57e387fa01d785713c439b9d518220bd5fc70fa6805136449a74d32e4622f257

Analysis

max time kernel
150s
max time network
152s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
27/05/2026, 16:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-27_f8c5670039264750d62c8f2ac656b211_icedid_mespinoza_njrat_ryuk.exe
Size 1.3MB
Sample260527-tspbpsd19w
SHA256 57e387fa01d785713c439b9d518220bd5fc70fa6805136449a74d32e4622f257
MD5 f8c5670039264750d62c8f2ac656b211
SHA1 e208776a44d047a9352df96eb82d7619ea051b19
SHA512 e9e02193377aa78e6e9b7ab25c03080ad837b302c19c9e5cb235a1a96452295a6091657716de3754e4ce4d2a97d72d50685aa209bc1245d6e04a9b94ebe87203
SSDEEP 24576:1uKxZ8VxWKAaNUF3P+iMod87mLWNNrIFsqjnhMgeiCl7G0nehbGZpbD:1uC8VxnUF3P+97ma+Dmg27RnWGj
TLSH
T19B55CF19B7A941E5E073923A89628251EBB2BC111B31D7DF5254B32F1F33AD44F3A722
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

persistence ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
1116	alg.exe
4508	DiagnosticsHub.StandardCollector.Service.exe
4600	fxssvc.exe
3408	elevation_service.exe
2968	elevation_service.exe
4392	maintenanceservice.exe
892	msdtc.exe
2740	OSE.EXE
3460	PerceptionSimulationService.exe
3216	perfhost.exe
4536	locator.exe
3656	SensorDataService.exe
2240	snmptrap.exe
4652	spectrum.exe
3272	ssh-agent.exe
4232	TieringEngineService.exe
3992	AgentService.exe
4088	vds.exe
4512	vssvc.exe
2440	wbengine.exe
2708	WmiApSrv.exe
2768	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\e:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe

Drops file in System32 directory 35 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AgentService.exe	alg.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-05-27_f8c5670039264750d62c8f2ac656b211_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-05-27_f8c5670039264750d62c8f2ac656b211_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-05-27_f8c5670039264750d62c8f2ac656b211_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-05-27_f8c5670039264750d62c8f2ac656b211_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-05-27_f8c5670039264750d62c8f2ac656b211_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	alg.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-05-27_f8c5670039264750d62c8f2ac656b211_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-05-27_f8c5670039264750d62c8f2ac656b211_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-05-27_f8c5670039264750d62c8f2ac656b211_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-05-27_f8c5670039264750d62c8f2ac656b211_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	alg.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-05-27_f8c5670039264750d62c8f2ac656b211_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	alg.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-05-27_f8c5670039264750d62c8f2ac656b211_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-05-27_f8c5670039264750d62c8f2ac656b211_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-05-27_f8c5670039264750d62c8f2ac656b211_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-05-27_f8c5670039264750d62c8f2ac656b211_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-05-27_f8c5670039264750d62c8f2ac656b211_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-05-27_f8c5670039264750d62c8f2ac656b211_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\dllhost.exe	alg.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-05-27_f8c5670039264750d62c8f2ac656b211_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-05-27_f8c5670039264750d62c8f2ac656b211_icedid_mespinoza_njrat_ryuk.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\{17A6A947-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db	spectrum.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-05-27_f8c5670039264750d62c8f2ac656b211_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-05-27_f8c5670039264750d62c8f2ac656b211_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\13023557fe8d2f74.bin	alg.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-05-27_f8c5670039264750d62c8f2ac656b211_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-05-27_f8c5670039264750d62c8f2ac656b211_icedid_mespinoza_njrat_ryuk.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	spectrum.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-05-27_f8c5670039264750d62c8f2ac656b211_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-05-27_f8c5670039264750d62c8f2ac656b211_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-05-27_f8c5670039264750d62c8f2ac656b211_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2026-05-27_f8c5670039264750d62c8f2ac656b211_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-05-27_f8c5670039264750d62c8f2ac656b211_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-05-27_f8c5670039264750d62c8f2ac656b211_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	2026-05-27_f8c5670039264750d62c8f2ac656b211_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-05-27_f8c5670039264750d62c8f2ac656b211_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	2026-05-27_f8c5670039264750d62c8f2ac656b211_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2026-05-27_f8c5670039264750d62c8f2ac656b211_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-05-27_f8c5670039264750d62c8f2ac656b211_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-05-27_f8c5670039264750d62c8f2ac656b211_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2026-05-27_f8c5670039264750d62c8f2ac656b211_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	2026-05-27_f8c5670039264750d62c8f2ac656b211_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2026-05-27_f8c5670039264750d62c8f2ac656b211_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	2026-05-27_f8c5670039264750d62c8f2ac656b211_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-05-27_f8c5670039264750d62c8f2ac656b211_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-05-27_f8c5670039264750d62c8f2ac656b211_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-05-27_f8c5670039264750d62c8f2ac656b211_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-05-27_f8c5670039264750d62c8f2ac656b211_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2026-05-27_f8c5670039264750d62c8f2ac656b211_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	2026-05-27_f8c5670039264750d62c8f2ac656b211_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	2026-05-27_f8c5670039264750d62c8f2ac656b211_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	2026-05-27_f8c5670039264750d62c8f2ac656b211_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-05-27_f8c5670039264750d62c8f2ac656b211_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	2026-05-27_f8c5670039264750d62c8f2ac656b211_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	alg.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	2026-05-27_f8c5670039264750d62c8f2ac656b211_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-05-27_f8c5670039264750d62c8f2ac656b211_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-05-27_f8c5670039264750d62c8f2ac656b211_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-05-27_f8c5670039264750d62c8f2ac656b211_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	2026-05-27_f8c5670039264750d62c8f2ac656b211_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-05-27_f8c5670039264750d62c8f2ac656b211_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	2026-05-27_f8c5670039264750d62c8f2ac656b211_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	2026-05-27_f8c5670039264750d62c8f2ac656b211_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	2026-05-27_f8c5670039264750d62c8f2ac656b211_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	alg.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-05-27_f8c5670039264750d62c8f2ac656b211_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dib	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.crw\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ico\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9926 = "M3U file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c1d67ecef4eddc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9923 = "Windows Media playlist"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.crw	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006daafecff4eddc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpeg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.txt	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
644	2026-05-27_f8c5670039264750d62c8f2ac656b211_icedid_mespinoza_njrat_ryuk.exe
644	2026-05-27_f8c5670039264750d62c8f2ac656b211_icedid_mespinoza_njrat_ryuk.exe
644	2026-05-27_f8c5670039264750d62c8f2ac656b211_icedid_mespinoza_njrat_ryuk.exe
644	2026-05-27_f8c5670039264750d62c8f2ac656b211_icedid_mespinoza_njrat_ryuk.exe
644	2026-05-27_f8c5670039264750d62c8f2ac656b211_icedid_mespinoza_njrat_ryuk.exe
644	2026-05-27_f8c5670039264750d62c8f2ac656b211_icedid_mespinoza_njrat_ryuk.exe
644	2026-05-27_f8c5670039264750d62c8f2ac656b211_icedid_mespinoza_njrat_ryuk.exe
644	2026-05-27_f8c5670039264750d62c8f2ac656b211_icedid_mespinoza_njrat_ryuk.exe
644	2026-05-27_f8c5670039264750d62c8f2ac656b211_icedid_mespinoza_njrat_ryuk.exe
644	2026-05-27_f8c5670039264750d62c8f2ac656b211_icedid_mespinoza_njrat_ryuk.exe
644	2026-05-27_f8c5670039264750d62c8f2ac656b211_icedid_mespinoza_njrat_ryuk.exe
644	2026-05-27_f8c5670039264750d62c8f2ac656b211_icedid_mespinoza_njrat_ryuk.exe
644	2026-05-27_f8c5670039264750d62c8f2ac656b211_icedid_mespinoza_njrat_ryuk.exe
644	2026-05-27_f8c5670039264750d62c8f2ac656b211_icedid_mespinoza_njrat_ryuk.exe
644	2026-05-27_f8c5670039264750d62c8f2ac656b211_icedid_mespinoza_njrat_ryuk.exe
644	2026-05-27_f8c5670039264750d62c8f2ac656b211_icedid_mespinoza_njrat_ryuk.exe
644	2026-05-27_f8c5670039264750d62c8f2ac656b211_icedid_mespinoza_njrat_ryuk.exe
644	2026-05-27_f8c5670039264750d62c8f2ac656b211_icedid_mespinoza_njrat_ryuk.exe
644	2026-05-27_f8c5670039264750d62c8f2ac656b211_icedid_mespinoza_njrat_ryuk.exe
644	2026-05-27_f8c5670039264750d62c8f2ac656b211_icedid_mespinoza_njrat_ryuk.exe
644	2026-05-27_f8c5670039264750d62c8f2ac656b211_icedid_mespinoza_njrat_ryuk.exe
644	2026-05-27_f8c5670039264750d62c8f2ac656b211_icedid_mespinoza_njrat_ryuk.exe
644	2026-05-27_f8c5670039264750d62c8f2ac656b211_icedid_mespinoza_njrat_ryuk.exe
644	2026-05-27_f8c5670039264750d62c8f2ac656b211_icedid_mespinoza_njrat_ryuk.exe
644	2026-05-27_f8c5670039264750d62c8f2ac656b211_icedid_mespinoza_njrat_ryuk.exe
644	2026-05-27_f8c5670039264750d62c8f2ac656b211_icedid_mespinoza_njrat_ryuk.exe
644	2026-05-27_f8c5670039264750d62c8f2ac656b211_icedid_mespinoza_njrat_ryuk.exe
644	2026-05-27_f8c5670039264750d62c8f2ac656b211_icedid_mespinoza_njrat_ryuk.exe
644	2026-05-27_f8c5670039264750d62c8f2ac656b211_icedid_mespinoza_njrat_ryuk.exe
644	2026-05-27_f8c5670039264750d62c8f2ac656b211_icedid_mespinoza_njrat_ryuk.exe
644	2026-05-27_f8c5670039264750d62c8f2ac656b211_icedid_mespinoza_njrat_ryuk.exe
644	2026-05-27_f8c5670039264750d62c8f2ac656b211_icedid_mespinoza_njrat_ryuk.exe
644	2026-05-27_f8c5670039264750d62c8f2ac656b211_icedid_mespinoza_njrat_ryuk.exe
644	2026-05-27_f8c5670039264750d62c8f2ac656b211_icedid_mespinoza_njrat_ryuk.exe
644	2026-05-27_f8c5670039264750d62c8f2ac656b211_icedid_mespinoza_njrat_ryuk.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
676	Process not Found
676	Process not Found

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	644	2026-05-27_f8c5670039264750d62c8f2ac656b211_icedid_mespinoza_njrat_ryuk.exe
Token: SeAuditPrivilege	4600	fxssvc.exe
Token: SeRestorePrivilege	4232	TieringEngineService.exe
Token: SeManageVolumePrivilege	4232	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	3992	AgentService.exe
Token: SeBackupPrivilege	4512	vssvc.exe
Token: SeRestorePrivilege	4512	vssvc.exe
Token: SeAuditPrivilege	4512	vssvc.exe
Token: SeBackupPrivilege	2440	wbengine.exe
Token: SeRestorePrivilege	2440	wbengine.exe
Token: SeSecurityPrivilege	2440	wbengine.exe
Token: 33	2768	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2768	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2768	SearchIndexer.exe
Token: SeDebugPrivilege	644	2026-05-27_f8c5670039264750d62c8f2ac656b211_icedid_mespinoza_njrat_ryuk.exe
Token: SeDebugPrivilege	644	2026-05-27_f8c5670039264750d62c8f2ac656b211_icedid_mespinoza_njrat_ryuk.exe
Token: SeDebugPrivilege	644	2026-05-27_f8c5670039264750d62c8f2ac656b211_icedid_mespinoza_njrat_ryuk.exe
Token: SeDebugPrivilege	644	2026-05-27_f8c5670039264750d62c8f2ac656b211_icedid_mespinoza_njrat_ryuk.exe
Token: SeDebugPrivilege	644	2026-05-27_f8c5670039264750d62c8f2ac656b211_icedid_mespinoza_njrat_ryuk.exe
Token: SeDebugPrivilege	1116	alg.exe
Token: SeDebugPrivilege	1116	alg.exe
Token: SeDebugPrivilege	1116	alg.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
644	2026-05-27_f8c5670039264750d62c8f2ac656b211_icedid_mespinoza_njrat_ryuk.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
644	2026-05-27_f8c5670039264750d62c8f2ac656b211_icedid_mespinoza_njrat_ryuk.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
644	2026-05-27_f8c5670039264750d62c8f2ac656b211_icedid_mespinoza_njrat_ryuk.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 644 wrote to memory of 968	644	2026-05-27_f8c5670039264750d62c8f2ac656b211_icedid_mespinoza_njrat_ryuk.exe	85
PID 2768 wrote to memory of 4720	2768	SearchIndexer.exe	110
PID 2768 wrote to memory of 3412	2768	SearchIndexer.exe	114
PID 2768 wrote to memory of 2120	2768	SearchIndexer.exe	115

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-05-27_f8c5670039264750d62c8f2ac656b211_icedid_mespinoza_njrat_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-27_f8c5670039264750d62c8f2ac656b211_icedid_mespinoza_njrat_ryuk.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:644
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Delete /TN "EVKey - Vietnamese Keyboard" /F
  2⤵
  PID:968

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1116

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:4508

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:4960

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4600

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3408

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2968

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4392

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:892

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2740

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3460

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:3216

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4536

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3656

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:2240

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4652

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3272

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:3464

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4232

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3992

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:4088

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4512

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2440

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:2708

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2768
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4720
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2880 2876 924 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3412
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2936 2932 924 {85EE815A-7738-4808-A14A-3AD87E32A3BF}
  2⤵
  PID:2120

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 b105c5650ac372cc94c1b1a0567b24006eabde5c6de00b6c8c5fe6196d607778
MD5 f72135ec51f51817c67fa99f70c559a3
SHA1 e9034551c312aa460bf4ce0718f3035be2f5bf41
SHA512 b986c3c63b1bd0c1ec9d95b3ac5708a142243a440ef8aaa25bfa9940b01806f0e87973a70977a86978fd716d1a70bed7e9c07b402c7b32436bb683cde673c2d9
SSDEEP 49152:Eb+632BuPkFKRrdE6ohvstBhuXjfS4LWxn8Dmg27RnWGj:+3q6sjBDD527BWG
TLSH
T126D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 9d483f11470a0347bc12b743a0c57f1ba89cf6eb76d4d33c93de4e18f3fc63d2
MD5 b00681690f0d02092817f1a6f2d3fa72
SHA1 e528c226d73d3bcea203a79012b8025bc926cb81
SHA512 bb6b9649b64161978d0d9c42f53d003ddd03af1cea4349e2ee949a535d6b9452d95d356fb74c61986c0e93f4ae2934a1943dc13a1c9f56bb499260db564d7875
SSDEEP 24576:fXYfDtczAzsqjnhMgeiCl7G0nehbGZpbD:qtc2Dmg27RnWGj
TLSH
T1B8650129B3D408F9EC67817CC9A2C516EA337C554760E68B03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 d86040b55408ee75d59bf100e761ced9f33cf197560f742734d387493be09dcb
MD5 e8e4412f13d8cdd1f0d253a594fcffa3
SHA1 7c30b3638b4dad6f0621d8ba71d5a24b6745ca7c
SHA512 564c7064dc8c80cc8dcd50fae1da05e17405330b9b715d1bb21b4edb68b70a53d4c77e25812c823ab4e53421c92e89509d23197e38cf01f90b9cbf9edc5d2767
SSDEEP 24576:j0Le5ji0hmxxrMIsqjnhMgeiCl7G0nehbGZpbD:jPji0AjlDmg27RnWGj
TLSH
T13B859E26F6748335D073C0B9C5D2A68EED7230865B3089CB4286D77C7E676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 e31c027eeee73e22e6f39285a3963a012006805309f2265b8868844fe51b7609
MD5 aa9bb717e20c81532e8d633e3bbedccc
SHA1 a70d94aa422ca42fd2151445823aa472fbf3ca37
SHA512 14fc0be6030cd773acfc259616a8e00dc3f5dc07dcf8149a1a0036855bc22d838b09a4dce020a44fd97778bb75134e3df4e4b7d8c5f3e1aa7f32d4a8e35db4c8
SSDEEP 24576:+a7/ezSC6vUyD/aqgrvWn6q8wyuisqjnhMgeiCl7G0nehbGZpbD:5/ezSC6vUzPveHjyZDmg27RnWGj
TLSH
T1A7755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 9de2a43a23af553a7a74025f572bae42a551584fc12b8d1eac850afe6ca1ea0a
MD5 13b8572ba0abe2dfd858ed9c1c0cfb54
SHA1 5a7e3c68b71976abbef240ec41eea66c567cb5e3
SHA512 c10efeec8b97da54aa15151e916d3b1ca06e0d4f41f25cae76188a0ca6302bb7465f2832aea9933e21b180299b2135d7083f1a7d6b6816d57b0c33c12e43f7f3
SSDEEP 24576:EVbqPb88hv/l+YPsqjnhMgeiCl7G0nehbGZpbD:EVO88hXl+ODmg27RnWGj
TLSH
T16A559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 bad8d7a1d48bed50a61dc72369d53e015dabd54b815a85bf0446e0f8a670a2ec
MD5 2de761e52d85b1b9f3ec9650171a4fbe
SHA1 461621de5711e4f0d27309730335b146e98f41bc
SHA512 d8c58601cff9f532cddf95e021b793f9ac6be60e185e675bf22649c4eaf39a64bde459d8bbb51b92ea26c7e52325a030cc586558c85fe95120ea6f16fee1c132
SSDEEP 12288:NLEXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:NLEsqjnhMgeiCl7G0nehbGZpbD
TLSH
T14A4523BF865C50DAEB7608B5C3E9F11EAC137E56982008536A637CFDE6B5458CB39023
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 f3c4cf5d8087eacfcc138968d53cc6848a5862de9d0923dd6dbc8a753faca928
MD5 e3c048b4b9f2464294c1f54466098915
SHA1 1c6ace2179fd03f579030dc4df7f787a9d70b2c0
SHA512 332afa0d47f81fcc1661de3f138938fb1454b8c0bd3c1d80d6c7f9f169da16984aed39e3fecabfa1b12d6085ee4f012279c0c6b44ba45f8796eef3fcccde5dc8
SSDEEP 12288:GeBNUbTVO86UXXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:GJIUXsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1EC65CF7BEE28FCD2C27A8DB95791C600E76278314F21A3CBD165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 f26c48a7980e1a126346f53cdf20dfc1e6c9f1a8480da4a0d79d89ab0cc32d0f
MD5 ced1b6cd35488e4d656611ca419a1f7a
SHA1 55a7ab9e688cb5575bc0302c6bdfe9fcb6bd5dc1
SHA512 67dc8288fd7fbd59589a495615b57305eecb65e050d2331ff6f2ed86311ed5c53fd2c43c9739bc3811f4e1dfd8d4b12baa8cd7b824bece4390d553c2b687e2f4
SSDEEP 49152:WQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3TH6:WQvGAdlCEL8c/DRNw5CWD527BWG
TLSH
T1DB266C656BF880F5E0A7E178897AC572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 21c8700f5efd65e628eb20fe9bde483e820d0eecdde68ca9c791e3713dcd1d68
MD5 2682952065faf63f9eea0dc0575601da
SHA1 0d8c54fc8e29418eded1d803949ca20efb6ee7ae
SHA512 425f4d6b877d3a4354748c83e4c6ef77765ee63d1719569b0e52a47f8b0f914035ac41164023ac21aa1b84906eb1baf2da802efa3c136cd0bbfffcb063828cb5
SSDEEP 12288:nAwSfxL/2Dc3RDLLmt0LDQewsAjBXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:A0ewsAjBsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E575E031FA74E036C77B0DB60B36D71A182D7A204F6119C3E3E89D9E99702D12776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 5da8551d4c7ae1f1e052b165e10127310999f40fe16e15981910339d54e0338d
MD5 093726e1531328951f7e47f60c6658c1
SHA1 e8449a3e166a2b411c7798f1e98bcef0e43ff43d
SHA512 eeba8cf5956121c59ddfe01240fc3532ccb475de986439648e976d3f3841e2badfba9493b164358c5b7db41ceb3cb134bd8d8039268b80aa7d6246f8cf4e8d4c
SSDEEP 196608:xUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJH9VQBWG:xUEtQevvqc2W1cpV2tI32IB
TLSH
T1B7474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 e4b2256c43f566d57595e7cf22bad4b81423122e73088f56dfcf13297dc6a879
MD5 1ae897d26252e6e213001455b2ddfb00
SHA1 20e84ebe34a8b957b4bcc5f5283aed05a0e41606
SHA512 17d9d0e32a68528604efb178c98f4898f44e42b46c2867211fd4f4c47f69ea39c62aa4f34acaaca4fc993eb9281a99182f83f48550674d3764d6da82fe551e89
SSDEEP 49152:TCbRquA/m2yL5zTfFiV+XenmE3/z1Dmg27RnWGj:soquVjnmKD527BWG
TLSH
T101D58D1976B8C1E4D1F6C77886A2C647F37178154B309BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 02395f129b0db8c770be8db4e52e8323dc61f63cbd84f3b71fd616d44c4ef9ff
MD5 de3ba931e9b9fa65b94bf4e61c6634a1
SHA1 3c26780aa06a78c59f2bdeb31e5d17892081af56
SHA512 81350df755cf1142771181248382f0de4e33cef0547e7f7ac0c95f97a66062461762f14292af84c548cce4b727b93d9478d784665c5178aed16b17db37ea18df
SSDEEP 24576:hAhGL3IFoiwtA5l7S53msqjnhMgeiCl7G0nehbGZpbD:hAMUFoiq56Dmg27RnWGj
TLSH
T1FE359D81E7F951D4F5B3AAB899B69171E976BCAA5E30C20F2160D11F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 79b1b9fce43622fc07a03e9885a810910c8fd9f69662896e2d7e6e00db6fbe68
MD5 4458b3a36777777055e2c22ea4ed6d48
SHA1 019fa42c661d0df74cecde20d60dea555a8dda0f
SHA512 d0ae0e59d0acc8541187ac318c7c1522930d568a5c15cea4a17e02e2ffc29f81daddfd286220310409ee1e42e34bfd9ca271ee5c3288b829f808c060e66acbc8
SSDEEP 12288:mmw5HEjsChNVBFgl0WDm+CCXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:/wu4OWFsqjnhMgeiCl7G0nehbGZpbD
TLSH
T16F65F15A72A80CF9E9674539C697D136F7B3BC122A20D71F1760C65B6F33260AE2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 ee682d2b613b6aa3a294689663f5d5f973996bf7075d374cc90d5743fd55b841
MD5 1627ba781f4c2d4e1a77f95aa332ced3
SHA1 a98945f39e55a4c7a162ae0fcbe413bff1ef0f96
SHA512 f2fa2650c8e9b1c5cb49cfd813f55e810e80c414f3d4d19406880df44a6143543e09d98261d60c70980fc963ac01a47a3f5913a50beead6d2e388d6dc6660148
SSDEEP 12288:YeZ1IyxXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:JZuwsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1FD5512AE239820FAE163417CC5E5D609E7337C62673003CF16665AAA6F739D44E39723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 f9164c18e43e27ddeb7425a24fa2644f2ec6cb3f084a5cf17316ccfe0080af7c
MD5 9d7f65d2cc6dc5cb8cef1152008bed2a
SHA1 a60192eda90fccb9dffc4759272311acec078b27
SHA512 a2c4fd9298729b5c9ecac4c55ff3faeeebf9498ed08e2c64cc105904d5d011390e64ca5d6e007eafb6da72a470442233e49d12a33784dfdde8e764adc0acc564
SSDEEP 98304:BQRQyi36YOcPbLvw2gAf+PN3PD527BWG:YQyiKa/X+PNfVQBWG
TLSH
T1F5667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 d299fde8e982ad1299a6dfa2eb14402b7f287ca11a167535e59cf3554999a5d0
MD5 3995c73d7f98dc905309706b046ee88c
SHA1 bd755df927d430edd74a39fcb2f0f954b52da5d1
SHA512 086aac521d64760da1dc02526720239cc9456fd5f15d67c35956fcf4179c955aab0a9353f312268b06d8fb13b63196763287ee3b1ef3b7a48f8c511636d2fa91
SSDEEP 98304:0QRQyi36YOcPbLvw2gAf+PN3PD527BWG:bQyiKa/X+PNfVQBWG
TLSH
T130667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 822cbec35b0a7a890bbb0834cce1a946ae36d37a3b619d28f190ec94050dbdfc
MD5 cedcb2551e83a8044d29ebe67eee5ed4
SHA1 03daf2629b5b09f1cf112ce85f012860e2912adb
SHA512 f545fdbb59fd2acb34d362c6e32c6a0f0564d468283466cce1351499a8e139469e8ca4e1945666652d2ec042847ae6d8ed17039f44961911b0cdea22a88414f9
SSDEEP 24576:HwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0AsqjnhMgeiCl7Ge:v68Qg55nhceWu7PNU3/lDmg27RnWGj
TLSH
T152B55933B2F60099C44DE1769F4A873196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 515ef660b98b86b6ed31e4e1d656c8dadd2b988afcd0e5ba9354eeedabbad13b
MD5 abbaf668aaf611ab811ddd3a18ec8670
SHA1 9b1d7bb1bcae037e1d51dd36f9fb74ef75d61c1a
SHA512 6825f956ff64d3f4a1cf74e9863e33adbb7cefba25ef73ced82a55006d22d44264f3ccf2c26d2fbe0798a84936cae3c1835440892f04b62770d682314a8c9046
SSDEEP 98304:qy5112gYy5azzVvt69nLKnhZgD527BWG:TLIHEWhyVQBWG
TLSH
T156167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 f490146916d3e438db0b88c8eb6c7e725c3e9a5d0970d1473172a35ce4d5a38a
MD5 6936e90de271c07140817278c2552e1c
SHA1 00a93175ab5a11fdfddfab3420b75cde97c3524a
SHA512 7a79d234c168a6c8fd44447bcdda670c62e6c06b04af0491f4b443c0efb083b82f4f85bcacc949e7ed9e948f777384b0c6cc5b72c87d587e45e37f6638012ccb
SSDEEP 49152:AB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glHDmg27RnWGj:au6Jmdxd2dHD527BWG
TLSH
T199D59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 c920996f1364ea7a051ceda95e5fac28778518036016a09799c5ca83faf8c1ce
MD5 5effe54a35a79ca9e611caa005eec07a
SHA1 7d07aa28134e42ec97eacd20f26e96be03941158
SHA512 e31e81838a1a9af988ae59b764565ec44dda132ea2bf4e882ec7fbafd2977423e3f01b38ea7c31159d4eed97372a192964e38ffb6cf0589a6925a427054e2bf2
SSDEEP 49152:W1hpsNoJpF1A63U44CwH7R4xLDmg27RnWGj:WmifPWRKD527BWG
TLSH
T185B5BE13F2D800E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 cb42dd0165bb8998643806969c0329474a50ed8b879397968401ad6a632e2aeb
MD5 ce12e5a7afda24a1717e4d04d46c2aad
SHA1 c7354a4f1c6ff75543be494a1924514a30cfb73e
SHA512 9488b07db2863e2f6c4ae64cf5694844cb7829361d549fa3b0b70b7603be39d43b5711b27e4b9d9051042a767419d2d418f354feac5125e3acedb173893000e0
SSDEEP 49152:MSuZQIY0Be2KcRVtOnks6NMHqsDmg27RnWGj:u5dKii61sD527BWG
TLSH
T19BC5BE13F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 7bac909044062c48c8e135be7bf21a1a7c3148174edf43b153eafcddb60d801a
MD5 859a7ac4e0b48c047ec4b5ac38eb3e73
SHA1 e0a9d99f45837de360815c3476ed08f9ae7d9e19
SHA512 3cbeba8d341501fd187c3f02119ee66d6f749995bdbe6282c1601686182276bfcc13e3c4d6911228871647fe57759231fd9dbe3fdb0d594d00c10cb940d67a1a
SSDEEP 49152:4htSn8EApI0fig3giDn0AP5w3Dmg27RnWGj:pX2imph+D527BWG
TLSH
T10795BE13F2D900E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 963cc6bcf21bbd5f02ed482bef159ee343d8e5af7425ef42283e5b2b7e81ad72
MD5 133fa40f830ec9091b59cd406abeedc2
SHA1 26a12c57d208a77be8776190de483bc0571ef473
SHA512 4930473d01dacc95c482f96a18582d83c31d11f2bde7e7ca231b8a867f71baf63dbbe7dd060510afb3882e1120006f2265bb4aff7cd1a5d22023597d4891b62d
SSDEEP 12288:/sXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:/ssqjnhMgeiCl7G0nehbGZpbD
TLSH
T1CA4523BE955C41CAE52648B5C3E5F10DAC073E5BE92004937A5B7CBEEBB14984B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 c492d4125bd8170f9d834049a06cd38621c55376e33d16ece8ff588e63fee8b3
MD5 f6357b09cf2d2e2991e586047c1e0109
SHA1 94f8e1df592119df1e3c3dfe99896c50dca37636
SHA512 ca60bab3fb080d895b0a4f445f8a43c78d34cc6231e8ebb6c83e62fac3856612b8bab998f8cb65c29618326774efd649f346a8fcec2ce06558c638ee3c0a41a3
SSDEEP 12288:sdXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:sdsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1874523BE955C41CBE52648B5C3E5F10DAC073E5BE92004937A9B7CBAFBB14984B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 43ec1484d55b1d859fcc6256fa88d5bac8db807a8688f3ec613b09283883ae5d
MD5 21a66e5f7719f7f8cb9d6be3f929b775
SHA1 151895936f44eb1c92a558b7868397024fff4c21
SHA512 f9f58eb25df8e5ef89edbf16c8d871213f69dd99ed274f0bc19f1f756615c970c1157953bcd53040f3d4d84dda601921f62c3101a70d825b073784b1f371e3bf
SSDEEP 12288:EfXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:EfsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1964523BE955C41CAE52608B5C3E5F14DAC073E5BE9200493BA9B7CBDFBB14584B38463
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 327a80d047854d589fe227a231cad10b536b986f4d369bc4f254c90500f64e73
MD5 5cb91aa0239fe23d3e05e990ca97b104
SHA1 297a105379ad3b2f9e85b6c6fffef9938ee5c5ad
SHA512 346bf3d6109c3d10023367b8737e19eb5daa61aafefd1bb360b8c216e5beb8088bd98e5da4404f5b54307933c55f14b930b5c7da8d6a27a0d9c48364abe09464
SSDEEP 12288:iVGXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:VsqjnhMgeiCl7G0nehbGZpbD
TLSH
T17545237F575C00CAD83285B4C2E5E11DE8277D96EB30059B6B532CAE9FB16944F38A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 08b03a6f3a7dc751f96fe9b5a405304061afa13fd843d4c2de624c83a9227834
MD5 6fc8027dd2d7ebe33f69270d9ec7d499
SHA1 11a4f65b3eb9820590d5dccec508557e6688326a
SHA512 621320682e5b67f9e13372ce5ad4e8216d414833280190b945c607690d4995b823a3534587db240026729d512facfbd35dc4345528cd336869fe05306f05090f
SSDEEP 12288:B+Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:B+sqjnhMgeiCl7G0nehbGZpbD
TLSH
T19C4523BE965C41CBE52608B5C3E5F14EAC073E5BE92004937A9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 8cae6e6afcd062185e84217f2ab0a1e6b1519c47b0833659145dd6a5792765a5
MD5 e0aad38c3d79bb094e7ad2f20629e11a
SHA1 f4eda6213708a7f746bb8233264f8bdcecb775c0
SHA512 7207ef1f6aa153891c84f7c340bbf329b6a99af7e0529a12886a0e0f4707a92e1989de0b901b9cbf072e1a31edc4e2c339042662541d0f5d02cf31f83f9960e6
SSDEEP 12288:YpXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:YpsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1154523BE965C41CBE52648B5C3E5F10DAC073E5BE92004937A9B7CBAFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 cba2334131c5358ad749629cc725eb960e5c43851aa585880b77e65d634d76b3
MD5 9eae24ac970578a1fe34d83660059416
SHA1 2bde2997e210416d179a7ab617921a4445936a5a
SHA512 815ae49ca26c4af3f903a5bc703ba3b8ac68ca293f6bca1455d89c7e293e1b403d48988f2c951f3b24695b1d515f6a66731175e6e74f7dcfe62925d26c4c8242
SSDEEP 12288:/VXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:/VsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1684523BE965C41CBE62608B5C3E5F11DAC073E6BE92004937A5B7CBAF7B14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 1ce7d2641a92c80789dc1195a327b21f01cc5a8a8db265eb7f5ad34de23a9752
MD5 112f4bf250cd635b72d020c2a40c31ea
SHA1 c092ddf9eeef6fc48e4a629b089816f682a26655
SHA512 6fe8693cd1fcd5a861bc205af8e3200f5608019d8ad386ad167011a120192a999ed61179f61458b8aad636a9f4a7866f430d631de0c1c2c619bdef9445f39b1d
SSDEEP 24576:vZMRzFVSO9sqjnhMgeiCl7G0nehbGZpbD:vZMRzfdDmg27RnWGj
TLSH
T1F36501A9B35018F8EC63813EC965D90AD5B27C5A0B70C61F13A5366B5F733A00D3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 0300fdb7aba5f25b1426bca348ca59f2a3fb3bc176dcdeffb45dbe33931595c5
MD5 a90bb408c6b2e3c0d07486d94ac8cb80
SHA1 a17444e48735f4b1db0732e2761605caba185f40
SHA512 d56324c0fac992b82371e5de23e4523f7696bdbc72a4a140693d29d440f4284e29cb04a243ae28d27433ee2d570b7c756dffb5ae6562d98013c8ece1ee7520bb
SSDEEP 12288:egXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:egsqjnhMgeiCl7G0nehbGZpbD
TLSH
T18C4523BF955C41CAE62608B5C3E5F14DAC073E5BE9200493BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 c02b819309e4fd421c17ab0cdb5d23ead6c42bcfb8a2830b0f601ab8fc981add
MD5 4686d159334b744d5a7e3162e8b9e0bc
SHA1 9eb063f8b1921c269c18963dcf4831403a84d4e5
SHA512 2ae44ce24d3b2748b238b80b3c96adec379670e1878be9019ff6a4a4d69b984e3785ce286c55e1af9feacd69cecfe0ce1264eb4fc9c5916d83a6f4867c107c7a
SSDEEP 12288:V0Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:V0sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1424523BF965C41CAE62608B5C3E5F11DAC073E5BE92004937A5B7CBAFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 03150fe9f14668107befcd5da027f1841d45dcbb66b33dd66f74ac3a728af9a9
MD5 0b53e4bc3d0147950b3b2e3f7b5850c8
SHA1 161532e7881b7fb5baee8aec4a683df57234ffcb
SHA512 babf8b6699fc65f98db2d61f5818b8eb543804b57f6f754a256cdf50af565fb2628018ee2781838980f4418d6d3905f85daf7185de06a4dd49f50a273a62c29a
SSDEEP 12288:AyPz5L8xXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:xzyxsqjnhMgeiCl7G0nehbGZpbD
TLSH
T14555125B73A530F9D1368178C5A29A06F7327C3647204A9F17A416BA6F736908E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 27d2fd9dbfb20b30e75514f7b0a96408c817eb1ed5495648506a1c4b378445fb
MD5 10b0d7e4e4a936de50ecd9bef720d848
SHA1 7804abd203cef4126ce0d4805d1ac6d2800a5dd0
SHA512 5655badea2580c985d1cc9277420f0b885ddf9019337b89afcd9157386c417636b19bfe07cd950876d98bdd9d18a97d5ba737a0a2ad7094d5a6c8b1f0dd7c401
SSDEEP 12288:qgXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:qgsqjnhMgeiCl7G0nehbGZpbD
TLSH
T19D4523BF965C41CAE52608B5C3E5F14DAC073E5BE9200493BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 b3b9d7a921a08e19da9249f0dccdde104d7856a4b380eb17cea81b97fcbcd14f
MD5 9f688bab2bcc305e1ddba580d41234a1
SHA1 0262aa5c1642409bd4c0469d7c1cce9f50f13829
SHA512 9729dd6756f0532a3b6182ae41b3e09d1f7e6cf9065d17b4a23d9060af2f2e5bca3b2ddc7700789c4faef456819c0e6ffc94f6008222f4eef197f8efbdf0a391
SSDEEP 12288:DgXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:DgsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1934523BF955C41CAE52608B5C3E5F14DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 8c5106bf9a11e1f0bd6d3da23d5ec7b2c006c5441a494caf089023fad85527fa
MD5 3fe667ef8854297dbdc8a7ceb5fb87e6
SHA1 c8970f13f9302d7fe9d27401566c70d59de8f8d1
SHA512 65c3cd31c0d1f8b5e3100fee3aeb9e82b45f3bb005e16222703a25a9320f1e1329bbf80123e57e15e2a1830617239fa29255fde6a6211867a45abc8a408dfbfd
SSDEEP 24576:YCU3pvPDv4Ex1hfe7i8WVq2lIGU8lrtGUJLPuwvArsqjnhMgeiCl7G0nehbGZpbD:YCUZPTY+8Wg2lIL8lrIUJLWwSDmg27RN
TLSH
T15365AE1EA3DC0896D4BB81358A51CA06EB32782E1B3196CF2160C77D6F67ED54E39F06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 6ac7271ee0c52b78a3dad162a626292b7e95670b7a0caba350d1abe160dfab78
MD5 813b35a1d8276f114120cf37aa8003e5
SHA1 2d31c67a47cc6133046d7fb8f536342f02b121c7
SHA512 6c579876acd1a52ebc33ad59abe0647c8b930f3ff03a7289b8282c4cb63256053fe5f431e4dcdcf40b1982bfb5a00e7e9f81e8215ccf794a8d1e0131c9ffec1d
SSDEEP 12288:jbsfwXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:2wsqjnhMgeiCl7G0nehbGZpbD
TLSH
T19F55011AD29802D9C06E6179C3969605F7333C2697E093CB67D1F87E1F766908EF9A03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setting.ini

Path C:\Users\Admin\AppData\Local\Temp\setting.ini
Size 638B
SHA256 0c1f03b3a7d2790796ac63380f72a47276866c988dd24dca9bad044b1ba38707
MD5 11146409813d8c3e8b77604a6996ec59
SHA1 cec26456fbcd6d4423632f6fdf35fa932e07ba17
SHA512 3951681956286acabbfda5859ac14491364b7c37aa30ac2cdc6053bdd635c916e4fb9fc2d45a40665f753dd967e830e86d2d9c54264c7f74d61cbd41fee9a6d3
TLSH
T1ABF022334D488A1D112273B41DF2886561EAE481A870489CBFAAB8836F9895717B67DF
MD5 SHA1 SHA512 TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 0b3db7eb9f2732428b5968e1a009b24b747a1603576ab6dbc4efee7725b8d6fa
MD5 2ef05dc74400229e35779afbf76260cb
SHA1 f888d8a8a88bfbb36b5cc807af3f2e84264ac06a
SHA512 0e1ab5cd24f2860a10bed7a88f4f84be905c3695285f6cbea81f35c618067dfab6e0e4d992f4539fd922a97abb82af2960a43c548de7cd95d3ad18658cf01469
SSDEEP 12288:R/Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:R/sqjnhMgeiCl7G0nehbGZpbD
TLSH
T11645237AD34C518AE57609B482EAF12D681B7E669F2004C3B94738FDF6B18D48F38517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 f6a4114a486cf40789a57a6d44d42f7e2520efc5a84c3a7e92855ac15e6aadca
MD5 2a8939b3ca1065d4dddf4372bde37274
SHA1 e1add9aff7bb49a865de7a96cec2b23434efbd6b
SHA512 e45863b5c91235f4424aeea9c85fb3d63726de93c0be82a0452241cfa01193f6df6af0d9aece496328b631bf71ad4c37189533d4fa9a601279608faabfdf3755
SSDEEP 24576:98RMyNoSFw1d+rC4vrmRcGPiQEaiPnMRTChsqjnhMgeiCl7G0nehbGZpbD:CRZwQCyiHiQEaiPnMUDmg27RnWGj
TLSH
T11985B01E62DC42A5E0BAD278CDA78407E6B27816573197CF1291C27D1F27DF48E3AB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 420a2a60baf90deee4781b4f95f6e3ccbc1e9b49a8434b8db36d361c703dd535
MD5 2464fde20190a79fddb8632835eea1a6
SHA1 9ee129aee22a824d2c00bb440b4937b2ad19c7c5
SHA512 19e13233f9923ae8ef3d77473e21ef1aede1f020bf37ba07df1aee2c4537ef97a68653984fee4c17641bfe0abc09bd0f6c836a74364c5ce157a479253b7b5527
SSDEEP 12288:VbxA1U7KvXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:VbxA1UGvsqjnhMgeiCl7G0nehbGZpbD
TLSH
T13B55123E62AC10E5E176957D86D2C10AD7327C26672053DF21D282BE5F37EE84E39E42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 82016c62fc3bd204196f93d1771ffb978eceff70d69b860ffaa3879c78810f2a
MD5 71009d2422b74441196a643ee6e19dbf
SHA1 f18eb1fa35553c2d55f13c150ec9219ce7bd9fe6
SHA512 c0aafacff03025cbbc5ed6f14db871e4d59bc7face1c74c1e570569fda30ef38a7e560a688230a2d579c300ea65c60b4aa2844feca136115faa0d928cd121d92
SSDEEP 24576:EjsmP0yHaqrVqHra44KDzMsrn2sqjnhMgeiCl7G0nehbGZpbD:EjRP0yHfVqzlAsrn6Dmg27RnWGj
TLSH
T1F645AE2EF2B910F9D4AAD136454147B5BB71782D1F209AC70170C634AF0AEE89F39F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 f16276e9a823c5380ae5a6123e8612ea0e644f8cedca9ec84c0487a6829808d1
MD5 0d60c773353f6f342f8ea8ee85630352
SHA1 bc310a36301bcd96fafec73ed6adbf5f3417f361
SHA512 f196a4d76f038507b0cd32c9669dd453d953867b96b6624bb6ca983f3b860ec4eae8b9758fde89a636fd405edfe93c88de4c57330decd8ccab8b09c453a4275a
SSDEEP 12288:eJXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:eJsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1FF4523BE924C51CAE93649B5C3E9E11DA8073E26AB2004D379977CFEE7B54D84B38413
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.5MB
SHA256 c90f8a89226bba27c96702fee57db6d2c4c3c18c287e44985acef2e9ed163caa
MD5 fdc802be0341f9f8ad4b8d1c5d3965de
SHA1 ed3a998189ed04733723d31086c93df5002e75e5
SHA512 afe00d7ba7f227480384ceea0c985059bc771efb8957fa4a8a70fd53c9959ecab76ffd4046cc7d65f8618f0b7153f9b90a4e1ba52efd195deee440fa86d3afa7
SSDEEP 12288:FObfA4LWO+vAYFTzXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9L:CbLBUTzsqjnhMgeiCl7G0nehbGZpbD
TLSH
T140750159E79800F9E87B813CC5A2D616E672785D0720E7DF03A94AA91F637E04F3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 a972d51f6b9d36eee4659f4bbe86d746bfe42376e552c6e91b97f63e548f4f45
MD5 e36738fa2a603007762c9dad0f1ef8d4
SHA1 eef669b7c669034f1c4377577be2e51ccbc42fcc
SHA512 902e30479e211bc5e3ceeadd0d7bdd909d7135283925aba800d9a6cec7f046ec77241e107189bae3b5568a14df90984ca3a8d0f023948e10017a4f830d9c7d91
SSDEEP 12288:Z70Vm9IYNvUyBp8Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DX:WpYNHasqjnhMgeiCl7G0nehbGZpbD
TLSH
T17C65E12FA2AC18E5E53B9179CAC2C209F5737866171192CF15B082BE1F17EE8BD39741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 d44ef7f2914d84d1c27219c0a8760da0ac5e1f78b40dfb6547bfd8bac37e7ede
MD5 e3c2e56fa6b83a3d38be4b2fe1cd7804
SHA1 a9fcde7953f8896c498f811c57744d4605b0c2ed
SHA512 7125b5e1d6e777c9a6dda7647f795c11523cf0cd01104da1400c0fb7e72bf84dd2a239fd747fd458bc719a65aa1d8e13d87b0fb5cb631cd1182e7d09f51569bb
SSDEEP 24576:DnXoJjNYH84VVSNAApoEmP66aspcrcHBjSSKHPWdQwPF3hJ8ssmOc+XLxu+x7uKS:DnXoJJYH84VVS6AmEOJas+cHBjSSKHPM
TLSH
T1A565BF6EA2BC04D8D5BBD17DC5C28506F5B278621331C6CF026182BA7F27AF55E39B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 2ba4fabb204103945838651181e463194f0676d494c88151b7881ce751ccafe3
MD5 a0e812b791845803fb0a8e34c53a90b0
SHA1 98e8b6315e061b64fb64b65b2c4b4d719be5a259
SHA512 84b5236ebedc71c0573755b7fc0af01d6c7e95c903110508eceafda6d1974bc10f75e782200eb995c042ea7b6ecf844ebf70dd54f356c5b544cfe962d78fe03e
SSDEEP 24576:Pv7Xbxd9Tuycf8M/TYlSuxrr2PCksqjnhMgeiCl7G0nehbGZpbD:PDLL9TuJ0M/TYj2PtDmg27RnWGj
TLSH
T147858D5EA2EC42D8E07BDABD85B79046FAB2B855173081CF1251856E1F23BF05D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.3MB
SHA256 c856044cbee8d6ed9a4767d25abc309a2e0c7fc72091fdeb76f61176a50963df
MD5 3428ec5b2babb5609014a1cad5657652
SHA1 dc8308e8dd6d5d62d80fe4dfc2376170b1675f4f
SHA512 886c2e540a7cd93c3063e5b1e3802057a2dca1ed678a726f2c0498af66e60acb8d5507c301021f4542c44ddf3365caecca3ebc92116ce2835d16ad0d1c37e539
SSDEEP 24576:gegJgpwJOmPOHWAKk8ZguIGyPsxr5Vin10wzsqjnhMgeiCl7G0nehbGZpbD:gngOJOmPOHz3Dmg27RnWGj
TLSH
T14855CF3FA7BC15D5E03EC17DCA928916F6B1782603255ACF05A0827E5F1BEE42E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 0f599e3bb539b30d52c2c0ae72459d3908d918d6f320559ae2bca577f2ee61e1
MD5 5c8d8a5c31f0bae208859996dfcf4522
SHA1 809146c27091b375c2f2c48ad7d9c5314d00bb04
SHA512 9e7ef1b3cace610927773e054bf6669b918a6647e03224e7b23a24eb40c63f5791b1abe4f9d6794032fd92e9ca8b4a42c648525bf9667843efe012ff0ce466e8
SSDEEP 24576:ELJnJiTk3R3waE4JrOpsqjnhMgeiCl7G0nehbGZpbD:ELJnJK8R304lKDmg27RnWGj
TLSH
T17175E13DD2A810E8D477C2B4825A5756FE32387D2B2169CB29B4D4353F12FE09A39F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 ffd60a21499f17abfebf9ad64dc2024dd75043dfe01bd9b61e1b6c7bcf1cfa1c
MD5 e7b37ec56cbfd3414572969e5585eef6
SHA1 c52b0f7ce2f599c5b1dd2a4450c42300533e2137
SHA512 485892980c90570281c86df9cae737461e7d8599d351c719fb72c96d6bbc98629d034d27aed7f1a15bcad74bfc0c7d698ffca8c4e4b533fc60334bc968a4b8aa
SSDEEP 49152:U9mqCzDScAZmlvTcFg8Ph6JDmg27RnWGj:GOD527BWG
TLSH
T145955C15F7EB5298E8B3CAF1C96694159A337C409B34F7EF0A80C96A1E32BD1D538B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 13e0246282ac99383686d8b95d74364b757bbf077b3b14ac715c5d884082efa4
MD5 c8b8d870f71c21fc8bca70338b593bc4
SHA1 29642c28be3edca751ef8ef308ecf78751f7d3f4
SHA512 e2c8a78dd9f147662eb2fa0edfeecc95494ce1afaeef7e42fc19443622a812a14b30a4fcd9eb25f52e71cdd47b3f68eb43e3c193825925a92136b4366bf7df35
SSDEEP 24576:elYJeXm5jUuEjsqjnhMgeiCl7G0nehbGZpbD:elYJeXmRUuEnDmg27RnWGj
TLSH
T12455126E669C30E5E13A8079C2E2C508E633B872671017EF56E0D5BE9F679E40F38E41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.3MB
SHA256 3a5ab2bd2190b567f22b243bf911677baace35d4e46b3a92f959bc17f9a9984e
MD5 e7f12152164f4f58aad8cc6f341b6fe0
SHA1 bb95ca472b53a5f3f97caa90d8fefe8b7b8d7dea
SHA512 ca29ec9de97c25e96f32587e22312129311ebf6581ae4725edb80c8ec65f93506bb94cde7a137b4f0af60ad9c211727068667705c61d1769e874232f84b40aa6
SSDEEP 12288:emu6kyWXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:e7tyWsqjnhMgeiCl7G0nehbGZpbD
TLSH
T181552219639860D9EA760978C6B3C158DC367C219F2042DF65D1FA3FAF72AD48E34B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 16326b368079238b3fe515c9bac6a04fe10eb31d3ecc4f11ac613467a59b19fc
MD5 31454ac535cc10c1480578812e249258
SHA1 de0eeececae4084f933999e36dfdc1c40aaf2299
SHA512 39f740cdf614a3c1d5e43abf9c9494ba771e416389feed5c318a0e8d21ec2cda25729e5e52fa7a0153fbe3bc49b7a29e92549bec109202411f1f5dd34e2a1e33
SSDEEP 12288:uPzXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:6zsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1DB4523BE525C60CAD93248B4C2A5E10DA8173E36AB2014E779E7FCBDEBB54D44B34813
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 cbedaef38293a6f49fdb903cf5b6317de8d1e3466b756523fbd5253e296d0182
MD5 3d4be18267ddcdae2427a571b3f79617
SHA1 4fc98723fe1cf34c6372546bcd884e82a100d4f6
SHA512 2e487c3ba4c3b86c6069ac7b844c13676912b73adfb79ccccf40797720e60719ea12cdd2c9a74b029e87e55442dd8a7123d229983fb52940c1dc421fd9730594
SSDEEP 24576:YC+TyQIu93VAumZr7jmQsqjnhMgeiCl7G0nehbGZpbD:Y/TfIq+YMDmg27RnWGj
TLSH
T165558D2DA7F919CAE276C575C9A34493E933B872137186CF2044C07D499EEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 81fac006469e9bb6cf6c9bfb11fc3384d68a819f7fae8b0b95c8405171f125d5
MD5 6725200ec08a7e574cb580d93e2763db
SHA1 310319b0c92a2512f2d473917c35389cf6fea9e5
SHA512 a37d03d9ea4de81437ca59be8af74d73e9ef43bd7fbeddcf0f0351a603ed20f6292af0e69f870cbf3f95e2671192ad6c2942fbcd608bcd5b879b2ce47178e1ae
SSDEEP 12288:ocyrWOstaa3kcsnXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DX:NLQikZnsqjnhMgeiCl7G0nehbGZpbD
TLSH
T15C65F11FB3AE0095E067817CC8858116FA737835571163DF02A1CBBD5BA75E8BE38B42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 46b4951ca18bd1d9a2c9dd55547d0cc178bb028ff1644d944bd336fbfb4fa6b6
MD5 10c6bc2e9089de1f199bed1811d859b3
SHA1 a31e7ab90de4b36a900c406fe9ae96fb95780d98
SHA512 c0dcd83bab379e9a3556dfbb3aa74675fd494c1f574505fb04d36cb1709829cd8f4e7a8260905dc1e32eac4f729d266e8c3cec676a61cf19a2aab5b8a0baf78e
SSDEEP 49152:LpJFwrPpGyqWo6cbT2TZ8maJO35NPHXogsS7Q78ZGAvL9vnF35LWAPaDmg27RnWm:gpC7b4+80GTkxD527BWG
TLSH
T161A57C3DE2B810ADD8AAC375C5461665EE71382E3F2015DB11B0C578BF1AEF19A38F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 528b8688f527f09fc2fa5489affeab89a64dc34c95f02afda94863cef41d29ae
MD5 6a3421480a1bff1cb1a871820d1ac3ab
SHA1 8d1b99efbf01932ef1a85ed1bd6edcd0372b1769
SHA512 8f8d2859f4274aa557edd8cc6fb49016b75773a2d31973c98db14448911e3748d7e89bafb6e74168177b7189b225732a997d865837fa531519e85a7723e7fe6f
SSDEEP 24576:MSAwJPE1IDAo+4Kt+l4413JUQesqjnhMgeiCl7G0nehbGZpbD:MqPCIo4Kol4vQyDmg27RnWGj
TLSH
T16755BF2AA7F956E5E17ACBB4C663C601FB733822133163CF5290857E0E169E85E39F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.6MB
SHA256 699c496b042ff073848bc984e3693f27fac84cee79b08b8ac37b8a4a30d55759
MD5 3b40954d5c147732fca2f65e699733fa
SHA1 b12a042f6296821b40affc00d47c132aa490b873
SHA512 2f3d89b168b6a0ba71708727f541975b6cddd18cdcac39dfc91b7cf96e9cddc844123402fe46056c9b6d73195b5231bb430b63c74c9bc8a9ee9e5174e586c790
SSDEEP 24576:vyLXPLcw94tOsqjnhMgeiCl7G0nehbGZpbD:vy7PoXtiDmg27RnWGj
TLSH
T1C775D03ED76C04E5E47AC27CC6A3C506F6723CAD033166CB19A095792F6BEE46939B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StructuredQuerySchema.bin

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin
Size 414KB
SHA256 e67e330837a6b2f6d5f76815e7235a512b54b1c90f2ad62a3e9d142ae6939c8d
MD5 16b9618962f5623ca791a1366eee5708
SHA1 f0d257511952f075b2a0ec7d8e8730c3e464461a
SHA512 18e1d5a105b87fc72df94645685f5a8d3f593df2d3a9b8652b3b4a4ceaf92d3c7a67b0c08847186149dd608428cae8f1b3bc844bc7aacfc9e3219da823ca2fe2
SSDEEP 12288:vMUC7+vlk3n61mSkplXZ5RwmF9n4w/TSD:vXhl6V/i
TLSH
T124945F36BF88CB22C59A15748897C01A2E30A7C49E04CF6B73DC513CFA576685FBA359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.4MB
SHA256 8922ea5032a7f12299c8b9c0747ef8ebdc565f3feee5f75a2c649533b78d3538
MD5 88b82181c0422ad5f0d40295126c7e36
SHA1 65cd19e2aa788075ecf1fea7178e43d92cae43ab
SHA512 9fe9b7b2d200ee0249e45b539616d180c8f633a123144dfcacf9c22d5335f1f33962dc334b0231af7fb8f7d104005975e67e52f96b3bc4408df11b6055bace01
SSDEEP 12288:r9lyvj3IkxjbBz3Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DX:rWv8qjp3sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1AC65126E52A820D9E43A4674C266D12994337C77173459EF75C5E8BF8B31AC0CA3EF22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/644-68-0x0000000000950000-0x00000000009B0000-memory.dmp

Download

memory/644-137-0x0000000140000000-0x0000000140167000-memory.dmp

Download

memory/644-1-0x0000000000950000-0x00000000009B0000-memory.dmp

Download

memory/644-0-0x0000000140000000-0x0000000140167000-memory.dmp

Download

memory/892-153-0x0000000000E20000-0x0000000000E80000-memory.dmp

Download

memory/892-150-0x0000000140000000-0x00000001401F9000-memory.dmp

Download

memory/892-274-0x0000000140000000-0x00000001401F9000-memory.dmp

Download

memory/892-159-0x0000000000E20000-0x0000000000E80000-memory.dmp

Download

memory/1116-70-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/1116-171-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/1116-71-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/1116-80-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/2240-223-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2240-347-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2240-227-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2240-217-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2440-312-0x0000000000BA0000-0x0000000000C00000-memory.dmp

Download

memory/2440-306-0x0000000000BA0000-0x0000000000C00000-memory.dmp

Download

memory/2440-533-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/2440-305-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/2708-534-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/2708-322-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/2708-327-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/2740-290-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/2740-165-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/2740-172-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/2740-173-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/2768-541-0x000000000BCA0000-0x000000000BCA8000-memory.dmp

Download

memory/2768-337-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/2768-392-0x000000000A520000-0x000000000A528000-memory.dmp

Download

memory/2768-331-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/2768-360-0x0000000001C30000-0x0000000001C40000-memory.dmp

Download

memory/2768-330-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2768-538-0x000000000BCB0000-0x000000000BCB8000-memory.dmp

Download

memory/2768-535-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2768-539-0x000000000BCA0000-0x000000000BCA1000-memory.dmp

Download

memory/2768-376-0x0000000001EE0000-0x0000000001EF0000-memory.dmp

Download

memory/2968-129-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/2968-123-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/2968-237-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2968-131-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3216-188-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/3216-304-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/3272-243-0x0000000000E30000-0x0000000000E90000-memory.dmp

Download

memory/3272-250-0x0000000000E30000-0x0000000000E90000-memory.dmp

Download

memory/3272-249-0x0000000140000000-0x0000000140241000-memory.dmp

Download

memory/3272-466-0x0000000140000000-0x0000000140241000-memory.dmp

Download

memory/3408-226-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3408-118-0x0000000000570000-0x00000000005D0000-memory.dmp

Download

memory/3408-121-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3408-112-0x0000000000570000-0x00000000005D0000-memory.dmp

Download

memory/3412-552-0x000001C47DEB0000-0x000001C47DEC0000-memory.dmp

Download

memory/3412-557-0x000001C47DEB0000-0x000001C47DEC0000-memory.dmp

Download

memory/3412-550-0x000001C47DEB0000-0x000001C47DEC0000-memory.dmp

Download

memory/3412-553-0x000001C47DEB0000-0x000001C47DEC0000-memory.dmp

Download

memory/3412-554-0x000001C47DEB0000-0x000001C47DEC0000-memory.dmp

Download

memory/3412-556-0x000001C47DEB0000-0x000001C47DEC0000-memory.dmp

Download

memory/3412-558-0x000001C47DEB0000-0x000001C47DEC0000-memory.dmp

Download

memory/3412-555-0x000001C47DEB0000-0x000001C47DEC0000-memory.dmp

Download

memory/3412-551-0x000001C47DEB0000-0x000001C47DEC0000-memory.dmp

Download

memory/3412-544-0x000001C47DEB0000-0x000001C47DEC0000-memory.dmp

Download

memory/3412-543-0x000001C47DEB0000-0x000001C47DEC0000-memory.dmp

Download

memory/3412-545-0x000001C47DEB0000-0x000001C47DEC0000-memory.dmp

Download

memory/3412-548-0x000001C47DEB0000-0x000001C47DEC0000-memory.dmp

Download

memory/3412-547-0x000001C47DEB0000-0x000001C47DEC0000-memory.dmp

Download

memory/3412-546-0x000001C47DEB0000-0x000001C47DEC0000-memory.dmp

Download

memory/3412-549-0x000001C47DEB0000-0x000001C47DEC0000-memory.dmp

Download

memory/3460-183-0x0000000000BC0000-0x0000000000C20000-memory.dmp

Download

memory/3460-177-0x0000000000BC0000-0x0000000000C20000-memory.dmp

Download

memory/3460-186-0x0000000140000000-0x0000000140209000-memory.dmp

Download

memory/3656-211-0x0000000000670000-0x00000000006D0000-memory.dmp

Download

memory/3656-528-0x0000000000670000-0x00000000006D0000-memory.dmp

Download

memory/3656-329-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/3656-530-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/3656-205-0x0000000000670000-0x00000000006D0000-memory.dmp

Download

memory/3656-215-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/3992-275-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/3992-271-0x0000000000BC0000-0x0000000000C20000-memory.dmp

Download

memory/3992-277-0x0000000000BC0000-0x0000000000C20000-memory.dmp

Download

memory/3992-279-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/4088-291-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4088-531-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4088-281-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/4088-287-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/4232-260-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4232-513-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/4232-263-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/4232-254-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4392-161-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/4392-146-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/4392-144-0x0000000001570000-0x00000000015D0000-memory.dmp

Download

memory/4392-139-0x0000000001570000-0x00000000015D0000-memory.dmp

Download

memory/4392-151-0x0000000001570000-0x00000000015D0000-memory.dmp

Download

memory/4508-89-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/4508-98-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/4508-99-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/4512-293-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/4512-532-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/4512-294-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/4512-300-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/4536-197-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/4536-326-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/4536-191-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/4536-200-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/4600-134-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/4600-132-0x0000000000DD0000-0x0000000000E30000-memory.dmp

Download

memory/4600-102-0x0000000000DD0000-0x0000000000E30000-memory.dmp

Download

memory/4600-108-0x0000000000DD0000-0x0000000000E30000-memory.dmp

Download

memory/4600-101-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/4652-235-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/4652-413-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/4652-238-0x0000000140000000-0x0000000140149000-memory.dmp

Download