ec8060e8dfddd09e2ea2319040c7b80ff735e9f7cf078721afe1974dfb1a1d76

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20250619-en
resource tags

arch:x64arch:x86image:win10v2004-20250619-enlocale:en-usos:windows10-2004-x64system
submitted
07/05/2026, 04:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
Size 1.3MB
Sample260507-e86tcsez5s
SHA256 ec8060e8dfddd09e2ea2319040c7b80ff735e9f7cf078721afe1974dfb1a1d76
MD5 3dd8f6a795ca6601785decfee9d9c0bc
SHA1 506c3d98a0dd70fbfdfc08a0b54cc0ec6f17bcf8
SHA512 c428c89ff45d285780b6ba67e4772bc200a318d9feaa6b6c25421649a876cb99391bc311f9e474fd9f397f71f991a1eda690b31761c35586c8f1b308c7796820
SSDEEP 24576:HuKxZ8VxWKAZQUF3P+iMod87mLWNNrI8nQ/tbw/2Mkjy6Fr7g0or:HuC8VxZUF3P+97mafQ/lFTjN4
TLSH
T14E55CF19B7A945E5E073923A89628251EBB2BC111B31D7DF5294732F1F33AD40F3A722
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence ransomware spyware stealer

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-636600838-1632888396-3521553955-1000\Control Panel\International\Geo\Nation	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe

Executes dropped EXE 22 IoCs

pid	Process
3820	alg.exe
1944	DiagnosticsHub.StandardCollector.Service.exe
4480	fxssvc.exe
1360	elevation_service.exe
1928	elevation_service.exe
4460	maintenanceservice.exe
4692	msdtc.exe
4408	OSE.EXE
4940	PerceptionSimulationService.exe
2968	perfhost.exe
468	locator.exe
3576	SensorDataService.exe
6076	snmptrap.exe
4584	spectrum.exe
5768	ssh-agent.exe
5976	TieringEngineService.exe
5964	AgentService.exe
4052	vds.exe
5076	vssvc.exe
4552	wbengine.exe
4288	WmiApSrv.exe
3440	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 31 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\376ad67e8f562a88.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_85250\javaw.exe	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevated_tracing_service.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_85250\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	DiagnosticsHub.StandardCollector.Service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\setup.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\133.0.6943.60\chrome_pwa_launcher.exe	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\133.0.6943.60\chrome_pwa_launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000966dc444dbdddc01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000525ad044dbdddc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002893af46dbdddc01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e9061f45dbdddc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d1ceaa46dbdddc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f91cf444dbdddc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000095708644dbdddc01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000025d0c644dbdddc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004181d744dbdddc01	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 42 IoCs

pid	Process
1208	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
1208	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
1208	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
1208	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
1208	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
1208	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
1208	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
1208	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
1208	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
1208	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
1208	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
1208	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
1208	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
1208	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
1208	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
1208	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
1208	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
1208	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
1208	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
1208	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
1208	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
1208	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
1208	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
1208	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
1208	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
1208	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
1208	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
1208	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
1208	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
1208	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
1208	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
1208	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
1208	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
1208	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
1208	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
1944	DiagnosticsHub.StandardCollector.Service.exe
1944	DiagnosticsHub.StandardCollector.Service.exe
1944	DiagnosticsHub.StandardCollector.Service.exe
1944	DiagnosticsHub.StandardCollector.Service.exe
1944	DiagnosticsHub.StandardCollector.Service.exe
1944	DiagnosticsHub.StandardCollector.Service.exe
1944	DiagnosticsHub.StandardCollector.Service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
656	Process not Found
656	Process not Found

Suspicious use of AdjustPrivilegeToken 43 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1208	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
Token: SeAuditPrivilege	4480	fxssvc.exe
Token: SeRestorePrivilege	5976	TieringEngineService.exe
Token: SeManageVolumePrivilege	5976	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	5964	AgentService.exe
Token: SeBackupPrivilege	5076	vssvc.exe
Token: SeRestorePrivilege	5076	vssvc.exe
Token: SeAuditPrivilege	5076	vssvc.exe
Token: SeBackupPrivilege	4552	wbengine.exe
Token: SeRestorePrivilege	4552	wbengine.exe
Token: SeSecurityPrivilege	4552	wbengine.exe
Token: 33	3440	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3440	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3440	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3440	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3440	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3440	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3440	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3440	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3440	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3440	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3440	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3440	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3440	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3440	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3440	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3440	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3440	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3440	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3440	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3440	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3440	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3440	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3440	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3440	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3440	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3440	SearchIndexer.exe
Token: SeDebugPrivilege	1208	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
Token: SeDebugPrivilege	1208	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
Token: SeDebugPrivilege	1208	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
Token: SeDebugPrivilege	1208	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
Token: SeDebugPrivilege	1208	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
Token: SeDebugPrivilege	1944	DiagnosticsHub.StandardCollector.Service.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1208	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
1208	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1208	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1208 wrote to memory of 4024	1208	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe	86
PID 3440 wrote to memory of 1476	3440	SearchIndexer.exe	112
PID 3440 wrote to memory of 4388	3440	SearchIndexer.exe	113

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe"
1⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1208
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Delete /TN "EVKey - Vietnamese Keyboard" /F
  2⤵
  PID:4024

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:3820

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1944

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:4156

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4480

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1360

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1928

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4460

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4692

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4408

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4940

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2968

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:468

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3576

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:6076

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4584

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5768

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:5908

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5976

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5964

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:4052

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5076

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4552

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:4288

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3440
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1476
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:4388

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
Size 2.3MB
SHA256 0b9bd8247de248ccbfbb5cd6835a4bd42e2f1e1297a6598eadb6943329506f4e
MD5 16adb8ef4efb9666f6a2d4af83a0a93f
SHA1 44a7851c7b22380f1e3a1895635a9353f89d031e
SHA512 a348739124612e2d856d20127976ebee1932ec6a07472fa4690b7c73c9655b8033a4d6860138d0248443d30a0e143142f4790532af961eed6b17fd3c1b05c168
SSDEEP 49152:p0X4/T3QDRmcQsqAU7BYYkG/Q/lFTjN4:M4EDRQDsLm
TLSH
T135B59D03F2D941E8D06AD178C746953AEA727C890B34A6EF0790B2592E77EE45F3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 4d6d251f0869eb5ff8083cd413106f7c015bdbee2eb4065bca40678ea23711d6
MD5 8a54e51ae7bf6609dc78b0836bc2f386
SHA1 498b093833a8cc8444b02d78d2a15db49f1890cd
SHA512 1f4e78985a9a078cfa3e92c3f41701e8c9795fdc5d2284a6a2d833795c9b90c4fa8cfeb3a7fc2e2af63c003cb545d8b20fca041225378e13c34ef38f56bb4de4
SSDEEP 12288:L1XLsswWkxy2lRq2czAhGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWs:xXYfDtczAxnQ/tbw/2Mkjy6Fr7g0os
TLSH
T13665F12877E448F9ED67827DCCA28502EB73788547A0E78B03A495295F373D85E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 3c49114b2664af370d87a509af0b73707f8ffdffc6531c35ea26474a4bdc26ea
MD5 8f641bda9ae2f4f3753ff65393f0277d
SHA1 e091219e54e2e4c96150a9b7196b33772ae35f3d
SHA512 06131714bca8839f155fdcf3e269b799e6d6a5369c2bd76dc3950dc99354ca1eef820f737bf58c24a7a4d06e756b8e3e59d6a26537f54c97f03cfe902b473e20
SSDEEP 24576:A0Le5ji0hmxLrMWnQ/tbw/2Mkjy6Fr7g0on:APji0AlXQ/lFTjN4
TLSH
T104859E15F6748735D073C0B9C5D2A68AEE7230825B308ACB4286D77C7E677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 7417fa5f59dce3e67f4477260362e355b201045b1031a4251e988490f2cd88e8
MD5 9eb337b46e1484696a93cc3a4016cc63
SHA1 95e4d3d34f13bd37a7d23abd68803e9a9d05a721
SHA512 17924d46519fce14dcbb4d26098b985fc614b709c96c5fc5fad55e710f09958347ee3f00069e2a48a359c14d1e5406af73081c6928b23d6558f1e1d8932b0dfe
SSDEEP 24576:ga7/ezSC6vUyD/aqgrvWE6q8wyu4nQ/tbw/2Mkjy6Fr7g0o+:X/ezSC6vUzPvxHjybQ/lFTjN4
TLSH
T163755D25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 aebcfec9b542a53e5e21bc2aab0bd2d368414c8e4122314c5c65c2e10fbc8c49
MD5 96f83fbec13499126b6be8ee4c7c8fd6
SHA1 32add66af66a1d7c474ca379c0b15f4d45efb25f
SHA512 eadda9b2de13a6c2e3d72b87c9d833a651d2372b9fc93b2bdf3e319fdddd9c8d8e5a6f58bba25921a451c115f00727066b019ed3a9adb879aa05fa817106cce3
SSDEEP 24576:YVbqPb88hv/l+6tnQ/tbw/2Mkjy6Fr7g0ol:YVO88hXl+qQ/lFTjN4
TLSH
T11D559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E777E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 3f1cf9580f74a796ca5cc5ce1fddafc4603d9183197e6f6c2aab0e8e4dadf131
MD5 0d1174bfbdd1e616f9afd0e302500f48
SHA1 0c9c4d2ffb54d286d573754eac540ba018f0ff8c
SHA512 531ead0e147b5de5095a3df9293cb0f736211286afb4cfb96b75f5e55212249db36e3daec31236a955e7f2e82812030b81727408cc9bb22bfc1a14d36b710701
SSDEEP 12288:BziGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWg:BzinQ/tbw/2Mkjy6Fr7g0og
TLSH
T1265523796A24F897FF2B06B15C8284826B7B0EC1BFD0AB4E7744362D857C39446DB381
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 626a8dcdc0ad382b9c4d00da3935096995d7d2c7093acdc1bbd21f68972c8352
MD5 5322f141aff85f03956ee33279727d83
SHA1 bbfc7f5e1c228dcd448b3919491158f79c4a6e84
SHA512 c80da5653951c99d2e4499a2556984ec56e37be370810ae6a5ecc28ea66a4cae0559d24c80b53bf2cfbdec88543f6f8a05b3780494142b3b1a936c6ea034f7c7
SSDEEP 12288:keBNUbTVO86UVGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWf:kJIU1nQ/tbw/2Mkjy6Fr7g0of
TLSH
T1E275CF3BAE28FCD2C67E4DB85A918640D77278704F61A3CBD164830EDE276E01E7AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 fe0b918ac7ed3f690c7b314a70da1969c85ee23dc86d4c8115782797af24ac6f
MD5 b15c04bd3ca92b59ff2baaaa5ba1768c
SHA1 70a059b6fb84c31411700d97d8ce864ed245651a
SHA512 1225a455a09ed965a00a8ac9c52170ee8ca1310515108a0895641085ccdb813b0ef18cb717558f70ce929168fb3c1febf0fd6f093f51ffa346e28cfc0c0e7616
SSDEEP 49152:kQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THd:kQvGAdlCEL8c/yRNw5CLLm
TLSH
T109267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 3c9ba852382d63f2d99492a0c8b38a33719860c2c15fee36053d1a5d336edf73
MD5 333ee5c01494ba9b73c50ec277aa62ff
SHA1 0d8762bee3a993283a0043884940fb84e4272127
SHA512 be29f3c80b31d49d5fa290a4f08c1ac319bc115c5321e37634f1798e0fa9f21e8e674de5f46df72e9b804e101cd9d2b314429f591c436961b2eeafb2ccd9f58b
SSDEEP 12288:uAwSfxL/2Dc39DLLmt0LDQewsAjnGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg4:TQewsAjHnQ/tbw/2Mkjy6Fr7g0oO
TLSH
T1A775E031FE74E436C77F0DB21B22C706593D6A604FA11AC3E3A84A9D99342D22776B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 2a4a5c249d9c3126c1976300ea5d5c9aebdd6ed1a7b164774145be54c7c23c5d
MD5 35ff54d8a77cd3bb434072fe8b6f6b07
SHA1 78cc4ea037752febb7b6d346bcdec1529c38ed5a
SHA512 e4685bbbeb30af1379ee1b5a85fcf7647c3d743e233f355b46e3b8fca086efcdfb9d539588afcf29ab7f1d02774b4e6a3b815b0c55b530fbe54919fd97205461
SSDEEP 196608:NUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJH0L:NUEtQevvqc2W1cpV2EI32
TLSH
T191474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 9fea8ddbfaa8aceba5c45b4045116b6865a5f66c0bec8f54e731a9cb8ca0bf0d
MD5 0e2a9da0397e49fb219ea10673fad293
SHA1 4348142f882cde8e6eec91e5dfbe41fed611ab13
SHA512 c44a6a89e355c1b8ae907b2ced577e832a4b4d515cb0a54e305cc3c7f9f193f73ecbcab5e9ebc0f0ab7e9ac2a75e425bf0c068ec7f976a4d52a76c34f6312390
SSDEEP 49152:TCbRquA/m2yL5zQfFiV+XenmE3/znQ/lFTjN4:soqtVjnmfLm
TLSH
T197D58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 24b391152cff6576c3b3ad9e9298375d4fdaa6ac9602cbeccb48ab073de6dace
MD5 1c79bb44f3f136de32f35ced867c6ded
SHA1 0bce49d77a9b366f2e3333a958d4ce426f898a43
SHA512 ea5f76c0ba32d67a57359502eed6cf06bb78abaf34fdd530d23c5498d3b6b9dba9fd916f01e3414cdac0409eac952e7c51b15e3e9f0f218e1514050bc7553fe3
SSDEEP 24576:lAhGLJIFoiwtA5l7S53cnQ/tbw/2Mkjy6Fr7g0oe:lAMyFoiq5sQ/lFTjN4
TLSH
T13135AD81E7F955D4F5B3AAB899B68171EA77BCA65E31C20F2250D11F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 b677719201d8f43bf3464199f9d9f5b95fd4f69e0c090a6c020f28da8024a1ea
MD5 581080df23bbf448e00d8701de67b233
SHA1 13dfdd77db58d0531e2fd89f2d4826b5b5439143
SHA512 b343485fcdfa4a2f7ec189a9482e2f28745c83b4b3c80517acf97f2f671e9dbb0f3fa95d205adec03377562b951a79ca6af3490b56bc90f177a0954e59b6c096
SSDEEP 12288:zmw5HEjsChN2BFgl0WDm+CYGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMo:SwuHOW7nQ/tbw/2Mkjy6Fr7g0o9
TLSH
T14C65F14A36A45CF9EA6742388993C136F7B3BC422A61DB1F1760C65B5F373606D2EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 14d7a425ca386d5495492f78b86c44c506a600eadde06adc2e0bdab5ecf3282f
MD5 85f6f3079f805f8a9d894a98c95030dd
SHA1 ff3fa9943a377e5a4e965f858ae688b508bcb116
SHA512 7363580630f5c56197ad27779d99b78462e34475d5fefa07189b8a1bb6015d3bfc4770e75f5fceec4cc1a5bd851227594759f11e8dc6c435b083a5c998e26d5d
SSDEEP 12288:0XZ1IyXGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWw:0Zu+nQ/tbw/2Mkjy6Fr7g0ow
TLSH
T17355126933A4B0FAE6674278CCE28646E773388267B183CF275402695F3B7D11E7A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\chrmstp.exe
Size 6.6MB
SHA256 82612fa2fe55cfc685d83aef383e9d8473ed6f06a56dcfefb674e035187d5506
MD5 1ec8e298eb9723754164824c7a741196
SHA1 c00af23f51940ebc96af2e2d30be54dc5eab2ad2
SHA512 f7d1d268357123830b584358aa286670ea340447d88035cbd058f49d51336db90bf5b4e84ffd80fa5d5ed25ff484090024c451f613c2d225eef7cc7d4516dd3d
SSDEEP 49152:YTEoba3y9bVILkmvguhO4NOP5PlcQKvfjBbPZu7H4mYwrjDDSNdihLuZykH8mYxm:Yut4LcLBbPU7H8SUY/P5h93Lm
TLSH
T171667D53F3B500A8E05ED9B4CF3956229B757C4B47B092EF269436E11A72EC47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\setup.exe
Size 6.6MB
SHA256 5be7fe84332a300603ab7f68bd20406239b948cd1ff850d6ba21a0472594d04b
MD5 3e023fce9fbabf2dee114c80eaa7fcb8
SHA1 c897c6cfda2a7b58ba66b99c8057b9938026ba74
SHA512 e6da2e20f139e2906095c02034fc0b61171a8e9fe64443e82e19317e3fb9736b3e29c8a2d5ca6f9540f3668d3167ea0fac728e9a8766aeb70ae76740aac5945d
SSDEEP 49152:VTEoba3y9bVILkmvguhO4NOP5PlcQKvfjBbPZu7H4mYwrjDDSNdihLuZykH8mYxm:Xut4LcLBbPU7H8SUY/P5h93Lm
TLSH
T15F667D53F3B500A8E05ED9B4CF3956229B757C4B47B092EF269436E11A72EC47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\133.0.6943.60\chrome_pwa_launcher.exe
Size 1.9MB
SHA256 d3dc499f9c9ff93dd572bb0b6b9eda1a4543f90e955d1bec7466f2e113e4fe1a
MD5 7bab25b64e3fcdfdf9a1329a69fb397a
SHA1 1495996ad9c41edce30c407c30a5ea2256624367
SHA512 279da7190accf80881a5f97110842582406c0c756128714db6fa83c52fb3af58a3dd20deb994de41696cef233f44fe15eaae81c4bf00df751994aaaf90ed9206
SSDEEP 24576:FXHhwegnv8593atGFEtDUeRQt5iMaJgv4W2E4Ps1nQ/tbw/2Mkjy6Fr7g0oU:FXenvGq2EtDUtLuXW28Q/lFTjN4
TLSH
T15C95483672F300A9C45EA0769F56473196D27CB1CFE0D3DB8241721A1FB29D47A3AA1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevated_tracing_service.exe
Size 3.3MB
SHA256 d03cad071169410073b256c95f74cfa980740396b9c06f7bc66141a4de754c9c
MD5 d061e3e3545456c061f89e78acce63ed
SHA1 46275d6447d8c6acd67ef1146c1d4a5268ca37f3
SHA512 5f3c006cfec43198cbaa70e1e99bbc54bf8dd665c1e4520d649c082168b480bac549d9ddfd59738a15036328308b0f30e139edbd3c36c91bc603c7ab4ea7d542
SSDEEP 49152:FFKbxUEEhQ9gsfxp6MZEtEYVnNKkNIHNNlCX0cXz6GfpksGLP3/N7Q/lFTjN4:xKKsnZEBSkNIHNNIhj6MpkJwLm
TLSH
T1EEF57B13F29900E8E05DD1B8CB4A9622EAB2BC850B3576DF0650B7562F7BED45B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
Size 2.3MB
SHA256 707ac47d96c981943987d2467f1904bf22591159a257932b6e83c1c7ba209361
MD5 065b59874521a30cc48b3a4e39c4f6bd
SHA1 1d7a350a1c15e77914149bb3f6293bad0348aada
SHA512 0bc62a81221861ce85f5a2b3dab19f7202f2c60ab62b15eb85e8b308f81d1caec1e162f1f1abff788c612832a504acb544901aa6978992999b6edbd4786beb0c
SSDEEP 49152:P1xWevYkaNRxiCtSGAeA4msvxQtghSpORQ/lFTjN4:JHMSGCHLm
TLSH
T1DFB5AD07F2C941E8D06AD574C7469236EA62BC8A0B34B6DF0790B2562F77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\133.0.6943.60\notification_helper.exe
Size 1.9MB
SHA256 97e6bda5e32c57cadd413c57d48534ab6d53518993a927535811ac543b8e4fec
MD5 9c1bb8aad406c2ef784dedd42cb59556
SHA1 ee0213247fcb8d55925de4ec4f77971236d0f191
SHA512 1074aae697ae2742d7d7e28837ad04069a48df2ae42be11e1a16cf139ba34def8fc751902cadc54f18994088e114cc38760eb09dce51cb6721649b87f8b2fc70
SSDEEP 24576:SvA5Wwt59ZKNT4cQywprNzP8AqYUI8byGrXP3xvHrpnQ/tbw/2Mkjy6Fr7g0ov:SvAl59A9GJzXq9I65XPhvdQ/lFTjN4
TLSH
T11D95CE13B29940E8D05EC1B8C7568636EA727C820B34A6DF0798B6592E7BFD45F3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\133.0.6943.60\os_update_handler.exe
Size 2.1MB
SHA256 ff0720244dd50f3e540a9001c950bef9fd8035043147da45dd48ef1b4f3584b8
MD5 ed611525b54195cd6bd7b2d2480b48b7
SHA1 a1a81cfce1f2197d61cdfaa1a443e0cfc7a91012
SHA512 2e57ba2e116c7130ee5e22380eb8be58318c66db96a0b17598d0da55d39f603910515bd98b1ff50eb7da5ec4965e8973d2ae0453c7bafd1b3149aae49c5ff582
SSDEEP 49152:SXZNoU5kqRZvTE9lDKGWfMh+Q/lFTjN4:mFZI9lhWGLm
TLSH
T18DA5AF17B2D940E8E0AED274C7668522EAB27C410B38A6DF0790B2591E7BFE45F3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 1.6MB
SHA256 04aa837a9eb2b02774732bd68f9ba1e7f6b94a3fb6ef6020de69e2f68cfa2047
MD5 241c3964b2957a7e526487c01ec50f86
SHA1 cd1a1345a95cfa51a67aebc7a4590d1763c11e8f
SHA512 f681f3f281fed5cb47a780f93de9e48694e199795dd98dcf61066591dbce0d142d79e748d25577f6812fc46d930b630b316bc98fdd766663fa4b0e878b4fc118
SSDEEP 24576:V09xwCr/8dMJlrNs4ffuTdskLV+gvnZlsnQ/tbw/2Mkjy6Fr7g0oD:V0FrFp3nuT26V+gsQ/lFTjN4
TLSH
T14375CF17B69941E8D02AD5B4CB668132EA727C810B34AADF0790B3592F7BEE45F3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 6bf980c52c61726f7b65ea0326211a8c8e3cd526a8ff0ec21caa426404a370c3
MD5 795f3b59d70b26038a298f913fa247b6
SHA1 b8f0a09bb17031c20a663713bf7d45a46333d6ce
SHA512 a877a944bee871be71fba065613667c4bb9ff12df4b1e7261e8db0f0058ccfae7e71679f779fa3eb53e434d944a80d13da111bbad130485f73311d5ea3a230c9
SSDEEP 12288:OqGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWC:OqnQ/tbw/2Mkjy6Fr7g0oC
TLSH
T1D45523697964F98BFB1706F18C828182A77F0EC6BFD1938F77482129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 5d6e63da3e98428e96d05ec26533fd27b65adea1cd736f82d321acb5aaa7a866
MD5 9ae36ee55e729dac72330c573bced483
SHA1 78ddd55a991341cc6f130e504e0b31141a82afb1
SHA512 e9b84e30445c6a7a64e24fdfe7bfda193eb930336b865d5ba2625c0e792ebaf2d6cd011ac7e75f764da979ba925f9074a2e9ab29d492ab6cad9d07d296b10f4f
SSDEEP 12288:ijGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWr:iTnQ/tbw/2Mkjy6Fr7g0or
TLSH
T1365523797965F98BFB1706F14C8281829B3B0EC6BFD1938F7B482129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 5da5addb9aa98afecda3dc19f64c0b911d06bf965d7fd657ceb08aea1224fc2b
MD5 b1816def42aee280efa942e2e09270fa
SHA1 b98b9d9f3bdcb178c0b7b011fa6f655ca5ee17c1
SHA512 5a6ebb73411248a8ccf1a70b6db6c64225cb8d983c9e86c5ca4cd20adf4b273f82c7f22966cc43cdcb46f0685602d7202f117bca650bd2093b963397a9a34118
SSDEEP 12288:8dGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWr:89nQ/tbw/2Mkjy6Fr7g0or
TLSH
T15C5523697965F98BFB1706F14C8381829B7B0EC6BFD1938F7B482128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 2bd23001e9713138aaf2962f451623f6bb8c912946140482f93ca7028e49c70e
MD5 204a5cd27e5511ebd952f4761b648a07
SHA1 3389b99c16bd34f14ad66aa3d83aa68be932e974
SHA512 2572306e00b852173fd09666206ffe3b0675ec3001488f86ee27fa7f6402743c630e3f74d1eed194a7f02f6d1470cc5f4007364e26a0660e1adc3eb200377125
SSDEEP 12288:lV8GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWN:cnQ/tbw/2Mkjy6Fr7g0oN
TLSH
T1555523693A69F4C7FD2742B4CC938142E77B3DC5BBA1A38F6B04111D4E793D41AA6B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 025e5451d128428f98673d979dfca43a37c6fdaddeacae9c2c4e644d9b73106a
MD5 eb65c9073f1ff695f546d801341559c0
SHA1 c311dea36c626cabdde02d19482595ad8f5a442a
SHA512 c0323659c386e3b7ca988440afe85040dc6bf5bec4fdbc398c1d08e4a2a39ea5790c5cae524b7281f4f9baf9dbe5621ba0e9a3d944effa7cae1839912e1ab425
SSDEEP 12288:S0GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWm:SUnQ/tbw/2Mkjy6Fr7g0om
TLSH
T10D5523697925F98BFB1706F14C838182977B0EC6BFD1938F7B482128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 f1f96ecacf9e4bc003b1c0aac6a48049036de174619f994feeb72293decc8525
MD5 1c4b07568ee2e64f0fbe9e68c7b20bc8
SHA1 fb673e81cbd5bd1d0f274cae8462b6edd67028d8
SHA512 3f853c35b3088d18ec3b8aedbdf228e373bc85b3d545e23dbd69e0d8d86c2e373b599f4a6f82f30ce260ed0e93dcaff133e4fe9f3c1ea89c24fe6c5a57db27a1
SSDEEP 12288:hPGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW7:hvnQ/tbw/2Mkjy6Fr7g0o7
TLSH
T1A15523697965F98BFB2706F14C828182973F0EC6BFD1938F7B482129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 c47f650d514b8a3cbd37d78573eb7426fb7868729a85b892716033fbc4918135
MD5 9740d75040c09b02d593435d0342200a
SHA1 07713ecbbaee5ad43579f13035653c4b5c025241
SHA512 71f1c325756a10d3c39ce21983f6d0090d63bbbb88d80b67c0b9f58580d0682f1e9a2cc4381abb4b7115e14b4bd56ce28b3bd61e81a8794bb2431cce8ab87ff3
SSDEEP 12288:GbGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWj:GLnQ/tbw/2Mkjy6Fr7g0oj
TLSH
T1525523797964F98BFB2706F14C8281829B3B0EC6BFD1938F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 5701698445389315ec48722117ca53fdbb1a62fa4cae8c001f0e831389e1fd06
MD5 cebeee9da03645bc1113712e3befadad
SHA1 06dc06d57beda86485bce823c005d45af0e7a351
SHA512 bb70f7371b983fd83f681be3a1370647dfe6511b16ec32688573152ebc7f6f87cf7ced0ed0cc9fb0b1badd1d2361b330ca9bdcc49a2b14cd5552608fa5deb5ad
SSDEEP 12288:tiZwbDzzFEoS2cPvyDGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWd:wZM3zFVSOznQ/tbw/2Mkjy6Fr7g0od
TLSH
T12C7501A5B35058F9EC67427ECC518906D7B27C5A1BA0C71F13A8322A5F373A01D3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 51f43683e326871a6f730cc7d924bf6e70fff26e7dfb91027c2bb2b23ee5c065
MD5 88a82eac622f0a26acfc8bb95fb17158
SHA1 abcad30b20424cc0c7f7c1632253f7e0bbe03788
SHA512 999d07801cdfa9ba0e0a6a863bfa29f79ef7d743ee2138ed61e2d6c129b2dcb4f79dcafe4332d3a3a66c784bf51280f5b3e076b599467130caeacdfa5f459a4f
SSDEEP 12288:ZuGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWL:ZunQ/tbw/2Mkjy6Fr7g0oL
TLSH
T1445523697964F98BFB1706F54C8281829B7F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 e35de99cab0e21396021034bff19e45b69518892b4eed3ec1bb0a6faef2ab481
MD5 ea8da11e654bba149edf010766e81875
SHA1 61c01ca8b1d6218077ddac26dd5305d4007b1da0
SHA512 c52bbd29c71dc4bbdee2727d1989da4a60bf99336b875443be2297a0c2d34cbb005c2b59be37a22dfbc7e1824203908606d6faa24b39a5fb0f48e646fc574d57
SSDEEP 12288:vSGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWL:vSnQ/tbw/2Mkjy6Fr7g0oL
TLSH
T15D5523697964F98BFB1706F14C8281829B3F0EC6BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 907f80867b8e9620c173376723d50bee49044fdc1358eebfca17ce17863357df
MD5 302537f831cbaa9fe1ed2d1f4c3e524f
SHA1 cea61ba2d711728d62a20e83767c0a4d3fdd0cb2
SHA512 55fe1c6ddf4ef5d11d879c71c6469dd360f58178efde3e364286e5986b9e0051d6599339d0f9f137945fe68fcd5d228e8bb64bb87c99d2bd737df75e02073933
SSDEEP 12288:KyPz5L8XGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW8:Xzy3nQ/tbw/2Mkjy6Fr7g0o8
TLSH
T16365021777A170FAE537427888920A02F77678725B609B9F2754037A2F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 0b4ed64c47ea496ff81e33f520a53428fc393763d3956ba30ad6d61d932ebe75
MD5 72cbdbd8e671a4d96ec2e849406dc75b
SHA1 0eead23bd2cb77ea25eb0b47874ac0fb7f90f239
SHA512 b24ccc2c4ea16e13f101cedd9c3bf8b0e9029ed5021a02f479d9552cbbf82ca6c3fc743f23017ee2071fa7993a7609ab12eba53daabbe599f4c4a32c3258075f
SSDEEP 12288:KuGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWa:KunQ/tbw/2Mkjy6Fr7g0oa
TLSH
T1815523697964F98BFB1706F54C8281829B7F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 c0d632a3c65e64e0566bf243fe48c67d39c3dbf1d474b50355916c834e787ca0
MD5 7beea6bb44ed690d71e932632a375e8d
SHA1 23f2bd1c87f9c4f12d3864a1f6d25e7dcd3055fa
SHA512 d62b5b049dc978dddb4b19181dd03ff679a912eecc3d3dded35455fbbef10298bece66f6f4ca23ab10355c37b68d9a853d8dc2779e94a6b6d6e1580fc42f5542
SSDEEP 12288:ruGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWa:runQ/tbw/2Mkjy6Fr7g0oa
TLSH
T1195523697964F98BFB1706F54C8281829B7F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 c5ecad705a0b470581a335fd10f2bc676daf22fe76259a302ad9f0a3ffb34d17
MD5 6068b496e725467c6600ab3095816a1d
SHA1 3b3ffdacb92cfb422ec6f4da565b928709a2e002
SHA512 a47e533f041025afb67f91d904628aae74c0287bc97290b96077e3daf89ea70c7c0ba8e501fb4cf9c6e0b76338deb2d328b37123a4b24c91ac79c98494df6d9a
SSDEEP 12288:ayPz5L8XGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWy:Hzy3nQ/tbw/2Mkjy6Fr7g0oy
TLSH
T10B65021777A170FAE537427888920A02F77678725B609B9F2754037A2F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 3a27ed67fc96197443898ae622c6b3300e8fd212bf4a07ce6ee79e27e4ab64d4
MD5 61524400f363444b30937e5379aed2a7
SHA1 342eb28d0eae6ef096c0cc484fe161e7b26f5309
SHA512 219880d8b1574f73e93e99e6a499cf6d2dc399653c7629d1936ffc592e48f3da5f824a286ddac9255688d87cd833471a31900c9958fa57a23e65d1f1fcd675ac
SSDEEP 24576:acP4mcvIjkGOxhKP2l71nNKbrh/8KBmnQ/tbw/2Mkjy6Fr7g0oZ:FP4m4IpOO67W8KoQ/lFTjN4
TLSH
T17265AE2DABDC0096D0BB917485658A4AFAB1742A2F3286CB1160933C7F77EE54F35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 be2a8c98f221a27a650b98bc490b82bb9e675b32758b25228e3678e40c740af1
MD5 f706bfd066c39da2ee4b5979e40574e9
SHA1 7c3d938b07b542cd80527ad26a37a3601991b895
SHA512 0477e23b6e4d994e308a7438e8fec74ccdfcfb38e4d9a55960bd3156e356a2654465ae173df88940af283a817810fc57546f6a6bea68d029cb85035d2d7a7d1e
SSDEEP 12288:mssf+GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWq:A+nQ/tbw/2Mkjy6Fr7g0oq
TLSH
T17F65F119E29852E9D02E52B5CB828641B3373C9597E1D3CB67C0F53E0F7A2905EEA743
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setting.ini

Path C:\Users\Admin\AppData\Local\Temp\setting.ini
Size 638B
SHA256 0c1f03b3a7d2790796ac63380f72a47276866c988dd24dca9bad044b1ba38707
MD5 11146409813d8c3e8b77604a6996ec59
SHA1 cec26456fbcd6d4423632f6fdf35fa932e07ba17
SHA512 3951681956286acabbfda5859ac14491364b7c37aa30ac2cdc6053bdd635c916e4fb9fc2d45a40665f753dd967e830e86d2d9c54264c7f74d61cbd41fee9a6d3
TLSH
T1ABF022334D488A1D112273B41DF2886561EAE481A870489CBFAAB8836F9895717B67DF
MD5 SHA1 SHA512 TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 675f446d530face3949ccd9ccfcdc4bf59f5967001d1f365009c5dc469f2dd9b
MD5 9de33e810439d9ffe9d6bf3691581182
SHA1 5206ab08a478f7cabde1d21d21cb0d9e9be09eed
SHA512 7c94d5ccdca79bd8d43d153c23d7c8b8a43be14ed0f7fe20f47e91ddc827c3c1c15f018a45dd41dd469f140399cde764f6cb96f94262dd2f92703807b85018f9
SSDEEP 12288:leGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWX:lenQ/tbw/2Mkjy6Fr7g0oX
TLSH
T1F55523296768F94BFA3B06B05882C151673F0EC5BF91D78FBB08222D957C3D01EAA745
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 75d327f99ccb86845ba5cb129ac2a3f7689d7a0dc68d106debf5225075ad48e8
MD5 0c0dcf67eee5a19aacd98e404eee5964
SHA1 ddd1c05ff80264cd2122d1554ecd6025c4b6e357
SHA512 25af048600f947eee11118f95b25a30c724c8103c26d6971ec6f0733f65186b706a239a8152002131a35a7af9bb226f40bfe50a0aa9168604051212f726171cc
SSDEEP 49152:Ya0h2GEkuAe73q3pp46zwwQUQ/lFTjN4:Ya0hNYG4Jw0Lm
TLSH
T1C7859E1E67EC82B5D0BAD278C9A6814BE6B2B4261B3156CF1150853D3F37EE44D3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 6ccfa468478092066534cbf26fb503cff7a6eb26c3d7b064cd7ac276eb9044f9
MD5 452810ee43396e229c8c6ead76afca20
SHA1 696fbf34f7efb4262935aa8e446adb446fd221aa
SHA512 dec48e4bb8e37ec281e783d454e91582035adf9f8703a99b1078bbc65719e5a583216f88932ca17f1f74eb58f03fb3b653cb3524ade56e73e7ceb41d7768ad8c
SSDEEP 12288:ghbHjfXzGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWD:ghbHjPjnQ/tbw/2Mkjy6Fr7g0oD
TLSH
T1EC55027D26AC30DAF63692BD88928546D7327C552B11A3DF2381827D4F3BBE40D79B81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 cdb9ac97151f4bb69f0bd67edc39dbe247b3ef317c6d500ad5b26050cfb0b237
MD5 13660c1177835462fde39867d51b3561
SHA1 2cbe983ddaef76d1ba0dbb4b8705634d17cd3291
SHA512 135d19d27b7047937537e7f1c20c69ae3fcf318dc81adaa0d3aa7c66625a99b014ed6cd7ed32f1932cce33b7c8731b3ac4c7dfa10d4fc160648c04f45b670c39
SSDEEP 24576:A3YgnJcRTk4yti+R5dBR/7nQ/tbw/2Mkjy6Fr7g0o4:AIgnaTk46pBR/7Q/lFTjN4
TLSH
T1E545BF2DF2B910B9D8AAD236450147B5FB71782D1F209BCB0170C538AF1AEE85E39F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 4dd45ce46a059d28a40ba1730af9372684ee4cb6b9174a3443f83ed6d4117433
MD5 47201ea0bf386ca0090eb819fa2e84fb
SHA1 10c86b9839a7c2b14810e354ffef270ecc1595df
SHA512 8891d155df22cb7f7a82c92ed91046efd2b38d958aa84bae2407ca5f0f5d900f1776eaa32229cbc7beb30d539ec1f175c1308857b2dd1103e058785c598e87f9
SSDEEP 12288:lCGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWI:lCnQ/tbw/2Mkjy6Fr7g0oI
TLSH
T1C45523687614F98BFA2706F54C838546673B0EC17FA1A3CF7B482129967D3D41AFA780
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.6MB
SHA256 c0f810f530598838e7bc8ae964d3cf1c7ff248e7d9cc1c682f33ed2d2fb43975
MD5 128befb82c2c530a0e1ca7e74dc283c8
SHA1 789e71ee9175e763be69ce0399b0702898a7086e
SHA512 211491e5ceab47225aa7c60c0fca5ba83402f12fb451d2be2d487f4b638233908200124d2e1613873c847ba7bc33e1d6bef5f5c1b1cac76fe4555563220d468e
SSDEEP 12288:EOb4A4LWOsvAYFThGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWq:pwL3UTxnQ/tbw/2Mkjy6Fr7g0oq
TLSH
T1F075F155F7A450F9E92B817CC8A28616E372789D1764E7DF03A84A691F333E14E3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 1f957f33d7faa577c2e08717b27848233a06b1bbb7789482ce40f13badea6456
MD5 e1823090c2a9d0d9ec9697e1c9c6cb48
SHA1 e165f51ced0633314f7f1d0cbd3f65750c211c83
SHA512 ed1eff8da6023eb23db710aef5fb87542796755f7c29c5b6e6ea2dbf5accb655d9eaa67ff38739e53be1e9b3318bae918a513506713a60b41ce84dbcbe99e6c2
SSDEEP 12288:qpFtCO1GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWE:XOVnQ/tbw/2Mkjy6Fr7g0oE
TLSH
T1FB55022D36EC60E6E536527C89838249D37278961B6253DF0780817E5F7BBF81C7AB81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 8b89d9d7185d3dbce643bec4891111aa6cbe575169618d81f56817a7b2c43516
MD5 4cf7f5c574f6290174901ebf9496d607
SHA1 6acc66cbdf5468848bc0efb210562d4373e37f65
SHA512 fba35cd5c23fcb7d398ea6ae2875078613814f03f3e90d020450f18b15f15dc78e79d06f5ff265c9c70a633d11f11cd07f44b2ff520a073193d6b792a71c872b
SSDEEP 24576:Y7NM9YqZqmWMUkPjZM48Mv6bEhsunQ/tbw/2Mkjy6Fr7g0oQ:Y7cBWMpPjN8DbEhDQ/lFTjN4
TLSH
T187659E2E6BAC81D5D577D13DC9E28206F6B2B4611B318ACF1152833E6F37AE44E36721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 4cc3469277d94154da8ae86ac4acd6d8c99a175d8e3a8549e2d8da72f5db7191
MD5 4818607fe00a44aa496752c58d283d17
SHA1 4ef6a2c714f0a58e11bdac2199c8918ec20a2311
SHA512 94d3c0320c542acbadbe4ba921d6a11f2e2cf4760eced5829ef443fef7803e7768570af0885b06ae42d901d98f5eb748c2e5efb4869681534f3856a12075edde
SSDEEP 24576:yW6BApg2YuyuNDYTabvcdvNYf8km1QnQ/tbw/2Mkjy6Fr7g0oM:yF2YuHNETovAvNYf8kmOQ/lFTjN4
TLSH
T1D8857E6927ED80A4E0BBD27D45B7D246FAB2B8511B3056CF0255862E1F33AF44D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 b20b5dad217e73dddb74415111e2a89db5c66147671718ca33e35a179f7540ed
MD5 00b9522036af7a1e85830c328377cb3a
SHA1 68aac7ee153ba9f71d68d65c8068ec21d73bd114
SHA512 3baf723e60a3063e9ba868f9e8759c1027769aa69a02f70e1053fcb83904e3a5337ca690cbaab5d04f07144bbe58ee739a54470d5c44d0bbfd61d2698d30789d
SSDEEP 24576:SAFs06+Omlf3NXEbTo5nQ/tbw/2Mkjy6Fr7g0oV:LFs060lVXu0Q/lFTjN4
TLSH
T13465AF2F66AC00D5E07ED17D8997C91AF7B1746307255ACB0260863E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 ad629a94d3ae5de594bd3e0cbb9a8c319db06dcb86067a90d253ede5e5e1705d
MD5 09bb7605ad82994c63b7e256def1bf17
SHA1 8e72026d1f5f9da3cf346befe75f43e084180bc4
SHA512 b341f58c4da05de54b090828ca6352ae53ac7e74d86c9149c1767236988af9e3e4aa1794c90e74f42d640333c3faa5ce07f02b1ed578642691cccf4d33ad3dd7
SSDEEP 12288:cCJnJ5D3VkrqzxOGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWI:hJnJ5D3Wa0nQ/tbw/2Mkjy6Fr7g0oI
TLSH
T11075D03DD2A810E9E477C2B4815A1746FF72386D2F226ACB28A4D5357F22FE05979F04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 ecee90c2316ec0cb69cf1a12fb8070f63fa162fc0391ff18cad34ade65339d15
MD5 4a40a437f076fc89ae4d12aa18bc99a9
SHA1 88405e6a7579859e092945949a44b83104b73ed2
SHA512 8f5b79d9e96faf434db34fece3bbf42cf87fbd9a89223e12bba4d9c878cfb9ac9b551f9730593fd36ad796fa96064b61493b76b079618e7c2a983cd625aefa1b
SSDEEP 24576:pEPghm6/7IIXdwcXrif7qQncjlP65i3Vu7nQ/tbw/2Mkjy6Fr7g0oG:Og06DIKdwc+eQnSt65aVqQ/lFTjN4
TLSH
T18B955C16B7EA5294E8B3CAB1C96291169B327C509B34F7DF0AC0C92E1E33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 2a4a82d9e28fcc98e31b0641c6aa0740e3ca738c020249b78a2d24bc2af5035a
MD5 5e981a09704c2c794a64e9a2cc90b640
SHA1 75008c203d9f3f899c13e5e043b16baf73342481
SHA512 bf6bff12aec53a36c08652169af9d8c07ffaf38d910a9cd8df5d4c3bce5938bc1995e7e900906474325be1626c40e3f49746a947f46394abb99c4122f4acc4b7
SSDEEP 12288:WEP3RSYGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWl:VSYnQ/tbw/2Mkjy6Fr7g0ol
TLSH
T18D55126D37ACB0EAE526517D88918145D373F4A16B5267EF2680823D8F3B7E81E3DB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.4MB
SHA256 a7e96894faa03348539b3e2553476a5b76dede68da4371813af6f779c477b37a
MD5 d478e047651c0547d75328a26b33d5c8
SHA1 bfbad5519fa398c702776b16a3903e96fdedca38
SHA512 eee6769cda871c6ba06a5713d0380b40425fe3318f1006de9b79bf8677779aee24d6aaffc6564215b26704151fe15286aa0fdb3c3f7d4ac0106ec854d89c4d74
SSDEEP 12288:SjkyjGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWs:SIyTnQ/tbw/2Mkjy6Fr7g0os
TLSH
T1306512186398F4C6FA7A06788DA381919B367C506F2193DF6280F23E9F3A3D46D75B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 1b76c90cbad4918f8a3c58a712f8d204de7e8afc6ea839afdb8e5746172f48b8
MD5 13f58bf1463bbafe6ebe5abc795a68a4
SHA1 08478ec24d7eef3a45c5c827fab86619985f2d07
SHA512 1dacb224f53d5e7203cbc8bee23b64e1686c532375b3206e9896048cc02d420c3ab384e374bdf4893541440add7278c32e180bb327d4d195ec7e08017c37de8a
SSDEEP 12288:M0lGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWp:HFnQ/tbw/2Mkjy6Fr7g0op
TLSH
T15155236C2625F89BFE2706F448928542973B09C17F9167EF36846239CB7D3D416F6B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 c92d39a6573ebec62cae656b5c5b05dbd68e0a6b0de7a1dab48c7376fa7b3942
MD5 5b3e67ae3e3dbe52daaec2132c264e32
SHA1 3fcb3d503668d65ad3f04103da71953d39552a20
SHA512 7e208ce881f74a9f6d5def18a0e70a43a9ae1b74239ec214a4c89bc18df67b524ebf27815e5f21ed88806d3db7c7e26de96db297660d5746bc7115391d4e671a
SSDEEP 24576:SQ9MxZKdcz9dw32nQ/tbw/2Mkjy6Fr7g0o0:SVKZ2Q/lFTjN4
TLSH
T11B558D2DABE9199AE177D27594A240C3A633B4311B31D6CF2448D03D4D7BEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 fde221ec0367ce91f8f8109860c68f79eeca9cc3669a180acb367bb45b65bf93
MD5 4b45a9cbe01efa3c74a23a0ab216d0e6
SHA1 8a72413f279e51905b77f6ff17ba2c7fad4d9abd
SHA512 598e3160a40b76ab52fbe08fe2854a05d68e9042ce76e293f2287e79ac39e2edfe7623ddd175b1c2cffb8fa404e19db95ed49d403abd394a64fa5a1643c2aa84
SSDEEP 12288:QyoKo20Rple9pnGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWb:QyocSApHnQ/tbw/2Mkjy6Fr7g0ob
TLSH
T18C65E01FBB6990A2E136813C88818745E773B4706B6267CB6681C33D8F776E87D39B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 829a6b4b2abd1a9f6b16992b35bb376ce3702ea72245f88c37dad936c5f64e9e
MD5 f6e9accc773dbb599167244d886bb452
SHA1 2029df694923971004ac98b13f2388de16d01b2d
SHA512 dc8473d743e88998aeaad0ab6da03a04987a270eb1e2334a43b5bcc59f1954a74b9da0c416b41b29e59294dd03a083cdf8dce960cacf897ea9cfdef0cdd71768
SSDEEP 49152:wWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKHQ/lFTjN4:i0zuNIWLm
TLSH
T19DA57C3DA2BC00A9D8AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 4f0f490107a95eb65c4ecf8d145a394c5e88f1d4ea7d208dd132625137f577a5
MD5 4b502a4a217fbf2ced5834c14f3b5604
SHA1 e5e545a32f80d9028497b8bbfe690128435dc0d6
SHA512 95e3d584a0840da3c5c62305ad156d9ee4206af69f7d736f9e23b24e0bf62e196d26f10c4259e3d4085bc5f91a42a3762f136362d68483aaf23da781cded4768
SSDEEP 24576:S1QT7EcpfxR+N5AWAz3ooiYtjMqbYnQ/tbw/2Mkjy6Fr7g0oP:PTDxR+N5YzTfjM1Q/lFTjN4
TLSH
T15355B02EA7F855E9D17E86798A23C502FB727861033193CB42A0C17E1E7B5D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.5MB
SHA256 2cff0e2a9b5a296b40820e949b1f805abcb467f64665fa86f32f3dfb19432202
MD5 8aea351e797853d1fdb6af4ac70504ce
SHA1 096b7549a64e166f0dd709bc290325f2be345625
SHA512 5d22f65a485bbf5297b222216f9a2137517373c4007e8d3447dac4d69f4add994826de5f1b3500d69622cc611978cefafd2216de7a494f3b6890785ba348c85c
SSDEEP 24576:VTMdOz0FFS+1mSL8nQ/tbw/2Mkjy6Fr7g0oB:P0K+1mSL8Q/lFTjN4
TLSH
T1E475E17E636D14E5E53BC27D9A438906E67334620322A6DB0690C17D2F6BFE4397EB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.3MB
SHA256 396cb1ea10dc87653cde2cea6167c2dc48cb23ef2667e0e0477af823bb0c8659
MD5 fdeba9b8494861b38fd571adf27afd12
SHA1 2c20deadc60bbaf9b5e5ff6aa775868d6c95b2d2
SHA512 fe9329d469f7cde62a9fab914ce22ec678c6cade1a40d89a196bba4e8790edce02048db42ea22e437bd2a93015c6a6616ffa6f90a458e089bb2e542ed6ff7f3f
SSDEEP 12288:Z4ThGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWf:cxnQ/tbw/2Mkjy6Fr7g0of
TLSH
T13355122D23E8B4DAF93352B48962414697327CA2276167FF36C4C63E8F3A3D44979B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/468-221-0x0000000140000000-0x0000000140140000-memory.dmp

Download

memory/1208-144-0x0000000140000000-0x0000000140167000-memory.dmp

Download

memory/1208-1-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/1208-7-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/1208-0-0x0000000140000000-0x0000000140167000-memory.dmp

Download

memory/1360-100-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/1360-414-0x0000000140000000-0x000000014025F000-memory.dmp

Download

memory/1360-94-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/1360-103-0x0000000140000000-0x000000014025F000-memory.dmp

Download

memory/1928-112-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1928-105-0x0000000140000000-0x0000000140266000-memory.dmp

Download

memory/1928-106-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1928-415-0x0000000140000000-0x0000000140266000-memory.dmp

Download

memory/1944-319-0x0000000140000000-0x0000000140154000-memory.dmp

Download

memory/1944-73-0x0000000000680000-0x00000000006E0000-memory.dmp

Download

memory/1944-82-0x0000000000680000-0x00000000006E0000-memory.dmp

Download

memory/1944-81-0x0000000140000000-0x0000000140154000-memory.dmp

Download

memory/2968-220-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/2968-160-0x00000000007F0000-0x0000000000856000-memory.dmp

Download

memory/2968-165-0x00000000007F0000-0x0000000000856000-memory.dmp

Download

memory/3440-484-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/3440-253-0x0000000001A20000-0x0000000001A30000-memory.dmp

Download

memory/3440-290-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/3440-237-0x0000000001770000-0x0000000001780000-memory.dmp

Download

memory/3440-273-0x0000000009E60000-0x0000000009E68000-memory.dmp

Download

memory/3440-412-0x000000000CDD0000-0x000000000CDD8000-memory.dmp

Download

memory/3576-434-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3576-222-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3820-317-0x0000000140000000-0x0000000140155000-memory.dmp

Download

memory/3820-71-0x0000000140000000-0x0000000140155000-memory.dmp

Download

memory/4052-228-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4288-288-0x0000000140000000-0x0000000140171000-memory.dmp

Download

memory/4388-418-0x000001DACCB50000-0x000001DACCB60000-memory.dmp

Download

memory/4388-429-0x000001DACCB50000-0x000001DACCB60000-memory.dmp

Download

memory/4388-417-0x000001DACCB50000-0x000001DACCB60000-memory.dmp

Download

memory/4388-416-0x000001DACCB50000-0x000001DACCB60000-memory.dmp

Download

memory/4388-425-0x000001DACCB50000-0x000001DACCB60000-memory.dmp

Download

memory/4388-435-0x000001DACCB50000-0x000001DACCB60000-memory.dmp

Download

memory/4388-436-0x000001DACCB50000-0x000001DACCB60000-memory.dmp

Download

memory/4388-437-0x000001DACCB50000-0x000001DACCB60000-memory.dmp

Download

memory/4388-440-0x000001DACCB50000-0x000001DACCB60000-memory.dmp

Download

memory/4388-439-0x000001DACCB50000-0x000001DACCB60000-memory.dmp

Download

memory/4388-438-0x000001DACCB50000-0x000001DACCB60000-memory.dmp

Download

memory/4388-441-0x000001DACCB50000-0x000001DACCB60000-memory.dmp

Download

memory/4388-442-0x000001DACCB50000-0x000001DACCB60000-memory.dmp

Download

memory/4388-458-0x000001DACCB50000-0x000001DACCB60000-memory.dmp

Download

memory/4388-457-0x000001DACCB50000-0x000001DACCB60000-memory.dmp

Download

memory/4388-456-0x000001DACCB50000-0x000001DACCB60000-memory.dmp

Download

memory/4388-455-0x000001DACCB50000-0x000001DACCB60000-memory.dmp

Download

memory/4388-454-0x000001DACCB50000-0x000001DACCB60000-memory.dmp

Download

memory/4388-453-0x000001DACCB50000-0x000001DACCB60000-memory.dmp

Download

memory/4388-452-0x000001DACCB50000-0x000001DACCB60000-memory.dmp

Download

memory/4388-451-0x000001DACCB50000-0x000001DACCB60000-memory.dmp

Download

memory/4388-450-0x000001DACCB50000-0x000001DACCB60000-memory.dmp

Download

memory/4388-449-0x000001DACCB50000-0x000001DACCB60000-memory.dmp

Download

memory/4388-448-0x000001DACCB50000-0x000001DACCB60000-memory.dmp

Download

memory/4388-447-0x000001DACCB50000-0x000001DACCB60000-memory.dmp

Download

memory/4388-446-0x000001DACCB50000-0x000001DACCB60000-memory.dmp

Download

memory/4388-445-0x000001DACCB50000-0x000001DACCB60000-memory.dmp

Download

memory/4388-444-0x000001DACCB50000-0x000001DACCB60000-memory.dmp

Download

memory/4388-443-0x000001DACCB50000-0x000001DACCB60000-memory.dmp

Download

memory/4388-420-0x000001DACCB50000-0x000001DACCB60000-memory.dmp

Download

memory/4388-428-0x000001DACCB50000-0x000001DACCB60000-memory.dmp

Download

memory/4388-430-0x000001DACCB50000-0x000001DACCB60000-memory.dmp

Download

memory/4388-431-0x000001DACCB50000-0x000001DACCB60000-memory.dmp

Download

memory/4388-423-0x000001DACCB50000-0x000001DACCB60000-memory.dmp

Download

memory/4388-426-0x000001DACCB50000-0x000001DACCB60000-memory.dmp

Download

memory/4388-427-0x000001DACCB50000-0x000001DACCB60000-memory.dmp

Download

memory/4388-424-0x000001DACCB50000-0x000001DACCB60000-memory.dmp

Download

memory/4388-422-0x000001DACCB50000-0x000001DACCB60000-memory.dmp

Download

memory/4388-421-0x000001DACCB50000-0x000001DACCB60000-memory.dmp

Download

memory/4388-419-0x000001DACCB50000-0x000001DACCB60000-memory.dmp

Download

memory/4408-136-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/4408-142-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/4408-433-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/4408-219-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/4460-124-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/4460-127-0x0000000001A30000-0x0000000001A90000-memory.dmp

Download

memory/4460-122-0x0000000001A30000-0x0000000001A90000-memory.dmp

Download

memory/4460-116-0x0000000001A30000-0x0000000001A90000-memory.dmp

Download

memory/4460-129-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/4480-134-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4480-91-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4552-271-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4584-176-0x0000000000570000-0x00000000005D0000-memory.dmp

Download

memory/4584-182-0x0000000000570000-0x00000000005D0000-memory.dmp

Download

memory/4584-225-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4692-131-0x0000000140000000-0x0000000140164000-memory.dmp

Download

memory/4692-432-0x0000000140000000-0x0000000140164000-memory.dmp

Download

memory/4940-294-0x0000000140000000-0x0000000140156000-memory.dmp

Download

memory/4940-150-0x00000000004F0000-0x0000000000550000-memory.dmp

Download

memory/4940-156-0x00000000004F0000-0x0000000000550000-memory.dmp

Download

memory/5076-229-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/5076-483-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/5768-193-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/5768-226-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/5768-187-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/5964-200-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/5976-227-0x0000000140000000-0x000000014018D000-memory.dmp

Download

memory/6076-224-0x0000000140000000-0x0000000140141000-memory.dmp

Download