614248fa4cc834b9947321f4405bc1b12609bdecc2ba147358c2dc199da2a9fe

Analysis

max time kernel
148s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
22/05/2026, 12:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-22_24ba8116baa2296670f635e006f75d87_icedid_luca-stealer_njrat_stealc.exe
Size 2.9MB
Sample260522-plnpdadv5w
SHA256 614248fa4cc834b9947321f4405bc1b12609bdecc2ba147358c2dc199da2a9fe
MD5 24ba8116baa2296670f635e006f75d87
SHA1 f982f8ac579fea0be455c45dc9a31cf7052acf20
SHA512 a8376f5a356e8a508782f85128014879d96c69491d8755a5efd06b5237c8e11f0dc8bde538403918fcc63921af732290b6eed56eb075296ce4d6c215d7a26928
SSDEEP 49152:l3Y3dGiDIKldNDajIT1P2saNoNla+20Z9iv71XyEBXOf:gYiDJdN+eaNEa+20Z9A7c2Of
TLSH
T118E55A09A15770DCC159B07AEA3FEA22D6723C05172086DB26D87E3B3EF6BD1493B611
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
1356	alg.exe
1244	DiagnosticsHub.StandardCollector.Service.exe
4064	fxssvc.exe
564	elevation_service.exe
3492	elevation_service.exe
2420	maintenanceservice.exe
660	msdtc.exe
4968	OSE.EXE
2116	PerceptionSimulationService.exe
2092	perfhost.exe
1052	locator.exe
492	SensorDataService.exe
4836	snmptrap.exe
3760	spectrum.exe
5668	ssh-agent.exe
5540	TieringEngineService.exe
5632	AgentService.exe
5732	vds.exe
5692	vssvc.exe
5836	wbengine.exe
5196	WmiApSrv.exe
3212	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Public\Videos\desktop.ini	2026-05-22_24ba8116baa2296670f635e006f75d87_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	2026-05-22_24ba8116baa2296670f635e006f75d87_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Users\Public\desktop.ini	2026-05-22_24ba8116baa2296670f635e006f75d87_icedid_luca-stealer_njrat_stealc.exe

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\e:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe

Drops file in System32 directory 35 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-05-22_24ba8116baa2296670f635e006f75d87_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-05-22_24ba8116baa2296670f635e006f75d87_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-05-22_24ba8116baa2296670f635e006f75d87_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-05-22_24ba8116baa2296670f635e006f75d87_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-05-22_24ba8116baa2296670f635e006f75d87_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\d59e5a451c6cb3b6.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-05-22_24ba8116baa2296670f635e006f75d87_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-05-22_24ba8116baa2296670f635e006f75d87_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-05-22_24ba8116baa2296670f635e006f75d87_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-05-22_24ba8116baa2296670f635e006f75d87_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-05-22_24ba8116baa2296670f635e006f75d87_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-05-22_24ba8116baa2296670f635e006f75d87_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-05-22_24ba8116baa2296670f635e006f75d87_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-05-22_24ba8116baa2296670f635e006f75d87_icedid_luca-stealer_njrat_stealc.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\{17A6A947-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db	spectrum.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-05-22_24ba8116baa2296670f635e006f75d87_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-05-22_24ba8116baa2296670f635e006f75d87_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-05-22_24ba8116baa2296670f635e006f75d87_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	spectrum.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-05-22_24ba8116baa2296670f635e006f75d87_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-05-22_24ba8116baa2296670f635e006f75d87_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-05-22_24ba8116baa2296670f635e006f75d87_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-05-22_24ba8116baa2296670f635e006f75d87_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-05-22_24ba8116baa2296670f635e006f75d87_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-05-22_24ba8116baa2296670f635e006f75d87_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-05-22_24ba8116baa2296670f635e006f75d87_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-05-22_24ba8116baa2296670f635e006f75d87_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-05-22_24ba8116baa2296670f635e006f75d87_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	2026-05-22_24ba8116baa2296670f635e006f75d87_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	2026-05-22_24ba8116baa2296670f635e006f75d87_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_173546\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-05-22_24ba8116baa2296670f635e006f75d87_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-05-22_24ba8116baa2296670f635e006f75d87_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-05-22_24ba8116baa2296670f635e006f75d87_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-05-22_24ba8116baa2296670f635e006f75d87_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	2026-05-22_24ba8116baa2296670f635e006f75d87_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	2026-05-22_24ba8116baa2296670f635e006f75d87_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	2026-05-22_24ba8116baa2296670f635e006f75d87_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	2026-05-22_24ba8116baa2296670f635e006f75d87_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-05-22_24ba8116baa2296670f635e006f75d87_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	2026-05-22_24ba8116baa2296670f635e006f75d87_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-05-22_24ba8116baa2296670f635e006f75d87_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2026-05-22_24ba8116baa2296670f635e006f75d87_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2026-05-22_24ba8116baa2296670f635e006f75d87_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-05-22_24ba8116baa2296670f635e006f75d87_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	2026-05-22_24ba8116baa2296670f635e006f75d87_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-05-22_24ba8116baa2296670f635e006f75d87_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	2026-05-22_24ba8116baa2296670f635e006f75d87_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-05-22_24ba8116baa2296670f635e006f75d87_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-05-22_24ba8116baa2296670f635e006f75d87_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-05-22_24ba8116baa2296670f635e006f75d87_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-05-22_24ba8116baa2296670f635e006f75d87_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	DiagnosticsHub.StandardCollector.Service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-05-22_24ba8116baa2296670f635e006f75d87_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-05-22_24ba8116baa2296670f635e006f75d87_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	2026-05-22_24ba8116baa2296670f635e006f75d87_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-05-22_24ba8116baa2296670f635e006f75d87_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-05-22_24ba8116baa2296670f635e006f75d87_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-05-22_24ba8116baa2296670f635e006f75d87_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-05-22_24ba8116baa2296670f635e006f75d87_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-05-22_24ba8116baa2296670f635e006f75d87_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2026-05-22_24ba8116baa2296670f635e006f75d87_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_173546\javaw.exe	2026-05-22_24ba8116baa2296670f635e006f75d87_icedid_luca-stealer_njrat_stealc.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-05-22_24ba8116baa2296670f635e006f75d87_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tiff	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000066ea68bfe6e9dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dib\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000867815bfe6e9dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000afc8e5bee6e9dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raw	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000df0200bfe6e9dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9923 = "Windows Media playlist"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe

Suspicious behavior: EnumeratesProcesses 42 IoCs

pid	Process
1248	2026-05-22_24ba8116baa2296670f635e006f75d87_icedid_luca-stealer_njrat_stealc.exe
1248	2026-05-22_24ba8116baa2296670f635e006f75d87_icedid_luca-stealer_njrat_stealc.exe
1248	2026-05-22_24ba8116baa2296670f635e006f75d87_icedid_luca-stealer_njrat_stealc.exe
1248	2026-05-22_24ba8116baa2296670f635e006f75d87_icedid_luca-stealer_njrat_stealc.exe
1248	2026-05-22_24ba8116baa2296670f635e006f75d87_icedid_luca-stealer_njrat_stealc.exe
1248	2026-05-22_24ba8116baa2296670f635e006f75d87_icedid_luca-stealer_njrat_stealc.exe
1248	2026-05-22_24ba8116baa2296670f635e006f75d87_icedid_luca-stealer_njrat_stealc.exe
1248	2026-05-22_24ba8116baa2296670f635e006f75d87_icedid_luca-stealer_njrat_stealc.exe
1248	2026-05-22_24ba8116baa2296670f635e006f75d87_icedid_luca-stealer_njrat_stealc.exe
1248	2026-05-22_24ba8116baa2296670f635e006f75d87_icedid_luca-stealer_njrat_stealc.exe
1248	2026-05-22_24ba8116baa2296670f635e006f75d87_icedid_luca-stealer_njrat_stealc.exe
1248	2026-05-22_24ba8116baa2296670f635e006f75d87_icedid_luca-stealer_njrat_stealc.exe
1248	2026-05-22_24ba8116baa2296670f635e006f75d87_icedid_luca-stealer_njrat_stealc.exe
1248	2026-05-22_24ba8116baa2296670f635e006f75d87_icedid_luca-stealer_njrat_stealc.exe
1248	2026-05-22_24ba8116baa2296670f635e006f75d87_icedid_luca-stealer_njrat_stealc.exe
1248	2026-05-22_24ba8116baa2296670f635e006f75d87_icedid_luca-stealer_njrat_stealc.exe
1248	2026-05-22_24ba8116baa2296670f635e006f75d87_icedid_luca-stealer_njrat_stealc.exe
1248	2026-05-22_24ba8116baa2296670f635e006f75d87_icedid_luca-stealer_njrat_stealc.exe
1248	2026-05-22_24ba8116baa2296670f635e006f75d87_icedid_luca-stealer_njrat_stealc.exe
1248	2026-05-22_24ba8116baa2296670f635e006f75d87_icedid_luca-stealer_njrat_stealc.exe
1248	2026-05-22_24ba8116baa2296670f635e006f75d87_icedid_luca-stealer_njrat_stealc.exe
1248	2026-05-22_24ba8116baa2296670f635e006f75d87_icedid_luca-stealer_njrat_stealc.exe
1248	2026-05-22_24ba8116baa2296670f635e006f75d87_icedid_luca-stealer_njrat_stealc.exe
1248	2026-05-22_24ba8116baa2296670f635e006f75d87_icedid_luca-stealer_njrat_stealc.exe
1248	2026-05-22_24ba8116baa2296670f635e006f75d87_icedid_luca-stealer_njrat_stealc.exe
1248	2026-05-22_24ba8116baa2296670f635e006f75d87_icedid_luca-stealer_njrat_stealc.exe
1248	2026-05-22_24ba8116baa2296670f635e006f75d87_icedid_luca-stealer_njrat_stealc.exe
1248	2026-05-22_24ba8116baa2296670f635e006f75d87_icedid_luca-stealer_njrat_stealc.exe
1248	2026-05-22_24ba8116baa2296670f635e006f75d87_icedid_luca-stealer_njrat_stealc.exe
1248	2026-05-22_24ba8116baa2296670f635e006f75d87_icedid_luca-stealer_njrat_stealc.exe
1248	2026-05-22_24ba8116baa2296670f635e006f75d87_icedid_luca-stealer_njrat_stealc.exe
1248	2026-05-22_24ba8116baa2296670f635e006f75d87_icedid_luca-stealer_njrat_stealc.exe
1248	2026-05-22_24ba8116baa2296670f635e006f75d87_icedid_luca-stealer_njrat_stealc.exe
1248	2026-05-22_24ba8116baa2296670f635e006f75d87_icedid_luca-stealer_njrat_stealc.exe
1248	2026-05-22_24ba8116baa2296670f635e006f75d87_icedid_luca-stealer_njrat_stealc.exe
1244	DiagnosticsHub.StandardCollector.Service.exe
1244	DiagnosticsHub.StandardCollector.Service.exe
1244	DiagnosticsHub.StandardCollector.Service.exe
1244	DiagnosticsHub.StandardCollector.Service.exe
1244	DiagnosticsHub.StandardCollector.Service.exe
1244	DiagnosticsHub.StandardCollector.Service.exe
1244	DiagnosticsHub.StandardCollector.Service.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1248	2026-05-22_24ba8116baa2296670f635e006f75d87_icedid_luca-stealer_njrat_stealc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
688	Process not Found
688	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1248	2026-05-22_24ba8116baa2296670f635e006f75d87_icedid_luca-stealer_njrat_stealc.exe
Token: SeAuditPrivilege	4064	fxssvc.exe
Token: SeRestorePrivilege	5540	TieringEngineService.exe
Token: SeManageVolumePrivilege	5540	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	5632	AgentService.exe
Token: SeBackupPrivilege	5692	vssvc.exe
Token: SeRestorePrivilege	5692	vssvc.exe
Token: SeAuditPrivilege	5692	vssvc.exe
Token: SeBackupPrivilege	5836	wbengine.exe
Token: SeRestorePrivilege	5836	wbengine.exe
Token: SeSecurityPrivilege	5836	wbengine.exe
Token: 33	3212	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3212	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3212	SearchIndexer.exe
Token: SeDebugPrivilege	1248	2026-05-22_24ba8116baa2296670f635e006f75d87_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	1248	2026-05-22_24ba8116baa2296670f635e006f75d87_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	1248	2026-05-22_24ba8116baa2296670f635e006f75d87_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	1248	2026-05-22_24ba8116baa2296670f635e006f75d87_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	1248	2026-05-22_24ba8116baa2296670f635e006f75d87_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	1244	DiagnosticsHub.StandardCollector.Service.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3212 wrote to memory of 4296	3212	SearchIndexer.exe	107
PID 3212 wrote to memory of 5644	3212	SearchIndexer.exe	108
PID 3212 wrote to memory of 6112	3212	SearchIndexer.exe	109

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-05-22_24ba8116baa2296670f635e006f75d87_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-22_24ba8116baa2296670f635e006f75d87_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:1248

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:1356

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1244

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:1572

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4064

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:564

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3492

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:2420

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:660

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4968

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2116

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s fdPHost
1⤵
PID:2200

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2092

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:1052

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:492

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:4836

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3760

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5668

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:5648

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5540

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5632

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:5732

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5692

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5836

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:5196

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3212
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4296
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2916 2896 924 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5644
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2952 2948 924 {85EE815A-7738-4808-A14A-3AD87E32A3BF}
  2⤵
  - Modifies data under HKEY_USERS
  PID:6112

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 5202ad34b41a8401f6552eee23eeff751a28529430fbbb734ae384cdc7bc495a
MD5 6169ddb04bed66b4405a8806139531fe
SHA1 6516ca81235c18bb25b5663e85f8a09c1de971f5
SHA512 3a98dbb80dd9add531b6c14c1918a242439121712a7d25224c0bf02234eb77294762ed922b76a140843bf1124282409f66707960cd4ad601b8b0d0fb7a25c586
SSDEEP 49152:xb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnQ0Z9iv71XyEBXOf:33q6HjBZ0Z9A7c2Of
TLSH
T1CAD59D03F2D900E9E069D178D7469133EAA2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 c4707734e4f73aa5db3dc0cd1f03150a9cf687f700ef0d2ea8ac8013b5f5bc81
MD5 80d2cac65ee348701cea716781e73f74
SHA1 1244126b5f27a311dfe470881dd615d19ce84a46
SHA512 2cb99dcb74c1501931fe19c29447c95a2276c1c0ee0e1a1c00853b517e8167ac52774821b8f881fcc0381f7f26c03a6fd52e1c1f1d6f65fa8da86aaea4d42baa
SSDEEP 24576:QXYfDtczAV0BTZ9iScVD++jJXyE3c4XsQS7f:ntcS0Z9iv71XyEBXOf
TLSH
T15A05F12967E409FAED67823CCCA28501E7337C914760E7DB03A499691F336D85E3EB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 a61e1cd8bf80ff40f46a2ee4582a306b0f885e8c1bd51651192fc766255fe5b9
MD5 3bed3e81403300792a6e8d87fb9a37a3
SHA1 05ad1f7d20008c881fe89b6fb40d21d1fd6f728a
SHA512 c7fcc3286e739ea338cafb6c45b0d7b68c8f8be2f9d27e9af538add67a2bbe419009781aa33244c7e28a2cf742e67816e22c6e0c6f3c828b6696c62121c401f8
SSDEEP 24576:U0Le5ji0hmxirM40BTZ9iScVD++jJXyE3c4XsQS7f:UPji0AcT0Z9iv71XyEBXOf
TLSH
T11C359E16F5788735D073C0B9C5D2A68EE97130825B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 1f0df156aa117646a0703990cbb47f6949fe8e4ee75cb24c1c39c9af7b11925b
MD5 c93926199b4e9ab1eda880af746ee47d
SHA1 2bf0d622525919914f8ecf3df054379bc23c850c
SHA512 8ac52dacb9394d963da3db452fea307867ddc08bd3e7ca79a7ea5d9c43c45993058a53a7f2962cafef345c9ffb987d18cf01fe69fcb54d46601cdb734481085e
SSDEEP 24576:Aa7/ezSC6vUyD/aqgrvWE6q8wyui0BTZ9iScVD++jJXyE3c4XsQS7f:3/ezSC6vUzPvxHjyf0Z9iv71XyEBXOf
TLSH
T114755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 6aba35ae67c6bcebb157f31762fd94b8a4751ceae62574001af75e3c2c704c35
MD5 24034652cd153b0934f35ff042139958
SHA1 16135be91487b3665725463a3f59ac6d64ac3828
SHA512 99f44d7dd0f6036aebe6fbe76013b6c4acfaa9648a2a242af304e627c2cfe9ea41f07f1dca56aa2adc9d6d6151da8e72ce2eb62c8246a5d96c3beae11df99ee6
SSDEEP 24576:qVbqPb88hv/l+6p0BTZ9iScVD++jJXyE3c4XsQS7f:qVO88hXl+E0Z9iv71XyEBXOf
TLSH
T156558E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C3E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 a7a725083b8590246a46cc5d6eeeb38cc56426bb7752fba4b2059356117e7096
MD5 39403ce4d0f9f8c4b1917d7bc686253d
SHA1 d33e5e46146c60c766d85a539fc9913f9a917fec
SHA512 fa916ac9d930643ec03772972ee35d2e9001aabdf990a737e434748879b8916f0e87fbcfadb4d675d0444eb8c0276cca591aa5c35b9be6fcee47097e4d3e43ac
SSDEEP 12288:xRchAlBciqqZeuiXC61iVNcDvG+XzzNQnGyEZ9c46usQS7f:xRc0BTZ9iScVD++jJXyE3c4XsQS7f
TLSH
T1ABC4238B455C6ECBFF89423DBC9A3902133D1DF1C855C8D68468FA496C78DBAD9183C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 8046b84f46e7d9fc35e5c80f29b0d73bac5f09d1e7776fb4d40620a828008234
MD5 5019145a17ce6a09bbe44d9bb7f39063
SHA1 99251b640c3ebac7592e6eb2c5e24b8a4f54f574
SHA512 e4e2f6b2d8a3c70ff1b35782dee556f0023051e8f40c9ef908759224dc28721a8eb5a9646c57346550d96dafb9615db8d43bfaeaab7f30ec74ae08410c3462a7
SSDEEP 12288:8eBNUbTVO86URhAlBciqqZeuiXC61iVNcDvG+XzzNQnGyEZ9c46usQS7f:8JIUR0BTZ9iScVD++jJXyE3c4XsQS7f
TLSH
T1F305CF3BEE28FCD2C67A8DB85A918600D77278704F6293CBD165C20EDE235E15E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 57ce63c59bc3e5962593ca0efd0347b96d1469b9c5193d5691089ab71f4cfe88
MD5 03e2771b566bb5a6523a03e7b8e57eea
SHA1 c9693af47c41df92e166451c20a09fd5b1fa2a1b
SHA512 d9edd727f67fddb51bf44fdf4c278d419562881af129086cf0f4c4ffae8a1354d23eca168857d7d53ba8bfc08cfdbff74c0a00961567fa99893f152b6162f8c6
SSDEEP 49152:5QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3TH6:5QvGAdlCEL8c/yRNw5Cy0Z9A7c2Of
TLSH
T13A267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 aad5469421fd37d04804ea866b31d6d80aea472a019226513611bdf3c5094440
MD5 dbd3bcb831a87df898c92c0d80f58a67
SHA1 2edf461be71da65f4a29fb6f9fb8c301ce65f0f8
SHA512 888aad0f9f6e61bb0b7208f88a05f5a0be2376aa27f8c3309a01fc22da75a870e4710cc258ef6449e23f501f9affd2b99ac4e616684a6d5d904bb05c06957ecf
SSDEEP 24576:/dewsAjj0BTZ9iScVD++jJXyE3c4XsQS7f:lljj0Z9iv71XyEBXOf
TLSH
T18B15E031FE78E436C7BB0DB62B26D706143C79604B6119C3E3A89E8E59302D26776B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 05b62e979e637d93671e2eb1f93b27605e84861eadef7a8d6a11abcdf13211ac
MD5 d53899c28d70f5cf4acd56a3219213d5
SHA1 5f58b52b7e361402253a794804f0545ef1fae47b
SHA512 971e9cd919db88024e8957a482149d055cdfec6b04183e534c169942d13e2523f1e147fde6f45ef03e904592af29f34d0381fd4267b2c389e844852c7f0d9c76
SSDEEP 196608:xUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJH70TwL:xUEtQevvqc2W1cpV2EI3270TwL
TLSH
T156474B91BBE843E2E3A6953484B182B6FBB17C1E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 78cff895b9b45c1d35de61ef56eaf14c3fc084c818c795aaa123f4fa59c42d24
MD5 070419407c282ef45ca001b842f9a7a3
SHA1 0111e663d4cf54f8cb7ad2786755a2092bf2b27f
SHA512 4c45731916927148e695f335081c610dea2b59bcd1747f9073dbf9dd43f98a63549388c7a660a1abf9a9247b1fc16b6ae9ca5a119d8d5b0f99aaf7caa0e874a8
SSDEEP 49152:mCbRquA/m2yL5zLfFiV+XenmE3/zD0Z9iv71XyEBXOf:Loq2Vjnme0Z9A7c2Of
TLSH
T1EDD58D0976B8C2E4D1F6C37896A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 92c87e49fb39bb36ee20f6ff4b5e9899d6c83cc8f7fb866f4711b990b4f46828
MD5 2e66044fdbb008786b0e20fd017f5133
SHA1 7bd9fad241e3d99fbcd5547bfed77c7e5cff191f
SHA512 595acad903b230a5193f2558b46382a06ff730c4aadae816b1eb197dbbfc9713856ab27b7e1936399d88f136cb71261c9e6dc5ab810ef8f9d282c9b6f31741a8
SSDEEP 24576:JAhGLJIFoiwtA5l7S53+0BTZ9iScVD++jJXyE3c4XsQS7f:JAMyFoiq5u0Z9iv71XyEBXOf
TLSH
T1F135AD81E7F955D4F5B3AA78A9B69170EA76BCA65E31C20F2160D10F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 19ce17cf07a76712a04564380ed960798a813501d1465c0143adf9bd6f60f7df
MD5 bc95ad36096247ebd50822cde6d9fdcb
SHA1 19a42e12cf84f206681642b1c1ea0b4d8291a72e
SHA512 ff26e0beaafe6e0cf6f6b12557e2d864bec9ee2c32395bd330bfaad6af1cd79d405aecae132e050cef7cf00dee1e186fb0eb7dee9b7dbfbd154277eb28e3dd01
SSDEEP 24576:pwuoOW/0BTZ9iScVD++jJXyE3c4XsQS7f:pwDOK0Z9iv71XyEBXOf
TLSH
T11F05F14A26A81CFAE9A7823CC5979532F7F27C522921C71F0360C65B6F37361AD2D760
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 b09d5f71b48bc44f2a41a45f80d71d50af5d6ebba31b9c6a0f71d195211d5d69
MD5 e526cab3f5aec88972df1fb524d6372d
SHA1 20049c69120c829f90f185ef2d6c905b84c485bb
SHA512 e44317b3d1d860a4c4cc42e72d59b03d14746a680491c74d42680f93ef712fee27cda9e9b950004c00171c2e7743cfee7d7b5e8ed05aa4e032aaefcf090a7f74
SSDEEP 12288:GBZ1IyzhAlBciqqZeuiXC61iVNcDvG+XzzNQnGyEZ9c46usQS7f:QZug0BTZ9iScVD++jJXyE3c4XsQS7f
TLSH
T178E4128B12DC35FBEA96423CDCE51A05D3763CA2477683CF052896592F32EE65D38362
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 93a140c1d588fb669ddfe2dfc2ec969b8956d35c1456e05835ec039e21916b19
MD5 edb06d0cdd3faf9179adb5bad30d3acc
SHA1 779045e741c93e77812d3553182ef8359ac002b6
SHA512 5ede8298a3e453a4ef4ceab6dfdb90da90398f73d7d4d1740548313e3d185b43ab0cccedf02458f8b167d301edf89bac0bd5d81494d994059bce9b54f8fbbe53
SSDEEP 98304:dQRQyi36YOcPQLvw2gAf+PN3d0Z9A7c2Of:UQyiKayX+PNN0TwL
TLSH
T197667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 8d01f6e7c6b39bbd5adc6b1e1bc46b015000df6bd03d06ca9b2159af49eec884
MD5 d0e09339aeb41b6d9732292fc6af5084
SHA1 9e1cb62f88d5a049f6b18e382f8625683a4b21cb
SHA512 5f73a1b6e23af5472832ab5abb1f00e2fd1a293c9a6248fcfaa58504b558f77b9cdb00d1764d8ad598ccba1e5686bd1a40a5b57724f71cabeb76eaa1c1c40dcb
SSDEEP 98304:MQRQyi36YOcPQLvw2gAf+PN3d0Z9A7c2Of:TQyiKayX+PNN0TwL
TLSH
T1CF667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 7c04cf808de399b25579a5c7994420ed39e966852076d4818b38aeffd5828de2
MD5 5daa8b351c77ed90d65be4af2f6a8ade
SHA1 4c3c480edb953e86f06477053276f7723a01a055
SHA512 1784a48da6d84cc97dfbda6e58e28dc9f13b07d78b190feb90709d81e3426426269bb84552bc5018a17a804b95463da714f51345bc036f444ac873988d5e41ee
SSDEEP 49152:f68Qg55nhheWu7PNU3/T0Z9iv71XyEBXOf:ZthWRc/T0Z9A7c2Of
TLSH
T10CB55933B2F60099C44DE1769F4A972196E17C718FE0E3DB8515720A1FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 3c493dd87f58748c6728aaa700ad1a9d7b479209c9df777963723fc422fb2673
MD5 85b8f242be8e89be750ab6e304269a9a
SHA1 7cc04be423ad095b7478364bb3b7cbe5b77cecd0
SHA512 02c236b73cd5668dc5b06ecdc3b5d69a4ae3ede468c955fed711cf7e84cb48374d0144260f0393a2aba06f41d8e2933cec2b7f2869e37bd892c07ad8a6fa7dd1
SSDEEP 98304:Iy5112gYy5azzVvL69nLKnhZc0Z9A7c2Of:hLIHmWhW0TwL
TLSH
T1BA167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 46ce72336d59213f0eb05c682bdbc0c1e941ce11ee761cf2aaad2a96dd99f157
MD5 96b7b7ba024281608260b83f22992bc3
SHA1 dd4beaacbc731a34fc8ae06351cd16e380bc613f
SHA512 29395869c02b3118e2ac7d1b198c743b023e4916fc7347d8c4000242629d664da5d21169fedb8e895d2dcca4b9902780a095613f63aff063eb312d80c66dc7c2
SSDEEP 49152:/B+taZ3usBWOBr4tEGT0bqx0z+n217aau1glF0Z9iv71XyEBXOf:Bu6JmVxd2dF0Z9A7c2Of
TLSH
T117D59D13F1DA01E8D05ED178974A9233EA62BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 8ea2bcb36f783b4602c0a154c636b7cbdd2dc5f6fba03fd0748e3a435b550852
MD5 74e944a440511a4990c733f268d3d980
SHA1 60774579424a28440576594e989afdf2bf7929e2
SHA512 0bb5c11b6cab02b74c0e5728349cb2de2a19cb9d8fd2a2ef1f2208b0dd1ab4ac310e1f839fb3e8ca2a40ef3734e2b7b65539274c6fa0cfa66cbbb09051f9cc12
SSDEEP 49152:21hpsNoJpF1A6UU44CwH7R4xx0Z9iv71XyEBXOf:2mifPbRe0Z9A7c2Of
TLSH
T1F5B5AD13F2D801E8D05ED17887569632EA72BC460B34B6DF0A90B7962F7BAE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 da10e07276039f78ee2bf1d33f0fa86bd012712ea9b783c97528acdee775c1ca
MD5 52076ca7a60097410923dcf2d0e4a647
SHA1 6113e42cf97011259f30f9c33589599381b1a7c1
SHA512 d5fa844a88069049aecdd9e85b7405fa08083971488d25aa844380f442bdd93734f4d18f244266e8f1a19b6588a9a3cb5d8b9db3a732b092e8dad2f44d5e29b8
SSDEEP 49152:ySuZQIY0Be2KRRVtOnks6NMHqg0Z9iv71XyEBXOf:s5dKTi61g0Z9A7c2Of
TLSH
T1E2C5BF03F2E941E8E0BED67887669232EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 192010b334fc555ea9b300c2c368447d07d244bd46334bcbc3f2fd38d70c3580
MD5 4bb9014692e407030beab86af8fb5822
SHA1 90db2fdc53e9637afd91167df8d84cdcdb671c02
SHA512 fd3abd16f6073536763af63050ec1925f894d5d8d5c1edf9bcb4a7917be0c6c86a9ab5f42875b2b28bf6a44b3a270db243ea5868ae3741bce9db0bd97113b9db
SSDEEP 49152:8htSn8EApI0figngiDn0AP5wV0Z9iv71XyEBXOf:9X2iyphq0Z9A7c2Of
TLSH
T11D95BE13F2D901E8D05ED178C7468632EA72BC160B35AAEF0A90B7561E7BBE45B3D311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 62af010997f9f9178905bd67f06395ffab138cc699746b6ba071851e04ebb662
MD5 2967b51295d7a9c5bcab1bf67c41c5c5
SHA1 676d513c316c612de157c76af99240c89bbfddb8
SHA512 33408e65f706405141878ef85d396b62e98f532ec0646ec6c8776872e79858bcbdc32271c2b069ff11b4ee0bb7327bad33d7b83af6e423b2ea02d38f0a248aff
SSDEEP 12288:KEhAlBciqqZeuiXC61iVNcDvG+XzzNQnGyEZ9c46usQS7f:KE0BTZ9iScVD++jJXyE3c4XsQS7f
TLSH
T197C4238B489C5ECBEF44827DF8863A01533D1DF3C856C0E6652DF509BE789BA99183C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 572f156b697d0ea32091a11a50c01a149bcbf458f33c785a6a274269d86d91d1
MD5 c799837c54068b6ba0e6ab9959aca3ec
SHA1 949710cf4cbd2797cc637989a3132583465bbdb8
SHA512 2d0b658f82c2a2aebb312776d6487a6d6505fba7d11d5e23d4ecbd48d5d136774cce5aa94735512245bf5a07f4f41bfc8f19f8aaf66c7605ce9a8a6c42ddc429
SSDEEP 12288:R3hAlBciqqZeuiXC61iVNcDvG+XzzNQnGyEZ9c46usQS7f:R30BTZ9iScVD++jJXyE3c4XsQS7f
TLSH
T15BC4238B489C5ECBEF44827DB8863A01533C1DF3C856C0E6652DF509BE78EBA99183D5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 b1039e8bbf4e8ea390e97f6b8b71bd210daf1b73df82dde326ce4282a61049af
MD5 44c9bbe90d8d64d7cc42acb31eaecf83
SHA1 ef664ef082b6abcdf6449317eae2ac63dea0de66
SHA512 40adf84c563dff23cc8295a9c7b9f97fd40081ec0aa18418d8fe1eda9844655de7b5af5da1050f1d387f2de6da9f2da165959dbc9fb55db940aedf44db7e8bec
SSDEEP 12288:/ZhAlBciqqZeuiXC61iVNcDvG+XzzNQnGyEZ9c46usQS7f:/Z0BTZ9iScVD++jJXyE3c4XsQS7f
TLSH
T1CAC4238B489C5ECBEF44827DB88A3A01533C1DF3C856C0E6952DF509BE78DBA99183D5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 5a53da511cb62c3e353cbba318b40ecf9dbf2e229fd27d65db6f463df72fdb40
MD5 e9304b67b508fd3cbf3d45d74be05146
SHA1 1d7904c7970d62834ed7a299eeef2898e660018d
SHA512 0b96a2f637149580a88ffef80dcd632733c6caec9a0fe75dbe4c9249de0053b55072f3363e78c2f2b84385f62753cc35a170df1d2dce5819a11506b972346fae
SSDEEP 12288:iVehAlBciqqZeuiXC61iVNcDvG+XzzNQnGyEZ9c46usQS7f:v0BTZ9iScVD++jJXyE3c4XsQS7f
TLSH
T1C4D4234B06AC1ACBEE85C37CEC96250193793CF2C432D6EF9518A5092E71BB99D387D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 d9eebe06389debcfaa194194af99b86695e4ec824ad1dc5f0b16e0cee4fc8f74
MD5 baafccf22aa527a29b2137ea4bdf5cf6
SHA1 72e72d4a3dc5382108f6c4a59631d42283c4a785
SHA512 e5642094c34f3606540ab2419b263ee38308f907459dae2599bbec551b4820781aabf517394bb190ee3899a2dd03ff9bc334171315a08650ea9c0e4557458ad2
SSDEEP 12288:m2hAlBciqqZeuiXC61iVNcDvG+XzzNQnGyEZ9c46usQS7f:m20BTZ9iScVD++jJXyE3c4XsQS7f
TLSH
T183C4238B489C5ACBEF44827DF8863A01533C1DF3C856C0E6A51DF509BE78EBA99183D5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 e8bd7d9c986ecd41092a076d173fb243f66af7cdb1441a405c8f3778716fd43e
MD5 2f6614ccfbd103a15dc2911a53bb5a3a
SHA1 ecaa7eff86a8e49120db2533b04151a8bce8ac96
SHA512 18a101eaa9a6074d7ff6ed433dce417823cc2777896d004b2eb12abb08b884409cc6756ac4205b73cf2f93da60b8288d278af00e2f19178235b5b7c01769eb94
SSDEEP 12288:ILhAlBciqqZeuiXC61iVNcDvG+XzzNQnGyEZ9c46usQS7f:IL0BTZ9iScVD++jJXyE3c4XsQS7f
TLSH
T12EC4238B489C5ECBEF44827DB8863A01533C1DF3C856C0E6652DF509BE78EBA99183D5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 811e162cfe386b294c1eab497ffbb8cf80bf60c8808151b6cdc2559ae001eff5
MD5 15922d9ac58ee26146b12183f3cd2a47
SHA1 08006cd63c23970fbaa207c1040822087c4d0cff
SHA512 c25bbb26f94e5d20b1472d4d0641da4a796dd0b20303746a96606a59301b259bd07f2bde33be984ffcaf214977c4a7e0a90dfee8d428f7c709faad0d38ceae9f
SSDEEP 12288:ZvhAlBciqqZeuiXC61iVNcDvG+XzzNQnGyEZ9c46usQS7f:Zv0BTZ9iScVD++jJXyE3c4XsQS7f
TLSH
T108C4238F489C5ECBEF44827DB8853A01433D1DF3C856C0E6A52DF509BE789BA99183D5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 97e088a105cbf2b197ae9eb74d6760de1b58c1f867f126ed8fe3d8f7f189833a
MD5 0b750d2e1928398e9e186b309a2e6f1e
SHA1 d11158f2abec4a0c72c7bb9d40057365d618c76f
SHA512 44e847ea519fd320dfa429ccb9f5db486a966241fa28f6a3e005979ba2c87229c5fb134b74e0b91a72b94b61940c000098f61da0e22617a8c390396d6783534b
SSDEEP 24576:9ZMSzFVSOX0BTZ9iScVD++jJXyE3c4XsQS7f:9ZMSzfb0Z9iv71XyEBXOf
TLSH
T11C050199B3941CF9EC67823ECC555906D2B27C6A4A70C65F03A8362B5F333A11C3DB96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 17b4acfa88e412796bf17ad38a366543762d63d1fc9163f23eb6243a5889a87a
MD5 342fb3b6f402b2a6f15d8bad7f06c440
SHA1 1cfaa08b0fac9e20c9a310bb924e1668497707ca
SHA512 62fb1da0ddcd25eed49838c2e205a22730ec4c2653a8ff399a2e97152131ecf0aa801f644dc0a489af4d85deb91d77e1bb376619ec15279ad6246fb6b293d1bf
SSDEEP 12288:fwhAlBciqqZeuiXC61iVNcDvG+XzzNQnGyEZ9c46usQS7f:fw0BTZ9iScVD++jJXyE3c4XsQS7f
TLSH
T1F8C4238F489C6ACBEF44427DB8863A01433C1DF3C896C4E6952DF509BE78DBA99183D5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 5de7df259cf057e9404ee77d657790be503ee4e1873b60e11243cfbab8b8551d
MD5 74648caffe68104f56622d4c6aedb07a
SHA1 d7b2477ed3406822c8c91f6d8f48144054d08434
SHA512 3c2f9772315ba6d7c4d3e737d16d24d68fd8b71b98a4d300f3b3813e8ad1535807d9f0c574814dcb09e963e9f5ec45f2ca42718cf9f2f0eba728682c1124e462
SSDEEP 12288:1shAlBciqqZeuiXC61iVNcDvG+XzzNQnGyEZ9c46usQS7f:1s0BTZ9iScVD++jJXyE3c4XsQS7f
TLSH
T188C4238F489C5ECBEF44827DB8863A05433C1EF3C856C0E6952DF509BE789BA99183D5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 35fb1184b87b8e8986a95d0682534602ef2e64ebe7ebf4e2d5be5851a29d8400
MD5 8cf260994b3a24549145a22342cfaf41
SHA1 1e8c4d1278f97310bcfc05b0d82991c5060413c5
SHA512 8f9a74a56bed344e1972836bd33e8ac410db4b381dc0cd7bd055fad60e1e15c665035ca0e6739b35861fc985577e368e7596f59c7cbb5f08b7b840d78bec5b6d
SSDEEP 12288:3yPz5L8zhAlBciqqZeuiXC61iVNcDvG+XzzNQnGyEZ9c46usQS7f:6zyz0BTZ9iScVD++jJXyE3c4XsQS7f
TLSH
T124F4124762A931FAD566823CC8921A02F3757C724720CAEF136457762F376E19D3EBA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 45daa915df237ba1ed40889bd19cd54d7c216b28e88db32844690a65a12b7b24
MD5 9e6de7a619d67efdba1b91e532fe565c
SHA1 2cbf0d8330edae4bd8e8a40a783f4fdd9e7351c1
SHA512 e951ee44cb72c273252aa70aae5fab24abb09c6d77b55d775833a852b9803e0a71751bb5f34cd52fecb1fd2aba6575ca3f7ddd315c61316f863c19389e7e10ed
SSDEEP 12288:+whAlBciqqZeuiXC61iVNcDvG+XzzNQnGyEZ9c46usQS7f:+w0BTZ9iScVD++jJXyE3c4XsQS7f
TLSH
T1F9C4238F489C6ECBEF44427DB88A3A01433C1DF3C856C4E6952DF509BE789BA99183D5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 15c66d42b0df904474068f6fd928bd702c1b6259aa55a915bc1d8d02c728e62b
MD5 04fc4af6d806cbe8758f335a586861ba
SHA1 239cd574bb315f4e33c777ea3ecda98338cb67ae
SHA512 dc4737eec0da4353635cd306a4b65dd19b1754ea7061fa3a33aa9fb5cc6037ae97992810e0514d1cb90f6b7d2bf999d87926609e4f3e9caf0d818345b1bfb6f2
SSDEEP 12288:JwhAlBciqqZeuiXC61iVNcDvG+XzzNQnGyEZ9c46usQS7f:Jw0BTZ9iScVD++jJXyE3c4XsQS7f
TLSH
T1E7C4238F489C6ECBEF44427DB88A3A05433C1DF3C856C4E6942DF509BE789BA99183D5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 0c1b28840b2edfe7f80a1d9651bc565be047b99e49c9532302735d7f03150ebc
MD5 dfd7571e4be1bb4f1d7581d1606165a5
SHA1 9a2594555e25cda4884ebb15f72dd1bb377063b9
SHA512 e1906c96285c2f8a45ae9ba503677464450d80f5adb815f431e19e83879474d103ad3c38f5d328c2de2572da0c13d401036790b45b278a26769cc1c9628dc514
SSDEEP 24576:JCUfpvPDv4Ex1hfe7i8WVq2lIGU8lrtGUJLPuwvAN0BTZ9iScVD++jJXyE3c4XsV:JCUxPTY+8Wg2lIL8lrIUJLWw20Z9iv7s
TLSH
T16765AE1EA3DC0896D4BB813589518A06EB723C2E1B22D6CF1160C37D6F67EE55E39F06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 77481f56f66fc5fa5f4b5abed555df94458af892a30db86b5375fdc015341415
MD5 2b82c79bb441bdfc02adec839d63752e
SHA1 14b86a7e9e952371c276eaa8c26df60695f8a541
SHA512 3b26c256c1bcc7fe9f78fbad5070b9c787b40456472aef14e8e7a56280daab5161528a86b662707df5c5245b0059d26d5217b61be8edff6ee0a8fafcac8238b6
SSDEEP 12288:uNsfghAlBciqqZeuiXC61iVNcDvG+XzzNQnGyEZ9c46usQS7f:Xg0BTZ9iScVD++jJXyE3c4XsQS7f
TLSH
T1D6E4014AC29802DAC55E5279CB461A01B3373CA287E1D3CB52D0F53E1F76AE49DE9783
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 2b04d1065477198b4647a2dd2e80c71d680b81d63b76b9d0d13df27d114be284
MD5 dc06c05fc903dd34e86e1df265735911
SHA1 af99158fc2c4ef4b19d85c21a4167b8960e251cf
SHA512 1ac9ce9752996bbb8befa7d86c0021a78870cd329acea9a520e76586f213767ca03d5c726649efb4be3332be7913a106440973dacc668cde66c63274b614e1b0
SSDEEP 12288:/5hAlBciqqZeuiXC61iVNcDvG+XzzNQnGyEZ9c46usQS7f:/50BTZ9iScVD++jJXyE3c4XsQS7f
TLSH
T15ED4234B859C6E8BFE98437CA89A2611133D2DF2CE55C4D7A408B2497D74DFA8D383C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 faf40c321d4fa2b186bcd5eb623160c688052e525be1efd792f1c60a7fc8ee31
MD5 b0033c40f285c822f92df23c5f7e8d79
SHA1 4d81960c5f9a937fbb16029c4b035dfbc0080064
SHA512 cc97d3fda5147755db10b88b60021934a107867eb5999b77da1a755e85e43019b0bdbfaf3f9ac93dd25965184dd3423636b6bd0d657275a4817421cad120a69b
SSDEEP 49152:7RZwQCyiHiQEaaPnMY0Z9iv71XyEBXOf:d9xvPn0Z9A7c2Of
TLSH
T13085B01E62DC46A5E4BAD278CDA74407E6B27816473197CF0190C27D2F27EF49E3AB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 676KB
SHA256 4a68696b4ac2d985e830e174fd7abae452aaa4255cdfe5f6c7088c7346bb4588
MD5 32f50c41cc2d65798c28a4f1ba419c7a
SHA1 240bf92a3ee17cd3e0bd88267b11bcfb9fcaf585
SHA512 9522de03280dd999eeebdaea4f19371c52f69ac93377adc588c2b63d57de20b9e9ba28c0b43acf7fb518aa4e3bc1b210139d4ff348cc47adf3e319c6f1f5f323
SSDEEP 12288:0bxA1U7KJhAlBciqqZeuiXC61iVNcDvG+XzzNQnGyEZ9c46usQS7f:0bxA1UGJ0BTZ9iScVD++jJXyE3c4XsQs
TLSH
T14CE4126F45AC28E6FA65923D98D64106D3313C664721D3EF1094C27E1F3AEF99C39B82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 f72928f88812161aec5e80ae078cb65cb0352da2bfe344e71fffe2a02b758e6d
MD5 71307892295de6457ac3551b4fefee02
SHA1 b78e5cd1c50a4978bb6485a22f3d54f884ba5b21
SHA512 47c020673745e0d8486b6947991f71e935f716d1011334bd334b20190796aab0b12cbfa628a96405925ed5b10b277b1f5fe4edf14b869e0d3f19334fe9896ed9
SSDEEP 24576:8jsmP0yHaqrVqHra44KDzMsrnu0BTZ9iScVD++jJXyE3c4XsQS7f:8jRP0yHfVqzlAsrnu0Z9iv71XyEBXOf
TLSH
T17A45AF2EF2B910F9D8AAD136454107B5BB71782D1F219AC70170C634AF0AEE89F35F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 596KB
SHA256 ade4889312c299ae650a557cc73d71303bb2e581f64b95053b314398d0babcd3
MD5 975e3333ca422b26ddda3af8d6b89bbe
SHA1 e0c7b53c413da4d65beab68acea863ac2f2c7609
SHA512 8c45e632efd3f5378583cdc1bd4d354c71c405852d64c46ca158fe89f35c6a7f4aa1de629c27c3019998c75a4d1d95d6330103d6197450c703bf48a348dbedbf
SSDEEP 12288:srhAlBciqqZeuiXC61iVNcDvG+XzzNQnGyEZ9c46usQS7f:sr0BTZ9iScVD++jJXyE3c4XsQS7f
TLSH
T151D4238F445C6ECBEF44827DB88A2A01133C1EF28966C5E7546DF5496E789FB89383C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 940KB
SHA256 d7e3724ae7e8a4571d88b6a3352d9c9914551b9e1eb393761f47522ac25228d2
MD5 33cebf77dbc93dc3ff010f61c75c9003
SHA1 055885a45d1fc7d918a90c1604f14ea219998495
SHA512 77101f89903553f3a670a433beb01956b2435dd5dd1ff03a2b21f0f070c5244c3ed4676a68397cc0ae65a2f3f332571f12be17cddcb7752e81b5cc0d16f29aae
SSDEEP 24576:YpLBUTV0BTZ9iScVD++jJXyE3c4XsQS7f:YpLBUR0Z9iv71XyEBXOf
TLSH
T17B250145E79804F9ED6BC13CC8A69A12D27278AD0764E7DF03A88A551F237F24E3E750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 800KB
SHA256 df3749fd13fb887b062ce1e2782ca5bf3a95fa8122bde4c722d445855cc5ffe7
MD5 41da1971ec5623f75c602929125b4c25
SHA1 1a2aefad3469c62d40ade5632ec39c3b15d38e73
SHA512 7670acd76acbfb57fcbc09bb468fa3f7accbd66dd5bf4bd2641b5bc06a459db82b13ea9471064e42a005229edc6ff97f8ad8e4a7000acfc4187de3bd8040ef08
SSDEEP 24576:nrYNH60BTZ9iScVD++jJXyE3c4XsQS7f:nrYt60Z9iv71XyEBXOf
TLSH
T1D805F11F52AC1DE5EA7B917DC9C28609F27278A6071192CF04B0C27A1E27EE9BD3D741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 542bcd16d5b06bfff32d7bb64b535f0853766fcc9964268e4d70b2ba83350095
MD5 3f4627a1b9ce8dd7591c86213a09252e
SHA1 732303651f0f2f00a0a7cf118a8dbde47af6c5de
SHA512 365bd792a5e4c0e3680529fab3ed2754ee0a1f140b936aa8bff498c2662b84e0127b42e14b3681bd441da8752c93e4338da406f94b9f652825560f980e8f2318
SSDEEP 24576:lnXoJjNYH84VVSNAApoEON66aspcrcHBjSSKHPWdQwPF3hJ8ssmOc+XLxu+x7uKc:lnXoJJYH84VVS6AmEcJas+cHBjSSKHPM
TLSH
T13465BF9EA2BC04E9D5BBD17DC5C25506F5B138621331C6CF022182BA7F27AF59E39B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 2f09bab735a8fce9b553c6f4a0405e2529de0b8d8bccdb6fd68a225e13d763ac
MD5 55fa32a6bea989de17fddc8c3fe3de0f
SHA1 8b5e92162ee44562a19ef19ce2ed72477c7226cd
SHA512 a1bbad55d4c9370d253990b4df620b87c55245181c0af885bc6a374e8c9cc24384627cfc83812c6feba582e635b832f0f166187e5009586e34f226a46479ff0f
SSDEEP 24576:cv7Xbxd9Tuycf8M/TYlSuxwr2PC80BTZ9iScVD++jJXyE3c4XsQS7f:cDLL9TuJ0M/TYW2PL0Z9iv71XyEBXOf
TLSH
T127858D5EA2EC42D8E47BD6BD85B79046FAB2B895173081CF0251856E1F23BF05D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.3MB
SHA256 96074f05434d0a0b2bb3777dc2bd768391b919b40dccca5a13a83fda0bae7dec
MD5 b367c730a9ab336617bd3832346a17a3
SHA1 bb1ae4b24b9958487b25216f72c713f98ba0d9fd
SHA512 5bf663b713049bf5e49dfb27b48e06f42fcc6be32b59f8faa0198bc51b89210904d503e3a49870cf7796642c864f56526c188db93d7a08fa281e692b4f31315f
SSDEEP 24576:SegJgpwJOmPOHWAK+8ZguIGyPsxr5Vin10wV0BTZ9iScVD++jJXyE3c4XsQS7f:SngOJOmPOHhV0Z9iv71XyEBXOf
TLSH
T11555CF3FA7BC15D5E03EC17D8A968916F6B1782603259ACF0160827E5F1BEF46E39B01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 904KB
SHA256 0134f66dfa1db9c9ca2628ca0e34b1143446a17f7f1964a453c2328b39948fb7
MD5 f62de56b1409705e7d78a4e7b01d69e0
SHA1 ff98a6a822d4394631d60f842f462bec56f0f511
SHA512 cc3a7e40e7abfbe99d2bcb9b606163067e6a68fef816ec47bfebf02b3d703827f48b033705d624d0874a0f6dddd82eadfc70663d85d8de711419a4e44cdbb4a7
SSDEEP 24576:YLJnJiTk3R3waE4JrOL0BTZ9iScVD++jJXyE3c4XsQS7f:YLJnJK8R304le0Z9iv71XyEBXOf
TLSH
T1BF15E12DC2A810E9D4B7C2B4815A2756FF31387D2B2169CB59B4D5353F12FE0AA39F48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 d56a24d425a5c5c5658e8cdc7960d2251449fa9155ca8e4b4701a6ee2af32987
MD5 ad2a6a079405c0db9aab560373a75822
SHA1 7b06c73fd327fc1d64d589323d895dd4e4aebc5d
SHA512 03bd87f621939232f0d4facbac66cfd9821801865aab48e46b47ebe7626c1f89ab9a80a7cd13cf956b618ba82fad7a0d308a61f7bfdd7bb10db201a03fd55592
SSDEEP 49152:N9GqCzDScAZmlvTcFg8Ph6v0Z9iv71XyEBXOf:ha0Z9A7c2Of
TLSH
T130955D05F7EB5298E8B3CAF1C96694159B327C509B34F7EF0A80CA6A1E32BD1D534B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 676KB
SHA256 5e1a92dc8ad292bddea2da19f4ac67e197d28121ee20d40c068a90d5b0222dc6
MD5 61abad3e1fa0b7c0811c90be99c8b6c0
SHA1 85aff5fde481bf4d76f20a8798e89477faf75e24
SHA512 d91fd05679acfeab4549016abe63bf261820916660b81512e3671803e0c8fb7d91219dd5777237d084ec6df2aa564dba0ef94714a9e3b63839453b98d41b65f5
SSDEEP 12288:plYJeXm5nkEUuElhAlBciqqZeuiXC61iVNcDvG+XzzNQnGyEZ9c46usQS7f:plYJeXm5jUuEl0BTZ9iScVD++jJXyE3m
TLSH
T1CAE4124E259C31E6E65E817D98920A04D371B8B2431297FF40E4D17A9F66EFA5E3CBC0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 732KB
SHA256 97eb7dc828aa938448b855b34c404b3d29eca4a97daebba8545cbff3e772bafa
MD5 e5f4823aa1f96c381edda89b6e00d2ea
SHA1 1f780861c2b13fc89db77e914519d9de0268f0c7
SHA512 f1516d6076e79e24535d5aaad95f83602d318d1fd293fc36c75a94bfa31a5ff7e25069d4ab881e6d0390b3b6ca94ce359c223a4807948f6b0db89d62929e9806
SSDEEP 12288:gwu6kyOhAlBciqqZeuiXC61iVNcDvG+XzzNQnGyEZ9c46usQS7f:gVtyO0BTZ9iScVD++jJXyE3c4XsQS7f
TLSH
T176F4130A129C65DAEEA9423CEDA3114097397C718F11C2EF5090F63F6E35BE5AD34B92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 604KB
SHA256 16e170b2f9b870d4803f1a1357c27b2eff1ae587c1da38bf3243f5771254bdde
MD5 988ec6a55db7c494dee446fd6ff1e0de
SHA1 025d1ae83e1f080d7d2baa09920d7ba07f34c66c
SHA512 1f86c4172d74747e12dc9c186900672a87a72cfa1cc9b28487c9bb6505a6628e0aaec5b1d65308ce2241c490cdd8889129f9dfdf9a9b286d20b89687d45110af
SSDEEP 12288:VPVhAlBciqqZeuiXC61iVNcDvG+XzzNQnGyEZ9c46usQS7f:pV0BTZ9iScVD++jJXyE3c4XsQS7f
TLSH
T19DD4238F055C3ACBEE44427CA8562A01533D3DF28912D4FF54A8F539AE789F69938BC1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 55de7acfcc8bb8e5a855b1870e5a4876fab398192958294755dd5e9058d031df
MD5 884e57581e015a018d9dba71b6ac4e0a
SHA1 ff64417e1cc483354f9bfbeab4a414f99151676e
SHA512 0ce9ee45e602f7815c8845f6279e2a6697bacb2c819959ee28a5c3c1a727925364ea84bc87eb8f5ad494b9d7b2d2944a4d7a2ac2b3734d9ab90297b0cefb962a
SSDEEP 24576:XC+TyQIu93VAumZr7jmA0BTZ9iScVD++jJXyE3c4XsQS7f:X/TfIq+YA0Z9iv71XyEBXOf
TLSH
T17B558C1DA7E91DCAE276C675C8A34493E633B872137186CF2044C07D499EEE9AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 768KB
SHA256 6c85d7681fe27a878073c6180477217c9607ca72880b89f8d5698d131f9d426f
MD5 42b7d9c284851de728d14edc2df0cc58
SHA1 bab45e51329082748612e543caf5ff392d95e572
SHA512 ac4ae3639fe1e2060c2b64b0f868b2b14e9c0af5f5f938a5af2257c7bee4c76d740285635fa4999375b86317a4de628899ff6b06c785ca7767dfb24af9712068
SSDEEP 12288:ScyrWOstaa3kcsBhAlBciqqZeuiXC61iVNcDvG+XzzNQnGyEZ9c46usQS7f:jLQikZB0BTZ9iScVD++jJXyE3c4XsQSD
TLSH
T180F4F10FB2AE1096E5A7C23C88854102F7B378754712A7DF41A0C7795FA75EABD38B81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 1cbcf38180c16ba2e7df85a5eb8e8e9c7a556d55e1da16dde271f76fd83cbbc8
MD5 cef29c7589b50faf72fa4cd6c2c8c5ed
SHA1 bd38ae29d8aa69340b243635e8736c726dd24f5a
SHA512 d33343abe0691d41e838a5751bcb4e09a8f06f65d0f5aca877c45b51be2622c4f0bf0470c8f4de125cfd441b255ad023fc6dcbd2256f4e0780b6a76636d88e65
SSDEEP 49152:kpJFwrPpGyqWo6cbT2TZ8maJO35NPHXogsS7Q78ZGAvL9vnF35LWAPO0Z9iv71XW:lpC7b4+80GTkH0Z9A7c2Of
TLSH
T113A57C3DE2B810ADD8AAC375C5461665EE71382E3F2055DB00B0C578BF1AEF19A38F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 cdeeaa3680c927726f238b0cc561e2c399410e171628095333b63d9c9896d4ec
MD5 d7811b60dfccb04e6ab0d9450c1b6662
SHA1 59d7fcae8d715e4693b32caf55eab608019704f1
SHA512 77902d1f3bd7c864f19f18e684eb4d908e0f84d177fa8f2e807b5ec1c49ad785f5c701704c513dbb028f459ea99e910593ddc5b42f22cf49ce0c19d986d0e4bf
SSDEEP 24576:sSAwJPE1IDAo+4Kt+l44135UQW0BTZ9iScVD++jJXyE3c4XsQS7f:sqPCIo4Kol4/QW0Z9iv71XyEBXOf
TLSH
T1DB55B01AA7F956E5E17AC7B4D663C601FB7238231331A3CF5290913E0E169E89E39F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 956KB
SHA256 a465cb75d84800d88de0607fd1c5c41fabe6527981183e438ed9c85ff931692d
MD5 6e29c57b3dea19e95ff887b277547b58
SHA1 ba7184416772e3c476333b7610c0091b39f1b7f7
SHA512 84fb0587fb3f4a32d5dca0cc802ab1a72af9e5eab51b384714bc1db18d45113bc7dcb6d02673cf0951459756af91a1dbc196570631841eba7ce17c65cf681143
SSDEEP 24576:KyLXPLcM94tm0BTZ9iScVD++jJXyE3c4XsQS7f:Ky7PoLtm0Z9iv71XyEBXOf
TLSH
T15325E13ED66C08E5E47AC27CD6A38906F6723CAD033166CB15A490791F6BFF46939B40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StructuredQuerySchema.bin

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin
Size 414KB
SHA256 e67e330837a6b2f6d5f76815e7235a512b54b1c90f2ad62a3e9d142ae6939c8d
MD5 16b9618962f5623ca791a1366eee5708
SHA1 f0d257511952f075b2a0ec7d8e8730c3e464461a
SHA512 18e1d5a105b87fc72df94645685f5a8d3f593df2d3a9b8652b3b4a4ceaf92d3c7a67b0c08847186149dd608428cae8f1b3bc844bc7aacfc9e3219da823ca2fe2
SSDEEP 12288:vMUC7+vlk3n61mSkplXZ5RwmF9n4w/TSD:vXhl6V/i
TLSH
T124945F36BF88CB22C59A15748897C01A2E30A7C49E04CF6B73DC513CFA576685FBA359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 744KB
SHA256 ecb9b2fc102b60b5746a1f14a8f5a8bf9cec60726c4712d75f3624ecbd5f40cd
MD5 3f96328f6a399ae8e2c3cc8af38271bf
SHA1 6b3cf308b7ce749ce2e6505fdf5ed52b6cfaef41
SHA512 bd5444f4572311e55250780c04e0ddab386de40b840f7247fd0fda976fc981d19ba0be5391b784e0885c2de1abeff3b1d34b6703f39f2e4da174278690967022
SSDEEP 12288:a9lyvj3IkxjbBzxhAlBciqqZeuiXC61iVNcDvG+XzzNQnGyEZ9c46usQS7f:aWv8qjpx0BTZ9iScVD++jJXyE3c4XsQs
TLSH
T11EF4124F46E828CAF9688338E826521582753CB20765D9FF70C8E57A4F34AE1D93EF51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/492-117-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/492-375-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/492-181-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/564-128-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/564-39-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/564-33-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/564-41-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/660-73-0x0000000140000000-0x00000001400BA000-memory.dmp

Download

memory/1052-113-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/1052-170-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/1244-25-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/1244-17-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/1244-26-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/1248-0-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/1248-9-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/1248-72-0x0000000140000000-0x00000001402FE000-memory.dmp

Download

memory/1248-8-0x0000000140000000-0x00000001402FE000-memory.dmp

Download

memory/1356-13-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/1356-101-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/2092-108-0x0000000000660000-0x00000000006C7000-memory.dmp

Download

memory/2092-102-0x0000000000660000-0x00000000006C7000-memory.dmp

Download

memory/2092-107-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/2092-164-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/2116-87-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2116-93-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2116-161-0x0000000140000000-0x00000001400CA000-memory.dmp

Download

memory/2116-96-0x0000000140000000-0x00000001400CA000-memory.dmp

Download

memory/2420-74-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/2420-70-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/2420-62-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/2420-55-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/2420-61-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/3212-191-0x0000000001C30000-0x0000000001C40000-memory.dmp

Download

memory/3212-396-0x000000000BE90000-0x000000000BE98000-memory.dmp

Download

memory/3212-207-0x0000000001EE0000-0x0000000001EF0000-memory.dmp

Download

memory/3212-182-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3212-398-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3212-223-0x000000000A520000-0x000000000A528000-memory.dmp

Download

memory/3212-173-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/3212-179-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/3212-394-0x000000000BE90000-0x000000000BE91000-memory.dmp

Download

memory/3212-393-0x000000000BEA0000-0x000000000BEA8000-memory.dmp

Download

memory/3492-44-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/3492-54-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3492-50-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/3492-129-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3760-122-0x0000000000550000-0x00000000005B0000-memory.dmp

Download

memory/3760-131-0x0000000000550000-0x00000000005B0000-memory.dmp

Download

memory/3760-130-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/3760-338-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/4064-63-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/4064-30-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/4836-226-0x0000000140000000-0x0000000140098000-memory.dmp

Download

memory/4836-120-0x0000000140000000-0x0000000140098000-memory.dmp

Download

memory/4968-85-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/4968-157-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/4968-76-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/4968-82-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/5196-171-0x0000000140000000-0x00000001400C2000-memory.dmp

Download

memory/5196-392-0x0000000140000000-0x00000001400C2000-memory.dmp

Download

memory/5540-371-0x0000000140000000-0x00000001400E3000-memory.dmp

Download

memory/5540-148-0x0000000140000000-0x00000001400E3000-memory.dmp

Download

memory/5632-154-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/5632-153-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/5644-405-0x00000297FFE40000-0x00000297FFE50000-memory.dmp

Download

memory/5644-402-0x00000297FFE40000-0x00000297FFE50000-memory.dmp

Download

memory/5644-410-0x00000297FFE40000-0x00000297FFE50000-memory.dmp

Download

memory/5644-409-0x00000297FFE40000-0x00000297FFE50000-memory.dmp

Download

memory/5644-407-0x00000297FFE40000-0x00000297FFE50000-memory.dmp

Download

memory/5644-403-0x00000297FFE40000-0x00000297FFE50000-memory.dmp

Download

memory/5644-417-0x00000297FFE40000-0x00000297FFE50000-memory.dmp

Download

memory/5644-416-0x00000297FFE40000-0x00000297FFE50000-memory.dmp

Download

memory/5644-415-0x00000297FFE40000-0x00000297FFE50000-memory.dmp

Download

memory/5644-419-0x00000297FFE40000-0x00000297FFE50000-memory.dmp

Download

memory/5644-418-0x00000297FFE40000-0x00000297FFE50000-memory.dmp

Download

memory/5644-376-0x00000297FFE40000-0x00000297FFE50000-memory.dmp

Download

memory/5644-378-0x00000297FFE40000-0x00000297FFE50000-memory.dmp

Download

memory/5644-381-0x00000297FFE40000-0x00000297FFE50000-memory.dmp

Download

memory/5644-411-0x00000297FFE40000-0x00000297FFE50000-memory.dmp

Download

memory/5644-380-0x00000297FFE40000-0x00000297FFE50000-memory.dmp

Download

memory/5644-408-0x00000297FFE40000-0x00000297FFE50000-memory.dmp

Download

memory/5644-387-0x00000297FFE40000-0x00000297FFE50000-memory.dmp

Download

memory/5644-413-0x00000297FFE40000-0x00000297FFE50000-memory.dmp

Download

memory/5644-401-0x00000297FFE40000-0x00000297FFE50000-memory.dmp

Download

memory/5644-406-0x00000297FFE40000-0x00000297FFE50000-memory.dmp

Download

memory/5644-379-0x00000297FFE40000-0x00000297FFE50000-memory.dmp

Download

memory/5644-382-0x00000297FFE40000-0x00000297FFE50000-memory.dmp

Download

memory/5644-412-0x00000297FFE40000-0x00000297FFE50000-memory.dmp

Download

memory/5644-414-0x00000297FFE40000-0x00000297FFE50000-memory.dmp

Download

memory/5644-377-0x00000297FFE40000-0x00000297FFE50000-memory.dmp

Download

memory/5644-404-0x00000297FFE40000-0x00000297FFE50000-memory.dmp

Download

memory/5644-383-0x00000297FFE40000-0x00000297FFE50000-memory.dmp

Download

memory/5644-399-0x00000297FFE40000-0x00000297FFE50000-memory.dmp

Download

memory/5644-385-0x00000297FFE40000-0x00000297FFE50000-memory.dmp

Download

memory/5644-386-0x00000297FFE40000-0x00000297FFE50000-memory.dmp

Download

memory/5644-400-0x00000297FFE40000-0x00000297FFE50000-memory.dmp

Download

memory/5644-384-0x00000297FFE40000-0x00000297FFE50000-memory.dmp

Download

memory/5644-389-0x00000297FFE40000-0x00000297FFE50000-memory.dmp

Download

memory/5644-391-0x00000297FFE40000-0x00000297FFE50000-memory.dmp

Download

memory/5644-390-0x00000297FFE40000-0x00000297FFE50000-memory.dmp

Download

memory/5644-388-0x00000297FFE40000-0x00000297FFE50000-memory.dmp

Download

memory/5668-146-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/5668-143-0x0000000000590000-0x00000000005F0000-memory.dmp

Download

memory/5668-137-0x0000000000590000-0x00000000005F0000-memory.dmp

Download

memory/5668-369-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/5692-162-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/5692-373-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/5732-158-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/5732-372-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/5836-166-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/5836-374-0x0000000140000000-0x0000000140216000-memory.dmp

Download