000000077C000-memory.dmp

Download

memory/6012-148-0x0000000000DA0000-0x0000000000E00000-memory.dmp

Download

memory/6012-175-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/6012-142-0x0000000000DA0000-0x0000000000E00000-memory.dmp

Download

memory/6056-367-0x000000000C990000-0x000000000C998000-memory.dmp

Download

memory/6056-397-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/6056-199-0x0000000001A20000-0x0000000001A30000-memory.dmp

Download

memory/6056-183-0x0000000001770000-0x0000000001780000-memory.dmp

Download

memory/6056-219-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/6056-216-0x0000000009E60000-0x0000000009E68000-memory.dmp

Download