64ea9774bcccd57c4186e66cb435eade214d51898234b06ad06a1dc9e8347611

Analysis

max time kernel
149s
max time network
146s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
31/05/2026, 16:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-31_31915f5676a54889c304571d8f8276f9_icedid_njrat.exe
Size 1.3MB
Sample260531-tzfcdaez7r
SHA256 64ea9774bcccd57c4186e66cb435eade214d51898234b06ad06a1dc9e8347611
MD5 31915f5676a54889c304571d8f8276f9
SHA1 1a99081afe7996f5d64abc81226c489414b85740
SHA512 6df009630114cd3d6747f33797f4c18896b2f7909180bf6f11b2dea77b7367dd9c9e52a7b4268b2ec34ed6d1614d9c40da0e054c5ba094f17ac040418bd6b29f
SSDEEP 24576:rdhBh8H2hnrSN3zkwhBQJQXCr/C1eGrd4xqxy:rzBhTnUBQIC+0uak
TLSH
T17A557B857BA446B5F0B28A348965866DE6727C50D933CE0F11814EEEFFF39418E25B32
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
3352	alg.exe
3640	DiagnosticsHub.StandardCollector.Service.exe
2208	fxssvc.exe
2488	elevation_service.exe
2252	elevation_service.exe
2436	maintenanceservice.exe
5016	msdtc.exe
3372	OSE.EXE
4720	PerceptionSimulationService.exe
3208	perfhost.exe
236	locator.exe
2360	SensorDataService.exe
944	snmptrap.exe
2592	spectrum.exe
1016	ssh-agent.exe
4036	TieringEngineService.exe
1648	AgentService.exe
2968	vds.exe
5060	vssvc.exe
4496	wbengine.exe
2232	WmiApSrv.exe
5040	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\e:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\spectrum.exe	2026-05-31_31915f5676a54889c304571d8f8276f9_icedid_njrat.exe
File opened for modification	C:\Windows\system32\dllhost.exe	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-05-31_31915f5676a54889c304571d8f8276f9_icedid_njrat.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-05-31_31915f5676a54889c304571d8f8276f9_icedid_njrat.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-05-31_31915f5676a54889c304571d8f8276f9_icedid_njrat.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-05-31_31915f5676a54889c304571d8f8276f9_icedid_njrat.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	alg.exe
File opened for modification	C:\Windows\system32\AgentService.exe	alg.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-05-31_31915f5676a54889c304571d8f8276f9_icedid_njrat.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\95a47a421c6cb3b6.bin	alg.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-05-31_31915f5676a54889c304571d8f8276f9_icedid_njrat.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\{17A6A947-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db	spectrum.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-05-31_31915f5676a54889c304571d8f8276f9_icedid_njrat.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-05-31_31915f5676a54889c304571d8f8276f9_icedid_njrat.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-05-31_31915f5676a54889c304571d8f8276f9_icedid_njrat.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-05-31_31915f5676a54889c304571d8f8276f9_icedid_njrat.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-05-31_31915f5676a54889c304571d8f8276f9_icedid_njrat.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-05-31_31915f5676a54889c304571d8f8276f9_icedid_njrat.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-05-31_31915f5676a54889c304571d8f8276f9_icedid_njrat.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	spectrum.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-05-31_31915f5676a54889c304571d8f8276f9_icedid_njrat.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-05-31_31915f5676a54889c304571d8f8276f9_icedid_njrat.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-05-31_31915f5676a54889c304571d8f8276f9_icedid_njrat.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-05-31_31915f5676a54889c304571d8f8276f9_icedid_njrat.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-05-31_31915f5676a54889c304571d8f8276f9_icedid_njrat.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-05-31_31915f5676a54889c304571d8f8276f9_icedid_njrat.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-05-31_31915f5676a54889c304571d8f8276f9_icedid_njrat.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-05-31_31915f5676a54889c304571d8f8276f9_icedid_njrat.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-05-31_31915f5676a54889c304571d8f8276f9_icedid_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	2026-05-31_31915f5676a54889c304571d8f8276f9_icedid_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	2026-05-31_31915f5676a54889c304571d8f8276f9_icedid_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-05-31_31915f5676a54889c304571d8f8276f9_icedid_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	2026-05-31_31915f5676a54889c304571d8f8276f9_icedid_njrat.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	2026-05-31_31915f5676a54889c304571d8f8276f9_icedid_njrat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-05-31_31915f5676a54889c304571d8f8276f9_icedid_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-05-31_31915f5676a54889c304571d8f8276f9_icedid_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-05-31_31915f5676a54889c304571d8f8276f9_icedid_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	2026-05-31_31915f5676a54889c304571d8f8276f9_icedid_njrat.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-05-31_31915f5676a54889c304571d8f8276f9_icedid_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-05-31_31915f5676a54889c304571d8f8276f9_icedid_njrat.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	2026-05-31_31915f5676a54889c304571d8f8276f9_icedid_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-05-31_31915f5676a54889c304571d8f8276f9_icedid_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	2026-05-31_31915f5676a54889c304571d8f8276f9_icedid_njrat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-05-31_31915f5676a54889c304571d8f8276f9_icedid_njrat.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-05-31_31915f5676a54889c304571d8f8276f9_icedid_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	2026-05-31_31915f5676a54889c304571d8f8276f9_icedid_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-05-31_31915f5676a54889c304571d8f8276f9_icedid_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2026-05-31_31915f5676a54889c304571d8f8276f9_icedid_njrat.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-05-31_31915f5676a54889c304571d8f8276f9_icedid_njrat.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-05-31_31915f5676a54889c304571d8f8276f9_icedid_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-05-31_31915f5676a54889c304571d8f8276f9_icedid_njrat.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000067120b61af1dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.txt\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004c2a96b51af1dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ccffccb51af1dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dib\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tif	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000da4fbcb51af1dc01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c9c3d1b51af1dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002fecd8b51af1dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000545989b61af1dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cr2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c9c3d1b51af1dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cr2\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e9edb9b51af1dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
3640	DiagnosticsHub.StandardCollector.Service.exe
3640	DiagnosticsHub.StandardCollector.Service.exe
3640	DiagnosticsHub.StandardCollector.Service.exe
3640	DiagnosticsHub.StandardCollector.Service.exe
3640	DiagnosticsHub.StandardCollector.Service.exe
3640	DiagnosticsHub.StandardCollector.Service.exe
3640	DiagnosticsHub.StandardCollector.Service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
672	Process not Found
672	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3680	2026-05-31_31915f5676a54889c304571d8f8276f9_icedid_njrat.exe
Token: SeAuditPrivilege	2208	fxssvc.exe
Token: SeRestorePrivilege	4036	TieringEngineService.exe
Token: SeManageVolumePrivilege	4036	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	1648	AgentService.exe
Token: SeBackupPrivilege	5060	vssvc.exe
Token: SeRestorePrivilege	5060	vssvc.exe
Token: SeAuditPrivilege	5060	vssvc.exe
Token: SeBackupPrivilege	4496	wbengine.exe
Token: SeRestorePrivilege	4496	wbengine.exe
Token: SeSecurityPrivilege	4496	wbengine.exe
Token: 33	5040	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5040	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5040	SearchIndexer.exe
Token: SeDebugPrivilege	3352	alg.exe
Token: SeDebugPrivilege	3352	alg.exe
Token: SeDebugPrivilege	3352	alg.exe
Token: SeDebugPrivilege	3640	DiagnosticsHub.StandardCollector.Service.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5040 wrote to memory of 2024	5040	SearchIndexer.exe	105
PID 5040 wrote to memory of 4492	5040	SearchIndexer.exe	106
PID 5040 wrote to memory of 1704	5040	SearchIndexer.exe	107

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-05-31_31915f5676a54889c304571d8f8276f9_icedid_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-31_31915f5676a54889c304571d8f8276f9_icedid_njrat.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3680

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3352

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3640

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:1788

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2208

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2488

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2252

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2436

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:5016

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3372

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4720

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3208

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:236

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2360

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:944

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2592

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1016

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4036

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:2688

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1648

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:2968

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5060

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4496

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:2232

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5040
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2024
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2820 2812 924 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4492
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2848 2844 924 {85EE815A-7738-4808-A14A-3AD87E32A3BF}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1704

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 d8dfcf2e76a36bb1c7eae891d17faa0dce6292369a59e9debeeda56fa4adb219
MD5 ba83b6c502ef9ffe6b7ec04a5ce3c209
SHA1 62aaa52748f42865a94cd85c97924bbc299223c0
SHA512 f160fb00c38294e840b75a2daaf9d9acebc49d04d919c188ec382bd2b968d0c1b5493cddceb79e04d4ea8f7d8a6fe9095419ca7918ae353dbf6731c566eea0e0
SSDEEP 49152:/b+632BuPkFKRrdE6ohdstBhuXjfS4LWxnKBQIC+0uak:93q6mjBZBQIl0uak
TLSH
T178D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 73d341547f635af6798c4855a24662e06c4f73a1bdcd363c5f83a883650ea439
MD5 480441e170e70b9493f6050ee7f4c1d1
SHA1 d7f7e7b8b37b4d50a3beba56db1180b4d57d5424
SHA512 b1dd5d48b195f68d68eee19a4e3e2be3b57547907e01c8947455c90cc493a3fd47af73f5c89e285aa06fdd3cfcd754097ccc2ca65e59fbddd9b395044c0ddd18
SSDEEP 12288:h1XLsswWkxy2lRq2czACnwhU2QJQXCKReD/9QZPdAraZsyhdD4uJ+qBDGzuU:PXYfDtczAUwhBQJQXCr/C1eGrd4xqxy
TLSH
T12C85012977E405F9ED6B8239C9A18412E6337C9543A0E7DB03E499761F233C82E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 c9c0d5204f5d32c140fede57c8a509444d94beed114112fb359eea099106191a
MD5 cf5164045c5c4eb147d825093dcc87a3
SHA1 7a750df2353b3e99d3cb2bcc1ac29cd56f042ad2
SHA512 5ac24b783f7c7a9e68bb9ea491579c7035a933f6a260e8fe08790558b15c034b417e4c32ae6ad2c5a1d43855cc2e212c45e46812402600395e43b748d2a17c68
SSDEEP 24576:10Le5ji0hmxvrMFwhBQJQXCr/C1eGrd4xqxy:1Pji0AV/BQIC+0uak
TLSH
T1F4A5AE16F6748371D073C0B9C5D2A68AE97230865B308ACB4286D77C7F677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 d73b5af83b83df8691a52d6e104d03bf5e3d5c469f6d06c5eb61302f6ef94027
MD5 405b0fd1ec110c9c557e81b942a536a3
SHA1 d0f01204df2acee896170dbb16ff4b1e46febdd9
SHA512 3d49f76a41393bbc3271b566b0d177d5856dfa1d2b2e6d0eaeba03e0541ddac3b99235e257f2a22c968194626bd673820707d301af347ff08c6d4f5b3741f438
SSDEEP 24576:7a7/ezSC6vUyD/aqgrvWj6q8wyu7whBQJQXCr/C1eGrd4xqxy:W/ezSC6vUzPv+HjyTBQIC+0uak
TLSH
T1D7756C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 8ff67e0ed368846eb84a416e31fdcd26b72a71b59ba6a5cbfd0f543ce105d33d
MD5 82256be76d40f5e375665ea70047b05a
SHA1 0dc943da59ab5a903d7a9c233967bd42fea03f5b
SHA512 672491bfb1ddd0d9a88620fc3f374a7ba18150c66cc9f647853573b9cb29a7fa2271c87cfa3610a5d343de005fb8c9af37849e5d3e75bb587af7ea40781f6ccc
SSDEEP 24576:0VbqPb88hv/l+BwwhBQJQXCr/C1eGrd4xqxy:0VO88hXl+fBQIC+0uak
TLSH
T1A7559E66F6748331D073C0BAC5D2AA9AEE3234424B318ACB1246D76C3E677D6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.5MB
SHA256 3b023875f6cdcfd8cacd6a27116219f1ae532f8f3d21631539e9885a09e9479f
MD5 65868b483dce800cf811b4662d673ab8
SHA1 82cf8d0b957f0e56b7fed5130567df0eaf7c2b4a
SHA512 b0943409e94cdc2c797b432abe6b9c145b8de7b38cc51c06bf89c2876a25697577efb2db8c6436c5bece90ef78f4a8172fc95c66b28c4f8861077aaaa8dc74b8
SSDEEP 12288:WUFnwhU2QJQXCKReD/9QZPdAraZsyhdD4uJ+qBDGzuU:WUhwhBQJQXCr/C1eGrd4xqxy
TLSH
T1B66523C75E79A2D6FBBE433233A038A672736C9CC4D55B705A7475FA95FC280B210622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 afd56ad0e422809cb5da947353a0ca47a2d2df216494d74f6f6851bf98a391ac
MD5 695f063bb6536faf5a33b155bd885f15
SHA1 fd3542c40e30f3d586bcb24939496667a63daf5e
SHA512 20f3a30acee19fb6d089cc89a8d35f92ca4f1c3ab530cd09a91efa968f390b2b06d1c0b93af1af0a0b24a8dead478658ae8748c3184d8b4df8c25b2d29346f31
SSDEEP 12288:VeBNUbTVO86UmnwhU2QJQXCKReD/9QZPdAraZsyhdD4uJ+qBDGzuU:VJIUowhBQJQXCr/C1eGrd4xqxy
TLSH
T1D885CF7BAE28FCD2C27E8DB957918640E77278704B62A3CBD174820EDE235D05E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 48d3fd08bf8add15e531af3e668e8cba20438825cf5c51230d38130773c22c43
MD5 1f7bc638bbedfc07c39fd4e19ef42ce7
SHA1 89cc57357ef49298099078e570e0c109a8ec4174
SHA512 92035ba226d266f8d3566a08f4e224b4b6c20d2f1922fb27edb4d57185b3ee853c76c9bb81cfab72adbfd0c86fcbf0c3d7d2d5aeab61fc567856fea343cdb26f
SSDEEP 49152:VQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THn:VQvGAdlCEL8c/WRNw5CgBQIl0uak
TLSH
T12F267C656BF880F5E1B7E138897A85B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 d1bc1b638e0fcfd1b7b284663ac86b3ad6ca4999336786d4776f1f7377db2389
MD5 4bd0f2c752bbf86ac4e9f6defcadca51
SHA1 ebf04b4503f56a75ec100d3645278215883ab078
SHA512 0c054f8dea691bb1e43501743e6202ee2e144ed83de5644f921c5a88124afeae40770ba2aca05bd87f11f75615f006819ee685f0c9f16b2edc927bc17c9c20d9
SSDEEP 12288:+AwSfxL/2Dc3YDLLmt0LDQewsAjInwhU2QJQXCKReD/9QZPdAraZsyhdD4uJ+qB2:jdewsAjOwhBQJQXCr/C1eGrd4xqxy
TLSH
T12185E031FE74E036C7BF0DB21B35D716243D79604B911AC3E3A88A9E59742D22376A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 8f2b94a98040fff155e13de48e4e35ad6745c499cb03e2787727cfac1d0407d4
MD5 4134e6cd5df9ada84df991824cb1db24
SHA1 de93836d123124d178f76cd66e4d390170140786
SHA512 0e78d58c20a0904bf64a0971333fdac1f1b655845ee3e8e1f49ca00cd2f05c6708ad6206a24ec69bd816bc821c13f63b843d7fc79e9fbaa3094a23bba4d2761b
SSDEEP 196608:EUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHRreu:EUEtQevvqc2W1cpV20I32R6u
TLSH
T1DC474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 2f5ef763ee48a99e91510e99bb67db6fdc61981d67d6a52d5e57f0b016c4d42a
MD5 0836dd9ddb04061200a70fb94a626519
SHA1 f71d0ad7f446f7ce48415dee61b489ed072299c8
SHA512 df4214e60fc6122e71ca9049c5063dcc1905962dc529e5fa1cc6180d3d71ab0518fc76442df528c22ff35569e7a86739799147c94723d7f21f3924075f9e4cc9
SSDEEP 49152:kCbRquA/m2yL5zifFiV+XenmE3/zvBQIC+0uak:toqHVjnmUBQIl0uak
TLSH
T1EDD58D0976B8C2E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 579930760e7eddaaacb6d029a7c8803ed18c6433beaff0724368282249e32027
MD5 6bfce4481dfdde84cd09f6b33d72e247
SHA1 d7dffc4299ee32c0f86b1bceba1e00ec907af0e2
SHA512 d313698935e2da845e2002d2137952c71464f7edd7d94ede0b23fc949c23da3a734727fd80a2683b92c860b01c5f9b61dcf3f86976ffa6c93e247cc9b4c21446
SSDEEP 24576:OAhGL6IFoiwtA5l7S53/whBQJQXCr/C1eGrd4xqxy:OAM5Foiq5kBQIC+0uak
TLSH
T16A35AD81EBF951D4F5B39B7899B69171EA76BCA95E31C20F2160D11F0E33A40AD24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 9840877ad33effdcf27a9cff2e73c3ac11401e7f81b67d40ebd254dbd5dd93e2
MD5 153a7dc0d86c91550225378da35a3119
SHA1 96a5e4a8dc07237fd3e5670d5b11855833349017
SHA512 a807705a392ff7562b3520161ac715c2be691e11ac8110e6dd98205daaa4962f230253093b53ec8fd566dfe5a2776abf52a00a84253942f0046cb04e19ddb198
SSDEEP 12288:Lmw5HEjsChNGBFgl0WDm+CrnwhU2QJQXCKReD/9QZPdAraZsyhdD4uJ+qBDGzuU:KwuPOWSwhBQJQXCr/C1eGrd4xqxy
TLSH
T1CE85F14637A418F9EAA7823986978536F3F3BC052A61DB1F0760C65B5F373507E29B20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 2fc5ebcc919295f2e302f369f4a8ebb21b4c84416909e25fc5c054fb0662603b
MD5 870c4f08c9cd69b642a9d52779c40c8b
SHA1 6d1b897c97995bf8a98923d4f6a5b89873d05097
SHA512 20bf7ed70368829dd73cf6672f2cd4033432868b5adbda8384c69261621b95d8b5f5477d741ce8e1a49c68efb23dc7dd7334e95677588858421f9b37c2fafe0e
SSDEEP 12288:EYZ1IyYnwhU2QJQXCKReD/9QZPdAraZsyhdD4uJ+qBDGzuU:rZu9whBQJQXCr/C1eGrd4xqxy
TLSH
T1C675128A37A871F6E3A783399AE01946E3727C5A437543CF166442AA5F767C03E34732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 8a4028a604679d8b30159c109f75fd093b8dc96825f3aa719f9ecbdb6f0a2f6f
MD5 f31729da54b38f4dafdf0a84f332eb22
SHA1 ee9ba419dd7f9cf44354f619d0cbcac657457cc9
SHA512 adf948d9899be023d6109cfff37fcf09119c8fa793feaa66039e5146f68a40e22131c75342984c46f2a9fb4828c93763a3b79e8c477242ca696c556494402a74
SSDEEP 98304:OQRQyi36YOcPDLvw2gAf+PN3VBQIl0uak:VQyiKanX+PNHreu
TLSH
T1FC667C43F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 c6cf5464a5a80404a6784678154cf0ea161d65c0a786ad81039cf744dddfcd0a
MD5 499de252103ec5d10b2c945d4d85ab5d
SHA1 a6dbe49d4739ead63bb26d09ad2489b972e05b29
SHA512 72f5c96bfdd4307803bdb2f6bb8e0cd4289713d1aba70918ce4b86cf824557862e490e72939af973ad87137f3b6555cc5da92e43f5cbf9ef02df2ec530fd3022
SSDEEP 98304:+QRQyi36YOcPDLvw2gAf+PN3VBQIl0uak:lQyiKanX+PNHreu
TLSH
T1B3667C43F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 d75fe202cbe66975a305310ba88fbbcd2ece1b3f544e92157858eaf32709a438
MD5 d930cca4e0cdd9cfb57c55d48db2cfa6
SHA1 c76d7ba53aa6d95cc4fd8e9180d6d0e3920889fc
SHA512 9d9e0f13628294b8da238906f6fae87dc63dc187a1ab9ac4a52ecec317c5d7cc0230d9388dfa9065f9746bbdb4eb4b0e641ca1ea7bf4be9d4de3bd0d96a9433e
SSDEEP 24576:qwvLof6SRQ+rn/fDboqxN1nnh6v7DaHGTNHu7PNU3/5W/ohL0twhBQJQXCr/C1ep:E68Qg55nhkeWu7PNU3//BQIC+0uak
TLSH
T182B55933B2F600A9C44DD1769F4A873196E27C758FE0E3DB851172161BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 3640c3e04ed0e022a09d9d3bca424053490db51debbb4be1a6a09aa63968d0f4
MD5 b1c5bf65ead4a201b8509910823b44a2
SHA1 ef78444c4e5d9fb77279e14b6151b188c6001bf1
SHA512 a7697e20cf270705012d3a215b81a09246572c7eecb66c8cb5b304bb58dc38b7fdca4d981cabfab6a2daa74ada3490b974e6ab2caa87579faa4c30645d3d09c8
SSDEEP 98304:vy5112gYy5azzVvU69nLKnhZ+BQIl0uak:iLIHRWhQreu
TLSH
T11D167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 d042f122d88742bd9b15226eba3360e06c264722f621c823534eead85db49147
MD5 c86b1247fc198d84f47323bac8756b7f
SHA1 f4c9aab94568d9bf480b629670fe3a8c990c6c26
SHA512 88299e3d34028a511a96f91cd810fbd72bf78cde7fc66f6d85630d365258b3dcc1e400409ab516fd21003138f18fcfcb211faad4ebb5f2bd072c1261d4bcb907
SSDEEP 49152:zB+taZ3usBWOBr4tEGa0bqx0z+n217aau1gltBQIC+0uak:Fu6JmIxd2dtBQIl0uak
TLSH
T18CD59D13F1D901E8D06ED178974A9233FA62BC490B35B6EF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 6419d9e3154bb09988523e9a9f5d7c2bfdf5049494cf67f3af15664550f2e306
MD5 923ecec90bbcdcd19dfe43ea6dc3b91c
SHA1 9cfcba74cad156124b254a1a5b616ebdc2e78fb3
SHA512 6ffdd9646dec2696cfa8d58c4aad6e522b65cbd0d3c3127ffeeecf86d59c4b403747db98ffe084cdfebd596681862f852892b8b02e8d82f901e7e8dafe9d71bd
SSDEEP 49152:g1hpsNoJpF1A67U44CwH7R4xhBQIC+0uak:gmifPqRUBQIl0uak
TLSH
T1C7B5AE13F29901E8D06EC17887569632EA72BC450B34B6DF0A90B7961F7BBE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 f3ea258afaa4f2f9a613539f595f0d00b5d25e00104b16a649181826e52c8a9c
MD5 119c4e5ac1850bda254d6893d868740a
SHA1 367bfa487725157d0c872f576fa829562a998090
SHA512 c83117cc7b7129ee03c33127997ff3d250d56d118e7ec0057b5274b610e706d27c87f8a81f72b4cd562e0bae772309b79bb0533670c9fe173b1968cfaa8ec46f
SSDEEP 49152:gSuZQIY0Be2KkRVtOnks6NMHqaBQIC+0uak:65dKqi61aBQIl0uak
TLSH
T1A3C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 d674ae735fef96b2ada72ca4bbb2378276c63488070578678438263c1b2f5b3f
MD5 508c27a55d1219c1e354edea34fda9c7
SHA1 d19a24458dae67a403e8744536d32915f8d5d3c3
SHA512 bffee8d983d3a420d9fa4845f296f5e26df2bb2b511a3631199caf3bfed857d8bb207680598f8e287502bd4fbfc3718bf1739e14c2b4e4b54f0ea99392d983d0
SSDEEP 49152:FhtSn8EApI0figjgiDn0AP5w9BQIC+0uak:0X2iWphIBQIl0uak
TLSH
T1F595BE13F2D901E8D05EC174C7568632EA62BC150B35AAEF0A90B7561F7BBE46B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.5MB
SHA256 2991f686c18ed88998ee5d7e0d7e1cc80bf9ea26fb4cdd9675b798f86b7bb0b9
MD5 896f394d242a936b3a4522c39524e712
SHA1 a370ecf13c5c66642100b288e2b25107cae23aa9
SHA512 d73e452c1a64551840d99678cdc066b466b23cb3a2c1105443ef6dac160acc9611502ac97e9071dcc1a53c114041f5281434c97484bf6f02283ac8db7d219baa
SSDEEP 12288:YtnwhU2QJQXCKReD/9QZPdAraZsyhdD4uJ+qBDGzuU:YZwhBQJQXCr/C1eGrd4xqxy
TLSH
T1D26523C76D7992D7EB6E837263A038E6B2767C9DC4D657712B6C50769BE83C03310A20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.5MB
SHA256 99ab2e06f7564be55d752bdecf06fcc50dc2eb4d189dba2ba527d732da3f3cc3
MD5 594fe818f599f97ef3d33f0b04fa1da8
SHA1 0bb0b9ea151a238463bca4796ad62eecd59efd5d
SHA512 7523ef82a4fb1478548ca205cb95b4eb092a9ea45b5ba72d83ca8c39aa42a0f9a3de7dee2e82a39a9bb0be8c8692633470fbd4728b3cf807ccb9f3a526cba2ab
SSDEEP 12288:BUnwhU2QJQXCKReD/9QZPdAraZsyhdD4uJ+qBDGzuU:B6whBQJQXCr/C1eGrd4xqxy
TLSH
T1286523C76D7992D7EB6E837223A038E6B2767C9EC4D657B12B6C507697E83C03310921
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.5MB
SHA256 3e4270e6147e79e39d61dac7d72b5b33dd1bfbf80b9602c488d53e813071b344
MD5 49237dc98976fbc391d5d4b4139d753d
SHA1 6d1b61369b4bab484750ffc825514edc08375563
SHA512 0604e7ce923cea7152ca73596fc8ae258022b7de031cf04f28a98d0ade3a40f706ce605e484c2e58c13c1cb638a3021bc077015f0a0ea68b8c9daa94286a4bcc
SSDEEP 12288:6OnwhU2QJQXCKReD/9QZPdAraZsyhdD4uJ+qBDGzuU:6gwhBQJQXCr/C1eGrd4xqxy
TLSH
T1C76523C76D7992C7E76E837223A038E6B1767C9EC4D657B12BAC50769BE83C03310920
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 89521318f9781e1a693bc0fa4547fa941a26625cc8fabec4eef8ea3615194c8f
MD5 001a27e5560468dd98b87ca1a5aab78d
SHA1 434809061a94bb5c8906b8d4e0270ee5ebd4bade
SHA512 024d779e530615a16ac98ca854dc49490a2bae677db9c78b4d5a88451d53d2e65e9e521aa97776c744f7d77e43e00df5f01128f7180c4b8a3410aa882eecd12d
SSDEEP 12288:kVvnwhU2QJQXCKReD/9QZPdAraZsyhdD4uJ+qBDGzuU:cwhBQJQXCr/C1eGrd4xqxy
TLSH
T17A6523C72B7952C6EB7AC37197A024A6F2B2BCDDC5A257A75B5404A64EF43C03630F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.5MB
SHA256 092d7925fe8dc7ac78d88f02c874dfc98d5f63609b44c8712f97dda669ad1d69
MD5 0d4fdbbd58bc7db323f1eec95ecd1f05
SHA1 3a70bebf6a95033b823829004e8ddb719f40d03e
SHA512 fcfec8ff117d6fe96c1fb3eb0989e9ffe635b370209c08bcdf41d9cbac8ddacdc8a1ea5aec57edcb496d721d68ef499e74107382d4c9bfb738a1c86ecb54d5ba
SSDEEP 12288:WnnwhU2QJQXCKReD/9QZPdAraZsyhdD4uJ+qBDGzuU:WnwhBQJQXCr/C1eGrd4xqxy
TLSH
T1746523C76D7992D7E76E837263A028E6B1767C9EC4D657B12B6C50769BE83C03320930
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.5MB
SHA256 6cef9c00bc17a29ad14978bdc83e568d2a7c531002260038d9d74d54dcbf222c
MD5 f59774176ee2b93639ac4fd81683b05c
SHA1 b6023a849d488a43bbed38621b58d7bb4f6fc3aa
SHA512 def1d21da34047f3d0e2a886674065eb01849452aabbb2a51de39f5bdb17a2a4f7a4c16b267e3ca2ab54dedfed1aa094fdf4ed38864464a7024ab45aa9871ea9
SSDEEP 12288:iQnwhU2QJQXCKReD/9QZPdAraZsyhdD4uJ+qBDGzuU:iGwhBQJQXCr/C1eGrd4xqxy
TLSH
T1D46523C76D7992D7EB6E837223A038E6B2767C9EC4D657B12B6C507697E83803310931
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.5MB
SHA256 93158eabcdca17576d9626a2c532577c4d874158f3b99bf320674f744e6485c7
MD5 be0d73649a8dc52fb146bf89fdfd70fd
SHA1 106414079157d6f372bd5bdfcfd9c176c2ffdb3a
SHA512 83ca89e22eb23e6d90674c1fba9e39da47ae89f9ddc653d25abd90362d27c1b15f3529fb667730562841a2ae7e1f4b925494ca49c1414b94a8744d38c0dbeb7c
SSDEEP 12288:usnwhU2QJQXCKReD/9QZPdAraZsyhdD4uJ+qBDGzuU:uCwhBQJQXCr/C1eGrd4xqxy
TLSH
T1436523C76D7992D7EB6E837223A038E6B2767C9DC4D657712B6C90B697E82803310931
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 766508f0a948e509a7e7e25449168e6e0c8893151b642b106e47e2500200ebb6
MD5 9ab69d3bb66f600c7ce04597f4377cce
SHA1 ee2ac5564238d445ca11b34e0b7a744d18f7d1fa
SHA512 97a00e0a662d41445bf8544df9d0e901ec6bd1ff39d206bb84312cfe8600c2533b568889cbffa5a197b8253d2a38918aa91f16ba6217bf19abfe469ab2fd238b
SSDEEP 12288:JiZwbpzzFEoS2cPvy0nwhU2QJQXCKReD/9QZPdAraZsyhdD4uJ+qBDGzuU:MZMtzFVSOawhBQJQXCr/C1eGrd4xqxy
TLSH
T1AB850195B3A018F8ED67823EC9615906E2B27C5A4AA0C61F03F836675F733902D3DF65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.5MB
SHA256 a0099e7848ed2066d55d4219e447fa46276a80d814e90de682eb58d135424f8b
MD5 b5b5f77270b3afc0f4c95f0beb0ec02e
SHA1 b385dd36ca7bf5e8e8b6a4c7da891c915a3a0c0a
SHA512 4e87a5cabf55e89a6a679a3523a4636eebb2523fcc996ddd7e85c173b3ab622acc0ef8a7baa6db3824196f94347dea59a50943edf357c90c9ec0565cc40634f7
SSDEEP 12288:9RnwhU2QJQXCKReD/9QZPdAraZsyhdD4uJ+qBDGzuU:9NwhBQJQXCr/C1eGrd4xqxy
TLSH
T1106523CB6D7992D7FB6E837223A038E6B1767C9EC4D657B12B6C507697E82803310931
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.5MB
SHA256 ed4bdf558baf75cc1dd9d9a9f260d976aa7eac2456c09a479980553da671a42f
MD5 169332654957b0c4c8d0662fbc90599c
SHA1 0417def96e03826e78047b55cd539b0fac3c1768
SHA512 25da47db337f7846d4c65c00a77be801090dfa0792c58057b71d38e135babf1af62dc1dda38df83daa62a322653f7c9dd71ec17117d1c13768a03b4e258039ff
SSDEEP 12288:2VnwhU2QJQXCKReD/9QZPdAraZsyhdD4uJ+qBDGzuU:2xwhBQJQXCr/C1eGrd4xqxy
TLSH
T1C76523C76D7992D7EB6E837223A038E6B2767C9EC4D657B12B6C507697E83803310931
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 4f444f2fb3a2c37880967e2d87232a1d5604b9b1b62931870c0ccb3ac2340f9a
MD5 e5f2fae38f08b87f7305242267f4e6ed
SHA1 d94cc34c32c1ada4777f48c1122571b343f2d5a7
SHA512 6f0d89a29ec9dd67ec5442863bbd2dc7a32b288ac5b77431afede151101c4384edb5f14d4606f1ac5b748722caa235c58beef6818484e18b7a9dc2e48cdc3528
SSDEEP 12288:5yPz5L8YnwhU2QJQXCKReD/9QZPdAraZsyhdD4uJ+qBDGzuU:4zyewhBQJQXCr/C1eGrd4xqxy
TLSH
T16775124777A530F9D27B823589A11942F372BC3647608BAF17A406762F673D06E3AB30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.5MB
SHA256 6524d403a4522e58f5522900c7e7af3189559c567d66fb39479d3b46c7438e96
MD5 4b032215d1e6fe603bc8a220c0063e98
SHA1 0ccd8b6c806fde1e02d08c958a1031aba082f587
SHA512 f33e8bbab0d5a9e05ad794f29148f80f4a5e6bff6472eb096dd4b7f75ac0baae80e67feeaf10e841b1196ca99322f62599b7531bd9a4dd6ac43bff71235a08de
SSDEEP 12288:mRnwhU2QJQXCKReD/9QZPdAraZsyhdD4uJ+qBDGzuU:mNwhBQJQXCr/C1eGrd4xqxy
TLSH
T1E76523C76D7992D7FB6E837223A038E6B1767C9EC4D657B12B6C507697E82803310931
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.5MB
SHA256 db8dfe574f4419439ac95200fff047202cb062894f1c506d52616f66d248004c
MD5 bf274bb34ff5de2cde22fdd7f39df51d
SHA1 5658c987a762b6b5185ef29b064ca0979f3c403d
SHA512 58202f37df119474185ae9d293f508bd8dfe46b3a9f7820947d31307805b86df0133d646ae4d55ef0f14d2b4d48924970423792b229f6b4b87f319a21ff53254
SSDEEP 12288:QRnwhU2QJQXCKReD/9QZPdAraZsyhdD4uJ+qBDGzuU:QNwhBQJQXCr/C1eGrd4xqxy
TLSH
T14B6523C76D7992D7FB6E837223A038E6B1767C9EC4D657B12B6C50769BE82803310931
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 7ae4cfcd718a25d7349c1a5922386a711fc8bf9af3a36e502806b6893c2f7933
MD5 e8b2d9dcb577537e374555ec7291d91b
SHA1 65004c471a5c35cdb395c0f7ae5e6d6805f5839e
SHA512 8ac6def994dd474e191ddc21fd4871bd6ac13e49661e9d698cfbb2ae8b8c35f76cb9e1596e85a03ec405ccbfeca985c96502ce878eb839bc63289c403c9493af
SSDEEP 12288:hyPz5L8YnwhU2QJQXCKReD/9QZPdAraZsyhdD4uJ+qBDGzuU:wzyewhBQJQXCr/C1eGrd4xqxy
TLSH
T1C475124777A531F9D27B823589A11942F372BC3647608BAF17A406762F673D06E3AB30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 f3429effbabf01dad33deee3c39b33f25b3f6c36f0f249b934725f1c9149ed0a
MD5 f09ae159634619222a6b72f9b1a6fa50
SHA1 e121ca69e3c868a223401c87deadc150d9ea25bf
SHA512 e95611d537dbb43f087ce7a689bdf746afa28dab2dd54d6162379023190da7a0232cfe6deeacb35ed97b9831aa5e3f35eea827d6504238ca74c8c8420c9eb052
SSDEEP 24576:yCUApvPDv4Ex1hfe7i8WVq2lIGU8lrtGUJLPuwvAcwhBQJQXCr/C1eGrd4xqxy:yCUAPTY+8Wg2lIL8lrIUJLWwcBQIC+02
TLSH
T14365BE1EA3EC0896D4BB81358A518A16FB327C2E1B22D6CF1160C33D6F67AD55E35F06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 9b2f2b5821b3fb0d748ad424bec1b7431480e4c871a4b28108352ce7b0c4760c
MD5 c234a0b5d524ec9252d9ee49c867180b
SHA1 80a0a0c5174b8c1f274caa36b4fe54406ffca85a
SHA512 301c756858703ed7c628bfe26782d1cbfe848125c30d605e92df3d1ec5d210592d2b320ef40528d84e1289453274c6df10d126d891ee174c8e3e474377726645
SSDEEP 12288:xTsfBnwhU2QJQXCKReD/9QZPdAraZsyhdD4uJ+qBDGzuU:o9whBQJQXCr/C1eGrd4xqxy
TLSH
T15275F14AD2A842E9D26E9235C7511A41B3337C6983E1D3CB17D0F57E1FB92806EE9B13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.5MB
SHA256 232b70fc118fc1ecabed5e9b5965a60f438dd090adc2eda5a69b4a02c40ac0b1
MD5 eddb69efce480d7a0ce8489a40c3c16b
SHA1 97885c5256790ab9d38c9587e9105c49c77c32b3
SHA512 443a0e9324ee11c4ef7b960d5e9178770b9be084a75c8bcc338c34c6eb21b2d51d84a69cf849a43d29a0aa99384bfe49b5271de99798705808d30787ae8d6fca
SSDEEP 12288:wunwhU2QJQXCKReD/9QZPdAraZsyhdD4uJ+qBDGzuU:wAwhBQJQXCr/C1eGrd4xqxy
TLSH
T1F36523C75B7CD2C6FBBE433113A02475723A7CACCB9596E37A5851A696B42C07A30B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 a6589925ac833456d65098644a5758083343ddbe3320acb3abef2605bc3b33e3
MD5 ce6835e54dc4f9d9890d0cc9b2607d6e
SHA1 84b5e841dd5c815a72488429b5a426c228b75518
SHA512 e20d275b3444a06754ed475eda57fb68c9dde4a84e11a2b3f9503cbcc3601ebd1f52ab7b424378689fe23a30ffe49df3c89b90ab5ac45f3f13e1f5099c8a90b9
SSDEEP 24576:J8RMyNoSFw1d+rC4vrmRcGPiQEaiPnMRTCuwhBQJQXCr/C1eGrd4xqxy:WRZwQCyiHiQEaiPnMCBQIC+0uak
TLSH
T17985B01E63DC42A5E4BAD278CDA74407E6B27816473197CF1290C27D1F27EE49E3AB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.5MB
SHA256 7ed862af8e88547a5dc8a4ac7ea268b5c0bda0d89bf8e0bc0a9a1a7d27652211
MD5 e60134e62a15db2c17b09ed2e8457d44
SHA1 79c4257ed57605cb1997610cad0b36464a72700f
SHA512 daae654b69776e358461c94d6449eab9dbaad535de25996168a7ffa231d03de0c43f37e9145d601325827729cb529efebeedc273af1277fd572514c6cc3ba1ff
SSDEEP 12288:ibxA1U7K+nwhU2QJQXCKReD/9QZPdAraZsyhdD4uJ+qBDGzuU:ibxA1UGQwhBQJQXCr/C1eGrd4xqxy
TLSH
T10675125E26AC20E5F67AC2398AD14006E332BC6A476193EF25D4827E4F3ABD47D31F51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 1ad08da85285d0267f3a93378eed5922e2960c3c563b008e3776805d66b625f8
MD5 ad055701c63133ec22b537d981ebcf18
SHA1 dd04d75f82352793c39d77b71a3a41978e2f7c9d
SHA512 36f7ab77523544de6398ef8a48d5c8f8eae75fed471bc53b4449c8d8457452d4f6738e4a52a48f6f09d14dd1a2c0b0ac4ccbd2ffacc3d6ec5cbca4d8ad56a3c4
SSDEEP 24576:yjsmP0yHaqrVqHra44KDzMsrnvwhBQJQXCr/C1eGrd4xqxy:yjRP0yHfVqzlAsrnkBQIC+0uak
TLSH
T1A645AF2EF2B910F9D4AAC236454107B5BB71782D1F219AC70170C635AF0AEE89F35F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.5MB
SHA256 2c7accae769e743899d3702a8ed7141cd2c1cd40e3bbf915accb093e44234896
MD5 75edbceae410d46da25a68a85bdf139a
SHA1 078ac4fc22c07a8404ed713393ee21944cd0b407
SHA512 c741617a68f0b800f7b79207ad7e6f5591902a95e64ed2c2d8694a7534cbb38030763036d5ce9792e4c0df142750d38a06038d5456b3bd8b70e485ace218bd03
SSDEEP 12288:jwnwhU2QJQXCKReD/9QZPdAraZsyhdD4uJ+qBDGzuU:jmwhBQJQXCr/C1eGrd4xqxy
TLSH
T1546523C76A79D2C6EB7E8372139028A672327D9DC5D557F3296861B697EC3C03330A21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 d0a43ade11d28d13add9db21080dcd2b039edd7856b274aa5f428311a5026035
MD5 cc26da2783df9f9c4914c682f2eb63a3
SHA1 f8479d0eb0b062a28e5a44069eca94430f077cff
SHA512 5c0ea3ea4e5833f5f0e5cf20bc0ee7fe57d94629bdf0fae18d68eeb83dd49fb416e70dc188f6b6870c7de7b8efc4bf9009b2fb241f2519d86e8baafde4615931
SSDEEP 12288:gObuA4LWO+vAYFTCnwhU2QJQXCKReD/9QZPdAraZsyhdD4uJ+qBDGzuU:d+LBUTUwhBQJQXCr/C1eGrd4xqxy
TLSH
T17B95F145F7A400F9E97BC23CC9A29916E272789D0764E7DF03A84A661F533E15E3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 7c8e4546908e873c3ab256388e090e4c7401a4da6a948840c127689ed5187328
MD5 e21448c45ab2a40bfff58ab21d4504a6
SHA1 2a4c6918b9fb2b4105e24a842cc0807745ebe566
SHA512 f48432ebbbdea8b16e7f36288475a11d6fc587489d7d48e6d99a4f043afd95b8132c5a9e67ecb3a91ad16515c2659659801a423452295c62a86f5443ef4c26f3
SSDEEP 12288:T70VmdIYNvUyBpdnwhU2QJQXCKReD/9QZPdAraZsyhdD4uJ+qBDGzuU:cpYNHDwhBQJQXCr/C1eGrd4xqxy
TLSH
T1DA85F11F66AD09E5E67B91798AC28509F27378A6035193DF05F0C2BA0F17EE87D39B01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 2c327a85b012bc9c0ff2f07b2f0703f03323755df2535d9100e2f86cb168c7f7
MD5 9bbb47f023d2f7c95976e81ff4842fbf
SHA1 4a4c452cbfb6e0893722001eb6651a6a21ed7ba3
SHA512 25bad04b2258c652eca20a60f03898ba23e9b62e76aa14ae26b5ebfa8295db59a29de6852b5f3a14347a836d62028bd9ebcdec2aca8d0978101e22983bd5ec9d
SSDEEP 24576:+nXoJjNYH84VVSNAApoEOW66aspcrcHBjSSKHPWdQwPF3hJ8ssmOc+XLxu+x7uKs:+nXoJJYH84VVS6AmETJas+cHBjSSKHPh
TLSH
T1C965BF9EA2BC04E8D5BBC17DC5C25506F5B278661331CACF026082BA7F17AF56E35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 219223aa14b2e2ae64b5d933f83b1584eb2fd8180dd82675ad5a74876ba26826
MD5 3e336b6ab3a5aee3bd5fa8f4a411427e
SHA1 0a3f0b7aba3c19cbc2e6b0bff2fe6faf755e84e5
SHA512 249a4e0f7bd0c21a81fe3d95c7a2b22d0a2f2d5f69a68a059a2be53770d067d7999734c3c81b29e13973ce0988ed7be405445660fd968017167bbf55d64cc48c
SSDEEP 24576:uv7Xbxd9Tuycf8M/TYlSuxrr2PCBwhBQJQXCr/C1eGrd4xqxy:uDLL9TuJ0M/TYj2PnBQIC+0uak
TLSH
T116858D5EA3EC42D8E47BD6BD85B79046FAB2B855173081CF0291856E1F23BF0593DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.3MB
SHA256 c3b75c43afab0831a42ad42dc627be55c4a4d2313e7b83551ff903a0d57088bd
MD5 82d0c572584716f33a208bee64a9edfa
SHA1 6d4c26dfd2cb42fdb0a8d1c5be31a2fe4352185c
SHA512 ca2d5e9d5744bc9e76aa3926cdd6fe28deee66020f3b41234dab22f1d63faf8bd49c3d99c4e9e9fc0e96477ac6073fe525fa120ac0a36ecca9be4a45ffb42d63
SSDEEP 24576:4egJgpwJOmPOHWAKZ8ZguIGyPsxr5Vin10wUwhBQJQXCr/C1eGrd4xqxy:4ngOJOmPOHk9BQIC+0uak
TLSH
T16E55CF3FB7BC15D5E07EC17D8A928816F6B1782603255ACF05A0827E5F1BEE42E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.8MB
SHA256 17698c680c473c0cda48da56f865cb39801320e40a4b63ea390b77d11fca4da9
MD5 66d60c5fa45cacb0d3638b7f543f3116
SHA1 c905ed4fd39b492073ce91c02a2585fa648bc42c
SHA512 f69112b088cc5f4606dd93f73e520a1327f0b3162e19259400c94d96cb4ec25250aa69787746c51801e4eb02b6a1c0b99816819bc21f53564baa250fc3e7da4c
SSDEEP 24576:vLJnJiTk3R3waE4JrOGwhBQJQXCr/C1eGrd4xqxy:vLJnJK8R304lUBQIC+0uak
TLSH
T13285E16DD2A810E8D4B7C2B4825A2B56FF31387C2B2569CB19B4D5313F12FD0AA79F14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 a2d4cd9422a36bd10ebf15076660c2cb338988fe6df3c14d4bc80e93fd167b49
MD5 90a2be9fe265eb73b6f0402be806ae18
SHA1 fffe9e9c93ba27f6a1a9ed08dc2e8ce1c7095ae8
SHA512 1d0d1efa3638fd1837148d835b5dcf79fa3234bd0ef4e8447cbb82d7c14e5d01edc3cd0966d231da119d8199e3378261602d0ba225882e215dba4a0e8c57de2d
SSDEEP 49152:l9mqCzDScAZmlvTcFg8Ph6jBQIC+0uak:J4BQIl0uak
TLSH
T16B955C05F7EB5298E8B3CAF1C96294159B327C509B34F7EF0A80CA6A1E32BD1D535B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.5MB
SHA256 8f6a8473bff31b36e038b166548b4ae384029aa179f255e3c658dcb784644296
MD5 0b92008c8dbb557f6722f58c614ba5d3
SHA1 1d41890221d66d00fd1df03d755aa343e59fd664
SHA512 7a2f8b9a238e4e7c453bb83d1e3cbfce3795f586f1fe64d5ac9bf01a43307a67e78ab4dddd08a84fe090755025894bc8d409f59742de0fab34ef2898d1b6e25d
SSDEEP 24576:OlYJeXm5jUuEkwhBQJQXCr/C1eGrd4xqxy:OlYJeXmRUuENBQIC+0uak
TLSH
T11175128E3AAC71E5E37E823996A10955F372B4B5434167FF16E0C1BA8F966D03E34E40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.6MB
SHA256 85e7fa3862cf95c6e40981648e6abdbc5a34292b667c320986f67861a9d8d230
MD5 c1aedfbe5f479953b8422f3813ad7546
SHA1 ce03566882be915dc8c829aed5e9da04348dc4f6
SHA512 cc7485e14ecbd2652304f456688a1487901c6f3b8c611626bf46b806a2234bb5df07592f2e4be151acfc86b8b6d09184e25278c78bd069734266a956e84280f1
SSDEEP 12288:4ku6kyfnwhU2QJQXCKReD/9QZPdAraZsyhdD4uJ+qBDGzuU:45tyPwhBQJQXCr/C1eGrd4xqxy
TLSH
T13675124527A8A1D5EBBA43349BA201A1AB35BC248F5197EF15E0E63F6F753C07930F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.5MB
SHA256 abdbe8dfc09c61c98ac27e3f51f6f862588408e3ceef14d14399b73c324ad554
MD5 a82a16ba4555a6bb81d18b1fee661d1a
SHA1 f3c2f19127211585a89ab2040e839857a21cfd99
SHA512 ed54ee7f60d3a33983d1fbd689f9ab3e31d79a633f27d1392b650926b9a1bafa8db5d9f40e767b2a0f90abb1d3f183f100d87a907ff50fb16be828967aef896c
SSDEEP 12288:ePCnwhU2QJQXCKReD/9QZPdAraZsyhdD4uJ+qBDGzuU:qUwhBQJQXCr/C1eGrd4xqxy
TLSH
T1016523CE1A79B2D6EF7A8371136028A672767C7C85D566F725E8D176CBE82C03230E11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 b8c927dbabbd69c7cab4824336f8bbc4ae8d20782c38df290071d0cfd8a5eb35
MD5 6474c1d4db17c1015c8c0e20f4597e03
SHA1 599207b5c7db4825ced9ad091a134c09da394bea
SHA512 774ad28a5c44dc0967082bc61fc87e0b6b424d466488632a79c52b42194774244bdfbe89d426d5747a80b338f738cd7f138c420f181e3c83235ea090d37b8066
SSDEEP 24576:XC+TyQIu93VAumZr7jmdwhBQJQXCr/C1eGrd4xqxy:X/TfIq+Y6BQIC+0uak
TLSH
T13E558D1DA7F919CAE276C675C9A34493E633B872137186CF2044C07D499EEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.6MB
SHA256 95382bad453bd096941e18163e31ff7c88175dbfcda8cd51d13a7b8831c07de2
MD5 4e0612c54ad53515eb9b5b3a92b5e24d
SHA1 2b625cdc09c2092b5884d31dbb8fc4a2773aab69
SHA512 81906a7b6d03013ae7f654f2d7a3272e117fe9a666e346add26f3829f2035ca88ab2edafbd0645dade1c69aa52c2310217f3e4658dd553199ac8e6a51dedb7a0
SSDEEP 12288:XcyrWOstaa3kcsWnwhU2QJQXCKReD/9QZPdAraZsyhdD4uJ+qBDGzuU:uLQikZYwhBQJQXCr/C1eGrd4xqxy
TLSH
T13385F14FB7BE00E5E1ABC23889814152F6B37874475263DF06A0C77A4BA72E97D38B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 fa54ff7c3570f01fdc236e59f642867797b89f4c25cfe01bca81d61554869e25
MD5 4926aeeaa0d72a71fceff68bbf8c2d1e
SHA1 97870f20484f2a0c5964ad668463c6e381faf1db
SHA512 eab97cf9834f4cf427327be5d244b1f6b109165b86c15c45a200bc0151dcab4835515a308ce7a94ddc7990dbf0f4e41dc9d5f1a371c032ef70d43e8aa78931a2
SSDEEP 49152:jpJFwrPpGyqWo6cbT2TZ8maJO35NPHXogsS7Q78ZGAvL9vnF35LWAPEBQIC+0uak:4pC7b4+80GTkrBQIl0uak
TLSH
T168A57C3DE2B810ADD9AAC375C5461665EE71382E3F2015DB01B0C578BF1AEF19A38F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 fe873bc081183f9705a4ab5c0303e1b54fe1ed48a0ec2fbd4694c7de75b90956
MD5 c7b3bc396fc5ed8bf679c28c774fd649
SHA1 1f4cd108640e549679610925555a74e1c00d216b
SHA512 0980f805f09091505bed5c685e36dfa421d0f26627d8c1a31cdfd83359e6f05c2b7339ebb324dc4b7f64dcf0f07269e62c48cb5b5060b10ed3773392f2d9c398
SSDEEP 24576:OSAwJPE1IDAo+4Kt+l4413lUQHwhBQJQXCr/C1eGrd4xqxy:OqPCIo4Kol4jQ8BQIC+0uak
TLSH
T1E055BF2AA7F956E5E17AC7B4D663C611FB727822133163CF5290813E0F16AE85E39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.8MB
SHA256 0f0b3004603c64fa1021547868b9ad61a54bca45741ea83f14086449e5192d8d
MD5 81917ef41a9317c3a3591de9994f602a
SHA1 1e5b21f1c717dab38e219ee416bb4479cc5e1a9b
SHA512 678bc82d4c0c924528e53ca60d428e25489ee90fb084b6dc089f3443a8d657f7921bc5538faf685d148d71fd871d72a063525019f8ff015a36178768beee355c
SSDEEP 24576:OyLXPLcu94tXwhBQJQXCr/C1eGrd4xqxy:Oy7PoZtMBQIC+0uak
TLSH
T16095E02EE66C04E5E57AC27CD2A38906F6723CAD037166CB15A090791F6BFE47939F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StructuredQuerySchema.bin

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin
Size 414KB
SHA256 e67e330837a6b2f6d5f76815e7235a512b54b1c90f2ad62a3e9d142ae6939c8d
MD5 16b9618962f5623ca791a1366eee5708
SHA1 f0d257511952f075b2a0ec7d8e8730c3e464461a
SHA512 18e1d5a105b87fc72df94645685f5a8d3f593df2d3a9b8652b3b4a4ceaf92d3c7a67b0c08847186149dd608428cae8f1b3bc844bc7aacfc9e3219da823ca2fe2
SSDEEP 12288:vMUC7+vlk3n61mSkplXZ5RwmF9n4w/TSD:vXhl6V/i
TLSH
T124945F36BF88CB22C59A15748897C01A2E30A7C49E04CF6B73DC513CFA576685FBA359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.6MB
SHA256 a29b64dbad47275c49694bb2e125ab1137711b43156699df30d3d98b19f115bd
MD5 2bf9ea0cc7018a8b8d651820760c06dd
SHA1 fd48d6dc7c7a0f672c339ea5c8244b98ad532dbb
SHA512 81b91b145ac5e6261d24985f3979441e22109a2b4f797093c77029866838bfbdb1a9e126ad7b0535b0cee07a345f83565e7ed36ac143987e5eaca8951aac4480
SSDEEP 12288:z9lyvj3IkxjbBzGnwhU2QJQXCKReD/9QZPdAraZsyhdD4uJ+qBDGzuU:zWv8qjpIwhBQJQXCr/C1eGrd4xqxy
TLSH
T13D75228E16A460D9F67D8330E2714066A172BC7A03A49AFF35D8D5BB4B747C0B53AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/236-137-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/236-269-0x0000000140000000-0x0000000140178000-memory.dmp

Download

memory/944-158-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/944-152-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/944-271-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/1016-180-0x0000000000DF0000-0x0000000000E50000-memory.dmp

Download

memory/1016-174-0x0000000000DF0000-0x0000000000E50000-memory.dmp

Download

memory/1016-273-0x0000000140000000-0x00000001401E5000-memory.dmp

Download

memory/1648-194-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/1648-205-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/1648-203-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/1648-200-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/2208-39-0x0000000000F00000-0x0000000000F60000-memory.dmp

Download

memory/2208-45-0x0000000000F00000-0x0000000000F60000-memory.dmp

Download

memory/2208-70-0x0000000000F00000-0x0000000000F60000-memory.dmp

Download

memory/2208-38-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/2208-73-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/2232-278-0x0000000140000000-0x00000001401A4000-memory.dmp

Download

memory/2232-510-0x0000000140000000-0x00000001401A4000-memory.dmp

Download

memory/2232-244-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/2252-69-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2252-508-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2252-61-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/2252-67-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/2360-147-0x0000000000680000-0x00000000006E0000-memory.dmp

Download

memory/2360-141-0x0000000000680000-0x00000000006E0000-memory.dmp

Download

memory/2360-507-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/2360-505-0x0000000000680000-0x00000000006E0000-memory.dmp

Download

memory/2360-270-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/2436-81-0x0000000001AB0000-0x0000000001B10000-memory.dmp

Download

memory/2436-265-0x0000000140000000-0x00000001401B8000-memory.dmp

Download

memory/2436-86-0x0000000001AB0000-0x0000000001B10000-memory.dmp

Download

memory/2436-75-0x0000000001AB0000-0x0000000001B10000-memory.dmp

Download

memory/2488-49-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2488-57-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2488-55-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2488-504-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2592-168-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/2592-272-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/2592-162-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/2968-275-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/2968-214-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/2968-208-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/3208-122-0x0000000000900000-0x0000000000967000-memory.dmp

Download

memory/3208-268-0x0000000000400000-0x000000000057A000-memory.dmp

Download

memory/3208-127-0x0000000000900000-0x0000000000967000-memory.dmp

Download

memory/3352-13-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3352-24-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3352-23-0x0000000140000000-0x000000014018C000-memory.dmp

Download

memory/3352-319-0x0000000140000000-0x000000014018C000-memory.dmp

Download

memory/3372-99-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/3372-266-0x0000000140000000-0x00000001401B2000-memory.dmp

Download

memory/3372-105-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/3640-34-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/3640-455-0x0000000140000000-0x000000014018C000-memory.dmp

Download

memory/3640-28-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/3640-27-0x0000000140000000-0x000000014018C000-memory.dmp

Download

memory/3680-9-0x0000000002110000-0x0000000002170000-memory.dmp

Download

memory/3680-8-0x0000000140000000-0x0000000140151000-memory.dmp

Download

memory/3680-461-0x0000000002110000-0x0000000002170000-memory.dmp

Download

memory/3680-0-0x0000000002110000-0x0000000002170000-memory.dmp

Download

memory/3680-470-0x0000000140000000-0x0000000140151000-memory.dmp

Download

memory/3680-60-0x0000000140000000-0x0000000140151000-memory.dmp

Download

memory/4036-184-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/4036-274-0x0000000140000000-0x00000001401C5000-memory.dmp

Download

memory/4036-190-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/4492-525-0x000001D70ACF0000-0x000001D70AD00000-memory.dmp

Download

memory/4492-527-0x000001D70ACF0000-0x000001D70AD00000-memory.dmp

Download

memory/4492-523-0x000001D70ACF0000-0x000001D70AD00000-memory.dmp

Download

memory/4492-520-0x000001D70ACF0000-0x000001D70AD00000-memory.dmp

Download

memory/4492-519-0x000001D70ACF0000-0x000001D70AD00000-memory.dmp

Download

memory/4492-528-0x000001D70ACF0000-0x000001D70AD00000-memory.dmp

Download

memory/4492-521-0x000001D70ACF0000-0x000001D70AD00000-memory.dmp

Download

memory/4492-522-0x000001D70ACF0000-0x000001D70AD00000-memory.dmp

Download

memory/4492-526-0x000001D70ACF0000-0x000001D70AD00000-memory.dmp

Download

memory/4492-524-0x000001D70ACF0000-0x000001D70AD00000-memory.dmp

Download

memory/4492-529-0x000001D70ACF0000-0x000001D70AD00000-memory.dmp

Download

memory/4496-234-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/4496-277-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4496-228-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/4720-115-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/4720-267-0x0000000140000000-0x00000001401AC000-memory.dmp

Download

memory/4720-109-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/5016-94-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5016-88-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5016-280-0x0000000140000000-0x000000014019C000-memory.dmp

Download

memory/5040-515-0x000000000BC90000-0x000000000BC91000-memory.dmp

Download

memory/5040-279-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5040-517-0x000000000BC90000-0x000000000BC98000-memory.dmp

Download

memory/5040-514-0x000000000BCA0000-0x000000000BCA8000-memory.dmp

Download

memory/5040-297-0x0000000001EE0000-0x0000000001EF0000-memory.dmp

Download

memory/5040-511-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5040-255-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/5040-249-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/5040-281-0x0000000001C30000-0x0000000001C40000-memory.dmp

Download

memory/5040-314-0x000000000A520000-0x000000000A528000-memory.dmp

Download

memory/5060-276-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/5060-218-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/5060-224-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/5060-509-0x0000000140000000-0x00000001401F6000-memory.dmp

Download