6ad102560ca3e0543ebdd6a61e6a7cd7dba684ba69ec146e2d5f30ad89ae626b

Analysis

max time kernel
149s
max time network
146s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
04/06/2026, 07:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-04_5e82194a01c1ee5a7701319a91ae1469_icedid_luca-stealer_njrat_stealc.exe
Size 2.6MB
Sample260604-jmkq8aa19s
SHA256 6ad102560ca3e0543ebdd6a61e6a7cd7dba684ba69ec146e2d5f30ad89ae626b
MD5 5e82194a01c1ee5a7701319a91ae1469
SHA1 93522121cb1f29aa907640ef58c98ff9a61487ab
SHA512 9c1cd3eb12832af30cc9d6c324ac674c6a9e90f8ec37dad81b5dd387268f95c5e17d302162aa88bb6fe5a7920fdd4cc28de320bb6c0d5ec225503c13f55defa8
SSDEEP 49152:AucqsF0XxUtEmuxNXDNy9e9kVyC/ZwAUWSeLNiXicJFFRGNzj3:AisQ6XkO7wRGpj3
TLSH
T1FBC55BD521B841ACE166D87D89418D4AE9FB7C0D073979FB0270B9581F3FBEA0A35E21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
800	alg.exe
4492	DiagnosticsHub.StandardCollector.Service.exe
5952	fxssvc.exe
4660	elevation_service.exe
5844	elevation_service.exe
2812	maintenanceservice.exe
2292	msdtc.exe
2624	OSE.EXE
5428	PerceptionSimulationService.exe
5384	perfhost.exe
5348	locator.exe
4444	SensorDataService.exe
6104	snmptrap.exe
3820	spectrum.exe
4512	ssh-agent.exe
4356	TieringEngineService.exe
5792	AgentService.exe
1892	vds.exe
1036	vssvc.exe
2880	wbengine.exe
5220	WmiApSrv.exe
4956	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\e:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe

Drops file in System32 directory 42 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-06-04_5e82194a01c1ee5a7701319a91ae1469_icedid_luca-stealer_njrat_stealc.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-06-04_5e82194a01c1ee5a7701319a91ae1469_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-06-04_5e82194a01c1ee5a7701319a91ae1469_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-06-04_5e82194a01c1ee5a7701319a91ae1469_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-06-04_5e82194a01c1ee5a7701319a91ae1469_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-06-04_5e82194a01c1ee5a7701319a91ae1469_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-06-04_5e82194a01c1ee5a7701319a91ae1469_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-06-04_5e82194a01c1ee5a7701319a91ae1469_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-06-04_5e82194a01c1ee5a7701319a91ae1469_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-06-04_5e82194a01c1ee5a7701319a91ae1469_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-06-04_5e82194a01c1ee5a7701319a91ae1469_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-06-04_5e82194a01c1ee5a7701319a91ae1469_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-06-04_5e82194a01c1ee5a7701319a91ae1469_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-06-04_5e82194a01c1ee5a7701319a91ae1469_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-06-04_5e82194a01c1ee5a7701319a91ae1469_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-06-04_5e82194a01c1ee5a7701319a91ae1469_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-06-04_5e82194a01c1ee5a7701319a91ae1469_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\87b4b187ccebd5c8.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-06-04_5e82194a01c1ee5a7701319a91ae1469_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-06-04_5e82194a01c1ee5a7701319a91ae1469_icedid_luca-stealer_njrat_stealc.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\{17A6A947-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db	spectrum.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-06-04_5e82194a01c1ee5a7701319a91ae1469_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-06-04_5e82194a01c1ee5a7701319a91ae1469_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-06-04_5e82194a01c1ee5a7701319a91ae1469_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	spectrum.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-06-04_5e82194a01c1ee5a7701319a91ae1469_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	2026-06-04_5e82194a01c1ee5a7701319a91ae1469_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-06-04_5e82194a01c1ee5a7701319a91ae1469_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-06-04_5e82194a01c1ee5a7701319a91ae1469_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-06-04_5e82194a01c1ee5a7701319a91ae1469_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2026-06-04_5e82194a01c1ee5a7701319a91ae1469_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-06-04_5e82194a01c1ee5a7701319a91ae1469_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-06-04_5e82194a01c1ee5a7701319a91ae1469_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2026-06-04_5e82194a01c1ee5a7701319a91ae1469_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2026-06-04_5e82194a01c1ee5a7701319a91ae1469_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-06-04_5e82194a01c1ee5a7701319a91ae1469_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	2026-06-04_5e82194a01c1ee5a7701319a91ae1469_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-06-04_5e82194a01c1ee5a7701319a91ae1469_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	2026-06-04_5e82194a01c1ee5a7701319a91ae1469_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	2026-06-04_5e82194a01c1ee5a7701319a91ae1469_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-06-04_5e82194a01c1ee5a7701319a91ae1469_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	2026-06-04_5e82194a01c1ee5a7701319a91ae1469_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	2026-06-04_5e82194a01c1ee5a7701319a91ae1469_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	2026-06-04_5e82194a01c1ee5a7701319a91ae1469_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-06-04_5e82194a01c1ee5a7701319a91ae1469_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-06-04_5e82194a01c1ee5a7701319a91ae1469_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2026-06-04_5e82194a01c1ee5a7701319a91ae1469_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-06-04_5e82194a01c1ee5a7701319a91ae1469_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a6fe2669f6f3dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ico\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008ab01869f6f3dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raw	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dib\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.crw	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000068313668f6f3dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f9cd9b61f6f3dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpeg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tiff	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f92dbd61f6f3dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wdp	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000026c50c69f6f3dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.txt	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 49 IoCs

pid	Process
484	2026-06-04_5e82194a01c1ee5a7701319a91ae1469_icedid_luca-stealer_njrat_stealc.exe
484	2026-06-04_5e82194a01c1ee5a7701319a91ae1469_icedid_luca-stealer_njrat_stealc.exe
484	2026-06-04_5e82194a01c1ee5a7701319a91ae1469_icedid_luca-stealer_njrat_stealc.exe
484	2026-06-04_5e82194a01c1ee5a7701319a91ae1469_icedid_luca-stealer_njrat_stealc.exe
484	2026-06-04_5e82194a01c1ee5a7701319a91ae1469_icedid_luca-stealer_njrat_stealc.exe
484	2026-06-04_5e82194a01c1ee5a7701319a91ae1469_icedid_luca-stealer_njrat_stealc.exe
484	2026-06-04_5e82194a01c1ee5a7701319a91ae1469_icedid_luca-stealer_njrat_stealc.exe
484	2026-06-04_5e82194a01c1ee5a7701319a91ae1469_icedid_luca-stealer_njrat_stealc.exe
484	2026-06-04_5e82194a01c1ee5a7701319a91ae1469_icedid_luca-stealer_njrat_stealc.exe
484	2026-06-04_5e82194a01c1ee5a7701319a91ae1469_icedid_luca-stealer_njrat_stealc.exe
484	2026-06-04_5e82194a01c1ee5a7701319a91ae1469_icedid_luca-stealer_njrat_stealc.exe
484	2026-06-04_5e82194a01c1ee5a7701319a91ae1469_icedid_luca-stealer_njrat_stealc.exe
484	2026-06-04_5e82194a01c1ee5a7701319a91ae1469_icedid_luca-stealer_njrat_stealc.exe
484	2026-06-04_5e82194a01c1ee5a7701319a91ae1469_icedid_luca-stealer_njrat_stealc.exe
484	2026-06-04_5e82194a01c1ee5a7701319a91ae1469_icedid_luca-stealer_njrat_stealc.exe
484	2026-06-04_5e82194a01c1ee5a7701319a91ae1469_icedid_luca-stealer_njrat_stealc.exe
484	2026-06-04_5e82194a01c1ee5a7701319a91ae1469_icedid_luca-stealer_njrat_stealc.exe
484	2026-06-04_5e82194a01c1ee5a7701319a91ae1469_icedid_luca-stealer_njrat_stealc.exe
484	2026-06-04_5e82194a01c1ee5a7701319a91ae1469_icedid_luca-stealer_njrat_stealc.exe
484	2026-06-04_5e82194a01c1ee5a7701319a91ae1469_icedid_luca-stealer_njrat_stealc.exe
484	2026-06-04_5e82194a01c1ee5a7701319a91ae1469_icedid_luca-stealer_njrat_stealc.exe
484	2026-06-04_5e82194a01c1ee5a7701319a91ae1469_icedid_luca-stealer_njrat_stealc.exe
484	2026-06-04_5e82194a01c1ee5a7701319a91ae1469_icedid_luca-stealer_njrat_stealc.exe
484	2026-06-04_5e82194a01c1ee5a7701319a91ae1469_icedid_luca-stealer_njrat_stealc.exe
484	2026-06-04_5e82194a01c1ee5a7701319a91ae1469_icedid_luca-stealer_njrat_stealc.exe
484	2026-06-04_5e82194a01c1ee5a7701319a91ae1469_icedid_luca-stealer_njrat_stealc.exe
484	2026-06-04_5e82194a01c1ee5a7701319a91ae1469_icedid_luca-stealer_njrat_stealc.exe
484	2026-06-04_5e82194a01c1ee5a7701319a91ae1469_icedid_luca-stealer_njrat_stealc.exe
484	2026-06-04_5e82194a01c1ee5a7701319a91ae1469_icedid_luca-stealer_njrat_stealc.exe
484	2026-06-04_5e82194a01c1ee5a7701319a91ae1469_icedid_luca-stealer_njrat_stealc.exe
484	2026-06-04_5e82194a01c1ee5a7701319a91ae1469_icedid_luca-stealer_njrat_stealc.exe
484	2026-06-04_5e82194a01c1ee5a7701319a91ae1469_icedid_luca-stealer_njrat_stealc.exe
484	2026-06-04_5e82194a01c1ee5a7701319a91ae1469_icedid_luca-stealer_njrat_stealc.exe
484	2026-06-04_5e82194a01c1ee5a7701319a91ae1469_icedid_luca-stealer_njrat_stealc.exe
484	2026-06-04_5e82194a01c1ee5a7701319a91ae1469_icedid_luca-stealer_njrat_stealc.exe
4492	DiagnosticsHub.StandardCollector.Service.exe
4492	DiagnosticsHub.StandardCollector.Service.exe
4492	DiagnosticsHub.StandardCollector.Service.exe
4492	DiagnosticsHub.StandardCollector.Service.exe
4492	DiagnosticsHub.StandardCollector.Service.exe
4492	DiagnosticsHub.StandardCollector.Service.exe
4492	DiagnosticsHub.StandardCollector.Service.exe
4660	elevation_service.exe
4660	elevation_service.exe
4660	elevation_service.exe
4660	elevation_service.exe
4660	elevation_service.exe
4660	elevation_service.exe
4660	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
684	Process not Found
684	Process not Found

Suspicious use of AdjustPrivilegeToken 21 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	484	2026-06-04_5e82194a01c1ee5a7701319a91ae1469_icedid_luca-stealer_njrat_stealc.exe
Token: SeAuditPrivilege	5952	fxssvc.exe
Token: SeRestorePrivilege	4356	TieringEngineService.exe
Token: SeManageVolumePrivilege	4356	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	5792	AgentService.exe
Token: SeBackupPrivilege	1036	vssvc.exe
Token: SeRestorePrivilege	1036	vssvc.exe
Token: SeAuditPrivilege	1036	vssvc.exe
Token: SeBackupPrivilege	2880	wbengine.exe
Token: SeRestorePrivilege	2880	wbengine.exe
Token: SeSecurityPrivilege	2880	wbengine.exe
Token: 33	4956	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4956	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4956	SearchIndexer.exe
Token: SeDebugPrivilege	484	2026-06-04_5e82194a01c1ee5a7701319a91ae1469_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	484	2026-06-04_5e82194a01c1ee5a7701319a91ae1469_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	484	2026-06-04_5e82194a01c1ee5a7701319a91ae1469_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	484	2026-06-04_5e82194a01c1ee5a7701319a91ae1469_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	484	2026-06-04_5e82194a01c1ee5a7701319a91ae1469_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	4492	DiagnosticsHub.StandardCollector.Service.exe
Token: SeDebugPrivilege	4660	elevation_service.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4956 wrote to memory of 3104	4956	SearchIndexer.exe	105
PID 4956 wrote to memory of 2488	4956	SearchIndexer.exe	106
PID 4956 wrote to memory of 4568	4956	SearchIndexer.exe	107

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-06-04_5e82194a01c1ee5a7701319a91ae1469_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-04_5e82194a01c1ee5a7701319a91ae1469_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:484

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:800

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4492

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:2476

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:5952

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4660

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5844

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2812

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:2292

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2624

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5428

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5384

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:5348

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4444

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:6104

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3820

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4512

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:2592

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4356

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5792

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:1892

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1036

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2880

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:5220

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4956
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3104
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2884 2880 924 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2488
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2844 2876 924 {85EE815A-7738-4808-A14A-3AD87E32A3BF}
  2⤵
  PID:4568

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 6c876d42097617d4ad2c7e712f9a5eac9ae39f9de98d492cf8bbb6b2cd63a37e
MD5 a3acf0ae4324e44a2a67c0e7a1f92ced
SHA1 5f3366558a3f2a21892ee06ffbd6a72b1365f39f
SHA512 51bcfd5fb1521fc428b96b53e5b2a13b0edc335dea3c3847f5ef671a14f946844995d74bbe129ef9e80607a60f0a8531e675b05861d410182e568a0b54294127
SSDEEP 49152:xb+632BuPkFKRrdE6ohdstBhuXjfS4LWxn1LNiXicJFFRGNzj3:33q6mjB+7wRGpj3
TLSH
T106D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 a05e7c6efb77a34a393e7def1c9f3b83927c1ea43039ada8ffd3e9412776296f
MD5 2bcb94eb21eeddef222678f0bcbc8a91
SHA1 be4ce7b3aeb2dcab3c3e434b220ef4d21cd5cf5e
SHA512 9b412162c43215fe3de5db661b387841f2bfae78e67fb6a7db1d7c505546ba3925e033496717d5e102e95d486c1947f96d56d89b9e5288275dbbea8fe1c4aee6
SSDEEP 24576:OXYfDtczAy/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:NtcPLNiXicJFFRGNzj3
TLSH
T19A75012963D408F9EDBB813CC8B28411E6727C554760E7DB03A4A92A5F337D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 0590de7e52478874e205b1bfdb818b5add493db81f52340b82919e53e1c47084
MD5 747220db14093481461235d9be0ad93d
SHA1 a7bce9bd23afad1cfb4f1f601e7daa66bff13bef
SHA512 1608589346425b27a0ee1703f5865cd4ba1c781ba353596ff34b77a04731b9caacc57bc0021420970d3b9a7b17e8d8ad72d59c02578b65f6d107a177bd4bd7fb
SSDEEP 24576:h0Le5ji0hmxhrMd/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:hPji0AzILNiXicJFFRGNzj3
TLSH
T126859E16F6748331D073C0B9C5D2A69EE97130865B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 89cb318366f8813756d1933848dad57cfa9ae11f09c553ff094a15fb43d1903c
MD5 0114b355a05f76a74a9c651170a4017d
SHA1 e73e2a8f385b73c0bec50fbf5c2f2a2aafc8a424
SHA512 5cd0b2ad1542b76303caa92f25396228b625e20196f90037fdf602b6b22bd33f30ef40819a346805412d9b58409ebbb6a8719d6bb080151e5bf46f51e9a1724f
SSDEEP 24576:Ta7/ezSC6vUyD/aqgrvWj6q8wyu//TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:+/ezSC6vUzPv+HjysLNiXicJFFRGNzj3
TLSH
T1B6756C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 526e1fce9ba7bb7e50f4675b18e62a704f4d5f4b217218d6bd93ee02ba4d7ef7
MD5 59f6d61c7908f387bebd2d7caffb8954
SHA1 e612bb8b3cf9347d810666b3d598e548b218e925
SHA512 2959b6b9c0e07d47aeb90ee576672d3a1cad3b39e60ed5c42a3f509fec3a83e264eb193f39622b5bed23f67098a2ebc081a3f0c93ca143412a2543209981771c
SSDEEP 24576:lVbqPb88hv/l+Bu/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:lVO88hXl+oLNiXicJFFRGNzj3
TLSH
T18E559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E67BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 fa39295cd323f823486dd52950e4df7bdd8bda26dfb2a29b31da5ab7fed9d745
MD5 83d5bd594c4bbdd80933211274d097a7
SHA1 9e70274d8c129d3af71369aca3a8c02c3c167e7a
SHA512 9f55ad0d96268066c958e0ec03d96f2c593328058acd882c7710c78db2273e7f3f38ee4ff2bc66bd34954d8cd5c93afd2b93ad457fbe0230114c04a087296eac
SSDEEP 24576:XGp/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ILNiXicJFFRGNzj3
TLSH
T1C65523D3468854B1FBFD003A867A5828B5845E2C8A595DE3D2543E5EA13CFEBCF39123
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 8a358e09dca86ded38c7b57fa80c8926846ece2f001aea737ed01b32ea8b8410
MD5 e6fb178b291de3ca27af344ab34647e9
SHA1 03b6a8d3466dcde97fcdcdd75d959b10f4eb5c8b
SHA512 168c988b022883bc91ebf463b1e8688a0551fd22fa785334d307746f2b761f8a46c31387509c17886d716f5e6acb8ed2b578ebf97ad216b08f93d67f02697c45
SSDEEP 24576:sJIUW/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:sJIUWLNiXicJFFRGNzj3
TLSH
T12D75CF7BEE28FCE2C27E4C7957518600E76278304F62A3CBD165820EDE236E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 4d7bb9bc0956d8642750f05f7647f2da5847874430a0a7273f56fc0a4b244a94
MD5 a79be678921f3bee92ca85d1989954d3
SHA1 e63404d1f64ec9a30da45b9ff620190618489d93
SHA512 00df6438adbe74fc182bc4b4a55f724e125b552c75d63a6ddcfac2bcc5fbefd70680b9190d8d38693fea6028a357b5e341a19569689401c548f44799ee5dddb3
SSDEEP 49152:VQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THI:VQvGAdlCEL8c/WRNw5Cv7wRGpj3
TLSH
T124266C656BF880F5E0B7E178897A8572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 1aabf544de6e88a53746aa48b44585c44683a0f6da304018d7ad818ed099a74f
MD5 c68c5cb620f65c4a6d4e56cc9326a671
SHA1 57e24e353f7ca870f0bdefe1194e6c8afdf1d0c7
SHA512 da3a1dac5fa12040946740d10280eb55f46585aec021ac5a60465b5afd9645014d3ca590551ab1cae3d8249830df937a505c814cd833bd2525bb75d4480a7e4a
SSDEEP 24576:HfewsAj4/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:/lj4LNiXicJFFRGNzj3
TLSH
T1E575E031FA74E032C7BF0CB61B36C716646C7E204B6119C3E3A85E9E59346D26736A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 f8aa45b23120e7b6ccc735c168e0ceedf655f176397dc671e0a0630db0607023
MD5 586bc34e7a964f52352bb47f115b1303
SHA1 a8da7a90a23cabb06b9589dd7c9696561fef186c
SHA512 0a3227e56153d9478d7a980318af000f51911a0c4dbb0d43c514af47969f438210564d84fb2fef329060055849206e5a36544c084a8477328b727e68e2e18224
SSDEEP 196608:DUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHMF9:DUEtQevvqc2W1cpV20I32w9
TLSH
T105474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 9a4d1e795cdaf478dcb1a727cd974dd49973ab063f0b10af46aee106ea04befb
MD5 a22996c8c404655c6da8af8838418c5a
SHA1 a2670cc7d7f91afd43c197c37cfa1b39a99c28b8
SHA512 3ffc7f1792d8f36ee9301759f7970796d2e6658e65b0f8c13993749276759e64aaadff2d557307fa6d747141302675488ed319b2482b18ad64ee85f71f7fc56f
SSDEEP 49152:ACbRquA/m2yL5zLfFiV+XenmE3/zYLNiXicJFFRGNzj3:Joq2Vjnmj7wRGpj3
TLSH
T1C3D58D0976B881E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 661ef6f31191a550fb6285470a8ca377e8c85c34bd7ef4763d9de8bc628ef4eb
MD5 d6d894c713033c3e67f80c6345339543
SHA1 e643faa205a61584052a85ddb7293d04783829b9
SHA512 c3346968daab84968c2bff3a1fd6eaec6aa53b0cb5211252299cef699c1932fb2c812b26f4df5fe4db2db9913f08cfd0850fc1597920002726116f73bf0ff641
SSDEEP 24576:QAhGL6IFoiwtA5l7S53D/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:QAM5Foiq5TLNiXicJFFRGNzj3
TLSH
T160359D81E7F955D4F5F3AA7899B68170EA76BCAA5E31C20F2150911F0E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 899df1a26ba661a81e2f2917af97a3449d69bde96677322a54b530602a18dffb
MD5 cf33a00ee2523b2c5141765824d998f7
SHA1 0428247fc55e06963e69c2c1c7f017f4876b1a47
SHA512 67a1ac7bcae04d7db8c3278bb08b082abdab9a4be2735cb37ca42519795b17ee47a91b65e7f862c6587d7d7313ad363cc179fa00f929b946444234804c796632
SSDEEP 24576:zwuROWM/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:zwSOHLNiXicJFFRGNzj3
TLSH
T17B65F18632980CF9E9BA41398657C035F7F2BC152A21DB5F5360C65B6F37361AE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 cd584683f1971c5f938ae7b40988029f2cc573bf7b5a83e8c0a31781d4ee1a6a
MD5 e977c88fccb6631ad2180601f4b5c938
SHA1 336e5380e289d7966f5f53ff085d39cb3c3030f0
SHA512 02f7f887f6e562fc47ccf15a7adb1a11cde94a7bb54cd16093c4be9474f1f9d017137a1823281a0562202e0b96659ba0c103afb0ef0adb0003b0b801589e0ed6
SSDEEP 24576:rZul/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:cLNiXicJFFRGNzj3
TLSH
T1A955129622C820F5E6BB403DC9F54504E7A17C2A573643CF52242A6E6F36FD69E39332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 f56f56d131b6bf68a8515151a9ae2ad47705ed6702e385b3b06130dd212d5b21
MD5 7aef21b38165de7fcfc5bd98a1112aeb
SHA1 13b030034c19e0d5d4d8f32ac1ca112ac7a052d3
SHA512 7c1c527cb3b7a63808bee212ce5d2977b98c1f9cec3b1d6e406fd8f49d9bc4d14e3845f31d34092da68dd716f8eb1a433ae986235877c29807e878f1980c84a7
SSDEEP 98304:NQRQyi36YOcPDLvw2gAf+PN367wRGpj3:kQyiKanX+PNeF9
TLSH
T186667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 7d8d56cf3060aeccb98b8200cd971794bf139f3694bf2272bddf15a9e3e5d2d6
MD5 ed712a8a41899649cf5c706e1d389ce4
SHA1 2a29a6d7722567a658c3866b80423b5498e4fb81
SHA512 9aeaa8877ca6db82045c58615357928071a48bbdc53c63782202e11a9fbdac94eefef14fd6560164054ff9aa635551da35c8f72149e2839ca16809440adbaa68
SSDEEP 98304:aQRQyi36YOcPDLvw2gAf+PN367wRGpj3:RQyiKanX+PNeF9
TLSH
T1AB667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 604ec209f4df742c66e269dca1e150745e4235848a08b68e93948bc6f66bdcff
MD5 6c8ba51876ea3d0082c61b386f5005fd
SHA1 3b233a03cd1750910c876b4036d6f98106819d14
SHA512 47d0b26292d8619a626f349703d163bc4358eccc25d46a38068fba4d0d492b380df8057efa079d6a6392076555af55a57648909ad014aa6c0310d696d9e26636
SSDEEP 49152:+68Qg55nhkeWu7PNU3/ILNiXicJFFRGNzj3:MthTRc/I7wRGpj3
TLSH
T194B54933B2F600A9C45DE1769F4A873196D17C758FE1E3DB8111720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 ff9691e688a075719dd6586067fb3dcef1061b67261c327698312a83b0d06080
MD5 e5a02ca38123b1422a327909143ab097
SHA1 33137b696e7b8bc05447cc35f129553152c6335d
SHA512 43e007b407c396a5cff1e4928a04be62f79200671de6c7a86f8158574a94ddb073b4551b86b494ee06304834b7a162a31f01a76f6ed19e20c8fac3a9f647aae8
SSDEEP 98304:py5112gYy5azzVvU69nLKnhZp7wRGpj3:ELIHRWhfF9
TLSH
T13C167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 25f4dd64cd99fe516fb97463e1dcd6d439e4bbb4e01ebae8e685255fe54f4a6c
MD5 e9d6f5de80134e97f20bb4b14eabe82a
SHA1 5a14a58e2ffbb7e25393000a851b8e7f11b3196e
SHA512 7d1cd8c8cb4f7ac68d772ffe11fcb0cfca740dac7314cf43d966d1e236d9f9a1b8c1ab753e39e06d2280ce0d7e061166ca31f09e144dadd10d5ac5e15edee52c
SSDEEP 49152:uB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glCLNiXicJFFRGNzj3:8u6JmIxd2dC7wRGpj3
TLSH
T1A5D59D13F1D901E8D06ED478974A9233FA62BC490B35B6EF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 7e6617ef5f954eb9bee3fc6b8d9401b7bbb9f82f1fd5516a875b731d7ff03eb8
MD5 f3fb939dc7dafc856054d7d192da944c
SHA1 e399c0e5215e1c0d731f1cd5d866b56705716c03
SHA512 9c8b390e25fa1a33927a2618bcf80146128f44a7163f20d3282b878d52604b162055954a5cb7de51d4bfd7b1a5c6b3aa613689abadeb40305733b8244976b893
SSDEEP 49152:k1hpsNoJpF1A67U44CwH7R4x2LNiXicJFFRGNzj3:kmifPqRj7wRGpj3
TLSH
T1F1B5AD13F29900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 af670ee9dc372f604d2b9bf9cfb6d49354c58a512dffc1df0b94ab7d9fd497eb
MD5 9b249774066db8a1ec1f87869e4e3424
SHA1 d9c34419aa2a9864fdad339268f6ef0600cbe0dd
SHA512 cb24d8d787ee2e0cc8e71d46915b6a586e0690146d3be38ac9c7717fb325985077c0b101e58bdda1cb180267112c95c5d31682a02bda59abc6f5c95d37484bc7
SSDEEP 49152:OSuZQIY0Be2KkRVtOnks6NMHqlLNiXicJFFRGNzj3:A5dKqi61l7wRGpj3
TLSH
T1F9C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 4b11b30de321527aba611d46dc298577be0a1f7f22d74a8f3c9e005bef887e13
MD5 2fdc02112909959dcc1dd7de85038a58
SHA1 376cf7dc9f4706e87bcf241a886e06c9b45247bd
SHA512 865774e744f497b6341a323a2f7815d0f43c3f155293ccc8a459ca18ebbcffcc20a9a7c9edae96f9b82d4c72e1fb0d7d9c5613517f67ad2730ee2ffe4abd4acb
SSDEEP 49152:DhtSn8EApI0figjgiDn0AP5wyLNiXicJFFRGNzj3:iX2iWphn7wRGpj3
TLSH
T16995BE13F2D900E8D06ED178C7568632E962BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 a00937d76873a083293fbd2bd60f2adce0d0214ab893c837c90e534638aa6932
MD5 bcb651aa80c32bc9f9de7fcdac0edc28
SHA1 ee93ae7c07464e4a0302ec788d29a96cafca3458
SHA512 317dbda12ec5aa9048528cd5c49d5767728db9069d00ad6dbb17ec5ded9ca598db0a2de46e92a38b2635b3e93da2110f8e22224e4e03d487be0f49adcf9c7e26
SSDEEP 12288:dNiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:dR/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T13A5523D3548955B1FAFC0039C6754428F5882E2DEB5619E3E3083D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 c48483c9b9568d13815f5901fedff9d812dfbbe8ddffa02ba511f3c2b15b4118
MD5 d35a0dcb58a1408b8b102de466e20805
SHA1 81ef5f00ee3ecdc92c095019a0eac27ef1b3910d
SHA512 1951b05cb0ee7244a3d8d35868ef3b2446ff12549c2142f61c11c624ca0b815b2b8a74f97707ac2540fc7a4da3bac34d8f65b6bf1b25a972138b6f708938699c
SSDEEP 12288:MCiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:ME/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1C35523D3548955B1FABC0039C6754428F5882E2DEB5619E3E3483D1EA278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 8de5166bf2b1ba16211dd0a7f66350263a26cdd4fcb2925a14775015b654af4b
MD5 3b59d92b6cbcb694b4d6dd3c86162408
SHA1 fb34e15ef8900245893a9f674fcf19964364b73e
SHA512 c91013abe1816bddbac643349cf121cab46dfee115c7bda618d1f920b8526af605148c1f2f83b71aeedc5427c51a19d0fc1102af4049b47844e85637ca7cc6f0
SSDEEP 12288:TUiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:T+/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1B55523D3558955B1FAFC0039C6764428F5881E2DEB5618E3E3483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 1015c4b28180f861d05e1c3e7118d7d2676f8e5c592dfdb9bed917543f97938a
MD5 5ed98c1d415332d3a264488e92c68535
SHA1 3bda68b36354a25a4f62f60e36b8c7e5d2be1520
SHA512 67a94b6de323d5213294097d1c86d008b5ae3d304f97293d01d285d575d1370a6d907fd37150c335e4e90d565f0038da5f556d74b18c45571d040e3d24294219
SSDEEP 12288:aVXiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:k/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T19E552393168900E1E9BD8039CA764424F2A47D6CD7325AEBD3003D1E5A75FDA9F38A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 4d9d52a8ac77404c6c056f5c910d7a5da032d55238303e91c7e45dfb61c44c2e
MD5 d1fd4e875df1ebefa794e9fec81b508c
SHA1 968d1ff233e12e4e455c49b1a406fdd58500366a
SHA512 6bbb886bc79c766cf18668e7171a5bd0b6c3aefa2793b39eeda67741c3a80c24ffc19e60b2fcf675586950527185088a1baa25e013f9e4e9024fa004bea9c0b3
SSDEEP 12288:/PiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:/7/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1075523D3548955B1FAFC0039C6764428F5881E2DEB5619E3E3483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 718e57abf26dd4dd87668b266a0d36eb2ccc746ad265b629dea0544e5bfea3ae
MD5 7f8b09217cdca3f457f1b345de0a3218
SHA1 928be050f5f0a48d70370802d4709d50150c0e8d
SHA512 d78a6f8caad20e62d35bc85ffdaa433d62687a5c899568d9f18df1882111cf8d74951b5e5a70cbccfc2dceb8eb8d08ccbfd67cf48b5bcff0f072c1e27558c012
SSDEEP 12288:i2iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:iA/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1F75523D3548955B1FABC0039C6754428F5882E2DEB5619E3E3483D1EA278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 6053a6bf31efb138386596d9fa8d7103ff4829a3fa760270c368e1bb30104b69
MD5 6b316e667f412ddf5dae5019d88710f6
SHA1 a86c474ee8511ea6975aac983de3bb81f2108f35
SHA512 6aa492e330a5eb0acc80e9b948ac8b08de7fd966180919817d79a3f88cd37cb038412abc5e9b36ec63e61f12c58eb143a93a2ea9ecf0c7adc4a3505b8ae81ea0
SSDEEP 12288:r6iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:rc/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1AE5523D3548955B1FABC0039C6354428F5882E2DEB5659E3E3083D1EA278FEB9F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 6f98be79caea74e1b2890ed8fc77604215ed3590e59060557e46db23c90cc00d
MD5 afdf2b1d885ba7771255e004ead8c01d
SHA1 4a9e01a866e8eaf62b979b80462bf179e58eec02
SHA512 042d32f1685946f8fbe63f6149bf8a708df20257135a505f2ccd26225b7dca363712e696d8cee64a859944be96e501d7396cde85d2850513408e3afb71f39c4b
SSDEEP 24576:mZM3zFVSOk/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:mZM3zfwLNiXicJFFRGNzj3
TLSH
T11B750295B39018F4ECB7813EC9258815E6B27C194B70CA5F03A4362B5F337A15D3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 81bce65a5b1f40018adaba4b7fcda4514f28de8a4a005103442d94ae02298989
MD5 fdb132eb0e4664d758cf9e48da34a2ff
SHA1 35dc567e5c36873648568252f568edb949ecab93
SHA512 a757ed8b4609dd25844593b4e9d059c7a219bea08fc0fbcf73078d3c89392287f058504ec3131d438aaf4e48d920ab181e715d5d3323a84e7e817f6c3909048e
SSDEEP 12288:QJiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:QV/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1165523D3548955B1FAFC003DC6754428F5882E2DEB5619E3E2483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 366bb8f6e4e6dbaddbc60d821b4e1cf78380011866c6674beebbdbdb539a3323
MD5 83663c09b6085db2b09df95045c0c46d
SHA1 2e6a93ca8ccf2d2ef092c6fb9ac79c9aed6c7b04
SHA512 ac21bac6f565345a4ed0fd8ea91008471d19d3b89d23e4b14a017d91e8c43bde3c18ed9a46564e1ba2426fe82405881c26a4097ab6d21c3ae3bebb952cef35b6
SSDEEP 12288:O1iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:OZ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T19A5523D3548955B1FABC0039C6754428F5886E2DEB5619E3E3083D1EA278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 500dd8933b97ad893227af26ba6454de8416673c601af6ccc33f46f57aa59000
MD5 94635e23c7ac5880c114fcaab0bb05d5
SHA1 1c277d7f1467f604b15455e2d39ff3854c4e9b49
SHA512 d37da7095988e1d30d390114ad501ec284c715dd576ac89ae7732d40d3a819416a7a9fd05f04556060f11487b97b5a3cb5049ba98406a5c0b3f7f7ddcd9f2799
SSDEEP 24576:Kzyo/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:KnLNiXicJFFRGNzj3
TLSH
T163650147729530F9E17A8139C9620911F3757C3647208AEF53642A7A2F37BE19E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 eedb71090d7dcec7ee29d0105e830a2a7094973492c29f866bd7cb39abb0f69d
MD5 dfafddcd34748152bb955ce129e97437
SHA1 76e05541bc00bf65a76434e556e8e683d3ee4bd4
SHA512 a96101995a7dc877538d1ca82fd8c59e5a1a4a052c67b95b6b373b1694415b4db5fa08a05b629510301b07e95d788d4a03b71a966662ceadf1ba2547e0b97aa3
SSDEEP 12288:mJiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:mV/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1FB5523D3548955B1FAFC0039C6754428F5882E2DEB5619E3E2483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 1ed130ed52bfb288bdccab01ae2a4f29d9a2b8a9f45ad7d6a6cf6983192f0f6c
MD5 41aefa8075ae9c6538a91ea9040787ce
SHA1 ba20b466cb88b915fbad9e19832e394888495add
SHA512 c9e1b34f39fe53fcf4838da5845c69bffd9ef9db7858ec50faad6b18959f16fb76eeefa900158ff9b4e7ee8515370a26766005da8216ef68d57e993fb0691033
SSDEEP 12288:KJiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:KV/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1435523D3548955B1FAFC003D86754428F5882E2DEB5619E3E2483D1EA278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 0bfc2ef430e7dd71282fbd1db319203f2cd34d4ce786d07a17ba6bd9ffbb3bd0
MD5 347b48c3923760a21984fc4e75d7935d
SHA1 a7daeb6b9857e01fa65de24dbe92efff6c5de98f
SHA512 20ecc1f0a7beae01b1540e8241b22a0289eee1944622758d495b36dd1f06e121b26025d788194ed4c1af3720aec74be835b94f557fad382da317fb6a7b49a9aa
SSDEEP 24576:tCUApvPDv4Ex1hfe7i8WVq2lIGU8lrtGUJLPuwvAK/TwSfVcYG3K/cJHlnFR+IGe:tCUAPTY+8Wg2lIL8lrIUJLWw7LNiXico
TLSH
T14665BE1EA3DC0896D4BB81358A518A16FB723C2E1B2296CF1160C73D6F27ED95E35F06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 9340a78e5c3a73c87175d14bdc5095930f19429922df7ac28c42748a4f6bc5df
MD5 17ffeae4a2dcfd753d58e902e41b9782
SHA1 8b94b98d4de932da26e72ee9250cadce498db228
SHA512 9377d78bcfb431f774132b71c0acaafffaa328e786627c3b47927baac284e792a5f9d6fb63a22ea50bdd2537e91cbbf7bdfb47cf7f76766f12541fe39468fbd9
SSDEEP 12288:npsf5iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Il/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1D465F15AD28802E8D1AE5139C7664900F3633C2987E1D3CB52D0F93E1F7AAD59EF9613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 15e675e4857e91e64fed71e2ce312bad465559271498cf232d5efa91ab4fa630
MD5 1b6a78deedc37cbc303ac71b96f37c03
SHA1 981aeb59c0cb71c3745a01528eec1da32f533c3e
SHA512 e0d3c2634a6d7870313de8727f78e6c810246b3d43d8874214323337748a38b633bc0d61df59881edd92dde113e6993470db527ba575ea3c6d73355ec86e53ca
SSDEEP 12288:H0iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:He/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T13B552392528C59B1FAFD1039857A9438B14C7E2C9F1598D3E2043A5EA238FDBDF38527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 36920d23b521b2246c9a36f86c99553208789d28d834dae89d28cea74204ee7f
MD5 d9c46afe5babd5852a217e4cf40468da
SHA1 d1159747949ddd6c2e6f34914f497975bab01234
SHA512 3ea55721023c7132024e32012571a13fda5c7adab45412a1701b9ec04886572ef47d975ffb947e0b43f9efd76a4e2de4891709c23b0ac680110e8a251e5a673a
SSDEEP 49152:dRZwQCyiHiQEaaPnM9LNiXicJFFRGNzj3:v9xvPU7wRGpj3
TLSH
T17B85B01E62DC46A5E0BAD278CDA74407E6B27816473197CF0290C27D1F27EF49E3AB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 a7b452e112ad51ac5b62722bd95bf164103f7401156827a911e1542db4eb532f
MD5 dba6d96b6e8489e5b4bcfea87340e30c
SHA1 f62c6d16a954d878536417c17d03e29034a9e6ec
SHA512 d4ca94da678513be813f91ebd309166f9e265c29852b42e0a5036e8ff61e403f773faecbd76f455d90518c3d9a36b7cc944233a68a4629e0e264064df881000e
SSDEEP 24576:HbxA1UGO/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:HbxA1URLNiXicJFFRGNzj3
TLSH
T1E955126E129C14F0F5B9903D89A68005E3317C2A572197EF6180927E4F3BFE99E39F52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 67b14a2027cfca235ca50dae6e76cbc16a4f6faf6effc2164bfa845d72681eff
MD5 05f9590053b580bb51ff80228db9ed03
SHA1 dda0ce739b33abe7d39b3110f5c0a5db91c9d636
SHA512 ec0fa81841c19f06a8f255c69f24cca2c8df93a46c94975878497b2e12d313460a8a76d11a6ec49da973cb02d1274205c720487f1419933bdd2877f82443f559
SSDEEP 24576:GjsmP0yHaqrVqHra44KDzMsrnT/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:GjRP0yHfVqzlAsrnTLNiXicJFFRGNzj3
TLSH
T1F645AF2EF2B910B9D4AAD136454107B5FB71782D1F209AC70170C635AF0AEE89F39F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.3MB
SHA256 60415fb83d85754c890eda116590d55d883a754d85113a5df446493d924797e4
MD5 e6f8aab4aee6a0894c97452c0c7efd94
SHA1 cd02f14c980ae57805e1e0056a319921c1372b1a
SHA512 16fc4ec77cc61ab470ba03592903a93f83f3e95971597c0bf2a290121fad501f10d5607c045f440a62876c0e3b738c72c765023d58d2a73ca3c3b100234bc891
SSDEEP 12288:DWiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Dg/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T16F5523D2518955B1FAFD003D867A4428B1486F2C9B2619E3E1543E1EA27CFEFCF38562
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.6MB
SHA256 aecfc2e02027d331f7572b41906d384223033fbac2daa687fe11506d99b613fa
MD5 3c7188afadc6cad126d4ccb2dd29070f
SHA1 0d79cb14c733882a39155f1bc0f745eece271f86
SHA512 13955fb8cbff2855e9c51d6447fbf87b6891989ea954a1900e6727768bf9f2fe64b5ecfb89b775fa30699d27ad74d4bf358f00933adec59833f4298c53183361
SSDEEP 24576:6ALBUTy/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:6ALBUWLNiXicJFFRGNzj3
TLSH
T132750155E79400F5E97B813CC9728916E272785D0764E7DB03A84B6A1F237E28F3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 86bc5308fb2c48607fe0ca38e90117b4a3a714c353755b19b72e3ab7722111cb
MD5 64efa48ba0a99d361dca0754a3d6d0d8
SHA1 2125c72d1fc4c0dc29f0933fc58877938babacd1
SHA512 b981ae20b73567f9fbb7c7160ea4f2f7d89663ad86ee1f36da1f5c5927ba281aa9725084592ad5720b9edeed1f5702960641bd38ff27b520c91ec77d6c137c47
SSDEEP 24576:tfYNHX/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:tfYtXLNiXicJFFRGNzj3
TLSH
T11E65F12F629D18E4E57B913DCA828109F2727C66171192DF01A0827E1F27FE9BD3E751
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 85e9ed8c978ef926ccdd1ae3887d7f40335746711378804108c337919a5b782a
MD5 29207133aec0558b5c6af2bfb57cbc11
SHA1 90389e0b78f7a2ca5ed29999c7197d80fe69a6a1
SHA512 c76a0a2d4d15dc8642baf0676915cf5238338edefb6a86ddc0751fde220e5d0148653bfccb89a0d1d33b793d34099508c8758d01d2a6d3fdd7f2c686212928fb
SSDEEP 24576:fnXoJjNYH84VVSNAApoEOW66aspcrcHBjSSKHPWdQwPF3hJ8ssmOc+XLxu+x7uKV:fnXoJJYH84VVS6AmETJas+cHBjSSKHPi
TLSH
T14765BFAEA2BC04E8D5BBD17DC5C24506F5B178651331C6CF026082BA7F27AF59E39B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 475fec0d8ba81d05617b299540fe40f258996b365e689a7ae3d793ff861d8df6
MD5 73588c4fa8e82151fb62995488f898ba
SHA1 a2992e5ac863bfb5cee7ec37544d2af2a9d15809
SHA512 e1b2360ce648606068f4c5a341bf28f4fc6a2d182ecf37d3ab98c55c1db032a223493bc958f5029b6401397043057cb91df39b738567c06ec0853066ba87f8f5
SSDEEP 49152:nDLL9TuJ0M/TYW2PALNiXicJFFRGNzj3:0P7wRGpj3
TLSH
T18C858D5EA2EC42D8E4BBD6BD85B79046FAB2B855173081CF0251856E1F23BF05D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.3MB
SHA256 db80d731f74a18fb323634e66a5aa85045d7aa2b2c77f6d9ecafc4253cae830f
MD5 52c93f6435e10f52aa8ad6d553d4ca98
SHA1 1e15b2567235bb53c11324e2c62c2fd7a16f30d8
SHA512 c26f8fe3a1475a977b66ba18f25cf62c9b2751783f315c06d591a63ccef71a6058a6746b5e0923d83503556a2391d230591294202deee6eb80f9ce748b9510d9
SSDEEP 24576:5egJgpwJOmPOHWAKZ8ZguIGyPsxr5Vin10wy/TwSfVcYG3K/cJHlnFR+IGNe8j3w:5ngOJOmPOHkyLNiXicJFFRGNzj3
TLSH
T16755CF3FA7BC15D5E07EC13D8A968816F6B1782603255ACF0160827E5F2BEE46E3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.6MB
SHA256 ea11af41c93326f70047e47488e761d08e35327735fb42a847b9e413a127b0cf
MD5 9c4120c7a39e0676e2b05aca3a41e4b8
SHA1 ef3030655cd407c3f2bd544831e13e70824ef8f8
SHA512 3dee4956f780843b271bb0df2ef42b10e7eb8a3a94089a625c02485b546447f7f6fffad0f996f4ab8b8f3867f91e4de7d9cd9ccff665fb790896b65accdfb1f5
SSDEEP 24576:ULJnJiTk3R3waE4JrOA/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ULJnJK8R304ljLNiXicJFFRGNzj3
TLSH
T18275E03DD2A810E8E4B7C2B4825A1656FF31387C2B2169CB55B4D5353F12FE0AA39F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 f4a155abe17b8cb0f0763085dbb3a21953fb5bc624961a889252d7abb552e4c1
MD5 64d766bbb5a510a1f0ba8786fe9df7c4
SHA1 8a3d30ebcfd59fc9b2478243239de29a6112a74e
SHA512 83d55e14af52ab1c0df4beef2e455b66aba8eabd038a6f6f2957ba094ae1ce2b36436602e8aecd5adb99ce8995a360e0abfc6840e547df798a7f5c682d73f11f
SSDEEP 49152:P9GqCzDScAZmlvTcFg8Ph6cLNiXicJFFRGNzj3:737wRGpj3
TLSH
T11F955D05F7EB5298E8B3C9F1C96294159B327C509B34F7EF4A80CA6A1E32BD1D934B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 ab2c9e7bf8e0e750580ae7086e2f7641f8995d9e6a65001277090a69ff5a99b2
MD5 c5d972d7b404155d7623fb451bbe6ac9
SHA1 ee894d3b5c20442c7e2f9a27c457a629574caf41
SHA512 b606c70aefd1dfbcf7e2e30249bbbd58f00ee9e4632a41f80b485bdce953196419d3489350fd617156ee0cd58c19e96ea631abcbce7934aa7a46a81d7ae2ad08
SSDEEP 24576:nlYJeXm5jUuEi/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:nlYJeXmRUuEiLNiXicJFFRGNzj3
TLSH
T1B255129E268C30F1E27E803D85A24414E371B879571217FF91A0A57E8F3AFE65F38A51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.4MB
SHA256 fdf1b89d55ed2ce0989a9c75106856c96d16b4dd1e6528eac42dcc1d16fb6656
MD5 4bccc85d17726e807974e0eaae63f9e8
SHA1 dc2c916f8842e384615c77fcc6767b6310a64bf5
SHA512 b52d80e2418489e56765fc5ba657e4711efe1a9518613b42c3f0d479ab4cc9ba094929d6587e630aef96f6a06ed8160b2c9150b5d32be30847e8da483b57fe5d
SSDEEP 24576:5Vtyz/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:5VtULNiXicJFFRGNzj3
TLSH
T18965124122C465E4EABD053CCA734064EA647C249F2157EF9190BA3F6B36FD5EE34B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.3MB
SHA256 a08554f6c8e68ba46a7842bd97a8b382e54b1bd2440e41a3941e32e7396e2b2d
MD5 da02ef2e6ac38d3653dd8bd14db38ddc
SHA1 f6ed1c0de92f02241954dc662100f6cd2ca8e500
SHA512 cf6ff5c7c64afe86d9c19bd44752ecccdbafedf0ea150d31ef8c3581e16917d1d71df43bcfc80dcea18f811f38103dc06e61dfef67dddbd1c13bd319aefeb52b
SSDEEP 12288:VPgiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:py/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1A25523DA118965B1EABD003D86364424F1887E3C9B2528F7A194793ED379FDBCF38852
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 39c9403235fc6ac71729c6293948b7047b094862098745127d8798e5a874d41c
MD5 59a461a45a68fd004f608b753a5ba5d0
SHA1 697e5845ca61f1aa910a7cd9c538314473ba4b3b
SHA512 0d47d6d8acec495b75080e9e8616b3dbb855e168d780a615fad42f64ca9ae702c0b94cb996d4214f7c09b8d03a04876fdfe1df4683389838fada33f9df61beab
SSDEEP 24576:HC+TyQIu93VAumZr7jmF/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:H/TfIq+YFLNiXicJFFRGNzj3
TLSH
T117558C1DA7E919CAE2B6C575C8A34493E633B872137186CF2044C07D499EFE9AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 d79862d032f322c5430e568481dac9fa64beb11f535aa7f73418cabf8f77a56d
MD5 52a5b9c78a7e20cf8230cb771e36d8c6
SHA1 224cb1ef71f5b27db9bec36d394cb5913ad03aee
SHA512 0d0afc993b61c22bd12d369304bfddb2e2f55c7f0b8a6b7b794e93316f951ca6eb5e2345b077c0387cce058e993d5661dfeb6e3f02d3f4b0742f322d8c0238c9
SSDEEP 24576:eLQikZm/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:EQik4LNiXicJFFRGNzj3
TLSH
T1C665F10FB3AA00A5E1BB813C88554115F6B37834571267DF4290CB7E4B77AEABE38B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 6dab5df54345b9ed91e68f21a326be1700f1db6d4d89bdbd40a92471743ddfdb
MD5 9f24d8bdfb51b604ccba830a5117fb2f
SHA1 6a21e0a584d1f5856cc1003a07fa4148eaf427b8
SHA512 b9980ca9df4fc26fe9279a26f84a84495f34004d9cfaad6f140567b52df1176f04847a63c66c69bc59841484dac2f108c283226588139d936ba6db9b7a2734fd
SSDEEP 49152:MpJFwrPpGyqWo6cbT2TZ8maJO35NPHXogsS7Q78ZGAvL9vnF35LWAPzLNiXicJFc:NpC7b4+80GTk07wRGpj3
TLSH
T1BBA57C3DE2B810ADD9AAC375C5461665EE71382E3F2015DB01B0C578BF1AEF19A38F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 a693a262db3184b22c3203e5e5ad4076d494361857f8e52b1434cbc04da580a8
MD5 a9970065b4c18e7eff8a9b03cd5def79
SHA1 51cf5f4aba6308b98dae2908e6056385e692bf64
SHA512 4acc3df260f26a831facb0918d031429a7ea0fef2925bd58f6741953bc6f7050f854f8602fd9ed680e1d1e58cfee1355b9289f30a54f516ee2899b5373f294fb
SSDEEP 24576:+SAwJPE1IDAo+4Kt+l4413lUQb/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:+qPCIo4Kol4jQbLNiXicJFFRGNzj3
TLSH
T1C655B02AA7F956F4E17AC774C663C511FB723822133163CF9290913E0E16AE89E39F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.6MB
SHA256 2808ac7d43b9aa55dddbbb5b93f801205e122217efbf41d5a078de7e3b64cf7e
MD5 e09631fe58499b1ff1f193db7e8ba405
SHA1 9706e04a2644e452f3b4ab1a04eb5e968e51ef4a
SHA512 59e0eb3dc84bde1890f575362a3eb482a9c6ab5056a5bc13b69a13871189f6307fc1a3c324a1aee787b1bf98a829eb233bfded506863b746473322a911f1e081
SSDEEP 24576:MyLXPLcT94tL/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:My7PoqtLLNiXicJFFRGNzj3
TLSH
T1CB75D03ED66D04F4E57AC13CC6A38906F6723CAD033166CB15A0957A1F6BFE4A939B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StructuredQuerySchema.bin

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin
Size 414KB
SHA256 e67e330837a6b2f6d5f76815e7235a512b54b1c90f2ad62a3e9d142ae6939c8d
MD5 16b9618962f5623ca791a1366eee5708
SHA1 f0d257511952f075b2a0ec7d8e8730c3e464461a
SHA512 18e1d5a105b87fc72df94645685f5a8d3f593df2d3a9b8652b3b4a4ceaf92d3c7a67b0c08847186149dd608428cae8f1b3bc844bc7aacfc9e3219da823ca2fe2
SSDEEP 12288:vMUC7+vlk3n61mSkplXZ5RwmF9n4w/TSD:vXhl6V/i
TLSH
T124945F36BF88CB22C59A15748897C01A2E30A7C49E04CF6B73DC513CFA576685FBA359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.4MB
SHA256 0184d451d8a3d521e78f96e372b9bb5f079a13e5b00d82dd53658b382c1af2c0
MD5 2921affb781b23e894be83f675560f06
SHA1 bcdcc4a13549e7e9a72fc05862b6de771bb62515
SHA512 3efa732473beb57bbdd2a17cba66d585a53cabfceee165393a7837d1f6312eecb6bbfacc70660e62cdf489df9924dad9def419a2c73141ed5238c955715cc943
SSDEEP 24576:mWv8qjp2/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:mWv8DLNiXicJFFRGNzj3
TLSH
T17865129E12C424E4F5BD4138C636802490B17D3A176569FFB1C4A97E8B35BD6CA3EF22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/484-384-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/484-71-0x0000000140000000-0x00000001402A9000-memory.dmp

Download

memory/484-0-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/484-9-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/484-389-0x0000000140000000-0x00000001402A9000-memory.dmp

Download

memory/484-8-0x0000000140000000-0x00000001402A9000-memory.dmp

Download

memory/800-13-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/800-106-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/1036-373-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/1036-162-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/1892-372-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/1892-158-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/2292-72-0x0000000140000000-0x0000000140211000-memory.dmp

Download

memory/2292-157-0x0000000140000000-0x0000000140211000-memory.dmp

Download

memory/2488-438-0x00000188CF7F0000-0x00000188CF800000-memory.dmp

Download

memory/2488-462-0x00000188CF7F0000-0x00000188CF800000-memory.dmp

Download

memory/2488-431-0x00000188CF7F0000-0x00000188CF800000-memory.dmp

Download

memory/2488-430-0x00000188CF7F0000-0x00000188CF800000-memory.dmp

Download

memory/2488-457-0x00000188CF7F0000-0x00000188CF800000-memory.dmp

Download

memory/2488-427-0x00000188CF7F0000-0x00000188CF800000-memory.dmp

Download

memory/2488-432-0x00000188CF7F0000-0x00000188CF800000-memory.dmp

Download

memory/2488-428-0x00000188CF7F0000-0x00000188CF800000-memory.dmp

Download

memory/2488-429-0x00000188CF7F0000-0x00000188CF800000-memory.dmp

Download

memory/2488-426-0x00000188CF7F0000-0x00000188CF800000-memory.dmp

Download

memory/2488-433-0x00000188CF7F0000-0x00000188CF800000-memory.dmp

Download

memory/2488-442-0x00000188CF7F0000-0x00000188CF800000-memory.dmp

Download

memory/2488-439-0x00000188CF7F0000-0x00000188CF800000-memory.dmp

Download

memory/2488-425-0x00000188CF7F0000-0x00000188CF800000-memory.dmp

Download

memory/2488-424-0x00000188CF7F0000-0x00000188CF800000-memory.dmp

Download

memory/2488-437-0x00000188CF7F0000-0x00000188CF800000-memory.dmp

Download

memory/2488-454-0x00000188CF7F0000-0x00000188CF800000-memory.dmp

Download

memory/2488-443-0x00000188CF7F0000-0x00000188CF800000-memory.dmp

Download

memory/2488-436-0x00000188CF7F0000-0x00000188CF800000-memory.dmp

Download

memory/2488-455-0x00000188CF7F0000-0x00000188CF800000-memory.dmp

Download

memory/2488-453-0x00000188CF7F0000-0x00000188CF800000-memory.dmp

Download

memory/2488-444-0x00000188CF7F0000-0x00000188CF800000-memory.dmp

Download

memory/2488-445-0x00000188CF7F0000-0x00000188CF800000-memory.dmp

Download

memory/2488-446-0x00000188CF7F0000-0x00000188CF800000-memory.dmp

Download

memory/2488-461-0x00000188CF7F0000-0x00000188CF800000-memory.dmp

Download

memory/2488-440-0x00000188CF7F0000-0x00000188CF800000-memory.dmp

Download

memory/2488-463-0x00000188CF7F0000-0x00000188CF800000-memory.dmp

Download

memory/2488-435-0x00000188CF7F0000-0x00000188CF800000-memory.dmp

Download

memory/2488-447-0x00000188CF7F0000-0x00000188CF800000-memory.dmp

Download

memory/2488-448-0x00000188CF7F0000-0x00000188CF800000-memory.dmp

Download

memory/2488-460-0x00000188CF7F0000-0x00000188CF800000-memory.dmp

Download

memory/2488-459-0x00000188CF7F0000-0x00000188CF800000-memory.dmp

Download

memory/2488-458-0x00000188CF7F0000-0x00000188CF800000-memory.dmp

Download

memory/2488-449-0x00000188CF7F0000-0x00000188CF800000-memory.dmp

Download

memory/2488-441-0x00000188CF7F0000-0x00000188CF800000-memory.dmp

Download

memory/2488-434-0x00000188CF7F0000-0x00000188CF800000-memory.dmp

Download

memory/2488-450-0x00000188CF7F0000-0x00000188CF800000-memory.dmp

Download

memory/2488-451-0x00000188CF7F0000-0x00000188CF800000-memory.dmp

Download

memory/2488-452-0x00000188CF7F0000-0x00000188CF800000-memory.dmp

Download

memory/2488-456-0x00000188CF7F0000-0x00000188CF800000-memory.dmp

Download

memory/2624-85-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/2624-82-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/2624-76-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/2624-161-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/2812-67-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/2812-70-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/2812-56-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/2812-64-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/2812-62-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/2880-166-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/2880-374-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/3820-126-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/3820-120-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/3820-250-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/3820-129-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/4356-149-0x0000000140000000-0x000000014023A000-memory.dmp

Download

memory/4356-371-0x0000000140000000-0x000000014023A000-memory.dmp

Download

memory/4444-128-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/4444-186-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/4444-375-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/4492-17-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/4492-27-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/4492-26-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/4512-141-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/4512-135-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/4512-370-0x0000000140000000-0x0000000140259000-memory.dmp

Download

memory/4512-145-0x0000000140000000-0x0000000140259000-memory.dmp

Download

memory/4660-41-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4660-39-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/4660-144-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4660-33-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/4956-189-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4956-206-0x0000000001EE0000-0x0000000001EF0000-memory.dmp

Download

memory/4956-248-0x000000000A520000-0x000000000A528000-memory.dmp

Download

memory/4956-179-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/4956-173-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/4956-377-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4956-190-0x0000000001C30000-0x0000000001C40000-memory.dmp

Download

memory/5220-171-0x0000000140000000-0x0000000140219000-memory.dmp

Download

memory/5220-376-0x0000000140000000-0x0000000140219000-memory.dmp

Download

memory/5348-184-0x0000000140000000-0x00000001401ED000-memory.dmp

Download

memory/5348-113-0x0000000140000000-0x00000001401ED000-memory.dmp

Download

memory/5384-110-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/5384-170-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/5384-101-0x0000000000A00000-0x0000000000A66000-memory.dmp

Download

memory/5384-107-0x0000000000A00000-0x0000000000A66000-memory.dmp

Download

memory/5428-89-0x0000000000BA0000-0x0000000000C00000-memory.dmp

Download

memory/5428-95-0x0000000140000000-0x0000000140221000-memory.dmp

Download

memory/5428-96-0x0000000000BA0000-0x0000000000C00000-memory.dmp

Download

memory/5428-165-0x0000000140000000-0x0000000140221000-memory.dmp

Download

memory/5792-154-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/5792-152-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/5844-53-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5844-148-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5844-51-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/5844-45-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/5952-42-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/5952-30-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/6104-130-0x0000000140000000-0x00000001401EF000-memory.dmp

Download