ba2fdbe3ffa7c77a7b597fdc327b27c2f5eacdb0358b1155df09ff47fb037c74

Analysis

max time kernel
149s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
04/06/2026, 07:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-04_dba2f7dcba3ede08c23d26dc6f17d20d_icedid_luca-stealer_njrat_stealc.exe
Size 2.6MB
Sample260604-jqvqlabs3v
SHA256 ba2fdbe3ffa7c77a7b597fdc327b27c2f5eacdb0358b1155df09ff47fb037c74
MD5 dba2f7dcba3ede08c23d26dc6f17d20d
SHA1 fd24102e0afa646ce7003cd6b9d39734608316fb
SHA512 bf9d27dd5cb5732fa58bc578292b8c05c6d11d10111708c6fe1df5c04ef80c09557575eed1216a68acaeb0b0018463d53683808a24809176a77be27b72012876
SSDEEP 49152:ducqsF0XxUtEmuxNXDNy9e9kVyC/ZwAUWSILNiXicJFFRGNzj3:disQ6Xk47wRGpj3
TLSH
T1EDC55BD521B841ACE166D87D89418D4AE9FB7C0D073979FB0270B9581F3FBEA0A35E21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
4496	alg.exe
3784	DiagnosticsHub.StandardCollector.Service.exe
3720	fxssvc.exe
232	elevation_service.exe
744	elevation_service.exe
1788	maintenanceservice.exe
236	msdtc.exe
3064	OSE.EXE
2068	PerceptionSimulationService.exe
2500	perfhost.exe
2148	locator.exe
1584	SensorDataService.exe
3908	snmptrap.exe
3704	spectrum.exe
1072	ssh-agent.exe
5356	TieringEngineService.exe
5240	AgentService.exe
5296	vds.exe
5320	vssvc.exe
5456	wbengine.exe
5460	WmiApSrv.exe
5540	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\e:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\msdtc.exe	2026-06-04_dba2f7dcba3ede08c23d26dc6f17d20d_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-06-04_dba2f7dcba3ede08c23d26dc6f17d20d_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-06-04_dba2f7dcba3ede08c23d26dc6f17d20d_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-06-04_dba2f7dcba3ede08c23d26dc6f17d20d_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-06-04_dba2f7dcba3ede08c23d26dc6f17d20d_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-06-04_dba2f7dcba3ede08c23d26dc6f17d20d_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-06-04_dba2f7dcba3ede08c23d26dc6f17d20d_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-06-04_dba2f7dcba3ede08c23d26dc6f17d20d_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-06-04_dba2f7dcba3ede08c23d26dc6f17d20d_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	spectrum.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-06-04_dba2f7dcba3ede08c23d26dc6f17d20d_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-06-04_dba2f7dcba3ede08c23d26dc6f17d20d_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-06-04_dba2f7dcba3ede08c23d26dc6f17d20d_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-06-04_dba2f7dcba3ede08c23d26dc6f17d20d_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-06-04_dba2f7dcba3ede08c23d26dc6f17d20d_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-06-04_dba2f7dcba3ede08c23d26dc6f17d20d_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-06-04_dba2f7dcba3ede08c23d26dc6f17d20d_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-06-04_dba2f7dcba3ede08c23d26dc6f17d20d_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\d54894dff6d6c89d.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-06-04_dba2f7dcba3ede08c23d26dc6f17d20d_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-06-04_dba2f7dcba3ede08c23d26dc6f17d20d_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-06-04_dba2f7dcba3ede08c23d26dc6f17d20d_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\{17A6A947-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db	spectrum.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-06-04_dba2f7dcba3ede08c23d26dc6f17d20d_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-06-04_dba2f7dcba3ede08c23d26dc6f17d20d_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-06-04_dba2f7dcba3ede08c23d26dc6f17d20d_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-06-04_dba2f7dcba3ede08c23d26dc6f17d20d_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-06-04_dba2f7dcba3ede08c23d26dc6f17d20d_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-06-04_dba2f7dcba3ede08c23d26dc6f17d20d_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	2026-06-04_dba2f7dcba3ede08c23d26dc6f17d20d_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-06-04_dba2f7dcba3ede08c23d26dc6f17d20d_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-06-04_dba2f7dcba3ede08c23d26dc6f17d20d_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	2026-06-04_dba2f7dcba3ede08c23d26dc6f17d20d_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-06-04_dba2f7dcba3ede08c23d26dc6f17d20d_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-06-04_dba2f7dcba3ede08c23d26dc6f17d20d_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	2026-06-04_dba2f7dcba3ede08c23d26dc6f17d20d_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-06-04_dba2f7dcba3ede08c23d26dc6f17d20d_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	2026-06-04_dba2f7dcba3ede08c23d26dc6f17d20d_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	2026-06-04_dba2f7dcba3ede08c23d26dc6f17d20d_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-06-04_dba2f7dcba3ede08c23d26dc6f17d20d_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-06-04_dba2f7dcba3ede08c23d26dc6f17d20d_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-06-04_dba2f7dcba3ede08c23d26dc6f17d20d_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	2026-06-04_dba2f7dcba3ede08c23d26dc6f17d20d_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2026-06-04_dba2f7dcba3ede08c23d26dc6f17d20d_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-06-04_dba2f7dcba3ede08c23d26dc6f17d20d_icedid_luca-stealer_njrat_stealc.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-06-04_dba2f7dcba3ede08c23d26dc6f17d20d_icedid_luca-stealer_njrat_stealc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tif\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000071f1b32ef7f3dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000001d2b72ff7f3dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.crw\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.txt	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jfif\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dib	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tif	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000551f42ef7f3dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tiff	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.crw	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ico\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raw	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ico	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cr2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpeg\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f729ed2ef7f3dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
3784	DiagnosticsHub.StandardCollector.Service.exe
3784	DiagnosticsHub.StandardCollector.Service.exe
3784	DiagnosticsHub.StandardCollector.Service.exe
3784	DiagnosticsHub.StandardCollector.Service.exe
3784	DiagnosticsHub.StandardCollector.Service.exe
3784	DiagnosticsHub.StandardCollector.Service.exe
3784	DiagnosticsHub.StandardCollector.Service.exe
232	elevation_service.exe
232	elevation_service.exe
232	elevation_service.exe
232	elevation_service.exe
232	elevation_service.exe
232	elevation_service.exe
232	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
672	Process not Found
672	Process not Found

Suspicious use of AdjustPrivilegeToken 16 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5144	2026-06-04_dba2f7dcba3ede08c23d26dc6f17d20d_icedid_luca-stealer_njrat_stealc.exe
Token: SeAuditPrivilege	3720	fxssvc.exe
Token: SeRestorePrivilege	5356	TieringEngineService.exe
Token: SeManageVolumePrivilege	5356	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	5240	AgentService.exe
Token: SeBackupPrivilege	5320	vssvc.exe
Token: SeRestorePrivilege	5320	vssvc.exe
Token: SeAuditPrivilege	5320	vssvc.exe
Token: SeBackupPrivilege	5456	wbengine.exe
Token: SeRestorePrivilege	5456	wbengine.exe
Token: SeSecurityPrivilege	5456	wbengine.exe
Token: 33	5540	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5540	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5540	SearchIndexer.exe
Token: SeDebugPrivilege	3784	DiagnosticsHub.StandardCollector.Service.exe
Token: SeDebugPrivilege	232	elevation_service.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5540 wrote to memory of 5752	5540	SearchIndexer.exe	106
PID 5540 wrote to memory of 3252	5540	SearchIndexer.exe	107
PID 5540 wrote to memory of 2212	5540	SearchIndexer.exe	108

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-06-04_dba2f7dcba3ede08c23d26dc6f17d20d_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-04_dba2f7dcba3ede08c23d26dc6f17d20d_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:5144

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:4496

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3784

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:4036

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3720

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:232

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:744

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1788

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:236

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3064

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2068

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2500

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:2148

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1584

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:3908

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3704

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1072

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:2392

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5356

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5240

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:5296

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5320

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5456

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:5460

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5540
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5752
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2864 2844 924 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3252
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2880 2876 924 {85EE815A-7738-4808-A14A-3AD87E32A3BF}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2212

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 16dee4b7046c45d8ba9f479e1ff5ae505f4536388c0e8c0b9fb033002ab709d9
MD5 cd5853750e4352cc0994c56347251b61
SHA1 483ce05749625962c85ee1dde7fb44b14f84e64d
SHA512 d864d7617c083673cf22e472b60d1c05d1bbc5532b5a69daf1ef20c3f5042a0f8230dd4c1fbe07cf03011d7a4255cd93a2c6b3f3423157976de33a02f5845dfd
SSDEEP 49152:+b+632BuPkFKRrdE6ohdstBhuXjfS4LWxnaLNiXicJFFRGNzj3:A3q6mjBh7wRGpj3
TLSH
T197D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 3ca0221497b5137b6229b6ed6cba913f9d6b85ecb2d1f857580af88907ef1ca5
MD5 cb51ef6999ec14c3a35afe0fcbd0c6e9
SHA1 2f50dd539d28b6da0b92362215ab60a5e386bb9c
SHA512 38cb58e688c6f76adbf5d9d3ef619144125384bc9ae5f15487c12c95243f010e79edc36a62b6823caf3441414224ecb8d3a4aabc0e57d2ebbe0ac9fd843f7a53
SSDEEP 24576:sXYfDtczA1/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:LtckLNiXicJFFRGNzj3
TLSH
T1F275012963D408F9EDBB813CC8A28411E6737C554760E7DB03A4A92A5F337D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 0172cd59f2c0d481425bbd2f75faf81f88f4aeeb271c8d5774d4c85c2b1058a1
MD5 b6e6751f9d3d0167a258a07abd5dbdd8
SHA1 14d06a19517356a1f0dd3bf9c4c52bc57039e165
SHA512 0d4890e369b56648f1494660b5649b29faff766e69f8358cadd3e9bae5203987adb3fd6ba3b8ee8f2a8d816a376e9b1e2b8d116ec32475ca850a552c3e77bb13
SSDEEP 24576:j0Le5ji0hmxhrMy/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:jPji0AzzLNiXicJFFRGNzj3
TLSH
T1CD85AE16F6748331D073C0B9C5D2A69EE971308657308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 ec4ac6991b84b85c064423a15e69bfcb7bc52553dad41d5df34023b139672f04
MD5 88c2881553e9b63cb580e744f8d2ed87
SHA1 d3c57a58694bd508f029f39905dda97e491b6f37
SHA512 eafb8d99a65d36b8734e6c2d305f44e4aceca03504fe657dd3ad9bdad7a5fa01204d8924da3972ce35c70d9fe5a7d7c362fb99156267acd8ec1b77d6d1420374
SSDEEP 24576:ia7/ezSC6vUyD/aqgrvWj6q8wyuU/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:F/ezSC6vUzPv+HjynLNiXicJFFRGNzj3
TLSH
T122756C15F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C636739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 d1d76c4feac6cd73ad9bf042b98a691f92e2b5d2155727334ea5367718464651
MD5 97c9cb8b6a657a0cb7ce95a48de1184a
SHA1 b5802ab8ec70fb308ce7c283cb490f83c2b374fe
SHA512 676100305c2506c016570d8b9b81a4a3898c5aa921c4c19f6c2afd5e9af8188e3e9a4ba53cc9056ce01ea86403d365be827f71a322593455df3de35fbc8ea073
SSDEEP 24576:2VbqPb88hv/l+BR/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:2VO88hXl+TLNiXicJFFRGNzj3
TLSH
T1D4559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E67BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 dba791d6d5b63bdb72995621d62e039f17a83a6f6f9dca302aa3f7d7ecabbd48
MD5 52cb9798132ddabb85f7d1a0a3d7cb7f
SHA1 1b5b355797fb54a530271e6e73c3bad6aa80b023
SHA512 e04624989b9fb9ff7ffcd21d2419077304e925c6304fd9b92738624cee362cb8d23753bd78d119a8fe6937777bea6335fb66ebc1b65145fb3525f83d10bdbb63
SSDEEP 24576:pG+/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:9LNiXicJFFRGNzj3
TLSH
T10F5523D3468854B1FBFD003A867A5828B5845E2C8A595DE3D2543E5EA13CFEBCF39123
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 f9d70e4326e2889dc7eaf6f6c4dde3fed814de8c3ceb389ef222f3f83990d940
MD5 e427b04267f0a612f9801a05de71b3ef
SHA1 bb7cf3a3543033f35ee1193298af8a316f1311d2
SHA512 0d4249fb03a95a368f98863520693677146a6d88989719e447d1944795b3940d6e7f9d574100dae31a94093e9a25bf2f16b874ebbcaa8bb16f66e450e87e9c14
SSDEEP 24576:eJIUp/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:eJIUpLNiXicJFFRGNzj3
TLSH
T11275CF7BAE28FCE2C27E4C7957518600E76278304F62A3CBD165830EDE236E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 ba1448a394ec75da6123ae3e294b65d1787991b5fdbe4f6883ee00f68497ece2
MD5 3744fce64c8ac15045d62652ad51607a
SHA1 35a6d8946d7ef3c3f2cb3ce7e397c392bc2e0ffa
SHA512 79df32180e6e9a7f4a0d6df4186cd640148543d7a561e8fc9682abe0b3ee9038186e0e52e68054525d6be42a71a286eea337296dea4169cf0137336e127f189c
SSDEEP 49152:rQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THp:rQvGAdlCEL8c/WRNw5CE7wRGpj3
TLSH
T1D5266C656BF880F5E0B7E178897A8572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 a2cd038f922a9bd9f0cb1d3d54240f3df425516926fa7cfd128bca2c92fe8f16
MD5 5f756fdfdebf3a179785d710b8f977be
SHA1 83922c0db0ddeb3d9c79171ccedb13464baa3c45
SHA512 46a385a0ef95561572d94056c2e42aff0380c85be24d2497b9fa9b998ef0a1cc713707c481b5a10eb98e5bdbd0f4b11b121c0bd35c13536897ca4774dbcc0bf3
SSDEEP 24576:NfewsAjj/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:RljjLNiXicJFFRGNzj3
TLSH
T13B75E031FA74E032C7BF0CB61B36C716646C7E204B6119C3E3A85E9E59346D26736A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 ef7d5cb15aab0dbc53c1d2f3d59182253786bdc4caf0c1a8277bb3f4952af052
MD5 6191e5fbb433b7aee9d447f303857191
SHA1 de7e8d7c31c3a0805a616187671ac5a83f68a12b
SHA512 b85ab87177df78812d9f5a00c8718269288eed9b1b111a1be6991a50081e076296407d7d23181f189845317c8c54c12838a9361c0a99277f4756ce36e991698c
SSDEEP 196608:xUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHPF9:xUEtQevvqc2W1cpV20I3299
TLSH
T125474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 c03ed1307dfe3e7e8b0bf17cd7d818753a7158644c17249b21fc016d288a1eb3
MD5 a131a196c4695459a60834e3e8936fea
SHA1 b0d0c0e6a0b0a6312479b04b6d96070c88548808
SHA512 9a48832ae7da99acd5ae57b49420cc30a1ecf7b317419cdb2ea57a350bd11abdf4e11eccbaa70d62ad149b9385d7b2ae51be6b05463a2318c939ec897e96578e
SSDEEP 49152:fCbRquA/m2yL5zLfFiV+XenmE3/zDLNiXicJFFRGNzj3:4oq2Vjnmo7wRGpj3
TLSH
T1FBD58D0976B881E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 0fe0c994ee954780e0b37a8e19f0c8c75a871fb52d426474c6575dba0942edff
MD5 6aae6b8741fa1381b9db7953c7ce8aa4
SHA1 1da69ad7dfda5c0d4333f8bbd4e33516ce3d3988
SHA512 d86c3547ed650ab181cdd8c2ca2cbb658851051c0283f30ef34362c9073bc556c99291fc43d7df284f3991f20c19c84446e183e9ef5a8a8e40e58308588db0f4
SSDEEP 24576:yAhGL6IFoiwtA5l7S53I/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:yAM5Foiq5YLNiXicJFFRGNzj3
TLSH
T17C359D81E7F955D4F5F3AA7899B68170EA76BCAA5E31C20F2150911F0E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 2a7fccf7471df48a3a959e059960a585f6f0f102247a81c7deb1d855688ae018
MD5 92195aafe7aef4dfe282dbb0293a18da
SHA1 6c155d3f67b416c57c1992842c0531eefb52913f
SHA512 07c66f8dcd78b7a980045f34b8aca514318aaf4a56e5f21afa976286d38e99dbe9d5e1340f1b4eec90e4eeffb780298645389baee50171b5287516955000ec51
SSDEEP 24576:twuROWH/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:twSOsLNiXicJFFRGNzj3
TLSH
T11765F18632980CF9E9BA41398657C035F7F2BC152A21DB5F5360C65B6F37361AE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 cff85cbc9bf7da08b08a4cc586e9e70a43ef22cc93060f1d1d4957cdd430d260
MD5 5dcf683e9ee023263d636f383c92bca7
SHA1 6eb13896d64a95197877cec4e11c4fea68f27fd2
SHA512 75af9471eefa153b10d5bfddb8040f82c99c21e93b0d5d02fb1aa58ee459f44ef39792f8d321b6faca7bf4b015cc2f673617e17ddd674ca59920339325d44ad8
SSDEEP 24576:zZuK/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:/LNiXicJFFRGNzj3
TLSH
T14F55129622C820F5E6BB403DC9B54504E7A17C2A573643CF52242A6E6F36FD69F39332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 6d057c376add401a31270458e567c81e23041930642542f36517ee440acb3a30
MD5 f74195e4b8fe732a27b80d248d16b56a
SHA1 2f65f04aa76945fee226172f5dbe3e58150bfe33
SHA512 ab919df3ec393e77d495bf03b695c6f8088c59e526d4102a2600449aa2c6ade573ffab889690f978cb163dd3c4e4f66df6a5c1ac4e272f75e49065463e986b2f
SSDEEP 98304:ZQRQyi36YOcPDLvw2gAf+PN3t7wRGpj3:QQyiKanX+PNBF9
TLSH
T162667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 bd2b8eada7895c7e3fbd92b97f57bfd36b3c3c7d8b2be59fb22af840c6d930b0
MD5 803a5f7fb79c8ea0ff0b906500d3bf6e
SHA1 b9ef91dcc9fff7922302d4b1e381b1dd9e649f10
SHA512 860311d81b3c9d047567149e8709d0b037ad8cc498e0959db9249de0ca54089bd70672244d124f028d0733082509b9c77a5f2b187a8bdc155395031a1d9fca68
SSDEEP 98304:KQRQyi36YOcPDLvw2gAf+PN3t7wRGpj3:hQyiKanX+PNBF9
TLSH
T176667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 443dd48613a3fb8138a8e7eeb25ea62e95129836fba1229e22b94f4edca2c263
MD5 c780d42c221bb8551d94b5c1d0262e5d
SHA1 58f9e9c7feb5f2e5c2185b71f3325a910edee68c
SHA512 73dafed54861c075cb7248f030430b7fec43871946b9f93689a1f48366be836ca41a002485650a9a829e5ed0d762cf102bb7e418578cc41f1d7b6d718d988812
SSDEEP 49152:K68Qg55nhkeWu7PNU3/zLNiXicJFFRGNzj3:4thTRc/z7wRGpj3
TLSH
T1B9B54933B2F600A9C45DE1769F4A873196D17C758FE1E3DB8111720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 18a2190ab11e40eef13dfe5595e31523e1d73a2c4f537716093a11a8771dcd78
MD5 d3a8f8c4666eaf9ca871a6ed381ece06
SHA1 178952876a5608a6818123f809de2db01cb59ca3
SHA512 81d76d60448f155d9476faa7ccc587c85fd91783a2c98d9e6dc07172c1d2556fb9c75991b364dc9857c7bbb51e74972fc2fe6cd33fb9aaf47e4ffb64cc8ad7aa
SSDEEP 98304:jy5112gYy5azzVvU69nLKnhZ+7wRGpj3:+LIHRWhsF9
TLSH
T1F6167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 00c07509e6262f3b61f71b6f58eeb10fd2e2b2dadd60aa98a60854ea64ab29dc
MD5 7c2c6ad4ffb7b2edb7e1cf3cc4172820
SHA1 8ce1c79f8aa31cabb87a683ca30d4e6474e87ab6
SHA512 e24a5d1c3dd243fcaae922883852e9ecc0e231305cdcc9817a0dcfc7ad9e70b7c84d0de5cfbd5f23aed962521edaddd1b8f82026eb6325ac31569286a9652e19
SSDEEP 49152:WB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glFLNiXicJFFRGNzj3:ku6JmIxd2dF7wRGpj3
TLSH
T178D59D13F1D901E8D06ED478974A9233FA62BC490B35B6EF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 909074b5c3381b8677642684eb6417eabdb7a7ae847a360915d792b342ddaaae
MD5 238bea8129ddc5a465e8f2763cb332c9
SHA1 1f9829812b0d60ecf12ce8dea45a95847abb0cb7
SHA512 099ef992fb798f69b2b94d77a003255d035d648ba727e68a7a198e64e7022b53cd8993995c7339d34cf5a0d4d570945794faf64e2034d4b12b28a6ff1a96fe98
SSDEEP 49152:q1hpsNoJpF1A67U44CwH7R4xJLNiXicJFFRGNzj3:qmifPqRo7wRGpj3
TLSH
T132B5AD13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 075ccac731d2526d7f19cfb83f392d30ef3722d6b2ed5e7b3f751815aad5fae0
MD5 a0aecc6c8ed017b1a2ecf531bb27a17c
SHA1 41542f6c0c38d61cf6e58067fca827dc6a3dcacf
SHA512 c1d217c7c4c73d8ff858bb1aba654f36c70e6fe9daabbe0642ab669a1168285e658670218885612948f1b37e1dd7630d314b35bb28284f12afe2a661c8902692
SSDEEP 49152:hSuZQIY0Be2KkRVtOnks6NMHqKLNiXicJFFRGNzj3:v5dKqi61K7wRGpj3
TLSH
T131C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 5064a3d258bca66109d3ca189ec57d299a16990a2440690a99a2615705de80e7
MD5 8c6a8e1346a55aac299d4791349a813f
SHA1 d084e20f3b28efaf65855fb57e84476d4e9053af
SHA512 658fe41348ed7cdd6cca8b328ea52fea29ba430cad5179373aa167a1d9f49922e81cbf87e9df924f770249e88e66ddf6f7a09463f6eefb037a448a511a355a46
SSDEEP 49152:BhtSn8EApI0figjgiDn0AP5w1LNiXicJFFRGNzj3:QX2iWphM7wRGpj3
TLSH
T10995BE13F2D900E8D06ED178C7568632E962BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 269386f6380ba7a6dd186867c301b74f456a627f2318f6b94d9a3e5cd503045e
MD5 50d9ff2afe411255441155a2df30351f
SHA1 9b0b0177a9e491063386524fc1e9c0509adb784b
SHA512 c23841065d83f124908d53d7ee72a13dc0816eb92538a477a78a644f04a7d5ee2c16d1fb425403195ae939506a632ddf4054a3cc844f665e4913ec4a01f1e4ac
SSDEEP 12288:7MiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:72/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1175523D3558955B1FAFC0039C6754428F5882E2DEB5618E3E3483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 e9f8cbd42c0b35ec6a91a1b63a5d199bbcfb7768f069322d0a2df34f5a0a8adf
MD5 ca6a0fe4bcbe2f6a9ca62434629301fd
SHA1 a9dc2cd7d1ba82122cb3ed415e9426aef08e5bf0
SHA512 0fa84d3e0c0e26da2b3ba6416e5226a2d9cb8294c862f2dd59ffa98b221ce788f69f82123d4983c86fc96eb1237f868d85bb2f6f6ca130e8b9095f7a52d3aa85
SSDEEP 12288:jbiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:jP/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1235523D3548955B1FABC0039C6754428F5882E2DEB5619E3E3483D1EA278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 18794d6aac403d5f035788b2a60734e0357adcb2a906e310cb785f06f6057c0a
MD5 101a5d3e3310282e0ebb71481c3193a9
SHA1 8a52aadb536d09c550b95a8830a2657d069555f7
SHA512 2aeb9f60d9010f5f40b6b5cfc4b8f90a8926083b1625e4f556a9ea9dc6e367ebc87a4285308eb3b49a54ca83c26ef4692203702a8cf80b10f1df5689337ed82a
SSDEEP 12288:v9iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:vh/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1BD5523D3548955B1F6FC0039C6764428F5882E2DEB5619E3E3483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 379856f3389783c9047ed4c5dddf3d23d6690fcbbf939a681cb7a39eb6458781
MD5 1efa6af5ad13cfa4f6be18ee1f3275d2
SHA1 4846ab40dc75dc776d46ab9aad7ec04b804a02bd
SHA512 fcd00fca7512e96cbb9ba346447edc922a92a91fcd3c774fb8767ed9b1cd2c806e7c7dd5ef894db3bfa5c029e386186c8cbb9174d92c14c2d2bb47671b6ae984
SSDEEP 12288:nVeiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:G/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1E2552393168900F1E9BD8039CA764424F2A47D6CD7325AEBD3003D1E5A75BDADF38A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 c5720604b70d930e1d272af7c41245a66f167ea6710dbfc2f4746acbb6219fa7
MD5 26b432c0b1d33253cd3d18295972ff49
SHA1 f43471b0be09441eb4d22a6de304ff01d3cbe52c
SHA512 f7841563c7d6523c47ac1a4dd3b476a0391350c1f46d132e132052f188d8e4133ce6efee74ed08ec39f2dd5dd9a52ade897c58c3da525e17b0b713036e8388ae
SSDEEP 12288:AmiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:AQ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1025523D3548955B1F6FC0039C6764428F5882E2DEB5619E3E3483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 83d2972bfe7d1316da554e1ec6696ca302c610ee9c1823dc149a7279997e6ce0
MD5 690a14dccaa2ea4928b1c8a86d6079d3
SHA1 e97be7ec4c4ebe640f60d1f0444c33ea121c774b
SHA512 9e62a1f0db5fefe499c525dafe117aa9187e50002f27f91e5c87e2ae4918bb798ecede265a8720bb10b52e93b5d492d0ca0726cd832cad5373d069cc9aae7609
SSDEEP 12288:8viJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:8b/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1F25523D3548955B2F6BC0039C6754428F5882E2DEB5619E3E3483D1EA278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 0c4fd330c6f3a6d95b09e49926e083da42874f2d5f4ff53772fedc2ba90febcb
MD5 af8974a3fc5f531d8375fbb87feb8a9d
SHA1 0747977204eb07f00566423cbacb825431e3893b
SHA512 fffe7d8682c088d30fb82b0d7406e6c3362ddfe51db23a9cf266e81f276d7a4693d3da96aa1e5aee84e3b04b870c5f0897f27fbef05044c0441baf312fa6cd90
SSDEEP 12288:XjiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:XX/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1265523D3548955B1FABC0039C6354428F5882E2DEB5659E3E3083D1EA278FEB9F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 678f0854f5c4f271de02d50ac16f5b3a211c7093ad07609388d4c6da66978988
MD5 fc9ac234bfad8a02a8135dfa10308de7
SHA1 dffe75746cce95741f36bbb466059c67e6ae4d9f
SHA512 cf6c0f75f7fc0b39b51a1b6902b873155b6c980ccc4c632c930a9b320c2444490de583d5c98adcd96135ce05b56f130677142299ef05919917104c6ebf3cff3a
SSDEEP 24576:eZM3zFVSOv/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:eZM3zfLLNiXicJFFRGNzj3
TLSH
T1BD750295B39018F4ECB7813EC9258815E6B27C194B70CA5F03A4362B5F337A15D3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 8692ad443df44162f27dc0b78b839ea03b91910f87377de60572c68d7c02d539
MD5 6f98fd018a54b09473e68dc9d8ce9a56
SHA1 a7ae80e58dfbed48e7d3564f5b6a05ff099c9a2b
SHA512 75115ebcce914d95455dcbe0195d4e16e383de8c4b6afc7d54d1296f74a81e8881e487544c592be097bd2ede549b5d11974083190735ec7f7797a69101eb086d
SSDEEP 12288:CIiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:C6/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T17C5523D3548955B1FAFC003D86754428F5882E2DEB5619E3E3483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 7ab9cda74079962170f0239b49d65eae1bd6b396dafafe21b8842d33f135a8a7
MD5 389519e03a3193d5996be676d08134b6
SHA1 90ea702c6a77b2a68a62c33bbe01622c34b587c5
SHA512 7c4bcec62b7fc0a41cf4cf1dda7625537dbc0ba1ab7c4f85650c4001451d60529cd0f4b261f73a725c3fef6541b961800734b94e0aaa84ea2ba2e39407ae9b3f
SSDEEP 12288:XkiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Xu/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1175523D3548955B1FABC0039C6754428F5886E2DEB5619E3E3083D1EA278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 36ace4f3326317235f96df4a39cb6a1c83ff132c0ab14d75222d4dd7beaa8328
MD5 ce5ee3c21e61f94598d0818f11a15547
SHA1 9fb1f77d5fc3c1eab39e2c9bf0f7a25d46567185
SHA512 50ad10667d378a61f392b1292b247bd02896c6cdf6478008020c837a3a9da68939af2705a07ef19a6fce64eaeb5016ae2f5a32b310c1c22ea6dc28b9532e9d34
SSDEEP 24576:PzyT/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:PMLNiXicJFFRGNzj3
TLSH
T121650147729530F9E17A8139C9620911F3757C3647208AEF53642A7A2F37BE19E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 30d00c5d642265e74f04e8c77ae40609af8c6877583436f46811d3b7389d8c38
MD5 b2df9003a5e5b6581277c78f7239d9a0
SHA1 64abdeaa6002b214ff90947f8d4ed82bbc865543
SHA512 ec32bb3e362a96afb239cd9ad4ca20bf8fa799ee021c5679bc5dc9c4de4196d33abb775df69467c463f774140ab158ee7c3f327c34a2a2ab06f951b392b99d7a
SSDEEP 12288:7IiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:76/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T14B5523D3548955B1FAFC0039C6754428F5882E2DEB5619E3E2483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 9edcc8ea157f702a3c89699e7744376bef6ced326975e096376982dc8c95948b
MD5 cfb1564c94f86992da79849ab9a891fc
SHA1 847e32a98422e33168d38c79074027b99790c34f
SHA512 3217c038542a0b0062e3ed2e1c4edb5d55b82f1e7bfcc2f541fb4013c9aabc8cd728649a3c474161cd7e0678ba70baca1cf60c04c4ba220679e577ecb954a906
SSDEEP 12288:LIiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:L6/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1535523D3548955B1FAFC003986754428F5882E2DEB5619E3E2483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 c809c68d95b0842772d3ef8bbdd80518c6168eb8e9ca420a8fce16513783536b
MD5 63a4f757ce3eccbd5254f4954faf3a3b
SHA1 93a9d8cc571384c5171e996eab0813229a3ee491
SHA512 a2226beb1ba329772635e48dd90fa6e3c93eacce378ff1a37cc1deab62ca38d12d03a40464aa882214f051f431c845b5f5857d991b222c96e4afa14122ac7f37
SSDEEP 24576:dzyT/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:dMLNiXicJFFRGNzj3
TLSH
T157650147629530F9E17A8139C9620911F3757C3647208AEF53642B7A2F37BE19E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 2d015713aae686f9ac02bdd000a92de7203a07564bb52c1c1a858ac138b88c99
MD5 b17ab248e7d486136f8ef5d0cae65a5b
SHA1 d74649df4f62676fba9c72cd1bec94ae45bcba28
SHA512 09f35f821b64f8448b185474bffccd9ecfb41c2da6472f9dd54f252bd9a58357def2680e516ff43b87a870b31e675b48ff3d92f34b711300b282eab876f188d6
SSDEEP 24576:qCUApvPDv4Ex1hfe7i8WVq2lIGU8lrtGUJLPuwvA9/TwSfVcYG3K/cJHlnFR+IGe:qCUAPTY+8Wg2lIL8lrIUJLWwQLNiXico
TLSH
T1EC65BE1EA3DC0896D4BB81358A518A16FB723C2E1B2296CF1160C73D6F27ED95E35F06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 b2a1d72e6e3c0b73cb0a47aa74c3ff3e3c930eb023e269ca358b1429a8f36f28
MD5 cf3e7dfe3f518119eb940e85bf4bc07a
SHA1 0a48b2e84fa871716e1cf5aaee22a0ac4bc9960a
SHA512 997ca7b775eb8c8a5ef2c6d235ae4304ada8e2efeeda1522f2bd90f68361413c4d7890a04b4ae7fda090a919f5d161b60ed6bb185b4f71b69cf401c9b46852bc
SSDEEP 12288:fpsf4iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:QK/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1C965F15AD28802E8D1AE5139C7664900F3637C2987E1D3CB52C0F93E1F7AAD59EF9613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 42cc2b0de224e8925305abc1344d4024b823c40d8e9cfee3a675160bd833b15b
MD5 419ac87546ffec60387a20ff5fec254a
SHA1 fb5d936d5d237a5553a6d4dbece1e2e50a47ddb5
SHA512 27348e5f23673381dc31fdcb89fffc1ad307a49d0e91bb8aac51b00b76f248efb558b8ab6d1ee01a822e33c3566bd79b3edcfb4cd066f323737c25805cf08c80
SSDEEP 12288:adiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:aB/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1E4552392528C59B1FAFD1039857A9438B14C7E2C9F1598D3E2043A5EA238FDBDF38527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 23de2753d9dceaf334c542d8d5257d933bc7d0153dbc5982ef3479a45012026b
MD5 1ee983b3641f6013710427d6cd8062b8
SHA1 3ce4ac127b97e5024d9aea7712aafb283f1714f6
SHA512 6124f5776ead172f80bf37a5685db81b23ed290a0d79a670f7810976ad9b1c1c951be02dfc0c5303105c6e3479f9ed635ec347493fbd6085af7818fd0a0d9e0c
SSDEEP 49152:jRZwQCyiHiQEaaPnMSLNiXicJFFRGNzj3:F9xvPf7wRGpj3
TLSH
T1A685B01E62DC46A5E0BAD278CDA74407E6B27816573197CF0290C27D1F27EF49E3AB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 ffab034159a88cf05614436f4451d5b5c99a7545791c52f21cd1f3ed74fe45bc
MD5 df4835c88a625bb51e5a7e07a2a47f5f
SHA1 46e243ddc716691927b6d5d9df2540327632bc78
SHA512 b4b016799d559ee0f228954083f54214534876a0f2aa85942318c85ad028c49d6c3dd323a17b21aabf56d76cf0a8cdd92551aead891f8eb95f7c45c7a6535f21
SSDEEP 24576:/bxA1UGx/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:/bxA1U2LNiXicJFFRGNzj3
TLSH
T19255126E129C14F0F5B9903D89A68005E3317C2A572197EF6180927E4F3BFE99E39F52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 d4d34e90ffd8727b3c8c57e4c42616c0100b959abe165f6768b117cece57a60b
MD5 5df8b1061a5dd993cf3de688a6cd860f
SHA1 c9fe5d5590aac06ff48fbcff9d4c2e238c276ea0
SHA512 fbf2d75a4e9c0a79eb1849e9c32696b38333c26cd46270c83b572683ac5dcc08e7e4e0b2a3fca78a95df877753d3c610365aeaf17e52ebf419530aa60d9e3385
SSDEEP 24576:OjsmP0yHaqrVqHra44KDzMsrnY/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:OjRP0yHfVqzlAsrnYLNiXicJFFRGNzj3
TLSH
T17545AF2EF2B910B9D4AAD136454107B5FB71782D1F209AC70170C635AF0AEE89F39F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.3MB
SHA256 99f48699a5b2d54cc9308313dc05d8e1cd4548da1ee5441344cf7127859cb5b7
MD5 fe63cf94e8d8a9090f5773fe5babdd49
SHA1 1dc334407e1fbf576be871caf09f0e1dbad433fb
SHA512 c22514f48208f79afbea1022a3d7977b0454b224977bbdcc6639fc0e699690554573a2b2991f05bca6e04b6f875f6f82446a5df48c9c7a7e5ca441429aaa31f1
SSDEEP 12288:/PiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:/7/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1885523D2518955B1FAFD003D867A4428B1486F2C9B2619E3E1543E1EA27CFEFCF38562
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.6MB
SHA256 1cff8d2143fd0bdde3a93d25fb8b1d287fab758a520660f8e2b3ec2349bfa444
MD5 095dfc185b153e680da1ed3d67f5061a
SHA1 49f497a9ac4beaa93dac7e67295b54b72d16ae96
SHA512 c6c3b03517b7ce68c4cccaec16071871f0f78e0e6cbd0e07a7e046ad3bc1172870c6dc7c5f6f452d9bc9e9162b512984673da32ce398670ddf57851d2d8574bf
SSDEEP 24576:cALBUT1/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:cALBUpLNiXicJFFRGNzj3
TLSH
T140750155E79400F5E97B813CC9728916E2B2785D0764E7DB03A84B6A1F237E28F3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 6d3b63856002562dc116a14ce9b80454a74c31e5ad77027449e021828c5ea173
MD5 c83454bfbe4fc1267bf5a79f47d81f34
SHA1 54668cf04994b2ba67f19da130acd7a9e67ed09c
SHA512 6dcb489cd331d104119fc49c922a235442eabb1e6239502ab5b944859c58a9bd82745f0868f1a03f7347855ef1dd25578f072349f717c9cdf43cda30076b2596
SSDEEP 24576:ffYNH8/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ffYt8LNiXicJFFRGNzj3
TLSH
T10365F12F62AD18E4E57B913DCA828109F2727C66171196DF01A0827E1F27FE9BD3E741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 2e4f017ffc497eb43a76e27f536d2ecba98b388febf3fcd8f5aa0550f5a4d518
MD5 7fd3b6750e7290602bbc69c8cc0d24a1
SHA1 bf5ae0693faf58f7683eb1badbd1286ca85659dd
SHA512 fbb0737e227e47834b9722bf76684e749a48f31e59ec94655daa698e207fa6787eb0520b52d961b073c6a1bbb80558b2528f14e124e49b22b3c2300829a9be1e
SSDEEP 24576:+nXoJjNYH84VVSNAApoEOW66aspcrcHBjSSKHPWdQwPF3hJ8ssmOc+XLxu+x7uKU:+nXoJJYH84VVS6AmETJas+cHBjSSKHPz
TLSH
T1E565BFAEA2BC04E8D5BBD13DC5C24506F5B178651331C6CF026182BA7F27AF59E39B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 d8c6da0b5226ce4a73b35dab1a2d6abba360c29af76bd4dcb1dedc19e9e997d0
MD5 0ba45bdaa66a2d9c1dc3911a4978bb5d
SHA1 ef48cd34f29986f28cc5190c80a78182350d5590
SHA512 1ab0876d9d962f5b4baddba8cdabf7259db225e475009ab04ef35b557ff63836b6b5b57a2af95592ea09b9b58e747e200dc644e33401045416b77d6f43c3ce0b
SSDEEP 49152:ZDLL9TuJ0M/TYW2PbLNiXicJFFRGNzj3:ak7wRGpj3
TLSH
T1A0858D5EA2EC42D8E4BBD6BD85B79046FAB2B855173081CF0251856E1F23BF05D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.3MB
SHA256 55371342f38683b1f8c8de90d3a466f51f6cc18a4ae298bb75ddd45053370ce8
MD5 37a49a93e6b8bfda9b48d1fb9707ad53
SHA1 b949bbe766b856c26abf8331a19ae6d849c9a7e7
SHA512 af3227ae31b8ee18c65374b285666b3f35233c9729b66a526f1b58c37a7f5b38bd23816f49ad40b24105098db4e0f1f1e2c3e75bb8c596eae3ac446e5acd3a78
SSDEEP 24576:iegJgpwJOmPOHWAKZ8ZguIGyPsxr5Vin10w1/TwSfVcYG3K/cJHlnFR+IGNe8j3w:ingOJOmPOHk1LNiXicJFFRGNzj3
TLSH
T16F55CF3FA7BC15D5E07EC13DCA968816F6B1782603255ACF0160827E5F2BEE46E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.6MB
SHA256 e7ec0e830ecd11b994e8b99c2a92a4eaacfc6cc864e92b68032d1f97762f0e63
MD5 d707172f4aee3c0889eee24e24b1a3ac
SHA1 862206ad4fe21c6ae385e1c64d0dba4e4e1b1116
SHA512 844d4912b1476a051357afba33977f469968fd8507acba6f3d918517f3160d5101489b405a256bb272b812a01c4f844a29143da717ddbff79b9df5ff2b1c12e8
SSDEEP 24576:5LJnJiTk3R3waE4JrOb/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:5LJnJK8R304loLNiXicJFFRGNzj3
TLSH
T17475E07DD2A810E8E4B7C2B4825A1656FF31387C2B2169CB55B4D5353F12FE0AA39F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 6e935f7a25ddf3a80fd1ac7e6cb0264d211f87975dc019ed55de73ae13f01153
MD5 4571bc406097d1f8681ce4b08b6eb481
SHA1 2d39afd439010ef8942bc9d8db817d3eae1896a3
SHA512 1d1cd4b21c75f0859e700c9df560c8e48928d2a36ad76b5a8dc090cad991730cf8875c4579b9467be87f050c5928bdf6d01765f43943a4df82f7ec9bf5587e5c
SSDEEP 49152:r9GqCzDScAZmlvTcFg8Ph6XLNiXicJFFRGNzj3:vc7wRGpj3
TLSH
T1D8955D05F7EB5298E8B3C9F1C96294159B327C509B34F7EF4A80CA6A1E32BD1D934B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 b6f0efca208dec8bcc6e7e6cd66d3be30a6fc5c2724bd339923e83cf7105920d
MD5 9fc046603206f5a33dce3773266fb039
SHA1 9a64e978628ae3383c95573639056a29d12bf2e3
SHA512 5f06968952e5c5602aeab5c9b7e3c11e07918241cd5109a9a924366db13cf161b4302c4691f426d65830991835299956adb43bc7f252bccf0bcf1a0b9f52da6a
SSDEEP 24576:tlYJeXm5jUuEl/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:tlYJeXmRUuElLNiXicJFFRGNzj3
TLSH
T1D955129E268C30F1E27E403D85A24414E371B879571217FF91A0A67E8F7AFE65F38A41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.4MB
SHA256 4bfbf328f1b9c373c538c8842a8c2c8fc693aef0d61f60373fe0e178c2ba06cc
MD5 2b7cca997fb9457d327186ebdb5b937e
SHA1 4b23842a2066872e982a0e2389000b32e6bbd33c
SHA512 e9ba2d8d6b86ab5ad5cdf2705bdc4fe964e01cf2fabe6555121c989b99423cee86a5eec1dbc4c48324df975146580edfaa9dd2a9052de1fb6de7490f0d0e636c
SSDEEP 24576:DVty4/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:DVtfLNiXicJFFRGNzj3
TLSH
T1C565124522C465E4EABD013CCA734064EA747C249F2147EF9190BA3F6B36FD5AE34B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.3MB
SHA256 209628249a3ab1bb3d298433c04bb1cc759580156605958d9bea75647fa0facb
MD5 0acd2886ac9ef6edd00243d924abf933
SHA1 c8cd82d1a1224a6b10a856db60b1296d230f8055
SHA512 cde0b529c47c40957c22de9e63ef780597df89b628da73c72200ff32721da8e90dc6853275e37e4ad627444457186c607cd20b83f4a4e8c749b8452bfd892ae8
SSDEEP 12288:BPpiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:11/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1FD5523D6118864B1EABD003D86364424F1987E3C9B2528F7A194793ED379FDBCF38952
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 fc60226c502fa3f923c29fb073308be3beb6a398b3194f463c5c306ccdc49d7f
MD5 80b7685394069c0d1862299e509a595f
SHA1 08e4211f16dc49fa5063735e0d7b2f8e2461d14e
SHA512 56083553a57c2f6c626b9a01f4b3080b73add18e315768b79d4a9eed20b1a2aa39fa9ca6b0c05af591a525d4d97b6267da5d8798d7ffe0c68021ee6732808f3f
SSDEEP 24576:VC+TyQIu93VAumZr7jmq/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:V/TfIq+YqLNiXicJFFRGNzj3
TLSH
T190558C1DA7E919CAE2B6C575C8A34493E633B872137186CF2044C07D499EFE9AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 9fb10fb468d7d2172df636d3b9a431d98f995cf765d6918e7ef80e61d9c00d8e
MD5 0033182eeb19e54932edcbcc58544e45
SHA1 2c5a1cf0cce320854adbdc890ccb72ce3d1e9503
SHA512 4cfe9ba76dfa569437fb6ce93f9ae9ef14a9d113b9b1041173ef4c62e554041de9fa6e88d12426558dc2ed0cfb00cf86aa0dbd7085b2a95d98661303b3dbc5d5
SSDEEP 24576:LLQikZ5/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:PQikjLNiXicJFFRGNzj3
TLSH
T18865F10FB3AA00A5E1BB813C88554115F6B37834571267DF4290CB7E4B77AEABE38B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 3e286261134d0c7691b5116567c0d90f54ff7dc12711ff4081a4b80d0f3a06f5
MD5 216ae4375597d512de18b9071152367a
SHA1 58b22a51143fe54fab0a1755016206d5872f1f32
SHA512 9b194821a7ebdc5279249f5c9d6cf017df97594f34354b535392b065ad3ace56f8262b16feed28850912ab3d017c7a3014d0d6be36074893fa5d33b85ba614c0
SSDEEP 49152:opJFwrPpGyqWo6cbT2TZ8maJO35NPHXogsS7Q78ZGAvL9vnF35LWAP4LNiXicJFc:5pC7b4+80GTk/7wRGpj3
TLSH
T1C5A57C3DE2B810ADD9AAC375C5461665EE71382E3F2015DB01B0C578BF1AEF19A38F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 cbc324fc16551cb324346569cd7de62b5529eb6eb4d3f01a9d86ea71164ed7b4
MD5 6caed366141b9f2ac1c9403968970059
SHA1 2a0b334079562ef3b0319731aa9850007c860304
SHA512 6fd0209de49da48269e8ca2e911828fa92d1a3bb8b17fce369f4be736ac28e1e7c95220078639950aef461416acb69e7c91eb89fa83ceba3f813c13dc1e391fb
SSDEEP 24576:2SAwJPE1IDAo+4Kt+l4413lUQw/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:2qPCIo4Kol4jQwLNiXicJFFRGNzj3
TLSH
T13355B02AA7F956F4E17AC774C663C511FB723822133163CF9290953E0E16AE89E39F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.6MB
SHA256 4942e1321b23edea0820d047741eb6cc76dc0c80e424d3c79cd105b173b9e871
MD5 625bbaaccd7119c42c485f0246a6ccac
SHA1 df7158374f29d4da16621ab764c6f4181a4ab718
SHA512 11d068c005fd7801a9106a6b29dfbd85153ef34d5c443a2f334c2d53cb40d770c73f88d4111d7218db8f095b2c07fdf7cdc06ad28f30bfe9841c46c3d1192931
SSDEEP 24576:RyLXPLcT94tg/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:Ry7PoqtgLNiXicJFFRGNzj3
TLSH
T11275D03ED66C04F5E57AC13CC6A38906F6723CAD033166CB15A0957A1F6BFE4A939B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StructuredQuerySchema.bin

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin
Size 414KB
SHA256 e67e330837a6b2f6d5f76815e7235a512b54b1c90f2ad62a3e9d142ae6939c8d
MD5 16b9618962f5623ca791a1366eee5708
SHA1 f0d257511952f075b2a0ec7d8e8730c3e464461a
SHA512 18e1d5a105b87fc72df94645685f5a8d3f593df2d3a9b8652b3b4a4ceaf92d3c7a67b0c08847186149dd608428cae8f1b3bc844bc7aacfc9e3219da823ca2fe2
SSDEEP 12288:vMUC7+vlk3n61mSkplXZ5RwmF9n4w/TSD:vXhl6V/i
TLSH
T124945F36BF88CB22C59A15748897C01A2E30A7C49E04CF6B73DC513CFA576685FBA359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.4MB
SHA256 637180fa20906955ef9b476b9af164ef5cb83389e831127831118d34c372e796
MD5 2df03e4f9e87c18605be33e663566dc8
SHA1 8282afbdaa1f746876940a25b798ed16d343ad53
SHA512 3b5d5ebaaaeea0b47e56d23fd3ac216a9c34dfd9941828c823f77f0dc23cab33c80907b31d75eaeaff7cf6533e7479936ae0ad5c5c7e35b604020f1117c5ab8e
SSDEEP 24576:FWv8qjpJ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:FWv8ILNiXicJFFRGNzj3
TLSH
T19D65129E12C424E4F5BD4138C636802490B17D3A176559FFB1C4A97E8739BD6CA3EF22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/232-38-0x0000000000850000-0x00000000008B0000-memory.dmp

Download

memory/232-32-0x0000000000850000-0x00000000008B0000-memory.dmp

Download

memory/232-42-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/232-359-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/236-230-0x0000000140000000-0x0000000140211000-memory.dmp

Download

memory/744-49-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/744-52-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/744-43-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/744-402-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1072-123-0x0000000000DD0000-0x0000000000E30000-memory.dmp

Download

memory/1072-129-0x0000000000DD0000-0x0000000000E30000-memory.dmp

Download

memory/1072-176-0x0000000140000000-0x0000000140259000-memory.dmp

Download

memory/1584-403-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/1584-167-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/1788-60-0x0000000001AD0000-0x0000000001B30000-memory.dmp

Download

memory/1788-54-0x0000000001AD0000-0x0000000001B30000-memory.dmp

Download

memory/1788-64-0x0000000001AD0000-0x0000000001B30000-memory.dmp

Download

memory/1788-66-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/2068-164-0x0000000140000000-0x0000000140221000-memory.dmp

Download

memory/2068-82-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/2068-90-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/2148-166-0x0000000140000000-0x00000001401ED000-memory.dmp

Download

memory/2500-165-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/2500-95-0x00000000008C0000-0x0000000000926000-memory.dmp

Download

memory/2500-100-0x00000000008C0000-0x0000000000926000-memory.dmp

Download

memory/3064-72-0x00000000004A0000-0x0000000000500000-memory.dmp

Download

memory/3064-78-0x00000000004A0000-0x0000000000500000-memory.dmp

Download

memory/3064-228-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/3252-436-0x000001569B350000-0x000001569B360000-memory.dmp

Download

memory/3252-424-0x000001569B350000-0x000001569B360000-memory.dmp

Download

memory/3252-410-0x000001569B350000-0x000001569B360000-memory.dmp

Download

memory/3252-435-0x000001569B350000-0x000001569B360000-memory.dmp

Download

memory/3252-411-0x000001569B350000-0x000001569B360000-memory.dmp

Download

memory/3252-408-0x000001569B350000-0x000001569B360000-memory.dmp

Download

memory/3252-412-0x000001569B350000-0x000001569B360000-memory.dmp

Download

memory/3252-413-0x000001569B350000-0x000001569B360000-memory.dmp

Download

memory/3252-439-0x000001569B350000-0x000001569B360000-memory.dmp

Download

memory/3252-437-0x000001569B350000-0x000001569B360000-memory.dmp

Download

memory/3252-414-0x000001569B350000-0x000001569B360000-memory.dmp

Download

memory/3252-415-0x000001569B350000-0x000001569B360000-memory.dmp

Download

memory/3252-440-0x000001569B350000-0x000001569B360000-memory.dmp

Download

memory/3252-441-0x000001569B350000-0x000001569B360000-memory.dmp

Download

memory/3252-409-0x000001569B350000-0x000001569B360000-memory.dmp

Download

memory/3252-416-0x000001569B350000-0x000001569B360000-memory.dmp

Download

memory/3252-442-0x000001569B350000-0x000001569B360000-memory.dmp

Download

memory/3252-417-0x000001569B350000-0x000001569B360000-memory.dmp

Download

memory/3252-418-0x000001569B350000-0x000001569B360000-memory.dmp

Download

memory/3252-419-0x000001569B350000-0x000001569B360000-memory.dmp

Download

memory/3252-420-0x000001569B350000-0x000001569B360000-memory.dmp

Download

memory/3252-434-0x000001569B350000-0x000001569B360000-memory.dmp

Download

memory/3252-425-0x000001569B350000-0x000001569B360000-memory.dmp

Download

memory/3252-426-0x000001569B350000-0x000001569B360000-memory.dmp

Download

memory/3252-428-0x000001569B350000-0x000001569B360000-memory.dmp

Download

memory/3252-427-0x000001569B350000-0x000001569B360000-memory.dmp

Download

memory/3252-429-0x000001569B350000-0x000001569B360000-memory.dmp

Download

memory/3252-430-0x000001569B350000-0x000001569B360000-memory.dmp

Download

memory/3252-432-0x000001569B350000-0x000001569B360000-memory.dmp

Download

memory/3252-433-0x000001569B350000-0x000001569B360000-memory.dmp

Download

memory/3252-444-0x000001569B350000-0x000001569B360000-memory.dmp

Download

memory/3252-443-0x000001569B350000-0x000001569B360000-memory.dmp

Download

memory/3252-407-0x000001569B350000-0x000001569B360000-memory.dmp

Download

memory/3252-422-0x000001569B350000-0x000001569B360000-memory.dmp

Download

memory/3252-421-0x000001569B350000-0x000001569B360000-memory.dmp

Download

memory/3252-423-0x000001569B350000-0x000001569B360000-memory.dmp

Download

memory/3252-431-0x000001569B350000-0x000001569B360000-memory.dmp

Download

memory/3252-438-0x000001569B350000-0x000001569B360000-memory.dmp

Download

memory/3704-117-0x00000000004D0000-0x0000000000530000-memory.dmp

Download

memory/3704-111-0x00000000004D0000-0x0000000000530000-memory.dmp

Download

memory/3704-169-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/3720-68-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/3720-29-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/3784-23-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/3784-17-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/3784-27-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/3908-168-0x0000000140000000-0x00000001401EF000-memory.dmp

Download

memory/4496-14-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/4496-357-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/5144-0-0x0000000002070000-0x00000000020D0000-memory.dmp

Download

memory/5144-8-0x0000000140000000-0x00000001402A9000-memory.dmp

Download

memory/5144-368-0x0000000140000000-0x00000001402A9000-memory.dmp

Download

memory/5144-9-0x0000000002070000-0x00000000020D0000-memory.dmp

Download

memory/5144-358-0x0000000002070000-0x00000000020D0000-memory.dmp

Download

memory/5144-298-0x0000000140000000-0x00000001402A9000-memory.dmp

Download

memory/5240-137-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/5296-184-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/5320-404-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/5320-186-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/5356-182-0x0000000140000000-0x000000014023A000-memory.dmp

Download

memory/5456-188-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/5460-405-0x0000000140000000-0x0000000140219000-memory.dmp

Download

memory/5460-189-0x0000000140000000-0x0000000140219000-memory.dmp

Download

memory/5540-406-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5540-148-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/5540-253-0x000000000A520000-0x000000000A528000-memory.dmp

Download

memory/5540-190-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5540-191-0x0000000001C30000-0x0000000001C40000-memory.dmp

Download

memory/5540-207-0x0000000001EE0000-0x0000000001EF0000-memory.dmp

Download

memory/5540-154-0x0000000000910000-0x0000000000970000-memory.dmp

Download