a737abd3977371ea7fe902316d17081d1f13635913ec34400eaea1b522e140f9

Analysis

max time kernel
149s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
04/06/2026, 00:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-04_18de5fcc1d1dc35040558956276a8ebf_amadey_elex_icedid_smoke-loader_stop.exe
Size 1.5MB
Sample260604-avbc3shs6m
SHA256 a737abd3977371ea7fe902316d17081d1f13635913ec34400eaea1b522e140f9
MD5 18de5fcc1d1dc35040558956276a8ebf
SHA1 e3a5e88eaa5a1298792ea5bcf05a5fa462e251e5
SHA512 1c1d0d94c10096a04213be9c6742a8cc3f881b71a81525b37700286d1def4ecaeaac02952d2f36526df4329661afbd2fa7dd1a217a23d97e70a57df97988a04e
SSDEEP 12288:sEjjq/MkBOlOGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWx:sGiBoOnQ/tbw/2Mkjy6Fr7g0ox
TLSH
T1F275D12176B0CC76E56A35B28813C2B56A7E7E605B31678777A43F3DBD382C2492834D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
1108	alg.exe
1068	DiagnosticsHub.StandardCollector.Service.exe
3380	fxssvc.exe
1056	elevation_service.exe
4548	elevation_service.exe
4520	maintenanceservice.exe
1540	msdtc.exe
1480	OSE.EXE
3496	PerceptionSimulationService.exe
2240	perfhost.exe
2708	locator.exe
236	SensorDataService.exe
1192	snmptrap.exe
3916	spectrum.exe
1972	ssh-agent.exe
1604	TieringEngineService.exe
4408	AgentService.exe
2388	vds.exe
2628	vssvc.exe
2836	wbengine.exe
2380	WmiApSrv.exe
3000	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\e:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe

Drops file in System32 directory 35 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-06-04_18de5fcc1d1dc35040558956276a8ebf_amadey_elex_icedid_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-06-04_18de5fcc1d1dc35040558956276a8ebf_amadey_elex_icedid_smoke-loader_stop.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-06-04_18de5fcc1d1dc35040558956276a8ebf_amadey_elex_icedid_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-06-04_18de5fcc1d1dc35040558956276a8ebf_amadey_elex_icedid_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-06-04_18de5fcc1d1dc35040558956276a8ebf_amadey_elex_icedid_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\d1391cfbfc4568d2.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-06-04_18de5fcc1d1dc35040558956276a8ebf_amadey_elex_icedid_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	spectrum.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-06-04_18de5fcc1d1dc35040558956276a8ebf_amadey_elex_icedid_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-06-04_18de5fcc1d1dc35040558956276a8ebf_amadey_elex_icedid_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-06-04_18de5fcc1d1dc35040558956276a8ebf_amadey_elex_icedid_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-06-04_18de5fcc1d1dc35040558956276a8ebf_amadey_elex_icedid_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-06-04_18de5fcc1d1dc35040558956276a8ebf_amadey_elex_icedid_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-06-04_18de5fcc1d1dc35040558956276a8ebf_amadey_elex_icedid_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-06-04_18de5fcc1d1dc35040558956276a8ebf_amadey_elex_icedid_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-06-04_18de5fcc1d1dc35040558956276a8ebf_amadey_elex_icedid_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-06-04_18de5fcc1d1dc35040558956276a8ebf_amadey_elex_icedid_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-06-04_18de5fcc1d1dc35040558956276a8ebf_amadey_elex_icedid_smoke-loader_stop.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-06-04_18de5fcc1d1dc35040558956276a8ebf_amadey_elex_icedid_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-06-04_18de5fcc1d1dc35040558956276a8ebf_amadey_elex_icedid_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-06-04_18de5fcc1d1dc35040558956276a8ebf_amadey_elex_icedid_smoke-loader_stop.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\{17A6A947-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db	spectrum.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-06-04_18de5fcc1d1dc35040558956276a8ebf_amadey_elex_icedid_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-06-04_18de5fcc1d1dc35040558956276a8ebf_amadey_elex_icedid_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-06-04_18de5fcc1d1dc35040558956276a8ebf_amadey_elex_icedid_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-06-04_18de5fcc1d1dc35040558956276a8ebf_amadey_elex_icedid_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	2026-06-04_18de5fcc1d1dc35040558956276a8ebf_amadey_elex_icedid_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-06-04_18de5fcc1d1dc35040558956276a8ebf_amadey_elex_icedid_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	2026-06-04_18de5fcc1d1dc35040558956276a8ebf_amadey_elex_icedid_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-06-04_18de5fcc1d1dc35040558956276a8ebf_amadey_elex_icedid_smoke-loader_stop.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-06-04_18de5fcc1d1dc35040558956276a8ebf_amadey_elex_icedid_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-06-04_18de5fcc1d1dc35040558956276a8ebf_amadey_elex_icedid_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_180031\javaws.exe	2026-06-04_18de5fcc1d1dc35040558956276a8ebf_amadey_elex_icedid_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-06-04_18de5fcc1d1dc35040558956276a8ebf_amadey_elex_icedid_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	2026-06-04_18de5fcc1d1dc35040558956276a8ebf_amadey_elex_icedid_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-06-04_18de5fcc1d1dc35040558956276a8ebf_amadey_elex_icedid_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-06-04_18de5fcc1d1dc35040558956276a8ebf_amadey_elex_icedid_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-06-04_18de5fcc1d1dc35040558956276a8ebf_amadey_elex_icedid_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	2026-06-04_18de5fcc1d1dc35040558956276a8ebf_amadey_elex_icedid_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-06-04_18de5fcc1d1dc35040558956276a8ebf_amadey_elex_icedid_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-06-04_18de5fcc1d1dc35040558956276a8ebf_amadey_elex_icedid_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-06-04_18de5fcc1d1dc35040558956276a8ebf_amadey_elex_icedid_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	2026-06-04_18de5fcc1d1dc35040558956276a8ebf_amadey_elex_icedid_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-06-04_18de5fcc1d1dc35040558956276a8ebf_amadey_elex_icedid_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-06-04_18de5fcc1d1dc35040558956276a8ebf_amadey_elex_icedid_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2026-06-04_18de5fcc1d1dc35040558956276a8ebf_amadey_elex_icedid_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-06-04_18de5fcc1d1dc35040558956276a8ebf_amadey_elex_icedid_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	2026-06-04_18de5fcc1d1dc35040558956276a8ebf_amadey_elex_icedid_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	2026-06-04_18de5fcc1d1dc35040558956276a8ebf_amadey_elex_icedid_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	2026-06-04_18de5fcc1d1dc35040558956276a8ebf_amadey_elex_icedid_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	2026-06-04_18de5fcc1d1dc35040558956276a8ebf_amadey_elex_icedid_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	2026-06-04_18de5fcc1d1dc35040558956276a8ebf_amadey_elex_icedid_smoke-loader_stop.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-06-04_18de5fcc1d1dc35040558956276a8ebf_amadey_elex_icedid_smoke-loader_stop.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-04_18de5fcc1d1dc35040558956276a8ebf_amadey_elex_icedid_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dib\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001ca38d8db9f3dc01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ef21908db9f3dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9908 = "Wave Sound"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tiff\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpeg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tif\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b12e598db9f3dc01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d9cc758db9f3dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tif	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000c50dc8db9f3dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 42 IoCs

pid	Process
4168	2026-06-04_18de5fcc1d1dc35040558956276a8ebf_amadey_elex_icedid_smoke-loader_stop.exe
4168	2026-06-04_18de5fcc1d1dc35040558956276a8ebf_amadey_elex_icedid_smoke-loader_stop.exe
4168	2026-06-04_18de5fcc1d1dc35040558956276a8ebf_amadey_elex_icedid_smoke-loader_stop.exe
4168	2026-06-04_18de5fcc1d1dc35040558956276a8ebf_amadey_elex_icedid_smoke-loader_stop.exe
4168	2026-06-04_18de5fcc1d1dc35040558956276a8ebf_amadey_elex_icedid_smoke-loader_stop.exe
4168	2026-06-04_18de5fcc1d1dc35040558956276a8ebf_amadey_elex_icedid_smoke-loader_stop.exe
4168	2026-06-04_18de5fcc1d1dc35040558956276a8ebf_amadey_elex_icedid_smoke-loader_stop.exe
4168	2026-06-04_18de5fcc1d1dc35040558956276a8ebf_amadey_elex_icedid_smoke-loader_stop.exe
4168	2026-06-04_18de5fcc1d1dc35040558956276a8ebf_amadey_elex_icedid_smoke-loader_stop.exe
4168	2026-06-04_18de5fcc1d1dc35040558956276a8ebf_amadey_elex_icedid_smoke-loader_stop.exe
4168	2026-06-04_18de5fcc1d1dc35040558956276a8ebf_amadey_elex_icedid_smoke-loader_stop.exe
4168	2026-06-04_18de5fcc1d1dc35040558956276a8ebf_amadey_elex_icedid_smoke-loader_stop.exe
4168	2026-06-04_18de5fcc1d1dc35040558956276a8ebf_amadey_elex_icedid_smoke-loader_stop.exe
4168	2026-06-04_18de5fcc1d1dc35040558956276a8ebf_amadey_elex_icedid_smoke-loader_stop.exe
4168	2026-06-04_18de5fcc1d1dc35040558956276a8ebf_amadey_elex_icedid_smoke-loader_stop.exe
4168	2026-06-04_18de5fcc1d1dc35040558956276a8ebf_amadey_elex_icedid_smoke-loader_stop.exe
4168	2026-06-04_18de5fcc1d1dc35040558956276a8ebf_amadey_elex_icedid_smoke-loader_stop.exe
4168	2026-06-04_18de5fcc1d1dc35040558956276a8ebf_amadey_elex_icedid_smoke-loader_stop.exe
4168	2026-06-04_18de5fcc1d1dc35040558956276a8ebf_amadey_elex_icedid_smoke-loader_stop.exe
4168	2026-06-04_18de5fcc1d1dc35040558956276a8ebf_amadey_elex_icedid_smoke-loader_stop.exe
4168	2026-06-04_18de5fcc1d1dc35040558956276a8ebf_amadey_elex_icedid_smoke-loader_stop.exe
4168	2026-06-04_18de5fcc1d1dc35040558956276a8ebf_amadey_elex_icedid_smoke-loader_stop.exe
4168	2026-06-04_18de5fcc1d1dc35040558956276a8ebf_amadey_elex_icedid_smoke-loader_stop.exe
4168	2026-06-04_18de5fcc1d1dc35040558956276a8ebf_amadey_elex_icedid_smoke-loader_stop.exe
4168	2026-06-04_18de5fcc1d1dc35040558956276a8ebf_amadey_elex_icedid_smoke-loader_stop.exe
4168	2026-06-04_18de5fcc1d1dc35040558956276a8ebf_amadey_elex_icedid_smoke-loader_stop.exe
4168	2026-06-04_18de5fcc1d1dc35040558956276a8ebf_amadey_elex_icedid_smoke-loader_stop.exe
4168	2026-06-04_18de5fcc1d1dc35040558956276a8ebf_amadey_elex_icedid_smoke-loader_stop.exe
4168	2026-06-04_18de5fcc1d1dc35040558956276a8ebf_amadey_elex_icedid_smoke-loader_stop.exe
4168	2026-06-04_18de5fcc1d1dc35040558956276a8ebf_amadey_elex_icedid_smoke-loader_stop.exe
4168	2026-06-04_18de5fcc1d1dc35040558956276a8ebf_amadey_elex_icedid_smoke-loader_stop.exe
4168	2026-06-04_18de5fcc1d1dc35040558956276a8ebf_amadey_elex_icedid_smoke-loader_stop.exe
4168	2026-06-04_18de5fcc1d1dc35040558956276a8ebf_amadey_elex_icedid_smoke-loader_stop.exe
4168	2026-06-04_18de5fcc1d1dc35040558956276a8ebf_amadey_elex_icedid_smoke-loader_stop.exe
4168	2026-06-04_18de5fcc1d1dc35040558956276a8ebf_amadey_elex_icedid_smoke-loader_stop.exe
1068	DiagnosticsHub.StandardCollector.Service.exe
1068	DiagnosticsHub.StandardCollector.Service.exe
1068	DiagnosticsHub.StandardCollector.Service.exe
1068	DiagnosticsHub.StandardCollector.Service.exe
1068	DiagnosticsHub.StandardCollector.Service.exe
1068	DiagnosticsHub.StandardCollector.Service.exe
1068	DiagnosticsHub.StandardCollector.Service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
688	Process not Found
688	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4168	2026-06-04_18de5fcc1d1dc35040558956276a8ebf_amadey_elex_icedid_smoke-loader_stop.exe
Token: SeAuditPrivilege	3380	fxssvc.exe
Token: SeRestorePrivilege	1604	TieringEngineService.exe
Token: SeManageVolumePrivilege	1604	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	4408	AgentService.exe
Token: SeBackupPrivilege	2628	vssvc.exe
Token: SeRestorePrivilege	2628	vssvc.exe
Token: SeAuditPrivilege	2628	vssvc.exe
Token: SeBackupPrivilege	2836	wbengine.exe
Token: SeRestorePrivilege	2836	wbengine.exe
Token: SeSecurityPrivilege	2836	wbengine.exe
Token: 33	3000	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3000	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3000	SearchIndexer.exe
Token: SeDebugPrivilege	4168	2026-06-04_18de5fcc1d1dc35040558956276a8ebf_amadey_elex_icedid_smoke-loader_stop.exe
Token: SeDebugPrivilege	4168	2026-06-04_18de5fcc1d1dc35040558956276a8ebf_amadey_elex_icedid_smoke-loader_stop.exe
Token: SeDebugPrivilege	4168	2026-06-04_18de5fcc1d1dc35040558956276a8ebf_amadey_elex_icedid_smoke-loader_stop.exe
Token: SeDebugPrivilege	4168	2026-06-04_18de5fcc1d1dc35040558956276a8ebf_amadey_elex_icedid_smoke-loader_stop.exe
Token: SeDebugPrivilege	4168	2026-06-04_18de5fcc1d1dc35040558956276a8ebf_amadey_elex_icedid_smoke-loader_stop.exe
Token: SeDebugPrivilege	1068	DiagnosticsHub.StandardCollector.Service.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
4168	2026-06-04_18de5fcc1d1dc35040558956276a8ebf_amadey_elex_icedid_smoke-loader_stop.exe
4168	2026-06-04_18de5fcc1d1dc35040558956276a8ebf_amadey_elex_icedid_smoke-loader_stop.exe
4168	2026-06-04_18de5fcc1d1dc35040558956276a8ebf_amadey_elex_icedid_smoke-loader_stop.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
4168	2026-06-04_18de5fcc1d1dc35040558956276a8ebf_amadey_elex_icedid_smoke-loader_stop.exe
4168	2026-06-04_18de5fcc1d1dc35040558956276a8ebf_amadey_elex_icedid_smoke-loader_stop.exe
4168	2026-06-04_18de5fcc1d1dc35040558956276a8ebf_amadey_elex_icedid_smoke-loader_stop.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4168	2026-06-04_18de5fcc1d1dc35040558956276a8ebf_amadey_elex_icedid_smoke-loader_stop.exe
4168	2026-06-04_18de5fcc1d1dc35040558956276a8ebf_amadey_elex_icedid_smoke-loader_stop.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3000 wrote to memory of 2484	3000	SearchIndexer.exe	105
PID 3000 wrote to memory of 2464	3000	SearchIndexer.exe	106
PID 3000 wrote to memory of 1796	3000	SearchIndexer.exe	107

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-06-04_18de5fcc1d1dc35040558956276a8ebf_amadey_elex_icedid_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-04_18de5fcc1d1dc35040558956276a8ebf_amadey_elex_icedid_smoke-loader_stop.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4168

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:1108

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1068

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:4764

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3380

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1056

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4548

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4520

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:1540

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1480

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3496

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2240

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:2708

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:236

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:1192

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3916

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1972

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:2480

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1604

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4408

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:2388

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2628

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2836

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:2380

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3000
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2484
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2844 2856 924 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2464
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2808 2848 924 {85EE815A-7738-4808-A14A-3AD87E32A3BF}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1796

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 ed505ab87995cbd7bc5fc463f36d6b4306eea90c2e2bad242d3d2a83b2d9324e
MD5 7e55fbf41fb6f5a6ed2e7c19521137d6
SHA1 5ced0d790bb8d635bf82b533ef4ac6eb6ed90956
SHA512 58c5170a3d2a9c81b7f26f370de8ebc61f78217925fa65e0a23361e983734a0de2d37e6feaaa9d7b7996cff4cf8f5caa89f5fa300f3024df4eeec4ac1ea5df1e
SSDEEP 49152:zb+632BuPkFKRrdE6ohmstBhuXjfS4LWxneQ/lFTjN4:R3q6HjBWLm
TLSH
T11ED58D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 93535fce692c2eee2f15cbaa835645c5f7661d97108125a8e8e8a21aefe69a06
MD5 f3008ec1fbf453a1cbb7ff4a011e393c
SHA1 03d0d308eb5edeae12b667c219b6fdafc39c8dce
SHA512 750983ff699429ca3aa59a433e2acf563ca25e4887ebb0670d329f68e9d44dc9f04853496b9fbceca67aa74e1074b44ed2e8a1abade1a8f95bdea6f0398a31f4
SSDEEP 12288:51XLsswWkxy2lRq2czAVGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWi:XXYfDtczA1nQ/tbw/2Mkjy6Fr7g0oi
TLSH
T1AF65F12877E448F9ED67827DCCA28502EB73788547A0E78B03A495295F373D85E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 b393fac70b8217c96866e803d3cc4c5f54a392b10f9a5bfe8352ac75d52a0941
MD5 89b21dd17c5148f95488a9ae6b83de59
SHA1 4dad6d049d7c6ec9472d94b49fa2209f01b5015a
SHA512 72d5f44aaa875235129886f90759eabe839ed827fe6a02fd9a04d5d6ddc330492336f3758cc8bd131df0687017de89f1aeb27e02764dffbcec3f8a22c1290f29
SSDEEP 24576:x0Le5ji0hmxLrMmnQ/tbw/2Mkjy6Fr7g0ov:xPji0AlnQ/lFTjN4
TLSH
T15E859E15F6748735D073C0B9C5D2A68AEE7230825B308ACB4286D77C7E677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 d2f2924d7681d7ecc70e8f427317622e1fd0d396faf3ac47c0a60465001ebb0f
MD5 0db14125960f15c7d379713658beab06
SHA1 108c08c1501f2777f2689f35625e780245f49345
SHA512 04bab28b4277d5b99a3eee9fd544e785dcaafb1992e82b1ba411a0c15ae72a2b03a7660186fa949b59526ecc28ac8fd1541d609c2e18b1f7f0d40bca396852c6
SSDEEP 24576:sa7/ezSC6vUyD/aqgrvWE6q8wyu8nQ/tbw/2Mkjy6Fr7g0oG:L/ezSC6vUzPvxHjyrQ/lFTjN4
TLSH
T1F3755D25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 5149db3174f2be343fffc72f4229a85375c977b434b93cabf58cbbef63ced912
MD5 234daa65885cfc5dd1903e5031b15a93
SHA1 3252a661d8b3cd0ebba8a4b08c59183949fbda85
SHA512 e94104a876b1546dff2e5133eea7a4051e7ca94525f61bf290dbc462648bf37ac0aa6db5f9b6899a6d34c9b5ab767f3dfdf6ee63a91f3d35fce5807e385bd28e
SSDEEP 24576:6VbqPb88hv/l+6BnQ/tbw/2Mkjy6Fr7g0o5:6VO88hXl+aQ/lFTjN4
TLSH
T1CB559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E777E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 a0cd38f77e795c44c2ef3c274f8654bc61b508d87d169113dc91d00e712da721
MD5 43cd53d7cbd07123aabe4d5e74d436b3
SHA1 9c7522c446e80965bb4279d52d3571a49cbcbc4e
SHA512 31b8a968519c7f3aebedbb1b5843ed7634b6775eb00328d9e343a3ba736bccb49473979c761a700123ed99c1891717abd1ef7e1288fe19686e2d7a49b71e3a48
SSDEEP 12288:wzyGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW/:wzynQ/tbw/2Mkjy6Fr7g0o/
TLSH
T1655523796A24F887FF2B06B15CC28482AB7B0DC1BFD4A74E6B44322D857C39446DB385
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 20dd169592388a21f68f0c2800a199abe17cf4b27bbe5340ce20be4a22e5efcf
MD5 5ecaa288bbed369c6ede61210bd99f60
SHA1 b5128a33de2631854baf780e40f6a4d5430ed761
SHA512 7e50b60c2b0131761cf2f6f2425191fe53dcb7e4ae0e37ad7d21d0d0cdb6fcff001310ac2fbf43f600213f94168089ab51f2cde82cd35662e50525ee0dfe047b
SSDEEP 12288:geBNUbTVO86U5GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWB:gJIUJnQ/tbw/2Mkjy6Fr7g0oB
TLSH
T1AF75CF3BAE28FCD2C67E4DB85A918600D77278704F61A3CBD164830EDE276E01E7AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 15ea4e037766603efc2f39867f284166561bbdd39a404609e52a2d72a454692d
MD5 487aa34ec15452c59f5b1454d30f5974
SHA1 acee7e54261945b03eeb663ad89a1fb32f271bbc
SHA512 cb9775e15de45479d0bce7e52afdd81bd43f591f2d8c310a5328d804a7743e9300f58e7c6a314f24bae11962e01e6798d8acd2a4de01e8efa04acf8f1e112853
SSDEEP 49152:sQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THh:sQvGAdlCEL8c/yRNw5CvLm
TLSH
T146267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 530e739dce4ee51497b23ef825a2939d84040957a00ff4a501bd7bd254fef44b
MD5 75676318a2011a106183b2ef6124f2ac
SHA1 ce4a2f772ff72192a4d7a62cac36765fc4f66500
SHA512 3b582daf25704ef592ff6864dfcd4b3ae43db2b1db7bfc8a2efb30a32430179bc40825a93a5971daedcaaa812e5aa6b6cd15d90f5c97f6d86bbf747f0420c8ad
SSDEEP 12288:VAwSfxL/2Dc39DLLmt0LDQewsAjXGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsgN:2QewsAj3nQ/tbw/2Mkjy6Fr7g0oT
TLSH
T1E775E031FE74E436C77F0DB21B22C706593D6A604FA11AC3E3A84A9D99342D22776B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 f1ae083379e66e97acc171784f5ad4a70d335569b4dd093b24dbc8dea0aac180
MD5 7565f35a4732f838625a5f7a99ae66b8
SHA1 17723cb206393db734abbeb39a2d85f8f3649b82
SHA512 f0aee4e60dcabde3e3a3b29e481ce92ab4b9d98a5fa7dea2c47491ea81e821ad8842beefcf8598ea0577aa9485ec8255c0a17d22bfde2a75c83e4e38c7c602e2
SSDEEP 196608:YUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHEL:YUEtQevvqc2W1cpV2EI32
TLSH
T15E474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 ae449b0799162c5e57b8762073716683ae09cf9364d3f3610d9f19667e7d6b5a
MD5 4625f79cba23f494572e15c79009f7bd
SHA1 7f5325b8d90d0ba5ea9fc7edb22842366f2104ec
SHA512 c5c8c1c7c4081cbda9feb5b8e1e812b9696bc77f1a797941c6a1309adea6c49aaa061fd3c3da5e37a20f840a182aded17a78c5d96088eff87c41bc76b833b4e4
SSDEEP 49152:QCbRquA/m2yL5zQfFiV+XenmE3/zXQ/lFTjN4:5oqtVjnmTLm
TLSH
T171D58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 6a4727a28309d9d491a845881dc0bd58d08555dca97d255717ff0a70986b89ad
MD5 e83c5401467b20752a735ae396697f5f
SHA1 def8b9daab2e47be3c6f92b85a2251eeae550edf
SHA512 c27f8033fe212451329d5642ed5dced94d383bde13316e866814d014abe6d12ee92af5d451e2c1936ba668521d0917cc26f182ad105768c23877a54a0b32eed1
SSDEEP 24576:UAhGLJIFoiwtA5l7S53gnQ/tbw/2Mkjy6Fr7g0oR:UAMyFoiq5QQ/lFTjN4
TLSH
T14435AD81E7F955D4F5B3AAB899B68171EA77BCA65E31C20F2250D11F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 1d3d2237f08bb95f5e877cb0b89c5f6d5690adc3326f9993dfea48ee226ee842
MD5 2ed0ed6440900ada2c01f4c77dae0cc8
SHA1 4bb4421658d64dad5f3eb99fec27d7383e2a455c
SHA512 54b19cc77e27d61c5b934c052a822c0666f062e226baeae500b1f4ed9e8fec054a6fd4f71c531ebaff3d242da5e9de952fa3529ce8afd71dac4bc7c2944803ea
SSDEEP 12288:Pmw5HEjsChN2BFgl0WDm+CcGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMT:uwuHOWLnQ/tbw/2Mkjy6Fr7g0om
TLSH
T14E65F14A36A45CF9EA6742388993C136F7B3BC422A61DB1F1760C65B5F373606D2EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 b6aeb5db07d96fa54a72f8ece78c356cbe914ba45f56be05c5c6d458a2a07a77
MD5 7dada9d68305168575b15c3e40b463da
SHA1 398c6bc1a373bbace54d4b169ac48514157891ef
SHA512 8c461ed88894f5c2043e8e8e364610b817962eeca34a6889c0e4b1fdc0a1109b8ee90991fbe36d7af4b91f04e667089deb5b95e0c1d4facc721b610fc24faec6
SSDEEP 12288:oXZ1IynGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWs:wZuunQ/tbw/2Mkjy6Fr7g0os
TLSH
T11A5512A937A4B0FAE6674278CCE28646E7733882677183CF275402695F3B7D11E3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 a34fe44a57f5724728c44b9ee1e85e9a7c0910bb72a62f483ac6ec11449a884e
MD5 e53d893d102a1645f44fa09c03fba58a
SHA1 60ae84584029797bbe9c0042aa3031fb82739703
SHA512 d1b8f0c0c9bc45d5d45935b20bbe7bb7c910857d377ad148a7d4e2fb75bde4ce3ccfa326e1196a1a975e5fe00b7edf832c6ec19c89861e36b7d064bde013eb77
SSDEEP 49152:Uj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UF:LQRQyi36YOcPQLvw2gAf+PN3yLm
TLSH
T162667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 53ba7e38267235e3779293039f4f795bcfd2fb0012748cc65ea01fdbb70399bb
MD5 9281aa1a309ee1885b19d34661386c72
SHA1 c1f58a9180e6aa92a58371972637df9f3fba83b3
SHA512 7bfd81f9b565bc0abdd3165967293f572d4a14a86c75c250d5c2a4580e0f29eb64d54c851eea7f17047132946d45d556790748f947dae49a7f17792fdc42fa1b
SSDEEP 49152:hj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UF:oQRQyi36YOcPQLvw2gAf+PN3yLm
TLSH
T163667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 3012cfabc5557d6fd389e974a043ca23a3096f34fbdf3cdd3a0ba9271a5284e8
MD5 67b0bc8b326cabfa06c691c5f17c55a7
SHA1 366676a548d705d4ff1c44639211559ae5654a4c
SHA512 a1dda73a05da52f8adc0a30b44ab1f4f0fef2202c0de9ff2325b2ee0f0e400d331f2ca9770fe96b1a54c6ba7679d9a0caaf863be91affbdd1d13bfc28d26b70f
SSDEEP 24576:NwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0enQ/tbw/2Mkjy6j:p68Qg55nhheWu7PNU3/nQ/lFTjN4
TLSH
T1E5B55A33B2F600A9C44DE1769F46872196D27C75CFE0E3DB8505721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 acf0caf8fdd01038e559cfbc5999d78cfc6635fe9f0271e78cb5a97ff63237a8
MD5 77488bf44db37c48dafe3dde94e2d6bc
SHA1 cead0feb1bdff125aeb1b3e43fb6ee23d1b55e55
SHA512 ff1c849404560af76f915087e869aa10e749598ed89e130e69bfc35e36b6d9205bbd9319dba27bd41bfda0a4334713420a600f17c11447f071543ada67bc1a2a
SSDEEP 49152:b3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99f:+y5112gYy5azzVvL69nLKnhZ9Lm
TLSH
T1CE167B13F29910E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 2d63074853cff0d61d1744de9596859c627e16f4699814925771be02509ec89d
MD5 ef7db26bced2f8a21a247d61d2ea3313
SHA1 b7c734729788ea6c83fb2d7c16c9b72771e747b2
SHA512 28a38f3206c964b48f671d1a658a5f457011a375f6080ef1241e086b5786c9137fba19aa4b4ce5eb9f5a1f2393c817cb2f1589dc7e4a1dc56a977ef54c96c578
SSDEEP 49152:1B+taZ3usBWOBr4tEGT0bqx0z+n217aau1gllQ/lFTjN4:7u6JmVxd2dKLm
TLSH
T188D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 3a2cb4aff696f80c14b49df1cf5292f12a8e625236a0b0142878e92c810f3ca9
MD5 f682a91283c62f0792645f5bd32e058d
SHA1 65e25f3e8bf23789e7683c210352a2bdf644e53f
SHA512 c4fd43d5e53a147f876da9304bcf1496bf55b71c55c248fdf81998989f54577cab79980b96313a975c5ffb3fe41cd10ca2984717d09bf752507ddc1acfa3339b
SSDEEP 49152:n1hpsNoJpF1A6UU44CwH7R4xpQ/lFTjN4:nmifPbRTLm
TLSH
T13AB5AE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 20744dfc3ce5b717e0a61492d1f271e1eb1187dbe5474acd6b20607c156f0fcd
MD5 10d591b2a46e8e0f878fe663e5102dd2
SHA1 514bedced85822010fe03d40ce038e8411bc1537
SHA512 36a77fcf37ac5625054acbce73e10ad82993a5e838aaaa565b2adda52e36a5988879102e349d3e8ac310d43f6b14253a2e9271727b38c20905ce67e66404e900
SSDEEP 49152:2SuZQIY0Be2KRRVtOnks6NMHquQ/lFTjN4:Y5dKTi61JLm
TLSH
T184C5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 688fd4881d68a7293cc492ac914573b8af4d0766554ca8cd98e4fc47e0376a84
MD5 2807f43dad462545db5a76aff14d9be0
SHA1 8b010b6169e4a342c410b071bfb707e7902bf7a9
SHA512 d483bfc12967b87264cfa42d5f1c81ca171765459b15bcdcccc7d5c8602b63af0d7142e2758002c2364dd49c4159b8fd6a88e85934f25d2f7850132dc4c4dcae
SSDEEP 49152:xhtSn8EApI0figngiDn0AP5w1Q/lFTjN4:gX2iyph3Lm
TLSH
T1D095BE13F2D940E8D05ED178C7468632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 c30fec4267eeb6a372bdfd93fe5913be328994301c5c2799617f39fba9ad1f63
MD5 0988f62588d2b3985a1fd53621b65da4
SHA1 70ea42ecfb3b59e5ca50e0b8192045c7b743daf8
SHA512 78b24192c67abefee28d593456100cdbc2e194de03c21478b888edbe65b06df85e4ae93ca0a708dadac5e7daff72f5fc37cd6fe488fec16281a30b05f5b71f66
SSDEEP 12288:aaGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWZ:aanQ/tbw/2Mkjy6Fr7g0oZ
TLSH
T1DB5523697964F98BFB1706F18C828182A73F0DC6BFD1938F7B482129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 074b3e5389b0eb8e0a83f024df79c9dec6de1306fa8451c6e203e15bec358e25
MD5 90755e42f07e3ba76c899413ee9025f3
SHA1 24ac6bbc1c0e75233c7b1b30c73572747221e41f
SHA512 39bfa7d972e9e5ffd7f9d362bd5fc4c0cbe6d6fd5f123ddf45183749361bd8d45d571f64ae7798552432c393b6d84fe38180bcd229750207aa61dd56d8fe8770
SSDEEP 12288:YzGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWV:YjnQ/tbw/2Mkjy6Fr7g0oV
TLSH
T19F5523797965F98BFA1706F14C828182A73B0EC6BFD1938F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 41d30851df02878cc34c0d51d585d000f17db977f274866b70d2bd3208b9e925
MD5 39019e11a9b732dc941206ab1baa7a18
SHA1 39a6d8e7459d5cb6f42d1aa45f4efbda04f74ae4
SHA512 5ad157667c7ac0dfc7a69f35a4ae5eea15a4c9a220db75f2e4c70fbc78c9a1179a39cda350b3eeb7722a5c28a5017083dedf1b4b1ea1c0860bfa2b6bd8ba1969
SSDEEP 12288:fhGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWI:fxnQ/tbw/2Mkjy6Fr7g0oI
TLSH
T1835523697925F98BFA1706F14C828182AB7B0DC7BFD1A38F7B481128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 f54616dfccc1d4fcebefa3e0edcedb393ddb1d64b9ab1e7af1ca0a878947bf1f
MD5 70aed8478039e0da94316b6f6f83c53a
SHA1 b7863277cb08264d6039bac98a5f7b27fcc24357
SHA512 9034eea32fc277ce87c3abf9fd2664a87368c16c63812df7bbb123eca08fdd202be36760ba99a9815ed7093ee0edae2f9cbc9daf029f25259755b077ca4586e0
SSDEEP 12288:2VgGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW/:vnQ/tbw/2Mkjy6Fr7g0o/
TLSH
T1855523693A69F4C7F92742B4CC928142E77B3DC5BBB1A3CF6B04111D4E793D41AA5B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 17ef7d914a7bedbdf72f1baf6ae66ca7e07208226b2cf7f4f345942fb00651cd
MD5 c273e914894441fe37c07c4b8657eb12
SHA1 76ea0cdd4ae1b9f0a8bef861d33eea80a271b1f4
SHA512 25594f76440bb58e7340af72eb84d679b6bc530996d579d1b6110881add2142d167f3fbba403d8288d748e101166aa341c968d39849760ae5d62d28f9dea7e74
SSDEEP 12288:p4GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWv:p4nQ/tbw/2Mkjy6Fr7g0ov
TLSH
T16E5523697965F98BFA1706F14C838182AB3B0DC7BFD1938F7B482128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 aee6e3574706cf340a5b7ae2a6a0119db9facdef4f3d7ba02b940f74682d97ca
MD5 f932ad30fc586dc876851b4de1d0b99a
SHA1 102597fe206a0a31a8dad4028a8d45412f8e580e
SHA512 04ce5fbe3c4aec82cda9d940585e754c31569e51b43ff6719472e5ebfd9502b3cce88e346920b1149c98d3e449db0e611c80d31c5bca95d8fb317ad1dcd07c8a
SSDEEP 12288:z/GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWP:zfnQ/tbw/2Mkjy6Fr7g0oP
TLSH
T1BA5523697965F98BFB1B06F14C828182A73B0EC7BFD1938F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 7ff66ccd2a130838e43a4135753744cb553449dedaca8f50e5e3ed624e5f9e8f
MD5 738d3e66bfbb86ea372f7e6f0fdd8f14
SHA1 7a254455df5bf7d6b9138f1c860029872e721a74
SHA512 23278b06e7735478580c6034c2b92a6dd5ef7ac942259a33b79826ba4f0156d3c4c05aba1d757716f90c75c1880bc05d490fda86ee6add56a207639f4d13f19a
SSDEEP 12288:DLGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW6:D7nQ/tbw/2Mkjy6Fr7g0o6
TLSH
T10D5523797965F98BFB2706F14C8281829B3B0EC6BFD1938F7B481129967C39416CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 53b27fc3167269e49acdf9d3ade519f7a9eebcf5e64bbffba9666f96ab750030
MD5 b29ad6fbd95ca6cc54f9ad959c8c1a62
SHA1 d870e2c87032a3f777d1e6b858afff8d62a8a51e
SHA512 f35c77ce18c5bdaf6c5135a1c067f62733bbb3d68d62b3a27fc5c538177bd6ebd11abc7dbb4c8580c9fad0aa51ac70c21128f7a50266c19c81df1172bc204d1f
SSDEEP 12288:fiZwbDzzFEoS2cPvyTGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW/:6ZM3zFVSODnQ/tbw/2Mkjy6Fr7g0o/
TLSH
T1477501A5B39058F9EC67427ECC518906D7B27C5A1BA0C71F13A8322A5F373A01D3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 44d93707a06edfad8bad61fa76bd01223a50c19a99f800fabf9f605cb71fa561
MD5 558b6208ea4e93cff1dd7b75f47448d7
SHA1 22ccd143fb7b4239163df1398cdf3d3ec1552339
SHA512 5176cccc13e6379dfea66177aa292dd48ec8fe231bfa754589f17f9560cd95e63466a7b52c8487edc8ee0033659da8eb973285de73cf465b7a83ef4c5f448673
SSDEEP 12288:E+GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWr:E+nQ/tbw/2Mkjy6Fr7g0or
TLSH
T1715523697964F98BFB1706F54C8281829B7F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 11a4ed00c5e7c7c80f5ffcce90b9a4648a1ee8234692fba39024aaf20ace3cf0
MD5 1863745cb50d9da91c6db35be2654ede
SHA1 d8c5be6b89dc5e9fbab48fe6594cd94197bbc3bd
SHA512 92bcf8d62a3595c1cba2a08656c91abae3df5816428f49a83cc9240bc3e0360be1c4cde7ed624d25580e9b03659feb89ad3f66c971dc6b8548849a8843945522
SSDEEP 12288:GCGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWY:GCnQ/tbw/2Mkjy6Fr7g0oY
TLSH
T1875523697964F98BFB1706F54C8281869B3F0EC6BFD1A38F7B481129967C39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 13f911ad5107ddaee0ce7e819902b15b3bac3191f671e442cf772eedf8a03fbe
MD5 ed536a8120499b360455d9ded091652d
SHA1 69b2b3371441873ff3ccfc41e8d370f242ce4077
SHA512 2cf949cede9b5af77151501d8bc5c8960daccf60759d66fc86cc3b729a156089613e78ac3a5c87d9e7ed3070647ab92664a5144e3a0d5001c49f0d6e878d3c92
SSDEEP 12288:3yPz5L8nGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWW:6zyHnQ/tbw/2Mkjy6Fr7g0oW
TLSH
T12165021773A170FAE537427888920A02F77678725B609B9F2754037A2F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 167d81ede005c69135743667a80a20b0b5f1bdd6cf2435de77317303752c9621
MD5 1a283dbfda741a014a072bba5a939fe7
SHA1 b7d661274bb99a78dab346236e9d665a6c44aeee
SHA512 1a3599415dd2138d7fbc1cccc57cdac2c2105c0e03c31bac407b96527358ece9065c3b477fe6e90980acb610809963cf1c2d618dc8b2ceed8e82f883f9d618ec
SSDEEP 12288:v+GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWU:v+nQ/tbw/2Mkjy6Fr7g0oU
TLSH
T1855523697965F98BFB1706F54C8281829B3F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 235aed71e4a61653d40952ca5f1c072d8fb664be09e071fdfda2aa03c053db03
MD5 0227a33bc8b54742c770e8aa9233fe68
SHA1 2b9b428093e51198959bb6dcc0209a16e94a77bf
SHA512 ca745454b055aca5b0f128f3d817d2c8bcb4ade88edcc90f7f6fef71de8bc7b31f267e8f599e9eef72d2a34b39a87b0841730dc61a38644c5802f671d058f3e0
SSDEEP 12288:Y+GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWr:Y+nQ/tbw/2Mkjy6Fr7g0or
TLSH
T1505523697964F98BFB1706F54C8281829B7F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 25b7d49d579cfc5ab983da97e98d7fce7fa7213f48e1b3f98dcc0ad14700daed
MD5 a835d67d4a9e22305ece2c007e0c9da1
SHA1 23637d5095b7251508aee1f01e4739b6c04b3947
SHA512 e532a469c02ede9f0a049625f1461d6f38d38fef169d43fecd66d533729c25fb2aff047e62263ea93589e86771673cd1273b7ba625997a7435630247f3007d81
SSDEEP 24576:XCUfpvPDv4Ex1hfe7i8WVq2lIGU8lrtGUJLPuwvAtnQ/tbw/2Mkjy6Fr7g0ob:XCUxPTY+8Wg2lIL8lrIUJLWw4Q/lFTjG
TLSH
T15665AE1EA3EC0896D4BB813589518A06FB72782E1B32D6CF2160C33D6F27AD55E35F05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 c15d72f887d36d490698a090883ec4e1531695fcce3dfa21a6dc9eda1fbfb80e
MD5 20dbb5f9c94c656557e0557e352e85aa
SHA1 710fb1cca7a01d6232169c936fed54115fb2aab3
SHA512 f5fbf219a73ab5987d33b8ccb52f5a5329a5e6105192ec2a6dc3ab0f55cde4c2da23cb3ac1af4023d64a6029cb3fcaad8dcac67f66fbab9750893813045afeb9
SSDEEP 12288:XssfuGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWa:bunQ/tbw/2Mkjy6Fr7g0oa
TLSH
T11965F119E29852E9D02E5275CB828641B3373C9597E1D3CB67C0F53E0F7A2905EEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 de210198a686e6e14b01a746520f1658748bd822d925274d4b2dd4c179c2c383
MD5 c76160ce9b01b5459ada93789386f513
SHA1 3743e8c2ad0bb1310d6349327db366836bec99cd
SHA512 26759a369337ce674bafb9049f95af7e0d787d1cdb85b3fd1413764e68e3f83e421970d694b8bae4d727ddfe2ab8fecf75db03b558425d1f4811e0bbaf249eca
SSDEEP 12288:yBGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW0:yRnQ/tbw/2Mkjy6Fr7g0o0
TLSH
T1F75523696668F94BFA3B06B048928111673F0EC5BF91D3CFBB04226D953C3D41EBA785
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 992df9ed8f19b47bd65943766b1034774f1cc238af3e23b3adc43fd035e4a3a5
MD5 361a8e445b2bf32584f711a22483bf72
SHA1 37333d339971e047a4573e31312c59bdbf9c4c32
SHA512 a108a3a8d69469f4dc4ec8ae89ce43779bcb8aeae5ebfc2895ba6cc562e4fab01ba6be429236116d94af63fc7dccd730e58fc4bc40813471dfbb9067bcc55d60
SSDEEP 24576:M8RMyNoSFw1d+rC4vrmRcGPiQEaaPnMRTCXnQ/tbw/2Mkjy6Fr7g0oy:lRZwQCyiHiQEaaPnMGQ/lFTjN4
TLSH
T18B85BF1E62DC46A5E0BAD2B8CDA74407E6B23816573197CF1290C27D1F37EE45E3AB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 dc78bcf689a301471d34a1a1b7ed9c14080b78ad57a97361619fc70ec6c86242
MD5 b930c2501a691ffeeedd872f2bdec1d4
SHA1 3de9cb337af24c7c04bbbf9467234801e5a58c53
SHA512 1542f40bd2b18f339ded1490bafb4acd55c06058152dd9ee211d43c65498bb1482e5f3cdfe8839fcf404db2cc0451e028a6d122368d87910f3609e7aa0fbdf4a
SSDEEP 12288:XbxA1U7KRGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWx:XbxA1UGhnQ/tbw/2Mkjy6Fr7g0ox
TLSH
T19C55123E26AC24E6F636927D88D28106D3327C56676193DF2584823E4F3BBE41D76F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 706078fd1fe24b4de0b1a230e7b23ec7c5ea77a3705cb4de346869ce1a5f2d8a
MD5 1e0d95a4ac9bd034efabaa07c91c1103
SHA1 16e3bfaed5b0ad575033bee02b01b4cda48d689d
SHA512 0eeaf512f35331f93fb5e6eabb2691bbe21d9a8baaaeefdd1db9f43bcc5cf6b834521b3305e457535bb1dee997c5d25877568e39ae532c967383841d8b4fd67d
SSDEEP 24576:6jsmP0yHaqrVqHra44KDzMsrnQnQ/tbw/2Mkjy6Fr7g0ox:6jRP0yHfVqzlAsrnQQ/lFTjN4
TLSH
T12245AF2EF2B910B9D8AAD176454107B5BB71782D1F209BCB0170C234AF1AEE85F35F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 9738ca2f5380eaf8cf0692b9ac9a50f4268a93e21707c17f134689005b4e83d2
MD5 c200c33a28005ea9a5eb114bbb3ae04b
SHA1 9b1c972a922d4864c41a0e89201946c67a6d6d56
SHA512 91fe274624c960d431ead9241be77b43061111454b0dab3105024c88e5f4902ad13fc3b9f66fa78ddabe74fc81b606b82273e75ae3ce1030ab84f8e1741db33a
SSDEEP 12288:1fGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWX:1/nQ/tbw/2Mkjy6Fr7g0oX
TLSH
T1875523797655F98BFA2706F548828142673B0EC17FD1A3CF7B482229967D3D40AFA780
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.6MB
SHA256 cb240181293e4e0ccfa993c5c55d0833e8e7d956a5fa10e61ad7203bac44014f
MD5 c60aacf57ee6a90fc45208853baadad5
SHA1 0809daa17ddf63d3503f5fb26639519175ea9afe
SHA512 e1f9435e088e23e21eee0d01f7d818436abad9a14b31ab7e0635eb7521d6313aeb808bc03455a5e775de3540e7bcc0398cfc608ecc44cee36f2fdb7a4051aba5
SSDEEP 12288:pOb4A4LWO+vAYFTVGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW/:ewLBUT1nQ/tbw/2Mkjy6Fr7g0o/
TLSH
T19A75F155F7A450F9E92B817CC8A28616E372789D1764E7DF03A84A691F333E14E3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 db1dfd4f98918213ae00322836326f6744032649ec5ac16d216c51de0b335f38
MD5 0232b4b56165f2941bb43e0fbfd65438
SHA1 eab0d21d4bc4f91019ba986358edc34c6fbf4933
SHA512 99dc11ccecbe8c2661ad25800139d5708a78c083cb643533bce195f18645ecf331ca02183f38795c130ce1f6394d52ec8d23bf47f500ec1313a00c3309b2940e
SSDEEP 12288:/70VmuIYNvUyBpKGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWD:oKYNHUnQ/tbw/2Mkjy6Fr7g0oD
TLSH
T1CA65F12E62AD1CE5E53B91798AC38209F2737896175193CF05A0827E1F37BE87D3A741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 9749693826e239f03ae4205313211c91e9786e7bc3342d2251898bee983c34c8
MD5 f26cb0d7cbdf1a6660cae962c5025729
SHA1 cc4790d4863e3680be3eeac9d97b01ae76f7d1f1
SHA512 531ab4d23ab7ca42190774503cf6e896562450d7047544894c2129dc25c95cbb8b79cdd099ca48f3da7a4afa0e68a868dfe73abfac356826f5a1d79c813f6e94
SSDEEP 24576:BnXoJjNYH84VVSNAApoEON66aspcrcHBjSSKHPWdQwPF3hJ8ssmOc+XLxu+x7uK2:BnXoJJYH84VVS6AmEcJas+cHBjSSKHPb
TLSH
T1CA65BF6EA2BC04E9D5BBD17DC5C24506F5B278621331C6CF026082BA7F27AF55E39B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 ef254070680d090e3ea45043a76146da82142690b2613e99219aa8ca40f35145
MD5 b8846fe6fadb1bbc756b7331f82ff7d6
SHA1 18c8b9f3b8a9cdb4d1a2fd9a5c01f20f1757a5f2
SHA512 25ea9d0376f827c59584cc109e77a6ffd1a3bcd72b098c1d3acdd4954d5697e31b64f4f54228b8b08438c3de5fcc11bc45f663f2b3986b3c51a6bdccccdf1323
SSDEEP 24576:xv7Xbxd9Tuycf8M/TYlSuxwr2PCSnQ/tbw/2Mkjy6Fr7g0o2:xDLL9TuJ0M/TYW2PfQ/lFTjN4
TLSH
T134858D5EA3EC52D8E47BD6BD85A39046FAB2B895273081CF1250856E1F23BF05D3DB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.3MB
SHA256 e2959d59945b2d8b043362dced899e76167cd0b6e8fb328bff6465f8c98f61b4
MD5 1cb7e07749ad827826ba7c18cffa4fa2
SHA1 905489f91238c9a9691d382c90f50e8d1ba1f6fe
SHA512 172fc7ace83d02b64176ce0debcdaf90230542509583deca444711dd276c39b13c3f833fb67e6a33dc6c3d07972e3446528b6411f3637f749f98d5b2900cc1a0
SSDEEP 24576:yegJgpwJOmPOHWAK+8ZguIGyPsxr5Vin10w1nQ/tbw/2Mkjy6Fr7g0ov:yngOJOmPOHh1Q/lFTjN4
TLSH
T1E655BF3FB7BC15D5E03EC17D8A928916F6B1786613255ACF0550827E5F2BEE42E3AB00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.6MB
SHA256 ee0be4298478d15001cd9b5c9f111970a17216f8ec505a2ab7a52aa7726f51e0
MD5 5e484963520308c9a875d3df9e5811a9
SHA1 cf3927c56164eef39b55769cc5fdb6facfc5f6e2
SHA512 628987352c5bf60c8366b1db6b9be528ca9559706f901ef203938cc159455c2ed2dd2fa4c2539d298e7439bde771843b961d033a23a4d300e8975948903f7385
SSDEEP 24576:HLJnJiTk3R3waE4JrOfnQ/tbw/2Mkjy6Fr7g0oA:HLJnJK8R304lAQ/lFTjN4
TLSH
T16B75D03CD2A810E9E477C2B481561756FF32346D2B216ACB29B4D5353F22FE06A79F48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 4af767173dc639c03753c04058e2a8b172bd693470c39c3ccb1398162c52027d
MD5 c3713d0be8085dc5b96f2c8e3d5f44a7
SHA1 d4bb56888a6e063d38eff80737448607ac026d72
SHA512 77132d035ed8e86f96abb93b212cea66b72707628246a24afbe08bb20219c154e471c7a374ea9a648bf17bec2f6407372c86d2d526344e0350f94b4d70448066
SSDEEP 24576:HA9GqCceDQncA/BmlvLto8cFVr9og9P/Z6p9nQ/tbw/2Mkjy6Fr7g0oT:g9GqCzDScAZmlvTcFg8Ph67Q/lFTjN4
TLSH
T194955C15F7EA5298E8B3CAF1C96294159B337C409B34F7DF0A80CA6A1E32BD1D539B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 1604123937f2b901c60c5a04ae7ab29549d9852d69f9b99ac584fe624aa6a531
MD5 94a2d46b4868fc42928c4b0f8774b2e8
SHA1 59de4e0997403dc9cc3e8870652bab67e6afa8cd
SHA512 371935010420ca656a04e1aeececa814edfbee2f5e77a88caf2aa63e697b319b1859c74f39a76d4e1b3b42d5ef36f4d5da9cf9d18e3774c642f98cb8382617d3
SSDEEP 24576:XlYJeXm5jUuEFnQ/tbw/2Mkjy6Fr7g0o9:XlYJeXmRUuEFQ/lFTjN4
TLSH
T18855126D366CB0E6E22F41B988924545E372B4A1274163EF62D0C27D8F7B7E51E39F80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.4MB
SHA256 0e10d07514c742d1ee72473f6cf288dc9cd40db4a020441adb6f35b957d1ad15
MD5 e6e33c62f9cf3b0a21e82336945b9eda
SHA1 29846a6cd08e8d989685574be965b052a1312985
SHA512 db8f51978330d701b1de093e99e2263f56be4cdde19218b4d535716694ead469b0876a9086b40e8fb7442ea9415063f82993d37802fbc418a493b1c317f96f86
SSDEEP 12288:kFu6kyQGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWs:kUtywnQ/tbw/2Mkjy6Fr7g0os
TLSH
T11865121833A4B4D9FA7A06788DA381819F3A7C50AF5093DF66C0E23E5F3A3D46975B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.3MB
SHA256 fb708ba9edcde8d3842f18487f453f1c9e325f3ad0fb5dbb91b25346f2ddeb0d
MD5 5e187cad25e8b7390e1e80cb0536a32d
SHA1 ca398d4a9390a9070942036c549503b14aae0b11
SHA512 4ae315e203ce088342d354fd29fbcbfe101973d8fba1856b67c3e58df49069caa65d7fac06d7e712a4cd6f136655f1ea0970f51d1a4b4d179ddf70084e0ca824
SSDEEP 12288:zPVGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW9:L1nQ/tbw/2Mkjy6Fr7g0o9
TLSH
T1AB55236C2624F49BFE2706F448524142A77B1ED17B91A7EF36846139CB7D3D016B6B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 cf6618de9fdfa4b466112b51e072ad35c77ec8684fdf01fadd4ed9fce0533ad5
MD5 713627c9b6b983ab4bd596f974cd199e
SHA1 9bc259d8cae4b65ee2a74b64dcca02ab32904413
SHA512 f0ad7b1baed7248467ba2bdbdf13fd606d87c7304886f337d6b0e868be816681e27fb894f561f94edaf560f9f010192a896e82076f72efa5bb42b1a5d6860584
SSDEEP 24576:BC+TyQIu93VAumZr7jmOnQ/tbw/2Mkjy6Fr7g0oV:B/TfIq+YOQ/lFTjN4
TLSH
T144558C1DA7E91DCAE276C675C8A34493E633B872177186CF2044C07D49AEEE8AE74F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 dd8a85ad112f16d97e1803279e1ac16df8a464519e0b2080cefa32721a45f3f5
MD5 5531a3a290cf49cec0953658b026a973
SHA1 8c675d8f2b93f67be244aee5ca028680f5c28117
SHA512 0251146f2433a90460b61bfa9e4e64857b8f2e349d6a701025d3fd88641ead2197bc48f6717c4c2e1e77b88c9b201221143ceea04121487cc5b4709f21fb9de6
SSDEEP 12288:WcyrWOstaa3kcspGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWh:PLQikZ5nQ/tbw/2Mkjy6Fr7g0oh
TLSH
T1A365F11FB3AA10A6E56B827C88824142F7B37471575263DF1290C77D4BBB2E97D38B81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 8335c7f4acf00ac1e294779fcd424a3b2789681714651ce5bd9058c6f97b7e81
MD5 b6eee0478a20b61eb0bf29a0487d04d8
SHA1 e8327eb6d3ff0545833f651e90dacc5bfbf4f756
SHA512 dbe45aa3704e3b770ddb234f060b36626eb325f30663c3965b6f085ab4b01f26ae5eebdf2807a591ec4fe913293df7de17f87033da4564c0daad2f21642003db
SSDEEP 49152:ApJFwrPpGyqWo6cbT2TZ8maJO35NPHXogsS7Q78ZGAvL9vnF35LWAPwQ/lFTjN4:xpC7b4+80GTkYLm
TLSH
T1ACA57C3DE2B810ADD9AAC375C5461665EE71382E3F2015DB01B0C578BF1AEF19A38F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 b6db19c365ec9bf07f9293473c0925fc4e27b72c789ae0046117220f96662a1e
MD5 62278f4df36e18b134de2198f672009c
SHA1 dfa43b4744e6c2fbabc7f575ba306590c2c4f986
SHA512 c7c983e76cdb74444282440db997971bf2c8c24ca7831490c7cbd642b8f148e76a1e6121907c31ca8463fb257db158ba3d621ca717301cbf94e1e3ed1be71e9a
SSDEEP 24576:tSAwJPE1IDAo+4Kt+l44135UQYnQ/tbw/2Mkjy6Fr7g0oe:tqPCIo4Kol4/QYQ/lFTjN4
TLSH
T1C555B02AA7F956E5E17AC7B4D663C501FB733822133163CF5290813E0E26AE85E79F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.6MB
SHA256 174a1dd1e90fbfb84411fa107a1d3e98816167bb6285d8a52cb06095480e7293
MD5 b1dad645f6eb05e9c9fccf3522ae71f2
SHA1 e8038589e5c46a40512fe7632159ba64a696682b
SHA512 a243ef1d7daf23b8b7dfb37767479cfafe6a07511a42ab117fd97301ea007452750088716d17309e08087bfcf07c0338915365235a21325e5064b81b793fa446
SSDEEP 24576:zyLXPLcf94tonQ/tbw/2Mkjy6Fr7g0oR:zy7PoetoQ/lFTjN4
TLSH
T1F975E03EE66C08E5E43AC27CC6A38506F672389D037166CB199091791F7BFF46939B00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StructuredQuerySchema.bin

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin
Size 414KB
SHA256 e67e330837a6b2f6d5f76815e7235a512b54b1c90f2ad62a3e9d142ae6939c8d
MD5 16b9618962f5623ca791a1366eee5708
SHA1 f0d257511952f075b2a0ec7d8e8730c3e464461a
SHA512 18e1d5a105b87fc72df94645685f5a8d3f593df2d3a9b8652b3b4a4ceaf92d3c7a67b0c08847186149dd608428cae8f1b3bc844bc7aacfc9e3219da823ca2fe2
SSDEEP 12288:vMUC7+vlk3n61mSkplXZ5RwmF9n4w/TSD:vXhl6V/i
TLSH
T124945F36BF88CB22C59A15748897C01A2E30A7C49E04CF6B73DC513CFA576685FBA359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.4MB
SHA256 0da0d53f69e8f106a1309648c00df8f8cb1d231da90283d59bba14777bb40945
MD5 5d704b92bb0c5ababc610eaf817739e8
SHA1 4d5e3daaba2330ede07a2149ba48ab8d34f52715
SHA512 0d294392cb6cecbd6cd89f2b514f3387e5647f3b46242c002c8573075e7c52a22c06468e5e32d94a91f3c259c3f9c467df06d4fcb94e634ac4edb43a433e4de2
SSDEEP 12288:99lyvj3IkxjbBzZGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW7:9Wv8qjppnQ/tbw/2Mkjy6Fr7g0o7
TLSH
T13065135E26A4B4D9F53A0274D863811692767CB227A4ABEF36C8D57E4B393C0953FF00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/236-114-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/236-180-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/236-372-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/1056-38-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1056-35-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/1056-29-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/1056-113-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1068-22-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/1068-37-0x0000000140000000-0x0000000140155000-memory.dmp

Download

memory/1068-16-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/1108-12-0x0000000140000000-0x0000000140155000-memory.dmp

Download

memory/1108-109-0x0000000140000000-0x0000000140155000-memory.dmp

Download

memory/1192-118-0x0000000140000000-0x0000000140143000-memory.dmp

Download

memory/1192-242-0x0000000140000000-0x0000000140143000-memory.dmp

Download

memory/1480-82-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/1480-73-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/1480-155-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/1480-79-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/1540-150-0x0000000140000000-0x0000000140165000-memory.dmp

Download

memory/1540-70-0x0000000140000000-0x0000000140165000-memory.dmp

Download

memory/1604-146-0x0000000140000000-0x000000014018E000-memory.dmp

Download

memory/1604-370-0x0000000140000000-0x000000014018E000-memory.dmp

Download

memory/1972-135-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/1972-143-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/1972-355-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/1972-141-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2240-106-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/2240-99-0x0000000000800000-0x0000000000866000-memory.dmp

Download

memory/2240-104-0x0000000000800000-0x0000000000866000-memory.dmp

Download

memory/2240-163-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/2380-375-0x0000000140000000-0x000000014016D000-memory.dmp

Download

memory/2380-168-0x0000000140000000-0x000000014016D000-memory.dmp

Download

memory/2388-156-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/2388-371-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/2464-385-0x000001C7E86F0000-0x000001C7E8700000-memory.dmp

Download

memory/2464-416-0x000001C7E86F0000-0x000001C7E8700000-memory.dmp

Download

memory/2464-379-0x000001C7E86F0000-0x000001C7E8700000-memory.dmp

Download

memory/2464-380-0x000001C7E86F0000-0x000001C7E8700000-memory.dmp

Download

memory/2464-381-0x000001C7E86F0000-0x000001C7E8700000-memory.dmp

Download

memory/2464-383-0x000001C7E86F0000-0x000001C7E8700000-memory.dmp

Download

memory/2464-384-0x000001C7E86F0000-0x000001C7E8700000-memory.dmp

Download

memory/2464-382-0x000001C7E86F0000-0x000001C7E8700000-memory.dmp

Download

memory/2464-410-0x000001C7E86F0000-0x000001C7E8700000-memory.dmp

Download

memory/2464-409-0x000001C7E86F0000-0x000001C7E8700000-memory.dmp

Download

memory/2464-408-0x000001C7E86F0000-0x000001C7E8700000-memory.dmp

Download

memory/2464-407-0x000001C7E86F0000-0x000001C7E8700000-memory.dmp

Download

memory/2464-406-0x000001C7E86F0000-0x000001C7E8700000-memory.dmp

Download

memory/2464-405-0x000001C7E86F0000-0x000001C7E8700000-memory.dmp

Download

memory/2464-404-0x000001C7E86F0000-0x000001C7E8700000-memory.dmp

Download

memory/2464-403-0x000001C7E86F0000-0x000001C7E8700000-memory.dmp

Download

memory/2464-402-0x000001C7E86F0000-0x000001C7E8700000-memory.dmp

Download

memory/2464-401-0x000001C7E86F0000-0x000001C7E8700000-memory.dmp

Download

memory/2464-400-0x000001C7E86F0000-0x000001C7E8700000-memory.dmp

Download

memory/2464-399-0x000001C7E86F0000-0x000001C7E8700000-memory.dmp

Download

memory/2464-398-0x000001C7E86F0000-0x000001C7E8700000-memory.dmp

Download

memory/2464-397-0x000001C7E86F0000-0x000001C7E8700000-memory.dmp

Download

memory/2464-396-0x000001C7E86F0000-0x000001C7E8700000-memory.dmp

Download

memory/2464-395-0x000001C7E86F0000-0x000001C7E8700000-memory.dmp

Download

memory/2464-394-0x000001C7E86F0000-0x000001C7E8700000-memory.dmp

Download

memory/2464-393-0x000001C7E86F0000-0x000001C7E8700000-memory.dmp

Download

memory/2464-392-0x000001C7E86F0000-0x000001C7E8700000-memory.dmp

Download

memory/2464-391-0x000001C7E86F0000-0x000001C7E8700000-memory.dmp

Download

memory/2464-390-0x000001C7E86F0000-0x000001C7E8700000-memory.dmp

Download

memory/2464-389-0x000001C7E86F0000-0x000001C7E8700000-memory.dmp

Download

memory/2464-388-0x000001C7E86F0000-0x000001C7E8700000-memory.dmp

Download

memory/2464-386-0x000001C7E86F0000-0x000001C7E8700000-memory.dmp

Download

memory/2464-387-0x000001C7E86F0000-0x000001C7E8700000-memory.dmp

Download

memory/2464-418-0x000001C7E86F0000-0x000001C7E8700000-memory.dmp

Download

memory/2464-411-0x000001C7E86F0000-0x000001C7E8700000-memory.dmp

Download

memory/2464-412-0x000001C7E86F0000-0x000001C7E8700000-memory.dmp

Download

memory/2464-413-0x000001C7E86F0000-0x000001C7E8700000-memory.dmp

Download

memory/2464-415-0x000001C7E86F0000-0x000001C7E8700000-memory.dmp

Download

memory/2464-414-0x000001C7E86F0000-0x000001C7E8700000-memory.dmp

Download

memory/2628-373-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/2628-160-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/2708-110-0x0000000140000000-0x0000000140141000-memory.dmp

Download

memory/2708-167-0x0000000140000000-0x0000000140141000-memory.dmp

Download

memory/2836-164-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/2836-374-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/3000-181-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3000-222-0x000000000A520000-0x000000000A528000-memory.dmp

Download

memory/3000-376-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3000-188-0x0000000001C30000-0x0000000001C40000-memory.dmp

Download

memory/3000-206-0x0000000001EE0000-0x0000000001EF0000-memory.dmp

Download

memory/3000-172-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/3000-178-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/3380-54-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/3380-40-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/3496-92-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/3496-85-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/3496-159-0x0000000140000000-0x0000000140175000-memory.dmp

Download

memory/3496-91-0x0000000140000000-0x0000000140175000-memory.dmp

Download

memory/3916-122-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/3916-325-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/3916-130-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/3916-127-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/4168-8-0x0000000002530000-0x0000000002596000-memory.dmp

Download

memory/4168-0-0x0000000000400000-0x0000000000586000-memory.dmp

Download

memory/4168-90-0x0000000000400000-0x0000000000586000-memory.dmp

Download

memory/4168-1-0x0000000002530000-0x0000000002596000-memory.dmp

Download

memory/4408-153-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/4408-151-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/4520-55-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/4520-61-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/4520-64-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/4520-68-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/4520-53-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/4548-42-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/4548-48-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/4548-50-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4548-129-0x0000000140000000-0x00000001402D4000-memory.dmp

Download