d0a2b8729fa363bdaba7fac5fe7f3dceb82b27804f5dd293257fa16c08906264

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
24/04/2026, 23:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe
Size 1.7MB
Sample260424-3dxtzafv2q
SHA256 d0a2b8729fa363bdaba7fac5fe7f3dceb82b27804f5dd293257fa16c08906264
MD5 488fc813fcd178c3b0f0e91507dfeb1c
SHA1 87b3b18d426cd8dd08fc1535e06fbea9341129d7
SHA512 6975becd0755d2d476fa3de48a448ff7912eb3e1dfabadd7af34ccc89d8054a6dddd43940db45a0c5b75371af36b8826d54cf6db0a66ad04be95e75014e60245
SSDEEP 49152:aUNxvC6FGYJf6yjNQpNONZnTX5PlGPgq4EIxc7N/4xCj4MYPVyGLL:aULC6FPYpNONhVPlEgq41c71wVX
TLSH
T18285CE0733E6C0E8DF6790F2C6295223E77274111B289BDB68E0592DEF93E915B3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
4336	alg.exe
3288	DiagnosticsHub.StandardCollector.Service.exe
5112	fxssvc.exe
4080	elevation_service.exe
3696	elevation_service.exe
3832	maintenanceservice.exe
4532	msdtc.exe
3320	OSE.EXE
4784	PerceptionSimulationService.exe
2836	perfhost.exe
3356	locator.exe
4468	SensorDataService.exe
1196	snmptrap.exe
4172	spectrum.exe
1820	ssh-agent.exe
1408	TieringEngineService.exe
1912	AgentService.exe
3284	vds.exe
1784	vssvc.exe
2080	wbengine.exe
440	WmiApSrv.exe
5080	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\e:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe

Drops file in System32 directory 35 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\{17A6A947-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db	spectrum.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	spectrum.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\13f709d689fac755.bin	DiagnosticsHub.StandardCollector.Service.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_180578\java.exe	2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_180578\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cbb43d9141d4dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cr2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.crw	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ico	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000096646d9141d4dc01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007e23ee9141d4dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003c5d089241d4dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9933 = "MPEG-4 Audio"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raw\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009a86f09141d4dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raw	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 42 IoCs

pid	Process
4396	2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe
4396	2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe
4396	2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe
4396	2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe
4396	2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe
4396	2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe
4396	2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe
4396	2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe
4396	2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe
4396	2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe
4396	2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe
4396	2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe
4396	2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe
4396	2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe
4396	2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe
4396	2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe
4396	2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe
4396	2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe
4396	2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe
4396	2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe
4396	2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe
4396	2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe
4396	2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe
4396	2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe
4396	2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe
4396	2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe
4396	2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe
4396	2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe
4396	2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe
4396	2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe
4396	2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe
4396	2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe
4396	2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe
4396	2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe
4396	2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe
3288	DiagnosticsHub.StandardCollector.Service.exe
3288	DiagnosticsHub.StandardCollector.Service.exe
3288	DiagnosticsHub.StandardCollector.Service.exe
3288	DiagnosticsHub.StandardCollector.Service.exe
3288	DiagnosticsHub.StandardCollector.Service.exe
3288	DiagnosticsHub.StandardCollector.Service.exe
3288	DiagnosticsHub.StandardCollector.Service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
684	Process not Found
684	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4396	2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe
Token: SeAuditPrivilege	5112	fxssvc.exe
Token: SeRestorePrivilege	1408	TieringEngineService.exe
Token: SeManageVolumePrivilege	1408	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	1912	AgentService.exe
Token: SeBackupPrivilege	1784	vssvc.exe
Token: SeRestorePrivilege	1784	vssvc.exe
Token: SeAuditPrivilege	1784	vssvc.exe
Token: SeBackupPrivilege	2080	wbengine.exe
Token: SeRestorePrivilege	2080	wbengine.exe
Token: SeSecurityPrivilege	2080	wbengine.exe
Token: 33	5080	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5080	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5080	SearchIndexer.exe
Token: SeDebugPrivilege	4396	2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe
Token: SeDebugPrivilege	4396	2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe
Token: SeDebugPrivilege	4396	2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe
Token: SeDebugPrivilege	4396	2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe
Token: SeDebugPrivilege	4396	2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe
Token: SeDebugPrivilege	3288	DiagnosticsHub.StandardCollector.Service.exe

Suspicious use of FindShellTrayWindow 22 IoCs

pid	Process
4396	2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe
4396	2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe
4396	2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe
4396	2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe
4396	2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe
4396	2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe
4396	2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe
4396	2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe
4396	2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe
4396	2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe
4396	2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe
4396	2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe
4396	2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe
4396	2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe
4396	2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe
4396	2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe
4396	2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe
4396	2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe
4396	2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe
4396	2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe
4396	2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe
4396	2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe

Suspicious use of SendNotifyMessage 22 IoCs

pid	Process
4396	2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe
4396	2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe
4396	2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe
4396	2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe
4396	2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe
4396	2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe
4396	2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe
4396	2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe
4396	2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe
4396	2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe
4396	2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe
4396	2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe
4396	2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe
4396	2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe
4396	2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe
4396	2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe
4396	2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe
4396	2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe
4396	2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe
4396	2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe
4396	2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe
4396	2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4396	2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5080 wrote to memory of 2604	5080	SearchIndexer.exe	105
PID 5080 wrote to memory of 4516	5080	SearchIndexer.exe	106
PID 5080 wrote to memory of 1352	5080	SearchIndexer.exe	107

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4396

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:4336

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3288

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:656

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:5112

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4080

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3696

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3832

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4532

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3320

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4784

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2836

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:3356

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4468

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:1196

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4172

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1820

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:4420

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1408

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1912

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:3284

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1784

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2080

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:440

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5080
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2604
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2812 2820 924 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4516
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2884 2880 924 {85EE815A-7738-4808-A14A-3AD87E32A3BF}
  2⤵
  PID:1352

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 aaca4170bbb4448b3d4b21bc3756c858129f283e56b0c56a58228bbffe56d572
MD5 a4ae3dc18a74c978a78fd065c0c33aa1
SHA1 92a3f74752f0ee1e634795d746170779a0a54976
SHA512 0bb3604bab85e20cb7474e041ef86f013f0385d25af4d5601a2fabd0526770021f81b85dbaa51567f91fb5e632927e555c87cc64a6f1f643bbb980b496f142d8
SSDEEP 49152:Xb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnej4MYPVyGLY:F3q6HjBQVE
TLSH
T16DD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 2958094e4a7e0c108189adbd3df36be34e8bb65a4b4a4d66a268b895278b9d79
MD5 09ebe0fc56437bcd48d9fff512c1fe0e
SHA1 d08a8ea6c94616c2a5b2c7becb9f7b5bb75817a8
SHA512 853128c960354ac1b767015953c1b93e6332f716225d3e96e1d125ca061ea08d04fc917bb79b2cf656250e111aa794c3526f8afc790c97819abbe5bbae8890f5
SSDEEP 12288:+1XLsswWkxy2lRq2czAj34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9U:MXYfDtczA8SnnrFb4PM4MYgLxEVyGLC
TLSH
T11065F12977E408F9DD6B8278C9A28545E733B8518760F78B03E499662F333C85D3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 dd708bbed30af9df32347660605777a147d3a8eff7f88511912b775ec88878e2
MD5 1abb028fbc366b14fa7f56cd0f41ee5a
SHA1 8472ec7f590191ae1f93286393530e633698a64e
SHA512 91086d634566f66c52bd630e4aba72542ff835e02ccc7488ac1ec81983150cb17402730da8c3f1b39db207109ff4695b1f1312a10e680356d7a9d4bc9b757d0a
SSDEEP 24576:Y0Le5ji0hmxirMdSnnrFb4PM4MYgLxEVyGL2:YPji0Actj4MYPVyGL2
TLSH
T13F859E66F6788375D073C0B9C5D2A68EE97130825B308ACB4286D77C3F676E68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 d1d7fb99c2047ab51831d81c241d6f6853d5fb3082c8e8457a13452d02503254
MD5 807ae1a1d4090fdc128ea17946072eda
SHA1 50cd051397c9bd8583fa6265934a45073650d60d
SHA512 66165df209bf367c8592bf9bb096cf35dfcd7f1079ab15e0e9a0349e4bc9fad01e575bb2e7950bde2edfb9ae3148dd1ad3767589db1feb8b9730f1ea399d8966
SSDEEP 24576:0a7/ezSC6vUyD/aqgrvWE6q8wyuPSnnrFb4PM4MYgLxEVyGLh:j/ezSC6vUzPvxHjy5j4MYPVyGLh
TLSH
T144755C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 91dea4b004ad6f67a6de8bca7915f794303f898916465f76f6a89a35e7b7040e
MD5 a42cb5a2361077e91b2548c175dcfb74
SHA1 dfe4e3f90c1b9318574236c47c078c5cfb8f6f0a
SHA512 ec4bcf659e24b9157f53e42cbc69eca6c4c01d90557d25a53427d0391dff81bf8c2b74d520d2acd0294e782525d86230dfff6b6bf87b6eeabda6958f01929354
SSDEEP 24576:bVbqPb88hv/l+6gSnnrFb4PM4MYgLxEVyGL4:bVO88hXl+yj4MYPVyGL4
TLSH
T1FC559E66F5B48331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C3E677D6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 4939beb8e1c8f038b60d001fe7d337212a8d3b67ab7ec1f941f7b4e3510b57e3
MD5 96ee230917aa3e85bcf97df7427d8bf4
SHA1 7ab1931effc00d88d4d8d1d822b731eb8342231f
SHA512 d0312f377a5ea3e1802cd791b419efbc3d4c20d965e1fc1ab9b2deb1215366ce51c84b7ba608ed676e7229cc80d20aeca3e59d2c3e4d5c1b1fb3e2529c89c878
SSDEEP 12288:rRS34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ily:rRhSnnrFb4PM4MYgLxEVyGLI
TLSH
T10B4523A72BDC10EACFAE15B0D1B96AC8E605BC61F875B20B6750785B363F24DD891313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 f8a5f6fccae2ab2556385374017973a644f4c1161812d2bd41f58925d34a67a2
MD5 ccc21ab6b167ccd7db1e87559049d822
SHA1 69a7c66a6dc8f81a7dc41e7b0c3d38eaad85ec74
SHA512 fdbd160c7f6283a098147667aac69003b9579ab2d3ad1d208afde68548f234cdab5b09ad405d97c6b60fb80465bffdf341a29ba22c1affcacf372de051ba9e16
SSDEEP 12288:ReBNUbTVO86U334XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilJ:RJIU4SnnrFb4PM4MYgLxEVyGLr
TLSH
T1B965D03BEE28FCE2C67E4DB856918740E77278308F62A3CBD165820E9E235D45D76C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 140815ab365cec06cd5e95961c9b803c8e6e57df1138a2db714be36f28eddc4b
MD5 c44c896914917d318a8e65fc11b32808
SHA1 4b3e1f4eb31d969a86177099246971b781e84af1
SHA512 030eaf573669182e8ba39edbae0c3eebf258d84458f18ad6a09caf860f220afcd90ac4f27dd2f1e240458dd678d08724b5cbf9c2a658b806a6c113acdb4faac1
SSDEEP 49152:cQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3TH6:cQvGAdlCEL8c/yRNw5ClV5
TLSH
T15A267C656BF880F5E0A7E174897AC6B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 e3e9a70206939c70dfc6ef54e3723f0704c858acb0908fd3caa9f821446b2275
MD5 1a232ab8fadf87a81653cd5852d5120b
SHA1 828d39d7d81ba57681a9bdb0b39635a1b8b37600
SHA512 d16b922f8f19273e7020e6f2fe6c2b11d2a396efcc1c01e7f83a16db94582ad78c32f5598e2358c7a202b769eecbbf352ceee561232621e3cc395ba2995a13b9
SSDEEP 12288:PAwSfxL/2Dc34DLLmt0LDQewsAjl34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeA5:YdewsAjiSnnrFb4PM4MYgLxEVyGLe
TLSH
T17D75E031FE74E036C7BF0DB21B36C706542DB9204B612AC3E3A89D9E59342C26776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 f78b8c94a9772a7518af7758348d0908dcdfdf8fa72407bba901401f0cd8d725
MD5 a0ed2b7743a3e55518f4148a9f83b36f
SHA1 fc423e9171dc14331f5f5569d524254d684435d7
SHA512 742b5d0067d4b3f11f713f1e729246706460bd9261a8a6d7df7a7c93fdf3eadd5862a7f538b58baf50ded0bfad94d122faf2c96acbfd963b1e9e15fded44752f
SSDEEP 196608:2UEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJH:2UEtQevvqc2W1cpV2EI32
TLSH
T1E4474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 ae2954a0cd38ccdd02a1e75117aa19e8c611cbf4b85a016e1796a889de120f17
MD5 fbafa4b9c0bb90447ebf82979bfc1f4c
SHA1 96f29e2ecd128687d5514572cfa5edcfb8de5082
SHA512 48051633b5f96710822c2f73647f070a3eb145d65b1307e84e7a4a8cfbb9e3ad4e97b65df7f0f6a633072915837fcc93193f626ee7baceed73fd327b14cdbcaf
SSDEEP 49152:SCbRquA/m2yL5zQfFiV+XenmE3/z9j4MYPVyGL8:3oqtVjnmRVw
TLSH
T10FD58D0976B8C1E4D1F6C77886A2C647F37178158B31A7EF4266461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 547f2455bd6525d49bc0e098863efd47c995f51cdc617784e3d259cb3b964613
MD5 48ea630b761878203c51dbbde425d52e
SHA1 78c37a4bc3df2e50e5722347497652a85ec81097
SHA512 9ec7180ebb54a5f46ffb0b2f0c90e408152f37d5b0f64ffa2d5e0d1901035c6a3a86f7f0e9b737eaed19900c9d43ccb67ce6bae1d6ff629349119119300a0c05
SSDEEP 24576:2AhGLJIFoiwtA5l7S53LSnnrFb4PM4MYgLxEVyGL9:2AMyFoiq5kj4MYPVyGL9
TLSH
T18D35AD81EBF955D4F5B3AAB899B68170EA76BCA65E31D20F2150D10F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 da635a5885b4dbd8ad5099390876f1300c84e79d1ea2d2fd0ceb84091271ee55
MD5 bbcc2f5c5a55f5430e792c4b3a0ed4d0
SHA1 00c53377696fb132b31649dc8e6f9b78847d45ef
SHA512 f261272dacdd08947054817fa36d3330b64c3fc63e4840055f95f9f19a002cf9315301c2a992a12b1a6c19427a0aa986dc1f185c94beb513a3c14b9ca3952dd5
SSDEEP 12288:rmw5HEjsChNVBFgl0WDm+Ck34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqy:qwuoOW+SnnrFb4PM4MYgLxEVyGL0
TLSH
T17865F14637E81CF9EAA74238C5978535F7B2BC122A21D71F1760C65B6F37311AD2AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 9aa3c16ae6ff947bc23baca31bae622b57e22c53da25e762950cbc6e5ecf5197
MD5 3e6585e7e3340c00379371a5c05f1829
SHA1 04c1162bf15b39ba31674e6c90c9de2230793ad7
SHA512 1bc298774a09b66eea88f6d6a2b7ac7ee82fe465d2f9a2c77ef67b808940b2ce5edd804029d4f83aa1efc23ac32a0e4a5bec8f45e990e3a3117e13efc21539b1
SSDEEP 12288:RBZ1IyV34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilj:/Zu1SnnrFb4PM4MYgLxEVyGLp
TLSH
T1ED55129A37E820FACAAB4274C4F55688E3227862B73293CF1650655A3F37AC55C35332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 ef1d078dc7c8d089f77e292afefead317506d6abeb2e655cd65db93792fb4c84
MD5 7e6ce6243637df3bd63294c1b2a643e4
SHA1 05698da608a1a4c0b725ab3815a67b84589c633c
SHA512 f714e70e2a63c7f2bfd20829a6a592a40cd41b014970f72500d01894e06a72c565422d44d16d886976910452c70fd535286616c48e1cb4660b97b08ea48d408f
SSDEEP 49152:mj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uf:1QRQyi36YOcPQLvw2gAf+PN3UV8
TLSH
T186667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 229e7e35a7569bb5524c029b778cbe91ea555cb2c3bee7b3ee496bf6c798f56a
MD5 fde1017aa27aeb24e8d30a1368928b43
SHA1 fa857e59a8166aed823181a48626ec5181357b45
SHA512 34403e88d1ed6dad68f5723508fdcc3056a3b1724f217dc0294419a3ade2d1cc95cd05bfcc752fef71e3d659e6039c834cc063cbd4dc01e80014eb89c4631b0a
SSDEEP 49152:gj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23US:nQRQyi36YOcPQLvw2gAf+PN3UVd
TLSH
T155667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 81ae84cab77a45d4bc7fb1b8a30b3c48c96ec6cd55a7ab115afc85689b5f6429
MD5 fabee6b2775d89236138c1b5e6656e32
SHA1 63b78a683aeadb5f1304f399ed47bf8162c0df4d
SHA512 e1d754958e76b81aa3c63d8af32c48d58da0609d60c1cee8f8f65491d64248f6ee39f916fd740cb83ee359caf4dea1b9c4291a4251f387f58da3712175d4285a
SSDEEP 24576:nwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0FSnnrFb4PM4MYgE:P68Qg55nhheWu7PNU3/tj4MYPVyGLD
TLSH
T1FEB54A33B2F600A9C44DE1769F4A972196D27C71CFE1E3DB851172061BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 595abd5ba864709a5eeb88910a68aa4cc04f19c44a49507f15ec984cc56fc043
MD5 d62a276e5d4446b996ceb8cf91d320a7
SHA1 80ab494c7e1a5ad11663cdbbb5927c4183d23073
SHA512 2e655c6e4371084242e6a4cc15a30583442856b989872050b98d5e5c58413b07d15ad9a1443e051209da1e3d74e79ef961eabe3c39aa4a743fa09d6146ac7803
SSDEEP 49152:E3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk991:Ry5112gYy5azzVvL69nLKnhZbVM
TLSH
T199167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 a7d6f702f6f82c9791b26042662936dc0671ed83ed8b7fe38701a5fbe31a2d5a
MD5 eba1dfeaf3aee902c935849acc2b563f
SHA1 0d1cc10cff9b3e1d7ce3659016680e4fe401a7e0
SHA512 7cba7dc7408876eb8e5a664438c8fa18fd518c497e9d879369161b3ab5691ff997f4c289053f128ce513274674c7b6cc28846db4ed18980e3faa5ce0a65576ce
SSDEEP 49152:wB+taZ3usBWOBr4tEGT0bqx0z+n217aau1gl/j4MYPVyGLF:qu6JmVxd2dcVh
TLSH
T1FAD59D13F1DA01E8D06ED478974A9233FA62BC490B35B6DF0A9072562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 5c447cac190ccef6847e663c78fe7ce6fc75139ef4881ec0d1b347cdf8ff1880
MD5 ce2c20e94280690c903f377d887af2d6
SHA1 b1b59875afce36d24eb67ce9697828c601409a92
SHA512 2dd04b49083539ab401a23aae64532306e7da7291539148ab5fccce064b5417e3fce8c63d14e0fef43fc1d0dae267a93af738fcf90b41e8620551ee22e967bfd
SSDEEP 49152:z1hpsNoJpF1A6UU44CwH7R4xrj4MYPVyGL4:zmifPbRRVs
TLSH
T1B0B5BE13F2D900E8D06DD17887569632EA62BC460B34B6DF0A90B7962F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 5ed465dc9643f14fbc4dd1613b41419f40c44290cf4aa4b500d6ec7769b3c562
MD5 ea66bae55efbbce65ac187ddaefadfbe
SHA1 7009419ec46e7d3f1d42f498c8216a359613f175
SHA512 c5dd724663c82cb8d7a5c29185471a95557994330489e049f50512f68d8aa5ef8ae9feb173bdd20e44e63262a80438f56180de51011afe3b9fd14602ea9355ad
SSDEEP 49152:bSuZQIY0Be2KRRVtOnks6NMHqOj4MYPVyGLV:J5dKTi61vVR
TLSH
T142C5BE13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 586eabc5812de70530d5646efe9456915e068ce01906848d068176161ef00b58
MD5 d45a336295fcae55055e7817d159429b
SHA1 a1d6ec6ed12fdae29416d8244432052a9a083902
SHA512 63d93730bce84d6bd3dc0ec2070c759e6df2b06a34e7a6e6d284840ad41be37c413c0c3016679a53446ee526a9a2fe76232e6853d5d63af730f9236da6f639c6
SSDEEP 49152:+htSn8EApI0figngiDn0AP5wvj4MYPVyGLq:fX2iyph9Ve
TLSH
T16895BE13F2D900E8D05ED174C7568632EA62BC160B35B6EF0A90B6562F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 b613df8c717625dae3ef35c5f67af12f5921b39afa8324e1e0b4acfcb054106d
MD5 f2bc318f56fb53f25a696536b5927062
SHA1 b9dadd4dba533e2a8514b39749d4ef89f0f6dcbb
SHA512 bb391d4bb1403865d51c6a57d1aeddff67751678623ccb19ef5c27f47f95966d6cccb09ea463fe1069565ada38e7401e6e8ec99b9e3500c4d2eedc242ad88c77
SSDEEP 12288:+K34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2il2:+5SnnrFb4PM4MYgLxEVyGLw
TLSH
T13F4523A62EDD10EFCF5D16F0C1A566C8E2097C62F976B20F7B8574173B3B20D5892622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 b09b01faf0f6e38f3808cbd90c43cf9f48b1fe868ea1143688b3f94d1efc0680
MD5 e1027b78fd62112a141d92cb47c33e2c
SHA1 78ec903fc9572406bc82a26acaa67747a655c396
SHA512 715c8a5103197a093189daaa34f6ed0f8f8d1585e2975fab1051a735643c2a83f3ed8047edc562450f4f08cf781822a2f4be6ab74b3622b90d8ab566dd752c16
SSDEEP 12288:Nh34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2il5:NmSnnrFb4PM4MYgLxEVyGLH
TLSH
T1894523A62EDD10EECF5D16F0C1A566C8E2097C63F976B20F7B8574073B3B60D5892622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 e081fb701714c1d620b5c5d63e8e79de3bbe9440a2df36124db09b907ecab89b
MD5 25735e35732b4f7615ef1e367a70b508
SHA1 8e55436cead144f5737a4df107c3c2556262068a
SHA512 139cde83a8909a49dc836ac5b2c7ca161b4d50baba4e7416753e816c4e32f30d192f00fb9bd1208f9e761eb723a84795b5513874bbbe3383ddb4bd66482576a7
SSDEEP 12288:qv34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilF:qwSnnrFb4PM4MYgLxEVyGLz
TLSH
T1544523A62EDD10EFCF5D16F0C1A656C8E2097C63F976B20F7B8574063B3B20D5892662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 10607e87830907863722a9053821d5ff9e59e0edfcab1a0cbf375ea4f6837e20
MD5 8adccc0b641257655bc18e9e3b394ca6
SHA1 62ff4435b377a5d39b5af5c3f9975c7b7b52377e
SHA512 fec261cc4479c05536229e322a0296617e5605b1e125f9950640649e94d817aabde4b952f03d223bd57eb771ecb9df0b2eacf9b68f03f26fa4b5b4b9c53d087f
SSDEEP 12288:HVY34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2il3:pSnnrFb4PM4MYgLxEVyGL9
TLSH
T1EE4523662BDD10EACE6A96B0C1B556C8E225BC61FA72B35F6740381B3F373489C71721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 922e69c32a302d2e182735b17715bcdc13264de34d0d61d0106481eeafa15c5b
MD5 8df738b3709d7c6b60bd4860e35cf145
SHA1 4d7d9f5a5d3935c5c08d7ef8cfb6fb6db93e47db
SHA512 b7ff46c038c6e38bbd8811d7c0071cc71f0b1d6db4fa99770fccaa87502b660ecf7131e9cf33f233aece93be97c5996e016b4170aa3631745e395fb8404b5101
SSDEEP 12288:Sg34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilk:SzSnnrFb4PM4MYgLxEVyGLW
TLSH
T18A4523A62EDD10EFCF5D16F0C1A656C8E2097C63F976B20F7B8574063B3B20D5892662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 878b251706223509f6450deaba18c377244dc3143697b03aa82f638c7ff64829
MD5 cbcfc3463007f1463d89cbbd2452c59a
SHA1 72103d47fa5940a9856643ae9baf108cc19a0ef8
SHA512 d2f0adb2430a6ce06fa291de68acec1891bf481e07e73afc358af395e9d876e29dff0e66c03798bb2d2cb385ba8fa1e00eefbb90348e92873d5f6c9024fbac26
SSDEEP 12288:M934XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilk:M6SnnrFb4PM4MYgLxEVyGLW
TLSH
T1034523A62EDD10EFCF6D56F0C1A566C8E2097C62F976B20F7B8574073B3B20D5891622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 faff6adf3a11c5c2a2a94ac69e44b43531061300746d1e828724001b9224b8b2
MD5 e7a8fce57f855e3ba485c57d78ee3bb6
SHA1 f81407344995184794d09279fe258bf7a69084e3
SHA512 0761083cc9d3f5684a135cf915c24df0cda41941117c982fc88d1ae8b12f20a2e853056f36e34556a61c757d2642a8c9fc8d6986cf77ff16f364868d71ce6481
SSDEEP 12288:YJ34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2iln:YOSnnrFb4PM4MYgLxEVyGL9
TLSH
T1AD4523A62EDD10EFCF6D06F0C1A566C8E2097C62F976B20F7B4574173B3B20D6891662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 8511a70ef53444c1fd4a223e787928c858d93d2a21fc455c3a9eb52506bea597
MD5 beb78191c5083849015d64e3acae4993
SHA1 2bf218d116628b1679cb75e84a0619a2096c906b
SHA512 64da8fb9b7b149da0f1f1c68ecdf502e19c34fe3ae21ec5c07d8d04ed404ecea8b2a084f3561b27e7675e8e9590d3b58a4c3e22b9b05d1635c3d5d073afa9cc7
SSDEEP 12288:jiZwb6zzFEoS2cPvyB34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2O:OZMSzFVSOGSnnrFb4PM4MYgLxEVyGLz
TLSH
T1E66502A5739018F8DD67827EC9658945E2B27C265B70C61F13E4362B2F333911C3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 53820d3f0fc0be910379230cfd937cbbf5544733d81242580458509a9de80a58
MD5 96da16654598d0a9e30a229b339695c6
SHA1 c217f1eb17a97586599e85bc856c3aa01be746d8
SHA512 4e3169eaaf820fdbe68d544ccd899c268d0279e9108a181fdecfe359dde9111e31c743e323ab163027455998b74cdabc00e9412ec33f44d0aa57a6f827fc6810
SSDEEP 12288:wu34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ili:wlSnnrFb4PM4MYgLxEVyGLY
TLSH
T1F34523A62EDD10EECF5D06F0C1A666C8E2097C63F976B20F7B4574173B3B60D5892622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 790b271c2265f3a3009d6df823df2ccf7995d773210ce03d5f166d06dfc38490
MD5 08e852643df68986a87805339653a83f
SHA1 07dc8b04bf3dd571e20828c7dad34260de23ee6a
SHA512 1b8a25ea327a62edc24d06364587cc6d0b4056dc295d01d77766594932c7c1597742f0d4906592b454e46867abf72d96b25502715abd03fc1e29408b8caa8511
SSDEEP 12288:XC34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ili:XRSnnrFb4PM4MYgLxEVyGLY
TLSH
T1B54523A62EDD10EECF6D16F0C1A566C8E209BC63F976B20F7B4574073B3B60D5891622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 14e5c0af33ec1b29643c778c55522444be8976be5aa794d1b9a5a391d2a16ae2
MD5 1cadb9e90c5b5481516bca86f2df282f
SHA1 ecb359e9182fe927868a07e03ad512d9fb684bd8
SHA512 c27d22a1596426f32a5d4b3427411c50861174b7ee78bd885e9a461dfae57f7d1812c43a7087772c1d20521e75c2ca5c29c42e742380eae64548cbe3cf8529b0
SSDEEP 12288:6yPz5L8V34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2il7:nzySSnnrFb4PM4MYgLxEVyGLp
TLSH
T10655025737A530FDC67A8274C4A21A45F336B8329B309A5F27A016773F372849D7AB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 f44f61543742359e9af3ec723d577fe87026cf00bd3fe31bdeadf1494438b8d2
MD5 3b409042d37bfe6b6f71c6ab12a6231e
SHA1 3cfb73d7adc1db5ca7810ba5d64f0bdd865f5ecf
SHA512 e353382a2aa2e0f32b29778aedaa9ec88623f3ebe0e18ee64adcac049f4d5c80924da21b5edc7415231aa5027c39e124bc712d07d0573df0c338acb5f344bf95
SSDEEP 12288:zu34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilN:zlSnnrFb4PM4MYgLxEVyGL/
TLSH
T1564523A62EDD10EECF5D06F0C1A556C8E2097C63F976B20FBB4574173B3B60D5892622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 4ea4daa4ddf98fd594b016806a9418a6c078bce4b01b5a9e6c386bf0239995ee
MD5 06925f4e4a03214e6eeccc344e95f9ef
SHA1 f1995320c003117ab694474f3dbc9e61e5786f29
SHA512 36c5f10d4e90bde703f1e3d9f4c990cd2ca0a4081af4a2dd57d971bff2f96de05c4279d158f331d9da3f1c499c312222edf63b4aea2a3d6ed69b458c46811c2e
SSDEEP 12288:nu34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2il7:nlSnnrFb4PM4MYgLxEVyGLN
TLSH
T1444523A63EDD10EECF5D06F0C1A556C8E2097C63F976B20F7B8574163B3B60D5892622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 4a3b9c20433cad090e3e2a8a69a84938b9817a30cd15fadf41d0111430c4126c
MD5 dc17f955c8aa2223ac3004b7f952877c
SHA1 d2b708cf92643bbcb10d89c4a984ba96744357f3
SHA512 6ba45e2d3e4d65c85b46ffc768fd372848a15cae05658f975c8151c1c3121e4de20ac97a50308995cbf157ce5952cc2c12cbe5ac5f18ac12ec6452097652023d
SSDEEP 24576:rCUfpvPDv4Ex1hfe7i8WVq2lIGU8lrtGUJLPuwvAESnnrFb4PM4MYgLxEVyGLA:rCUxPTY+8Wg2lIL8lrIUJLWw8j4MYPVm
TLSH
T1BE65AE1EA3DC08DAD4BB817585518A06FB32782A1B32D6CF2160C73D2F27AD95E75F06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 3f9c65fa75cbde4e88de5dc5188267b129d51557ed255b71ab7067dc1d29c057
MD5 0e7a09d22531bf0319e98e804962d8b1
SHA1 903b9e1a3ff7819c428ad126aff71de3db6b2ff7
SHA512 fe1b60e10e01095c559c2d75d1c0b14835b07345a34edd8a99f8f5564b55488febb74617d61664426659daec48c02663d1384728b144e40a2e4ab00b6b3294d6
SSDEEP 12288:9Nsf+34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2il7:S1SnnrFb4PM4MYgLxEVyGLJ
TLSH
T1E455F15AD29801E9C56E6271C3565A84F3237C21A7E1E3CB67C0F43E2F366849DEA713
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

movementpro.ini

Path C:\Users\Admin\AppData\Local\Temp\movementpro.ini
Size 192B
SHA256 3cf47a7833855044343533b38a97da97270fb667e833074b926750ee8d3d31c5
MD5 b26fdd5f908fc6183cefbb1a8144216d
SHA1 c4ab663769397cc09bfa21744e2bff8d3b40591e
SHA512 f9b5323665c4acf2ace0ca4989f4591bb0cf75ade053718f80ad6d308694ee44734b3b7ce78bbf8bcad8d401b1516a6f181dacdea0f8d7366efc82b1a6b540be
TLSH
T18EC08C0303FC0004F0B20A18EAB941720B367D482C0CC02CA2E0921E48E0E00A8F7BFB
MD5 SHA1 SHA512 TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 5bfa6a26484dd9d7294ed6a83820f02b71902e2384ace653577d6d61d153c7e3
MD5 bce5b2ba5b31d023ac723d6f579694cf
SHA1 eebc2758fa85d0b8402a922e13d320629c0a0ae7
SHA512 bbf0ed5db761900e693707b9b4b350d9d86ff06ff6fe0e61f248b7162136ef2d1962de598b33d7e9d270503623ecce2c238b11318f98423c7b978575e104255b
SSDEEP 12288:QP34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilb:QQSnnrFb4PM4MYgLxEVyGLh
TLSH
T15B4523626BDC14DACE7D16B080B95698E20DB871FF71F18BB740744A363A6C99CB1713
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 5d3c0e83ac0c53243f2a635709a5d281d12fb1e6e7a174c3e51f09c0c729c26a
MD5 0c1c63c0fd48ff2729fe5281d2a48488
SHA1 46a47747b8e2e8755c7049c19b604af4c44051ca
SHA512 b35871755ad069b7a9512c2eb00092ccd82487a969a97bd290257d79c526a83e24917186def5dc4131432b4f73f25e4dcffb536a804fc3738c4c3c82706027ad
SSDEEP 24576:88RMyNoSFw1d+rC4vrmRcGPiQEaaPnMRTCCSnnrFb4PM4MYgLxEVyGLR:1RZwQCyiHiQEaaPnMWj4MYPVyGLR
TLSH
T17485B01E63DC46A5E0BAD278CD674407E6B278165731A3CF1290C27D1F27EE49E3AB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 e1e4a321d2c68cfb035fbe9f0b6c1a64c53fc6f83a6f4f28ed0a4b51ae009516
MD5 a52f53fc6fe60d1b209c46baa86d153d
SHA1 3b9a5d52e3d80a20ab6cceae5f4d12524c0c7540
SHA512 e1de41de2bfea26f379cedc395a546bef097b5782fbedde8979fb7a9371ec2973e43942d3865715e64954c3505b0ffeba1d9bc766b8f450000cedc923aab9c33
SSDEEP 12288:mbxA1U7K/34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilu:mbxA1UGASnnrFb4PM4MYgLxEVyGLw
TLSH
T19E55127E26EC14E5E67A9174C5E68245D331BC22A731A3DF21C0913E2F3BAD89C35B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 7d11377cd3a90ae89e7157be50dedcc162aefd7aeb7f262c7e81ac7362621bc1
MD5 ab82626b2ec65296d0bba942fd6c438b
SHA1 1424b6f6eaa22d354120fd28f34646ce242c4dc9
SHA512 e91f75075f314f8de7c17556ff83f04369905f6f007d9844b72be15fd54181cd9f7dca7f0588d0fa1e9c1cb27c96e78b2c093a5efc0c706d09d866e3b95660ce
SSDEEP 24576:kjsmP0yHaqrVqHra44KDzMsrnbSnnrFb4PM4MYgLxEVyGLH:kjRP0yHfVqzlAsrnkj4MYPVyGLH
TLSH
T12845BF2EF2B910F9D8AAD172454107B5FB71742D1F209ACB0170C635AF0AEE89E35F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 f2a8c2fa2b27e20fce97565e612dde27b79f49844ea63418142b1e5732fc0e87
MD5 5c2554eac882b2546067fa52ef33fc62
SHA1 509e54591a49741841f75d3e7ac736f4ec0a059d
SHA512 298c8bd51bb1b4b991edc6d07439a845c0dd758e7c04e3b35d1337439bfaf6dcb6998a98905bd6d7637d185f49e2d9d30cc03dc22ffe9ab4e6d891cbe086a221
SSDEEP 12288:vd34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2il+:vaSnnrFb4PM4MYgLxEVyGL0
TLSH
T1404523A62ADC10EECF6D56F0C1A956C8E2057C22FB76728B76407417373B68E9CB1712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.5MB
SHA256 39ea3da81a5335ce996098c96e45a0ccb52db3100aa5c6102ce2cb793cf21c58
MD5 e3ada0510389d1118de785fc95c0a0ab
SHA1 cf6bdf75ff6bb363770ed7eb1017303cf54d5f37
SHA512 63a5f0190dac73172c54fa1c89315db7d0c6bf9b9907c68af6746f91fc255770cf453eae2682ad85063008053b802a95edf0de00f230c88bc27570e7eaee9428
SSDEEP 12288:BOb9A4LWO+vAYFTj34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilU:2pLBUT8SnnrFb4PM4MYgLxEVyGLi
TLSH
T14A750155F7E800F9DD7B8138C5A28A16E272B85D1764E3DF03A84A662F233E54E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 fa9b03ca9db7c3928987325632b88bdc216a0613ec40346e48acc5d7a597f8f2
MD5 b4e9fd7e71ab0bb846527f75c0e70f51
SHA1 b94c1ea8aad2099a2d58a491f3b1cac71fba2cca
SHA512 69b866a4a02fbffc9a8c409059fd5286167fb09ce9ea3accd89dedbbd5cc5d6506504cc2a4365fd7c8b29282ae780904f622c0b48ae0e297b16da6e84472a4ec
SSDEEP 12288:o70VmvIYNvUyBpa34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilH:FrYNHXSnnrFb4PM4MYgLxEVyGL5
TLSH
T18B65F12F66AC18E5D67B9179CAC38249F27278625711A3CF05A0827E1F17EDCBC3A741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 d74a05a76079b1fbf5745e1763dcfeb192ec7b933f996e3bfc5fae9ae5a3274d
MD5 288bffac0f9b1ccfade0ba2b37e382b7
SHA1 7fb6a20075f925b6468dc18bf570d47a3b69edb5
SHA512 93086ec85d85c92d449afe230e604fa43c3b9d828361abd915929eac12df174af44ca2941d71c675722a6a5e22ce0e2cad927ac8e01ac2b662c84dd1cc121142
SSDEEP 24576:ynXoJjNYH84VVSNAApoEON66aspcrcHBjSSKHPWdQwPF3hJ8ssmOc+XLxu+x7uKB:ynXoJJYH84VVS6AmEcJas+cHBjSSKHPR
TLSH
T13D65BFAEA2BC04E8D5BBD17DC5C24506F5B178621331D6CF026182BA3F27AF59E35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 710bee94b14dec74c29d39bba50e51894342ffd02e306825cef84515e4cd425b
MD5 bf9864a31d9edf0797310649ded0174a
SHA1 9b74b272f02141dab1663ed7e3246969dd8a76a9
SHA512 91c78ab2cce6b1675d512c1585f1ee1eb043ee30f01d966e290bbcf5cd36734cf3ed218b6107788e29370091478fa7cf64373a451f864d35844faa74ec8bae3c
SSDEEP 24576:iv7Xbxd9Tuycf8M/TYlSuxwr2PCBSnnrFb4PM4MYgLxEVyGLE:iDLL9TuJ0M/TYW2P1j4MYPVyGLE
TLSH
T1AE858D5EA2EC42D8E47BD6BD85B79146FAB2B855273081CF0250856E1F23BF05D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.3MB
SHA256 278a2c53274f710d50f69cb1d88e2f218cdfe16a75746994daa234edee145cd6
MD5 91bb448e0f0540fc23c28a1dd5b17fd1
SHA1 8708afce8cb9d5fc73eb6477e5fe5fc5a3183f3f
SHA512 251ad54c4e59565c53e75a3e378a7bfad76483dafb659b8df8c7a37837974b16d0a08539b1ddcd1e19ab9efa4f18ce134b90a83ccb315d8bdc94ed457c720c4d
SSDEEP 24576:4egJgpwJOmPOHWAK+8ZguIGyPsxr5Vin10w8SnnrFb4PM4MYgLxEVyGLK:4ngOJOmPOHhvj4MYPVyGLK
TLSH
T1B555CF3FA7BC15D5D03EC17D8A968906F6B1782213356ACF0560827E1F1BEE46E3AB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 e63ec370ec291282cce82c2f95366b40b3764d4475c6de254ecd5f2593c5a317
MD5 090232523bd95181978fc18b77195d39
SHA1 a54e9baf9ae2174b363314fab924c8e231b7ffb3
SHA512 dff18ffa06a82639b9332f7bcd7359f519791ab33720e3b9856a1da8556c6ae36275e9598621b9e91c86ae2cd702e09fba70e03bb1a0855a8fc7353507929134
SSDEEP 24576:5LJnJiTk3R3waE4JrO6SnnrFb4PM4MYgLxEVyGLQ:5LJnJK8R304l0j4MYPVyGLQ
TLSH
T17775D03DD2A810E8D4B7C2B4815A1B96FF31346D2B2169CB69B4D4313F12FD0AA79F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 39ebe72b92cee782513045f5ef47bb41597577a4d12b779686caf3f39b547774
MD5 3ddd38ea0bf31fecb6c71821e40c4f09
SHA1 34022e1a67aa9f22b0858349197bb187b0657d23
SHA512 71861ff4df2ff9c90860229bf95cb38eaa2db7afc26cbd766b211aa289bf9d28e9bfa922f43c9545acbe83e0af67980a7e9121a894e1152d91fe148501aef04e
SSDEEP 49152:89GqCzDScAZmlvTcFg8Ph6pj4MYPVyGLX:GtVb
TLSH
T1DD955C05F7EB5298E8B3CAF1C96294159B327C509B34F7EF0A80C96A1E32BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 2e0a88bb32aa131c39bc296f3e955dfa5d32daeae5665fe90c7157dfdb54adc6
MD5 6280cab8be9c9f12fdd26c108ea71cab
SHA1 d1024164282892896da95db584f767fa8c53d135
SHA512 df08931bb7d262fa7b30d3378c2de36d987425e219a3aab6201f1ba0141f7487cb65c6184190c00f6f8e4a614e56e8ee138d02fcfaa810e320b22375dd49668f
SSDEEP 24576:jlYJeXm5jUuEsSnnrFb4PM4MYgLxEVyGLD:jlYJeXmRUuEfj4MYPVyGLD
TLSH
T1C655126E3ADC30E9D66E8174C1A24A84E331F471A71273EF52E0D07A1F27AC96D39B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.3MB
SHA256 366ef60923d3fa5ee7112e31f388bdb7fae0e9849d8f9cdbeb0e30dee480f49e
MD5 c12233a4fc7d7853f89e489b0054b718
SHA1 476ee5df750a34fc79d0e6b2c842b932fd56ffe9
SHA512 3830838960fa4a7f19372f0bcd74e74ef5916c11fe73ebd1a065d90dd424212f0a893539566a0b9e4a5a52299e70939b3e7b7e8af0108b06bdef73056a2f70dd
SSDEEP 12288:zwu6kyo34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilS:zVty7SnnrFb4PM4MYgLxEVyGLs
TLSH
T17E55125527D820E9DAB90670C5A242D4DA25BC21AF21A3DF66D0F52F3F377C8AC71B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 f954885a66efe28167b650c73b145ea228f38b9f31b7e81dacd8665eb489baaa
MD5 075772a6a7f7c0148b3ed3f362dedd67
SHA1 35a0e79cb35002da68ee25bc876b0374dcc293f0
SHA512 69f4792036764a6e5c23132e30f039ab6613a57573556482d719f708bbbf6b346688f70298b42049eb9a9d1cf8e5cdac0af98f04cda32bc48c2ea41c96feb930
SSDEEP 12288:mPj34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilf:i8SnnrFb4PM4MYgLxEVyGLd
TLSH
T1914523AA2BDC20EECF6956B0C17556C8E2157831FB71715F76C0B4363B3B28998B1B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 ff5eb48945525fa14fef1e08206c6f1fcc9614b0a0acbff1bf34391756676cff
MD5 48ddfdf35ec4c6602539f0f8f6d0fe1d
SHA1 f37ac469b5bc1ad21179aa5478583c5c906a0cd0
SHA512 66137593ef45a325e080e322653dc0151c770fb233dd9b598a4a6e6ed8c5165b4bd9cbf73e170ac3df75ef203618e9094a1da1b2f9f06159e724a61512cb3c21
SSDEEP 24576:zC+TyQIu93VAumZr7jmVSnnrFb4PM4MYgLxEVyGLl:z/TfIq+Yuj4MYPVyGLl
TLSH
T1BE558D1DA7E91DCAE276C675C8A34493E633B872137196CF2044C07D499EEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 cae168d29c26bdd5282f12db59e7cee1e47df2a3f87b64310050fba9eea0f044
MD5 c4ddba8eaeee04e5c2fa5a458d8e425c
SHA1 e21852ae2ee2b7cc0fb28e3fc8374f8abc1e156b
SHA512 739cdd5523957c12beae2869e18c49c33fbd0060e08e0da28b5078ad061b0784b21a4118af8356f7e0708b29777479777442f77612817cf99fdb3ffe2126330a
SSDEEP 12288:CcyrWOstaa3kcsH34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilq:zLQikZISnnrFb4PM4MYgLxEVyGLo
TLSH
T11965F10FB7AE00E9D5AB8278C8954245F6737431972263DF0290C77A1F6B6E9BD38B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 cb8c1644735cb7af4d82d19491f692e4c06306459bef123469796e59ee09b570
MD5 93df1a9d3b18500800fb80c5bc90388a
SHA1 259b721111479e085d08e382ee0747756df616db
SHA512 2d4c382cd95c2889376ba1b2d772ba7173fd4c31342310a766b8f4c3da1e292d988ff7a05189447d5af76a907dd3d530ecd87f0cde7b000546a9f2dfef532caf
SSDEEP 49152:MpJFwrPpGyqWo6cbT2TZ8maJO35NPHXogsS7Q78ZGAvL9vnF35LWAPEj4MYPVyGW:NpC7b4+80GTkKVu
TLSH
T13DA57C3DE2F810ADD9AA8375C5461665EE71382E3F2015DB01B0C578BF1AEF19A38F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 69903aa003934224adc2897d436d36fc3e41a147ba74b5139c56a4cc43d3d705
MD5 caae691e16820316e96fdcaaef030363
SHA1 76f5acf347836c9af7adc28521f75e37bee7688c
SHA512 e37aa1eca2b705c2896f7427042e7f1382513f596045aa635d37dedaff063b97562acc7fa69991a791e5a7c4a15a9b72c9dc198875076f5329f54fc4761b0474
SSDEEP 24576:YSAwJPE1IDAo+4Kt+l44135UQTSnnrFb4PM4MYgLxEVyGLu:YqPCIo4Kol4/Qcj4MYPVyGLu
TLSH
T13755B02AA7F946E5E17AC7B4C663C601FB727822133163CF5290813E1F16AE85E79F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.6MB
SHA256 070ad2482c87e7d8321e37329f62d03e5a782d4ab7f3202b382383a1e737a676
MD5 ee48f7de4d2a1d1ed45b31b7a0f00dba
SHA1 9e82f8e3b17ac9527d6cfc938e968fd296d22275
SHA512 46efb99baf0a06fda0c88312b664bcc06310ca04a8b39b08a0f65d7e66874b0ab4bffbcf6b8d905cbfaad6e836aa783499bb6f01432ae0c69e67433f4945badf
SSDEEP 24576:AyLXPLcM94tDSnnrFb4PM4MYgLxEVyGLE:Ay7PoLtMj4MYPVyGLE
TLSH
T1AD75E13EE76D04F5D57AC27CC2A38506F67238AD033166CB15A0947A2F6BFE46939B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StructuredQuerySchema.bin

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin
Size 414KB
SHA256 e67e330837a6b2f6d5f76815e7235a512b54b1c90f2ad62a3e9d142ae6939c8d
MD5 16b9618962f5623ca791a1366eee5708
SHA1 f0d257511952f075b2a0ec7d8e8730c3e464461a
SHA512 18e1d5a105b87fc72df94645685f5a8d3f593df2d3a9b8652b3b4a4ceaf92d3c7a67b0c08847186149dd608428cae8f1b3bc844bc7aacfc9e3219da823ca2fe2
SSDEEP 12288:vMUC7+vlk3n61mSkplXZ5RwmF9n4w/TSD:vXhl6V/i
TLSH
T124945F36BF88CB22C59A15748897C01A2E30A7C49E04CF6B73DC513CFA576685FBA359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.4MB
SHA256 dfd78c012b40b978d7367d57354c732ef1acd3d2bdb1fd9e6640d5b29fa6c2aa
MD5 b09f11a23134c60d46474a8526f92197
SHA1 fd55a2fe4c7bcd416186010f7d6dfe355c438a8b
SHA512 b0a4f68e7d2a8a0e3fea5c7ce20bc73e1ce162466aad6977f21d5439e88645abebc4545d43f8ceec8a57c9819797e00206658c3123a1f242f842aa451e5842a0
SSDEEP 12288:J9lyvj3IkxjbBzX34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilb:JWv8qjpYSnnrFb4PM4MYgLxEVyGLh
TLSH
T10165125E26E820E9E97D4270C1768298D131BC726775B6EF32C4E87B1B366C4D83AF11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/440-211-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/440-376-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/1196-172-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/1408-175-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/1784-209-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/1784-375-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/1820-130-0x0000000000E30000-0x0000000000E90000-memory.dmp

Download

memory/1820-174-0x0000000140000000-0x0000000140241000-memory.dmp

Download

memory/1820-124-0x0000000000E30000-0x0000000000E90000-memory.dmp

Download

memory/1912-138-0x00000000006F0000-0x0000000000A68000-memory.dmp

Download

memory/1912-139-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/2080-210-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/2080-374-0x00000000006F0000-0x0000000000A68000-memory.dmp

Download

memory/2836-96-0x00000000006E0000-0x0000000000747000-memory.dmp

Download

memory/2836-169-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/2836-101-0x00000000006E0000-0x0000000000747000-memory.dmp

Download

memory/3284-208-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/3284-373-0x0000000000680000-0x00000000009F8000-memory.dmp

Download

memory/3288-347-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/3288-17-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/3288-26-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/3288-23-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/3320-79-0x0000000000840000-0x00000000008A0000-memory.dmp

Download

memory/3320-167-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/3356-170-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/3696-51-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3696-43-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/3696-371-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3696-49-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/3832-56-0x0000000001910000-0x0000000001970000-memory.dmp

Download

memory/3832-68-0x0000000001550000-0x00000000018C8000-memory.dmp

Download

memory/3832-164-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/3832-372-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/3832-66-0x0000000001910000-0x0000000001970000-memory.dmp

Download

memory/3832-62-0x0000000001910000-0x0000000001970000-memory.dmp

Download

memory/4080-41-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4080-32-0x0000000000840000-0x00000000008A0000-memory.dmp

Download

memory/4080-38-0x0000000000840000-0x00000000008A0000-memory.dmp

Download

memory/4080-369-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4172-112-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/4172-118-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/4172-173-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/4336-13-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/4336-346-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/4396-368-0x0000000000E40000-0x00000000011B8000-memory.dmp

Download

memory/4396-0-0x0000000140000000-0x00000001401C4000-memory.dmp

Download

memory/4396-9-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4396-1-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4396-222-0x0000000140000000-0x00000001401C4000-memory.dmp

Download

memory/4468-171-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/4468-370-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/4516-390-0x000001DC4E7C0000-0x000001DC4E7D0000-memory.dmp

Download

memory/4516-389-0x000001DC4E7C0000-0x000001DC4E7D0000-memory.dmp

Download

memory/4516-407-0x000001DC4E7C0000-0x000001DC4E7D0000-memory.dmp

Download

memory/4516-409-0x000001DC4E7C0000-0x000001DC4E7D0000-memory.dmp

Download

memory/4516-408-0x000001DC4E7C0000-0x000001DC4E7D0000-memory.dmp

Download

memory/4516-411-0x000001DC4E7C0000-0x000001DC4E7D0000-memory.dmp

Download

memory/4516-410-0x000001DC4E7C0000-0x000001DC4E7D0000-memory.dmp

Download

memory/4516-405-0x000001DC4E7C0000-0x000001DC4E7D0000-memory.dmp

Download

memory/4516-404-0x000001DC4E7C0000-0x000001DC4E7D0000-memory.dmp

Download

memory/4516-403-0x000001DC4E7C0000-0x000001DC4E7D0000-memory.dmp

Download

memory/4516-402-0x000001DC4E7C0000-0x000001DC4E7D0000-memory.dmp

Download

memory/4516-401-0x000001DC4E7C0000-0x000001DC4E7D0000-memory.dmp

Download

memory/4516-400-0x000001DC4E7C0000-0x000001DC4E7D0000-memory.dmp

Download

memory/4516-399-0x000001DC4E7C0000-0x000001DC4E7D0000-memory.dmp

Download

memory/4516-379-0x000001DC4E7C0000-0x000001DC4E7D0000-memory.dmp

Download

memory/4516-378-0x000001DC4E7C0000-0x000001DC4E7D0000-memory.dmp

Download

memory/4516-380-0x000001DC4E7C0000-0x000001DC4E7D0000-memory.dmp

Download

memory/4516-398-0x000001DC4E7C0000-0x000001DC4E7D0000-memory.dmp

Download

memory/4516-397-0x000001DC4E7C0000-0x000001DC4E7D0000-memory.dmp

Download

memory/4516-383-0x000001DC4E7C0000-0x000001DC4E7D0000-memory.dmp

Download

memory/4516-395-0x000001DC4E7C0000-0x000001DC4E7D0000-memory.dmp

Download

memory/4516-396-0x000001DC4E7C0000-0x000001DC4E7D0000-memory.dmp

Download

memory/4516-394-0x000001DC4E7C0000-0x000001DC4E7D0000-memory.dmp

Download

memory/4516-382-0x000001DC4E7C0000-0x000001DC4E7D0000-memory.dmp

Download

memory/4516-381-0x000001DC4E7C0000-0x000001DC4E7D0000-memory.dmp

Download

memory/4516-384-0x000001DC4E7C0000-0x000001DC4E7D0000-memory.dmp

Download

memory/4516-385-0x000001DC4E7C0000-0x000001DC4E7D0000-memory.dmp

Download

memory/4516-386-0x000001DC4E7C0000-0x000001DC4E7D0000-memory.dmp

Download

memory/4516-387-0x000001DC4E7C0000-0x000001DC4E7D0000-memory.dmp

Download

memory/4516-388-0x000001DC4E7C0000-0x000001DC4E7D0000-memory.dmp

Download

memory/4516-392-0x000001DC4E7C0000-0x000001DC4E7D0000-memory.dmp

Download

memory/4516-406-0x000001DC4E7C0000-0x000001DC4E7D0000-memory.dmp

Download

memory/4516-393-0x000001DC4E7C0000-0x000001DC4E7D0000-memory.dmp

Download

memory/4516-391-0x000001DC4E7C0000-0x000001DC4E7D0000-memory.dmp

Download

memory/4532-213-0x0000000140000000-0x00000001401F9000-memory.dmp

Download

memory/4784-168-0x0000000140000000-0x0000000140209000-memory.dmp

Download

memory/4784-89-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/4784-83-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/5080-212-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5080-216-0x000000000A520000-0x000000000A528000-memory.dmp

Download

memory/5080-192-0x0000000001EE0000-0x0000000001EF0000-memory.dmp

Download

memory/5080-176-0x0000000001C30000-0x0000000001C40000-memory.dmp

Download

memory/5080-156-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/5080-150-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/5080-377-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5112-52-0x0000000000840000-0x0000000000BB8000-memory.dmp

Download

memory/5112-53-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/5112-29-0x0000000140000000-0x0000000140136000-memory.dmp

Download