ec8060e8dfddd09e2ea2319040c7b80ff735e9f7cf078721afe1974dfb1a1d76

Analysis

max time kernel
149s
max time network
145s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
07/05/2026, 04:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
Size 1.3MB
Sample260507-e86tcsez5s
SHA256 ec8060e8dfddd09e2ea2319040c7b80ff735e9f7cf078721afe1974dfb1a1d76
MD5 3dd8f6a795ca6601785decfee9d9c0bc
SHA1 506c3d98a0dd70fbfdfc08a0b54cc0ec6f17bcf8
SHA512 c428c89ff45d285780b6ba67e4772bc200a318d9feaa6b6c25421649a876cb99391bc311f9e474fd9f397f71f991a1eda690b31761c35586c8f1b308c7796820
SSDEEP 24576:HuKxZ8VxWKAZQUF3P+iMod87mLWNNrI8nQ/tbw/2Mkjy6Fr7g0or:HuC8VxZUF3P+97mafQ/lFTjN4
TLSH
T14E55CF19B7A945E5E073923A89628251EBB2BC111B31D7DF5294732F1F33AD40F3A722
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
3120	alg.exe
3288	DiagnosticsHub.StandardCollector.Service.exe
2388	fxssvc.exe
2308	elevation_service.exe
4768	elevation_service.exe
1868	maintenanceservice.exe
3032	msdtc.exe
1904	OSE.EXE
1404	PerceptionSimulationService.exe
800	perfhost.exe
4824	locator.exe
1652	SensorDataService.exe
2108	snmptrap.exe
2856	spectrum.exe
4496	ssh-agent.exe
2608	TieringEngineService.exe
3876	AgentService.exe
4656	vds.exe
1772	vssvc.exe
1780	wbengine.exe
2360	WmiApSrv.exe
5076	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\e:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe

Drops file in System32 directory 35 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\b11112877932a944.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\{17A6A947-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db	spectrum.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	spectrum.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_163328\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_163328\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_163328\javaws.exe	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bd93a746dbdddc01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002a277e47dbdddc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dib	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.crw	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d4154c47dbdddc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cr2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tiff	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tiff\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002375e645dbdddc01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000079d42646dbdddc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.txt	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000006847546dbdddc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe

Suspicious behavior: EnumeratesProcesses 42 IoCs

pid	Process
1160	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
1160	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
1160	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
1160	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
1160	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
1160	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
1160	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
1160	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
1160	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
1160	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
1160	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
1160	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
1160	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
1160	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
1160	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
1160	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
1160	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
1160	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
1160	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
1160	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
1160	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
1160	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
1160	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
1160	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
1160	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
1160	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
1160	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
1160	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
1160	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
1160	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
1160	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
1160	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
1160	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
1160	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
1160	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
3288	DiagnosticsHub.StandardCollector.Service.exe
3288	DiagnosticsHub.StandardCollector.Service.exe
3288	DiagnosticsHub.StandardCollector.Service.exe
3288	DiagnosticsHub.StandardCollector.Service.exe
3288	DiagnosticsHub.StandardCollector.Service.exe
3288	DiagnosticsHub.StandardCollector.Service.exe
3288	DiagnosticsHub.StandardCollector.Service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
676	Process not Found
676	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1160	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
Token: SeAuditPrivilege	2388	fxssvc.exe
Token: SeRestorePrivilege	2608	TieringEngineService.exe
Token: SeManageVolumePrivilege	2608	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	3876	AgentService.exe
Token: SeBackupPrivilege	1772	vssvc.exe
Token: SeRestorePrivilege	1772	vssvc.exe
Token: SeAuditPrivilege	1772	vssvc.exe
Token: SeBackupPrivilege	1780	wbengine.exe
Token: SeRestorePrivilege	1780	wbengine.exe
Token: SeSecurityPrivilege	1780	wbengine.exe
Token: 33	5076	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5076	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5076	SearchIndexer.exe
Token: SeDebugPrivilege	1160	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
Token: SeDebugPrivilege	1160	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
Token: SeDebugPrivilege	1160	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
Token: SeDebugPrivilege	1160	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
Token: SeDebugPrivilege	1160	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
Token: SeDebugPrivilege	3288	DiagnosticsHub.StandardCollector.Service.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1160	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
1160	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1160	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1160 wrote to memory of 1516	1160	2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe	81
PID 5076 wrote to memory of 4092	5076	SearchIndexer.exe	106
PID 5076 wrote to memory of 5100	5076	SearchIndexer.exe	107
PID 5076 wrote to memory of 4500	5076	SearchIndexer.exe	108

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-07_3dd8f6a795ca6601785decfee9d9c0bc_icedid_mespinoza_njrat_ryuk.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1160
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Delete /TN "EVKey - Vietnamese Keyboard" /F
  2⤵
  PID:1516

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:3120

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3288

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:1248

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2388

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2308

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4768

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1868

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:3032

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1904

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1404

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:800

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4824

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1652

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:2108

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2856

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4496

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2608

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:2332

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3876

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:4656

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1772

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1780

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:2360

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5076
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4092
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2808 2824 924 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5100
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2812 2792 924 {85EE815A-7738-4808-A14A-3AD87E32A3BF}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4500

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 2078335fcdf5f07e045eccc886b104fa803d5fd9a044fa35b04dc128bdab75eb
MD5 ccf74643125505402b84db2e74275dc5
SHA1 97e598cf1e1a873c4c9a68d7cb51a06713165a0e
SHA512 46bbdada6ea92ca4c5e550ecc748f7f0404504685c2ed8cb6eb9902b61c1574557cbcd9c97d9c28e6d16397001902c628b53a61f5d5fcf32ae4fced692e3dfdd
SSDEEP 49152:Sb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnbQ/lFTjN4:03q6HjB3Lm
TLSH
T1C0D58D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 8412e4c8b98a37df3b5539ab48bc61975579fde12c3d6dc4d522dda69ea91086
MD5 209817c739ccea3b52577ef56a1f8c3c
SHA1 ece50edf1649f560ea2018b74c29f56b491d1e81
SHA512 d8aa1be4ea3b0904f0f7e6028f285ff0cf4433b9ee13587a2d679e960983b8b78019ba2dca04586312c87af5a7202e1f4ce1c771e748103e7dad178eb007d70f
SSDEEP 12288:l1XLsswWkxy2lRq2czAQGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWK:rXYfDtczAwnQ/tbw/2Mkjy6Fr7g0oK
TLSH
T19B65F12877E448F9ED67827DCCA28502EB73788547A0E78B03A495295F373D85E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 eb53ef3c7e6941f13b69d0658afaa29b713dabc652af24f67d83ec146a0af554
MD5 33f80e2556627b1766e22f1c155aa076
SHA1 b540880b09b9e227d8bfc42659930cf3b2f22e76
SHA512 a7d5c9e93d52f1a24f8116cb352e72a4341c6343c5421bccfc7716c113d43d3e90b04a5f046119c0e922fdebf92dba91f6fa3962f62b24c92a7edf82edd917fd
SSDEEP 24576:b0Le5ji0hmxLrMDnQ/tbw/2Mkjy6Fr7g0om:bPji0AlSQ/lFTjN4
TLSH
T1F0859E15F6748735D073C0B9C5D2A68AEE7230825B308ACB4286D77C7E677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 6d6c87c57fb50f811fdd625d27b108cafab97abad4d3dc0970922c650ad38450
MD5 0c8c6a9c1de54a9b02219c313e3a5d22
SHA1 ce13161d8abfb3a699bf5b95e3b26adb11aee433
SHA512 69fd091fb95cb1d19f153df43462ef9fad4c9dea7d1b2b540492434c6965a92dd8ba5b501afe9dc5b38f352a07d4d8eb742b1d3e0e13d7df9981bbf026b823b2
SSDEEP 24576:Na7/ezSC6vUyD/aqgrvWE6q8wyuZnQ/tbw/2Mkjy6Fr7g0oS:E/ezSC6vUzPvxHjyuQ/lFTjN4
TLSH
T1EA755D25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 0cac4739cdbff6cd1834a4b3d4036bd275c823b6d8e5376efd0825d8b17ee448
MD5 77a0c44e9ba869bd3c1b04b1280bc7c6
SHA1 409a3151a4d83a11d6280aa75e1c3d2714d5feac
SHA512 729887a1e5b334d46bcedc6bfaef3a4b6ae774f2d486e53322dc05bd819c8bd64ffe7935a20ee7a83cf8c942b8d49a22610500d4144e6c53fec821ae32055889
SSDEEP 24576:1VbqPb88hv/l+6UnQ/tbw/2Mkjy6Fr7g0ot:1VO88hXl+vQ/lFTjN4
TLSH
T1E3559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E777E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 6e0d52f2db28979c8d176d782fc8ed5ea39fe2a09e59cd85409cc0eb86a89d5b
MD5 83af3ad76955bfbe47affb0443ac2bfb
SHA1 84421ab6b07afb192483e8924867a61dd56d09cd
SHA512 d5be54a9315b56ac753227fd43fa893fbc05c7e27eef1f2c5b936420b54f6e59671eaee3ce2973de7b3fc89ace403722daa8d3f15c51e359a427ecd5c88f565d
SSDEEP 12288:ezHGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWn:eznnQ/tbw/2Mkjy6Fr7g0on
TLSH
T1AD5523796A24F897FF2B06B55CC284826B7B0EC1BFD4A74E6B44322D857C39446DB381
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 d68a0ae7f06d18988bc3d096051412f7cd143312f513f5d84a28219e9e6c96eb
MD5 9732a33e518a787655bfaafdf1f0fe44
SHA1 995fcb4cb9c7019ab35eecfbaf35990f376d3a47
SHA512 3f211b1b6cd349575041c119dd133db4e053a2ee3f6b61cc163e1274a93a85c58b9ac090d5667c7f34d9fd87bff032a43893026c473e47b4cd6012e99252de7c
SSDEEP 12288:9eBNUbTVO86U8GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWf:9JIU8nQ/tbw/2Mkjy6Fr7g0of
TLSH
T11F75CF3BAE28FCD2C27E4DB85A918640D77278704F61A3CBD164830EDE276E05E7AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 c398cd5d2bba4f44ca01381dbe25cbc6aecebe0ad9693b6201119a87f4d301d1
MD5 7b7aceba79aeee069d06327e4ceeedf2
SHA1 4651e8a6735165a5ee63b7bc861838947eea634c
SHA512 1cfb85d2bc447a49be4be6c4ee9ccf7de25ff6632855f4c1ffdce1197ab9e20ac747d3c9cad0f5f3c038cee69dc232d1156756116dd7c6725f06a5f340d3dd1a
SSDEEP 49152:ZQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THa:ZQvGAdlCEL8c/yRNw5CeLm
TLSH
T1BA267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 47ef99399562ef2118c73ee79ff1d84496e4dc576705f109f0e124e1c2f034ca
MD5 e641bf08d329ad87e1eee854afc57b23
SHA1 70a720081ca7826d14abdefe12a1fecfcfa3f7a8
SHA512 b0c684a95229ea38524f83200d75139adcf11b941974784ad3f743b22ff3e8297602e4e9c6240ea2acfbff9cf87ce50a25d17d8c51e76a9890ecfb0db7261ebd
SSDEEP 12288:AAwSfxL/2Dc39DLLmt0LDQewsAjiGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsge:VQewsAjinQ/tbw/2Mkjy6Fr7g0oM
TLSH
T1B475E031FE74E436C77F0DB21B22C706183D6A604FA11AC3E3A84A9D99342D22776B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 a24d4378bbde7e6f823e4026422215c0a4d62dd26bb063ff09cf4787926ea5c5
MD5 e06c2cca9139ba141bffd4dfe5b4afac
SHA1 1b9b2d811db45b9d1ca1a62939d243d9e63d46fc
SHA512 dac8087a965cc34a892519c39128647f1d2b8b3d8bbeddde33bb367fb31141c67ce7137db4220203ae88bc58f0823d1431d3b9a022a3b364bf818b3047263344
SSDEEP 196608:bUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHVL:bUEtQevvqc2W1cpV2EI32
TLSH
T1D5474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 c564d09db957260536ff4be4875e9e340470e0e8d987f60185a0484103884d6b
MD5 d2baa7357dcca7ad62b35f6ab1d3d0d7
SHA1 a762edffe1f17cccf602de0c0aa1521d3e29d1a0
SHA512 edb89ce8fb9de471630d1cbc650807c7fbca4376b9864fae22752338e9c3ad2714d3c61f03214a3a8b2738c178cce0439dff66982befee0e9504d8b5a4256542
SSDEEP 49152:dCbRquA/m2yL5zQfFiV+XenmE3/zCQ/lFTjN4:aoqtVjnmqLm
TLSH
T135D58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 80f8d29b590d09b3529460e53a5486d79b811df1a650eaf2c22da216620d1c5f
MD5 ccc191df28373dd7be0e354329e1020e
SHA1 355c54f9101a2270d829fd60f18c4f621b0bd2c6
SHA512 3a3e213fbb24165e71c62e17e14e85d449e01e3c56da15069bbce48edd272581e70ace4a824535110491ff2bef9a84d2534921cd92e097348602c9230696aada
SSDEEP 24576:WAhGLJIFoiwtA5l7S53lnQ/tbw/2Mkjy6Fr7g0ov:WAMyFoiq5VQ/lFTjN4
TLSH
T17B35AD81E7F955D4F5B3AAB899B68171EA77BCA65E31C20F2250D11F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 97c13afc792383a5e3a85539fb68d76db82c69f049ded8252c908b83aea70f66
MD5 711c02d9a4abee973a895bb84d12495b
SHA1 260c2ac2207daad17edc46ba2460239ef9c83610
SHA512 b0351f9ac53be869c0322852672d4bdc52c3d8be92e0fbe28dfbd9c22ae9704aedb5719c86a19c6a4292de1eb2be106a6a785a875a11ef8c1bd9470704609878
SSDEEP 12288:xmw5HEjsChN2BFgl0WDm+CpGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMB:swuHOWOnQ/tbw/2Mkjy6Fr7g0oU
TLSH
T14565F14A36A45CFAEA6742388993C136F7B3BC422A61D71F1760C65B5F373606D2EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 841204b9f0aea0a42652699cb64a7f9d90b509faca563c5a60deaefcf4f112ca
MD5 c11acf7cf685972b7680d1924f50d80c
SHA1 bb8e6e5d939549474385bb47e7e071d6e1a9f943
SHA512 2d02a2cb5e5c04d1031d03f99d154626802c8c37a48bc66cdc2a04c50a4a6010b87b19d4f3a275ec544663e1767510f8cb10b5f60cb88b0bd59c1b215baede61
SSDEEP 12288:1XZ1IyyGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWU:FZurnQ/tbw/2Mkjy6Fr7g0oU
TLSH
T1AB55126A37A4B0FAE6674278CCE28646E7733882677183CF275402695F3B7D11E3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 32faa5541000983c2ccc24d921b8361fc097dc3fd2a41f91cc501b9bf6258bae
MD5 8170b43db4d58d153edaa50d7b8852d3
SHA1 ee15f7a583478746b4f0ebded7e10575e4177600
SHA512 8a956b813b66ab255ec004f499ba2e19f36874480cfe2846d368287def074fc7ee36670e6d1de91995005cdeaa9af58552e496993934ee2dba784e3b7548ccbe
SSDEEP 49152:fj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UW:uQRQyi36YOcPQLvw2gAf+PN37Lm
TLSH
T117667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 196b5290e0d8ec40cda0e84aac06eda54cea2031b21860f98d66ccc2c7c37d03
MD5 554ae58d6739298c2d5dea606859f4ae
SHA1 24b37413402a5c5b449009a67c2b7cddf73320e6
SHA512 a428271871b29582001f2ffb3aa5185e5f8e0bc6fc3d9f58425afe706851ccfc9c6e1fb65477abf8675b27d0d511129565db68ace23c183455865e14bf74973f
SSDEEP 49152:ij8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UW:BQRQyi36YOcPQLvw2gAf+PN37Lm
TLSH
T176667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 215a71dda70e6fbffe474ab7c64843cec90fde25b755d2034d933f69440b7164
MD5 ba1c21c6e7c7af74315b6fa7867334ba
SHA1 e34c3ef89dc944de8ff32e9705bcf1f180b4f107
SHA512 97a0ddf78e89d88889cba43cd2ea798f981d9a44eb31c6259507cea343ea0035cc74e3c81ad7c4d454222f87af48989990bbe11d1d56996fc449a00c10e6b4a8
SSDEEP 24576:JwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0bnQ/tbw/2Mkjy6E:V68Qg55nhheWu7PNU3/SQ/lFTjN4
TLSH
T1CEB55A33B2F600A9C44DE1769F46872196D27C75CFE0E3DB8505721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 8727505b2b0d8743eb509077bb9ae7c9f13c61ab27ff682f9c8fc9e1e0d45326
MD5 af965f4c7b7ce81972a8d1c09f841f38
SHA1 82d870b8c3510c8a9994e204ed0fca1feec9bd92
SHA512 7c9d1de30d5609c7cf487bd30a52f7057c38f5bd60ed841c2389a7ee210ee21c57f86d7a4bcec9b0c7ab3f4cb0d7f06fcddffedb0288e050f0a9a2bf5fa9bb7b
SSDEEP 49152:h3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99Q:gy5112gYy5azzVvL69nLKnhZMLm
TLSH
T150167B13F29910E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 cd695cda0395ed73368fa9fdb7aab8222655099bfd444c5d84af292ca333fef6
MD5 83d9dd5b231a47f218a296cbae5fa459
SHA1 829dcbbfadb473d8aeea38ed723971b3cb1d6d07
SHA512 89ff770255b0f49e19fe2494d44d5479a40f830cc505b8ac167c43f094054350b23ffc6cae6be44029876bb1b5205a0ac962eeec5009e7cec1831f69b259dcd6
SSDEEP 49152:AB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glgQ/lFTjN4:au6JmVxd2dzLm
TLSH
T138D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 5e98ff09b4409fee6d9cd10764350ff9f0f082f83dd996f7a424e4bb6071aca9
MD5 2e5866feafde013de92a9823c9a5ffaa
SHA1 737b25008dfda5ecd8e24df6c7854cebee432c99
SHA512 ce8276a788014ed612f9e94de9cd92dd35035db690933d6ca1a395bfecff2afb72506b43e6d044d4118e4b1cca5321d1fbc7312a44df26129ecbe550e3441cf8
SSDEEP 49152:01hpsNoJpF1A6UU44CwH7R4xcQ/lFTjN4:0mifPbRqLm
TLSH
T1CCB5AE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 5785e2827d07c733bc34402928a0548bc58868e99b1a4ac7a90bfdf71f5acf3b
MD5 2db4e56f648ab682d702edb998949a47
SHA1 6ec677a41a547a6d4f37a432e4c49541b3db891d
SHA512 9dac5b07659744c5aa2419c668483551719013fa83edf4e5a5e46579f912211feee0f899f5aaea5bba02893d72fcba2b827a8a45414608c3752a7102980deef7
SSDEEP 49152:lSuZQIY0Be2KRRVtOnks6NMHqrQ/lFTjN4:r5dKTi61gLm
TLSH
T16BC5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 99def7f8ebe99665c5bdfdb272b3f93345290045470a83c90db031046cfd8883
MD5 b45849349ad9d6c353d57ae35685ed4f
SHA1 41d9a9950ac19bca113ceeae94363fa7d3723325
SHA512 7f740e2468ab467a52fb7062556b6d7504b8863782a6e645d310da937bf5891c999d269e822d22bb06ec316a77c0ddc4be00be7b6c22e6c73336aa020d8f600d
SSDEEP 49152:EhtSn8EApI0figngiDn0AP5wwQ/lFTjN4:FX2iyphGLm
TLSH
T1C795BE13F2D940E8D05ED178C7468632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 e26892f42d3b8146bc3e958ec7d6fade9b332782289442d41a6c5fae9ab08980
MD5 86399e07862716115f7001bac61513b3
SHA1 67fdaad16c1402d190a1a2de5cec4422bc2d5fd3
SHA512 9d940bc98a54f8ef8658736ca357518f5feb39d7150d0f99877d5d4aa6311bb9db7bb99c7491a7ce107995a2e3b0b0611a3677da4dcad1909f9536f14af54b11
SSDEEP 12288:uPGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW0:uvnQ/tbw/2Mkjy6Fr7g0o0
TLSH
T17B5523697955F98BFB1706F18C828182A73F0EC6BFD1938F7B482129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 7730ece5aa1d157d308b93a5bddd8c1499e0a6241670ccebb67ab5062cc0ffe8
MD5 95e85ebc868f62bc11c0582efbe2c7f0
SHA1 1458b3568dc1291b846746b5a3246a6dae86d62f
SHA512 d6d20f093dbce9b8a68ec69fbc4eb5bd7ea7cc777553d5e96c8e440b0fb337f168a88f804f13c64168cb757b223665af9414919bbace008d216f8115e3ccd30a
SSDEEP 12288:eGGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWs:emnQ/tbw/2Mkjy6Fr7g0os
TLSH
T1C15523797964F98BFB1706F14C8281829B3B0EC6BFD1A38F7B481129967D39416CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 34ab98d13c74554f51bb665681e91dc905eb396865b25725a435f60eebae27f6
MD5 34df081239216a020a0c6047f4363d87
SHA1 f6d06cdbd98b86ac7d5e601ad9005299892ead35
SHA512 b0e3b5dede6883ac01dbd02ad7f9aa84313d25e463061186c931abd3c1857fd12cebff6e4b75bbc59dec4e866f172ae03deb9cbebcb7a9f2e6d28d9744bacacb
SSDEEP 12288:AkGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWs:AEnQ/tbw/2Mkjy6Fr7g0os
TLSH
T1265523697965F98BFA1706F14C8381829B3B0EC6BFD1A38F7B481128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 bcd1853c2f141b9fee7d4d135d27d2983a86ccbcba17ede45f169242f3fb9666
MD5 2cd35a472b5dac7ab482bca3c845e4dd
SHA1 f6dd0586f8dd0faa411bb7fedf042791648e35c0
SHA512 817a97cb2b16541734eed7c82a400f90999f2688d2c257c6a91edf8eea7c5dba158348b7387a2ee6b3cd37595d2ef154016341e3a389d7b5ea0482a785b44734
SSDEEP 12288:EVlGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWx:onQ/tbw/2Mkjy6Fr7g0ox
TLSH
T17D5523693A69F4C7F92742B4CC938142E77B3DC5BBA1A38F6B04111D4E793D41AA6B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 c4a1f4fcc62bf40bcc4da1d5505df756f976394af2dbe91a8593492610810449
MD5 469c442a8a467dabb0e88248ef497be4
SHA1 1a4807f45619d7e665408cae23868e1de8f198c5
SHA512 a01ec402204e227bb5d41a2b58c8ea1e861b3e67b78e5726f01aac7ddbabaa96d8dfa798fe385a07e63f22cef050ae20f787ab07f49b96b510648cc935930627
SSDEEP 12288:19GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWp:1dnQ/tbw/2Mkjy6Fr7g0op
TLSH
T1375523697965F98BFA1706F14C8381829B3B0EC6BFD1A38F7B4C1128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 82b4d668c559e4acfbaee912b156140aa994a2cb5b0147c5d85780b4f590114d
MD5 9febf0c75bd2a09c9b9ed33a354a930e
SHA1 84932e5427d9e68acd81664e1a6420271e68d96d
SHA512 a8f3450b9b344b00add1e18a57cf09edf47e1d41de173e9b5a58267c22bf0a249921dd1f86c2005e9ccccdc26d32676953cfb6f2745b294885835a1e7d2e482f
SSDEEP 12288:AqGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWO:AqnQ/tbw/2Mkjy6Fr7g0oO
TLSH
T1775523697964F98BFB1706F14C828186A73F0EC6BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 3c70105a83f6749195c7830db4246f6f875373086d64704ee19ccc2f5faf0381
MD5 5e4108e7b2f6538e5a491828eb622aa0
SHA1 0534b2f9ba2c5963b6d9631e519175c34470403f
SHA512 6421b5355f4f6187834a7b88ffff673a4f04064433ab8b176640ec067cd31f30e5f336c6f82bab7655ca2895a7f7192a8b6e4483280e1baa6e617d6e4d3bb5fe
SSDEEP 12288:I+GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW/:I+nQ/tbw/2Mkjy6Fr7g0o/
TLSH
T1A05523797964F98BFB1706F14C8281829B3B0EC6BFD1A38F7B481129967D39416CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 13e7a234543096bca7cd3140dcb82fe5cb0db002fa24c32178fab7e80b319f35
MD5 4326a5ac358d49f91359670243b3f19e
SHA1 30e70b846cd90c6910c0df853851c54d9d3fc660
SHA512 71254efe4ba25cb07387cc76e07c2d5529a9faded739cf388c80b442ba0e7696bc874a1185231c032cc8cb17d284b7e73e5f44930987580b983f4de59aae53bf
SSDEEP 12288:jiZwbDzzFEoS2cPvymGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWF:OZM3zFVSOGnQ/tbw/2Mkjy6Fr7g0oF
TLSH
T1F57501A5B39058F9EC67427ECC518906D7B27C5A1BA0C71F13A8322A5F373A01D3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 1f0f84efcf407d8dcc4af0044842464b0ddbba48c5f3f1995dfe6571f78a17f4
MD5 38a1ab244fc8c5ac8b7d7e7c25c0b3f5
SHA1 9fc49303ba63d7ae327f01125a7e57487f23146a
SHA512 2872115a6de7cb813076e48ad9ed8b04109ebdfa3b1c58ced0f0663e085c0616719d50d4105e3fbd1020b773da42917a2763c727e3da769d7415d5999e961ba7
SSDEEP 12288:LLGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWS:L7nQ/tbw/2Mkjy6Fr7g0oS
TLSH
T14F5523697964F98BFB1706F5488281869B3F0EC6BFD1A38F7B4C1128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 4ec79b1bc83e19c2fb363abc2921edd265a873d0b5cf7df2604d90405fda6031
MD5 7ebf3be8acebb46bc284b449bfa0a41b
SHA1 27c1ade254c066596c45738a2f1c22eaa069d2f2
SHA512 4f4d2eac5cc1c38b69c79157b569df061a41def665368b635b80a92e9d8a08ff047b3f8567de821309309195b0a4f7ab4f68d678f3ded9de9a5eac28a8396b25
SSDEEP 12288:HXGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWS:H3nQ/tbw/2Mkjy6Fr7g0oS
TLSH
T1F85523697964F98BFB1706F14C8281869B3F0EC6BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 10e03b75d37cd1e39f4d494d754103ce41a6bb51012fb16ffecf8f5309ad8f19
MD5 abb36d862ec845e27cf40bb05618ab03
SHA1 1e0d4f479bc2d42aeced6b068713d81fbf35fe23
SHA512 5e95219899072d6edd3a77aa0cb377889078411b1b87f6d8b994a0c94b0de3b5e9e0573e6e9acb76c71de48f951abafc5cd0cd09323443a40e775ad8ec531d15
SSDEEP 12288:EyPz5L8yGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWA:dzyynQ/tbw/2Mkjy6Fr7g0oA
TLSH
T13265021777A170FAE537427888920A02F77678725B609B9F2794037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 79a87c9e0d84da13f7e41b3154a8232748962993ee36eda9924cd4450e91e401
MD5 869e7a9d55cc79101ca64315c55ce5ca
SHA1 2feaf9f88617b4ce94b01f7786b0120ead573866
SHA512 8413e3f8b1ddb67924b32731850759bd6e7bd56a001c329f38b8596fe1d716121b08b1871da11e49a0168943960b517e012252a98f3166a71cb11cfb99b16e3b
SSDEEP 12288:vLGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWm:v7nQ/tbw/2Mkjy6Fr7g0om
TLSH
T17F5523697964F98BFA1706F54C8281829B3F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 4325acda2f7da52a888e2d579fb8413e1bc5090891ddd9ad21cf96050f5204c7
MD5 ed093f22a1ff43dc7918d6b81455b83c
SHA1 33a856487df64c38830b770a8075a42ece7a961f
SHA512 8c3110a34aad66a5bebd876a3d8fbde8431eb591a5a2056d04427c60c19f38ab6191f0ea64da92c52b356ca1eeb44765833a991bfb408367841896e02bec553d
SSDEEP 12288:9LGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWp:97nQ/tbw/2Mkjy6Fr7g0op
TLSH
T1355523697964F98BFB1706F54C8281869B3F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 869d0c69628b6918b1d73e6328dc67d7d6173ab5c9f2b52167680135137c1654
MD5 b50cbf068eba086c9580d821b728a20c
SHA1 a57fd4cfdac890a9df801dc2efec55e063f8ca7a
SHA512 0b42f58bcc9d6bf2b9c014320babe7ecfb41ec99669df93e5b7eade5ae368d7033959603404329eddab623eb11dda503897dedd528423033b99d892d0154a679
SSDEEP 24576:TCUfpvPDv4Ex1hfe7i8WVq2lIGU8lrtGUJLPuwvAInQ/tbw/2Mkjy6Fr7g0oC:TCUxPTY+8Wg2lIL8lrIUJLWwdQ/lFTjG
TLSH
T13A65BE1EA3EC0896D4BB817589518A06FB72782E1B32D6CF2160C33D6F27AD55E35F06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 91a21a568c8866f63cad1dd319761cf53b518593f3a7ae54b7b9e5b4f10b9fd2
MD5 bc58ce619f0ca33b3bf442b03661e6d2
SHA1 d98b9680424f5b02b97f49939149c620418712f0
SHA512 18c8b96b994d67a474dc3794ce3cae391e3efad755cbb68db69a38cbfc018b9172fdc5cf130e58c299396fd6ab6c4ab92a4a3f16a351b985d48402a7d8ac6040
SSDEEP 12288:7ssf7GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWL:3rnQ/tbw/2Mkjy6Fr7g0oL
TLSH
T19265F119E29852E9D02E5275CB828641B3373C9597E1D3CB67C0F53E0F7A2905EEA743
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setting.ini

Path C:\Users\Admin\AppData\Local\Temp\setting.ini
Size 638B
SHA256 0c1f03b3a7d2790796ac63380f72a47276866c988dd24dca9bad044b1ba38707
MD5 11146409813d8c3e8b77604a6996ec59
SHA1 cec26456fbcd6d4423632f6fdf35fa932e07ba17
SHA512 3951681956286acabbfda5859ac14491364b7c37aa30ac2cdc6053bdd635c916e4fb9fc2d45a40665f753dd967e830e86d2d9c54264c7f74d61cbd41fee9a6d3
TLSH
T1ABF022334D488A1D112273B41DF2886561EAE481A870489CBFAAB8836F9895717B67DF
MD5 SHA1 SHA512 TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 351e6855eee165c0a61953bbcb17df9cac0d00e6631ab2ba1a2d34869e9f190e
MD5 5e8ab36437785548cde8717eee2b65fb
SHA1 0ceb62f0be04c293efcd6a64d6f74528ba975aeb
SHA512 9f784fbe72ca66f28cc1e79fd99e783c3bc0ab83a7a46d1393ca5dfe3ce1ab30345a6318d7670e1659fc9e511242c319c479655993ed2b4ee6379429f41f3b4c
SSDEEP 12288:YEGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW0:YknQ/tbw/2Mkjy6Fr7g0o0
TLSH
T1FF5523696658F94BFA3B06B048928111673F0EC5BF91D3CFBB082269953C3D41EBA785
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 6ae508f214837334e4951951c8ded20c5cc39717298699291ea721ffff56e6a9
MD5 02d40f37dad41e415f605a3c806d86b5
SHA1 ab6aee9da24278d99f897d34a625d519ad12a131
SHA512 68d66246a407d52df3ff1e0a74cdd778fe7bc689576a645d54583bfb56b2b7e9b8d6654d8ba5ca6673e3ae12477083ee15c8185b3419104c1913c5dbe20bade8
SSDEEP 24576:h8RMyNoSFw1d+rC4vrmRcGPiQEaaPnMRTCCnQ/tbw/2Mkjy6Fr7g0oM:+RZwQCyiHiQEaaPnMjQ/lFTjN4
TLSH
T1C985B01E62DC46A5E0BAD2B8CDA74407E6B23816573197CF1290C27D1F37EE45E3AB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 45d2dccfcc59455f618da89fde8600d6f7efd1c14853ee78ca9dd3213b0d5e97
MD5 c6ac19bb0fb77d79a5d0e8cb015e9b74
SHA1 d88f1d9b201e7362be1db50ff0f25ebf4b3f9c55
SHA512 55cbb237ca0893849b5cdef40d10fef03229b7ad6f8ccc93a4c8d141bd70344f479fb747f4ecadf0b2ea101e1785da7a7fee317a81720bdb5a64ae83614006a1
SSDEEP 12288:VbxA1U7KUGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWc:VbxA1UG0nQ/tbw/2Mkjy6Fr7g0oc
TLSH
T10555123E26AC24E6F636927D88D28106D3327C56676193DF2584823E4F3BBE41D76F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 69f473b55dcb36446d7510a1f35a228f24a4ddd52bd69543e4076b4dc1ee1f7d
MD5 65d2bc945ea36371387b43cdea472dcf
SHA1 5b56678c9fb6b892fd2d1c1a46fa47543526391f
SHA512 58f9645c7b67956613c62412f5b5821ff13d161dcd1c625813e85fb8497e7f52b79d3dd523b5a28e786ffe798c6f1252b9651502445dc0830ceb899110565a43
SSDEEP 24576:RjsmP0yHaqrVqHra44KDzMsrnVnQ/tbw/2Mkjy6Fr7g0oY:RjRP0yHfVqzlAsrnVQ/lFTjN4
TLSH
T1C745AF2EF2B910B9D8AAD176454107B5BB71782D1F209BCB0170C234AF1AEE85F35F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 04d07208e91371a6f0e1a785c6f35ff9614a8086394360ac3ed96ef90b5d671b
MD5 62c312b898614de9d9a4f019380a6b75
SHA1 2791b33e0c6356532d529e2c226087fc3ec8ce4f
SHA512 5fcb9b10ef873878f7f7d603c80649609fbbc4c20974363d23f3fab30b5df9cc7c720a7acd9ec7fdfd7dbd0cb5fdb1ebc79fcb5928d2d91c035945d1ab72fc04
SSDEEP 12288:wKGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWe:wKnQ/tbw/2Mkjy6Fr7g0oe
TLSH
T1F25523797654F98BFA2706F54C828142673B0EC17F95A3CF7B482229967D3D40AFA780
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.6MB
SHA256 eda39b1a92420d57b6cb4b931db3f3b4fb6de0091adf0dc90b5f5e0374a65968
MD5 a662e0c901992c348652d5e2771c09b2
SHA1 17e27d14bf3b6aa724653b09231c1228046e16b5
SHA512 5f2371adc970ec7196c0340b55ec1363aa7de5af475ebc3c0f4003b3ca9c16e2aa4cf0f5fb0357c59160ea598b0a61b954c59273cc1d2bbe6e92f1d7bb5f7801
SSDEEP 12288:6Ob4A4LWO+vAYFTQGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWy:rwLBUTwnQ/tbw/2Mkjy6Fr7g0oy
TLSH
T17975F155F7A450F9E92B813CC8A28A16E372789D1764E7DF03A84A691F333E14E3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 2b884c03a4c4e1fbf2606dc5e96f421f92fab54bc69fcbe2825615c500a94040
MD5 5b8c0bbe685007045b88f5137421f995
SHA1 92b69ef74adc2457aacdd4a84dc5ace8840e83a1
SHA512 822437f3f9c65f7a4fc9afe46aaabe9e75d019cb3e149176ddd4cffade1d8031da4624b193d6ba75ba7ba92c03d0d8f3220e3421b1de682e900a4bc332810b9e
SSDEEP 12288:o70VmuIYNvUyBp/GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWU:FKYNHxnQ/tbw/2Mkjy6Fr7g0oU
TLSH
T19665F12E62AD1CE5E53B91798AC38209F2737896175193CF05A0827E1F37BE87D3A741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 480bf4a2bd47478c6f750fe75cbc531914cccf40888258c27fc8562cc668b5f5
MD5 2fb13aa54724b860d6324be02b630866
SHA1 c5c17e7727ee4bc9ae7a46b3a85911ade5c6be11
SHA512 df7cba57dd5b827bd4ad1ec9ac0ae55197b2cb6ce4aa7bcc45bc872d842d0ba4e212a506389cdbee1e010736adc6bcdf10186460b9fa6a95077408f3b8f4ede4
SSDEEP 24576:rnXoJjNYH84VVSNAApoEON66aspcrcHBjSSKHPWdQwPF3hJ8ssmOc+XLxu+x7uKc:rnXoJJYH84VVS6AmEcJas+cHBjSSKHPk
TLSH
T10765BF6EA2BC04E9D5BBD17DC5C24506F5B278621331C6CF026082BA7F27AF55E39B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 32ff264b4adf4fab8b26d9f8b63557b9fa2f10603635f37ab1bb7c499f5db836
MD5 ba697baf72a801be6c2cc9a60437f0eb
SHA1 019f5808bf8b69cd2faa5bd482a2fb2c51601453
SHA512 7f3183bd34556e9bc88ee1cf766e9401121ee8cbf724f2a09b43df5e4cbba6bdc3d59397d42ccf38b55de4540db33fbca0b2dda6823bbbd8d64e6d319710293b
SSDEEP 24576:Ev7Xbxd9Tuycf8M/TYlSuxwr2PCHnQ/tbw/2Mkjy6Fr7g0oJ:EDLL9TuJ0M/TYW2PqQ/lFTjN4
TLSH
T17D858D5EA3EC52D8E47BD6BD85A39046FAB2B895273081CF1250856E1F23BF05D3DB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.3MB
SHA256 488e97a0425d70472977214120fc29da577c7f81d27fb3de798dfae57866e406
MD5 9a90cbae6f20676c917639507a0ec720
SHA1 2c4970ec99d077be284c5df64026820210d6c6ff
SHA512 61cdbbd0919c0467de8fd57efdbe31b777cba19760213ab0341c8b4cf672a1622ac00ed52dfb34c4f06fd125acb5554dd9e8ea268884f8f9593a81049fb2c5a8
SSDEEP 24576:NegJgpwJOmPOHWAK+8ZguIGyPsxr5Vin10wwnQ/tbw/2Mkjy6Fr7g0oh:NngOJOmPOHhwQ/lFTjN4
TLSH
T13955BF3FB7BC15D5E03EC17D8A928916F6B1786613255ACF0550827E5F2BEE42E3AB00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.6MB
SHA256 69b0f05dd334f8b2f54eeb290118912ccaa69c4f96fd6c45658072f58fe6b437
MD5 a3dfc1e533c7622cc712313471502aea
SHA1 cc9ec968314057853f48064a0efd92de4f26cfd0
SHA512 13059c85dd82660d77265f81aa0c55d1ad9ad0dfd5fa8cf61a319447e7ade7716c31d51073dbf4d24e801f5cd1bd66987385001dae42a8e02e1809b611b76e3b
SSDEEP 24576:bLJnJiTk3R3waE4JrOqnQ/tbw/2Mkjy6Fr7g0oC:bLJnJK8R304lFQ/lFTjN4
TLSH
T13075D03CD2A810E9E477C2B481561756FF32346D2B216ACB29B4D5353F22FE06A79F48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 dd9366fdd76b4f5ec2052ec8a53d300f003cd282b8e363252ebdb181a273b30d
MD5 6c3be5f13dfb36788224806e1faaed29
SHA1 a6f9a0978d7093fc9620e8572b72c860ace6c4dd
SHA512 4f2b35ec7b812703e34cfb29c3c77fa0a38a798c24920f38cbda76353aae9a420aabbc894d22fd673816e6c9f481ed42ae638e02d8954c794d2387351838ed26
SSDEEP 24576:fA9GqCceDQncA/BmlvLto8cFVr9og9P/Z6pYnQ/tbw/2Mkjy6Fr7g0oG:I9GqCzDScAZmlvTcFg8Ph6+Q/lFTjN4
TLSH
T110955C15F7EA5298E8B3CAF1C96294159B337C409B34F7DF0A80CA6A1E32BD1D539B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 b8d665f679d9e31041bf8257cd9aa50ad8ab25da82b392cc6f5f094dfd88cc25
MD5 e2f2dd86c9237bef786895ae202f1419
SHA1 f73914e4ce7f983028f5a78b10079006c8015ae5
SHA512 42e0f3a429432cf9d6c3d1cbdbffaa5903bf4e0323d59f3e91ec10515fbea61a8f650d3777ae3be4e1049133cf2aa65ff28569b08ab3722ad2de1d64e5d51dbe
SSDEEP 24576:ulYJeXm5jUuEAnQ/tbw/2Mkjy6Fr7g0o8:ulYJeXmRUuEAQ/lFTjN4
TLSH
T10155126D366CB0E6E22F41B988928545E372B4A1275163EF62D0C17D8F7B7E41E39F80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.4MB
SHA256 e274df36c6ecb6f752029797489caa1f2b6776af0fcf1e5780bf349acfc86dda
MD5 93b1f64c83ed0bef4fd5cde8e5c0c565
SHA1 6fdf925ea36d4dd3e75b269b2d0740927b4c1dd5
SHA512 ff67345992368214b0eaba5721692ebf129bdcda97692215c016d838b0d932fc296be4922792a552ed5312b5cf40de447cafec6e642bfbdf34d674ec884603b8
SSDEEP 12288:DFu6kyVGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWn:DUty1nQ/tbw/2Mkjy6Fr7g0on
TLSH
T1A165121833A4B4D9FA7A06788DA381819F3A7C50AF5093DF66C0E23E5F3A3D46975B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.3MB
SHA256 ea22ee981c1aab19f4b17dac5780b9057e5ae21ad1ec662a0756ea944e8a2da1
MD5 20a607b6d8e18be72a83c3a0db574a23
SHA1 c5c548df619b0fa5320e10798706e52a02e9cad6
SHA512 e926b4d6043910e309576584331f62515a7a4515d024123eb519740fd37ab1003972e1134a00e48b0e97f4918f022d46b0e636a4cba6615a615fb2542f4b21e6
SSDEEP 12288:JPQGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWG:NwnQ/tbw/2Mkjy6Fr7g0oG
TLSH
T11155236D2624F49BFE2706F448528542A73B1EC17F91A3EF7684A139CB7D3D016B6B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 3d20e58556318948013c56e46eb00f269ece8b3d6875bcd09f620c63627c1067
MD5 512333f10637e8f651e5212a2c6e81d6
SHA1 b5753980fa1c946a523af484ab40510b145b4d7b
SHA512 e79d00b03e881ad1a64b2689b425f61d7443436669f7ad22262b01a9d2ba496a0dd88ac5e3c4ee62daad408023b1e685a108407cdb7b8b8e079bd0a2ff00ef59
SSDEEP 24576:iC+TyQIu93VAumZr7jmLnQ/tbw/2Mkjy6Fr7g0os:i/TfIq+YLQ/lFTjN4
TLSH
T19E558C1DA7E91DCAE276C675C8A34493E633B872177186CF2044C07D49AEEE8AE74F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 0d8417ae4adf8ec9535630fad484c7bb724eaa304c8af74b07adb52360686bc0
MD5 cb8ababceb86138d0c0d388fae910c25
SHA1 f1e988a9c1fda24870e5ff8ff7ba005ffaa4f31b
SHA512 e846ac824f2ba9fcbb14e9236a2903e095b5caa582fb71ae9713ba7c5d827aea83dc0fc39cd6682c1accf7914db7833c914d0dba3f7efa953da338572fc78a2f
SSDEEP 12288:ycyrWOstaa3kcssGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWw:DLQikZsnQ/tbw/2Mkjy6Fr7g0ow
TLSH
T11F65F11FB3AA10A6E56B827C88824142F7B37471575263DF1290C77D4BBB2E97D38B81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 1585d0a0478a085993144acf6eea91d138cce86e12738a173fb1614c24a6ff99
MD5 35950f64cc2dd4b25317ac3fe9978f97
SHA1 d740e47ceab350c0ed6079c954e8cda37d3103a1
SHA512 68d6ebac07eedfe2bda0234f2d5c7850394028bba8854f3bcddf6a7c2cfd31ce577a6f82691c3db434bd91748889a379e4dc472b63c472b77720733f36a79bf9
SSDEEP 49152:BpJFwrPpGyqWo6cbT2TZ8maJO35NPHXogsS7Q78ZGAvL9vnF35LWAP1Q/lFTjN4:SpC7b4+80GTkBLm
TLSH
T1C0A57C3DE2B810ADD9AAC375C5461665EE71382E3F2015DB01B0C578BF1AEF19A38F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 37a86a37b5313e812eeb5353d397aa0f834a79bb149551a1cd6ee0914bc4fc04
MD5 adf06124fcf371f64dddd0a7bbb0be59
SHA1 a908092b5a1a5915d60d04c112c97bfc0c316d91
SHA512 cbe0ff00a5f1968042475545cff54294cf81029fa03125f2b707dc9271ac9010183351a3a86602785d6ffb0ad817fc79c3c30d0406d38a09bcb2fa09d932b42a
SSDEEP 24576:bSAwJPE1IDAo+4Kt+l44135UQ9nQ/tbw/2Mkjy6Fr7g0oN:bqPCIo4Kol4/Q9Q/lFTjN4
TLSH
T1DB55B02AA7F956E5E17AC7B4D663C501FB733822133163CF5290813E0E26AE85E79F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.6MB
SHA256 74159385a86cab3cfdfcf8299b0db93173661927c57b90c264a0f6718624b473
MD5 6c1db84af0367f2b7fa890ce01968baf
SHA1 4c7a35e84fc31538225b3a0537d1ae8cea56f754
SHA512 b4ea84edb4b470e0bdad31b647e6fcd1cf91f85a715b0e689ca6d6d0262311e0dd358c239b3923bc0467070de2ae779b89ab2578786da47ffdaed68f543cf159
SSDEEP 24576:PyLXPLcf94tNnQ/tbw/2Mkjy6Fr7g0ow:Py7PoetNQ/lFTjN4
TLSH
T1C175E03EE66C08E5E53AC27CC6A38506F672389D037166CB1A9491791F7BFF46939B00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StructuredQuerySchema.bin

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin
Size 414KB
SHA256 e67e330837a6b2f6d5f76815e7235a512b54b1c90f2ad62a3e9d142ae6939c8d
MD5 16b9618962f5623ca791a1366eee5708
SHA1 f0d257511952f075b2a0ec7d8e8730c3e464461a
SHA512 18e1d5a105b87fc72df94645685f5a8d3f593df2d3a9b8652b3b4a4ceaf92d3c7a67b0c08847186149dd608428cae8f1b3bc844bc7aacfc9e3219da823ca2fe2
SSDEEP 12288:vMUC7+vlk3n61mSkplXZ5RwmF9n4w/TSD:vXhl6V/i
TLSH
T124945F36BF88CB22C59A15748897C01A2E30A7C49E04CF6B73DC513CFA576685FBA359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.4MB
SHA256 cc7456aa1c30ca9bc26869b042fec7cd0c3d5dd4e753887722e5410a56ddc57f
MD5 b7ee8cb36e4f9f5117146abca9642c95
SHA1 e48d0730710655b95c4622d6cc44de007faa6e75
SHA512 b94f7cef8842bf1cd894be492caba425237a4ca5f0bf117d83689e0820ddc59d92c2eadb042ccf2302346782057c82e8c0f194b1296974b94cf65e3e70158d18
SSDEEP 12288:V9lyvj3IkxjbBzcGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWu:VWv8qjpcnQ/tbw/2Mkjy6Fr7g0ou
TLSH
T16765126E66A4B4D9F53A0274D863811682727CB227A4A7EF76C8D57E4B393C0953FF00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/800-228-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/800-170-0x0000000000920000-0x0000000000986000-memory.dmp

Download

memory/800-165-0x0000000000920000-0x0000000000986000-memory.dmp

Download

memory/800-164-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/1160-146-0x0000000140000000-0x0000000140167000-memory.dmp

Download

memory/1160-0-0x0000000140000000-0x0000000140167000-memory.dmp

Download

memory/1160-68-0x0000000002050000-0x00000000020B0000-memory.dmp

Download

memory/1160-1-0x0000000002050000-0x00000000020B0000-memory.dmp

Download

memory/1404-221-0x0000000140000000-0x0000000140175000-memory.dmp

Download

memory/1404-163-0x0000000140000000-0x0000000140175000-memory.dmp

Download

memory/1404-157-0x0000000000670000-0x00000000006D0000-memory.dmp

Download

memory/1404-151-0x0000000000670000-0x00000000006D0000-memory.dmp

Download

memory/1652-340-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/1652-179-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/1652-451-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/1772-434-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/1772-225-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/1780-247-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/1868-124-0x0000000001B30000-0x0000000001B90000-memory.dmp

Download

memory/1868-118-0x0000000001B30000-0x0000000001B90000-memory.dmp

Download

memory/1868-126-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/1868-130-0x0000000001B30000-0x0000000001B90000-memory.dmp

Download

memory/1868-133-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/1904-220-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/1904-147-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/1904-143-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/1904-137-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/2108-413-0x0000000140000000-0x0000000140143000-memory.dmp

Download

memory/2108-182-0x0000000140000000-0x0000000140143000-memory.dmp

Download

memory/2308-101-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/2308-192-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2308-95-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/2308-104-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2360-485-0x0000000140000000-0x000000014016D000-memory.dmp

Download

memory/2360-249-0x0000000140000000-0x000000014016D000-memory.dmp

Download

memory/2388-92-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/2388-114-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/2608-432-0x0000000140000000-0x000000014018E000-memory.dmp

Download

memory/2608-210-0x0000000140000000-0x000000014018E000-memory.dmp

Download

memory/2856-190-0x00000000004D0000-0x0000000000530000-memory.dmp

Download

memory/2856-193-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/2856-184-0x00000000004D0000-0x0000000000530000-memory.dmp

Download

memory/2856-431-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/3032-214-0x0000000140000000-0x0000000140165000-memory.dmp

Download

memory/3032-132-0x0000000140000000-0x0000000140165000-memory.dmp

Download

memory/3120-159-0x0000000140000000-0x0000000140155000-memory.dmp

Download

memory/3120-72-0x0000000140000000-0x0000000140155000-memory.dmp

Download

memory/3288-88-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/3288-87-0x0000000140000000-0x0000000140155000-memory.dmp

Download

memory/3288-74-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/3876-216-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/3876-215-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/4496-197-0x0000000000850000-0x00000000008B0000-memory.dmp

Download

memory/4496-203-0x0000000000850000-0x00000000008B0000-memory.dmp

Download

memory/4496-207-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/4656-222-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4656-433-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4768-115-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4768-106-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/4768-206-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4768-112-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/4824-176-0x0000000140000000-0x0000000140141000-memory.dmp

Download

memory/5076-250-0x0000000001C30000-0x0000000001C40000-memory.dmp

Download

memory/5076-459-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5076-248-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5076-292-0x000000000A520000-0x000000000A528000-memory.dmp

Download

memory/5076-266-0x0000000001EE0000-0x0000000001EF0000-memory.dmp

Download

memory/5076-233-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/5076-239-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/5100-453-0x000001A318C70000-0x000001A318C80000-memory.dmp

Download

memory/5100-475-0x000001A318C70000-0x000001A318C80000-memory.dmp

Download

memory/5100-476-0x000001A318C70000-0x000001A318C80000-memory.dmp

Download

memory/5100-472-0x000001A318C70000-0x000001A318C80000-memory.dmp

Download

memory/5100-473-0x000001A318C70000-0x000001A318C80000-memory.dmp

Download

memory/5100-474-0x000001A318C70000-0x000001A318C80000-memory.dmp

Download

memory/5100-471-0x000001A318C70000-0x000001A318C80000-memory.dmp

Download

memory/5100-470-0x000001A318C70000-0x000001A318C80000-memory.dmp

Download

memory/5100-469-0x000001A318C70000-0x000001A318C80000-memory.dmp

Download

memory/5100-461-0x000001A318C70000-0x000001A318C80000-memory.dmp

Download

memory/5100-462-0x000001A318C70000-0x000001A318C80000-memory.dmp

Download

memory/5100-463-0x000001A318C70000-0x000001A318C80000-memory.dmp

Download

memory/5100-465-0x000001A318C70000-0x000001A318C80000-memory.dmp

Download

memory/5100-467-0x000001A318C70000-0x000001A318C80000-memory.dmp

Download

memory/5100-468-0x000001A318C70000-0x000001A318C80000-memory.dmp

Download

memory/5100-466-0x000001A318C70000-0x000001A318C80000-memory.dmp

Download

memory/5100-464-0x000001A318C70000-0x000001A318C80000-memory.dmp

Download

memory/5100-460-0x000001A318C70000-0x000001A318C80000-memory.dmp

Download

memory/5100-458-0x000001A318C70000-0x000001A318C80000-memory.dmp

Download

memory/5100-455-0x000001A318C70000-0x000001A318C80000-memory.dmp

Download

memory/5100-457-0x000001A318C70000-0x000001A318C80000-memory.dmp

Download

memory/5100-456-0x000001A318C70000-0x000001A318C80000-memory.dmp

Download

memory/5100-452-0x000001A318C70000-0x000001A318C80000-memory.dmp

Download

memory/5100-454-0x000001A318C70000-0x000001A318C80000-memory.dmp

Download

memory/5100-441-0x000001A318C70000-0x000001A318C80000-memory.dmp

Download

memory/5100-442-0x000001A318C70000-0x000001A318C80000-memory.dmp

Download

memory/5100-443-0x000001A318C70000-0x000001A318C80000-memory.dmp

Download

memory/5100-444-0x000001A318C70000-0x000001A318C80000-memory.dmp

Download

memory/5100-445-0x000001A318C70000-0x000001A318C80000-memory.dmp

Download

memory/5100-446-0x000001A318C70000-0x000001A318C80000-memory.dmp

Download

memory/5100-447-0x000001A318C70000-0x000001A318C80000-memory.dmp

Download

memory/5100-448-0x000001A318C70000-0x000001A318C80000-memory.dmp

Download

memory/5100-449-0x000001A318C70000-0x000001A318C80000-memory.dmp

Download

memory/5100-450-0x000001A318C70000-0x000001A318C80000-memory.dmp

Download

memory/5100-437-0x000001A318C70000-0x000001A318C80000-memory.dmp

Download

memory/5100-438-0x000001A318C70000-0x000001A318C80000-memory.dmp

Download

memory/5100-439-0x000001A318C70000-0x000001A318C80000-memory.dmp

Download

memory/5100-440-0x000001A318C70000-0x000001A318C80000-memory.dmp

Download

memory/5100-436-0x000001A318C70000-0x000001A318C80000-memory.dmp

Download

memory/5100-435-0x000001A318C70000-0x000001A318C80000-memory.dmp

Download