896e5bd9fe339a5cb99b96f758debdfac1c63a8886a6f52897f2eca285a79990

Resubmissions

04/06/2026, 17:07

260604-vm58psbs6z7

04/06/2026, 16:09

260604-tl3kraaw5y7

Analysis

max time kernel
149s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
04/06/2026, 17:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-04_a8d825ca88714362bd317b338b227900_icedid.exe
Size 2.1MB
Sample260604-vm58psbs6z
SHA256 896e5bd9fe339a5cb99b96f758debdfac1c63a8886a6f52897f2eca285a79990
MD5 a8d825ca88714362bd317b338b227900
SHA1 6e436b43b8ae1232c74ff58498c20c35ea672580
SHA512 304e32bcfda3e17628752d7d67c924033a91926a699d92742cc60be322f81eab6e2430fea04e5dac6bc58e6c26b8a365e18b6f1d6e720b98ab22b2898c5f1d4b
SSDEEP 49152:EQKi/v0G+NEGJ/7HslbU/BybKFgb565CqT8M2xz:Ai/a2Bp
TLSH
T1AFA59D0B72A882F4D077927DC9D68A8AE6F138454F2197DF01A85B5D2F33BE5493E321
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
5048	alg.exe
500	DiagnosticsHub.StandardCollector.Service.exe
4484	fxssvc.exe
1052	elevation_service.exe
5072	elevation_service.exe
4244	maintenanceservice.exe
1028	msdtc.exe
2924	OSE.EXE
1324	PerceptionSimulationService.exe
3812	perfhost.exe
4368	locator.exe
1692	SensorDataService.exe
1536	snmptrap.exe
5060	spectrum.exe
932	ssh-agent.exe
4888	TieringEngineService.exe
4892	AgentService.exe
2732	vds.exe
3408	vssvc.exe
764	wbengine.exe
784	WmiApSrv.exe
4068	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\e:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe

Drops file in System32 directory 35 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\msiexec.exe	2026-06-04_a8d825ca88714362bd317b338b227900_icedid.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-06-04_a8d825ca88714362bd317b338b227900_icedid.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-06-04_a8d825ca88714362bd317b338b227900_icedid.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-06-04_a8d825ca88714362bd317b338b227900_icedid.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	spectrum.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-06-04_a8d825ca88714362bd317b338b227900_icedid.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-06-04_a8d825ca88714362bd317b338b227900_icedid.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-06-04_a8d825ca88714362bd317b338b227900_icedid.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-06-04_a8d825ca88714362bd317b338b227900_icedid.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-06-04_a8d825ca88714362bd317b338b227900_icedid.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-06-04_a8d825ca88714362bd317b338b227900_icedid.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\{17A6A947-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db	spectrum.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-06-04_a8d825ca88714362bd317b338b227900_icedid.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-06-04_a8d825ca88714362bd317b338b227900_icedid.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-06-04_a8d825ca88714362bd317b338b227900_icedid.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-06-04_a8d825ca88714362bd317b338b227900_icedid.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-06-04_a8d825ca88714362bd317b338b227900_icedid.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-06-04_a8d825ca88714362bd317b338b227900_icedid.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-06-04_a8d825ca88714362bd317b338b227900_icedid.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-06-04_a8d825ca88714362bd317b338b227900_icedid.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-06-04_a8d825ca88714362bd317b338b227900_icedid.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-06-04_a8d825ca88714362bd317b338b227900_icedid.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-06-04_a8d825ca88714362bd317b338b227900_icedid.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\d17fe069e7fc2e30.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-06-04_a8d825ca88714362bd317b338b227900_icedid.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-06-04_a8d825ca88714362bd317b338b227900_icedid.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_161703\javaw.exe	2026-06-04_a8d825ca88714362bd317b338b227900_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	2026-06-04_a8d825ca88714362bd317b338b227900_icedid.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	2026-06-04_a8d825ca88714362bd317b338b227900_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_161703\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-06-04_a8d825ca88714362bd317b338b227900_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2026-06-04_a8d825ca88714362bd317b338b227900_icedid.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	2026-06-04_a8d825ca88714362bd317b338b227900_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	2026-06-04_a8d825ca88714362bd317b338b227900_icedid.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-06-04_a8d825ca88714362bd317b338b227900_icedid.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-06-04_a8d825ca88714362bd317b338b227900_icedid.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-06-04_a8d825ca88714362bd317b338b227900_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-06-04_a8d825ca88714362bd317b338b227900_icedid.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-06-04_a8d825ca88714362bd317b338b227900_icedid.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	2026-06-04_a8d825ca88714362bd317b338b227900_icedid.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-06-04_a8d825ca88714362bd317b338b227900_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-06-04_a8d825ca88714362bd317b338b227900_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-06-04_a8d825ca88714362bd317b338b227900_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-06-04_a8d825ca88714362bd317b338b227900_icedid.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-06-04_a8d825ca88714362bd317b338b227900_icedid.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	2026-06-04_a8d825ca88714362bd317b338b227900_icedid.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-06-04_a8d825ca88714362bd317b338b227900_icedid.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-06-04_a8d825ca88714362bd317b338b227900_icedid.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	2026-06-04_a8d825ca88714362bd317b338b227900_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-06-04_a8d825ca88714362bd317b338b227900_icedid.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	2026-06-04_a8d825ca88714362bd317b338b227900_icedid.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	2026-06-04_a8d825ca88714362bd317b338b227900_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_161703\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-06-04_a8d825ca88714362bd317b338b227900_icedid.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	2026-06-04_a8d825ca88714362bd317b338b227900_icedid.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	DiagnosticsHub.StandardCollector.Service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-06-04_a8d825ca88714362bd317b338b227900_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-06-04_a8d825ca88714362bd317b338b227900_icedid.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-06-04_a8d825ca88714362bd317b338b227900_icedid.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bd24a3ad44f4dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007fcc6dae44f4dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.txt\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c5e9a7ad44f4dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tiff\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dib	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dib\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ico	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002684e3ad44f4dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpe	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9908 = "Wave Sound"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raw\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 42 IoCs

pid	Process
1708	2026-06-04_a8d825ca88714362bd317b338b227900_icedid.exe
1708	2026-06-04_a8d825ca88714362bd317b338b227900_icedid.exe
1708	2026-06-04_a8d825ca88714362bd317b338b227900_icedid.exe
1708	2026-06-04_a8d825ca88714362bd317b338b227900_icedid.exe
1708	2026-06-04_a8d825ca88714362bd317b338b227900_icedid.exe
1708	2026-06-04_a8d825ca88714362bd317b338b227900_icedid.exe
1708	2026-06-04_a8d825ca88714362bd317b338b227900_icedid.exe
1708	2026-06-04_a8d825ca88714362bd317b338b227900_icedid.exe
1708	2026-06-04_a8d825ca88714362bd317b338b227900_icedid.exe
1708	2026-06-04_a8d825ca88714362bd317b338b227900_icedid.exe
1708	2026-06-04_a8d825ca88714362bd317b338b227900_icedid.exe
1708	2026-06-04_a8d825ca88714362bd317b338b227900_icedid.exe
1708	2026-06-04_a8d825ca88714362bd317b338b227900_icedid.exe
1708	2026-06-04_a8d825ca88714362bd317b338b227900_icedid.exe
1708	2026-06-04_a8d825ca88714362bd317b338b227900_icedid.exe
1708	2026-06-04_a8d825ca88714362bd317b338b227900_icedid.exe
1708	2026-06-04_a8d825ca88714362bd317b338b227900_icedid.exe
1708	2026-06-04_a8d825ca88714362bd317b338b227900_icedid.exe
1708	2026-06-04_a8d825ca88714362bd317b338b227900_icedid.exe
1708	2026-06-04_a8d825ca88714362bd317b338b227900_icedid.exe
1708	2026-06-04_a8d825ca88714362bd317b338b227900_icedid.exe
1708	2026-06-04_a8d825ca88714362bd317b338b227900_icedid.exe
1708	2026-06-04_a8d825ca88714362bd317b338b227900_icedid.exe
1708	2026-06-04_a8d825ca88714362bd317b338b227900_icedid.exe
1708	2026-06-04_a8d825ca88714362bd317b338b227900_icedid.exe
1708	2026-06-04_a8d825ca88714362bd317b338b227900_icedid.exe
1708	2026-06-04_a8d825ca88714362bd317b338b227900_icedid.exe
1708	2026-06-04_a8d825ca88714362bd317b338b227900_icedid.exe
1708	2026-06-04_a8d825ca88714362bd317b338b227900_icedid.exe
1708	2026-06-04_a8d825ca88714362bd317b338b227900_icedid.exe
1708	2026-06-04_a8d825ca88714362bd317b338b227900_icedid.exe
1708	2026-06-04_a8d825ca88714362bd317b338b227900_icedid.exe
1708	2026-06-04_a8d825ca88714362bd317b338b227900_icedid.exe
1708	2026-06-04_a8d825ca88714362bd317b338b227900_icedid.exe
1708	2026-06-04_a8d825ca88714362bd317b338b227900_icedid.exe
500	DiagnosticsHub.StandardCollector.Service.exe
500	DiagnosticsHub.StandardCollector.Service.exe
500	DiagnosticsHub.StandardCollector.Service.exe
500	DiagnosticsHub.StandardCollector.Service.exe
500	DiagnosticsHub.StandardCollector.Service.exe
500	DiagnosticsHub.StandardCollector.Service.exe
500	DiagnosticsHub.StandardCollector.Service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
684	Process not Found
684	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1708	2026-06-04_a8d825ca88714362bd317b338b227900_icedid.exe
Token: SeAuditPrivilege	4484	fxssvc.exe
Token: SeRestorePrivilege	4888	TieringEngineService.exe
Token: SeManageVolumePrivilege	4888	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	4892	AgentService.exe
Token: SeBackupPrivilege	3408	vssvc.exe
Token: SeRestorePrivilege	3408	vssvc.exe
Token: SeAuditPrivilege	3408	vssvc.exe
Token: SeBackupPrivilege	764	wbengine.exe
Token: SeRestorePrivilege	764	wbengine.exe
Token: SeSecurityPrivilege	764	wbengine.exe
Token: 33	4068	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4068	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4068	SearchIndexer.exe
Token: SeDebugPrivilege	1708	2026-06-04_a8d825ca88714362bd317b338b227900_icedid.exe
Token: SeDebugPrivilege	1708	2026-06-04_a8d825ca88714362bd317b338b227900_icedid.exe
Token: SeDebugPrivilege	1708	2026-06-04_a8d825ca88714362bd317b338b227900_icedid.exe
Token: SeDebugPrivilege	1708	2026-06-04_a8d825ca88714362bd317b338b227900_icedid.exe
Token: SeDebugPrivilege	1708	2026-06-04_a8d825ca88714362bd317b338b227900_icedid.exe
Token: SeDebugPrivilege	500	DiagnosticsHub.StandardCollector.Service.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1708 wrote to memory of 2180	1708	2026-06-04_a8d825ca88714362bd317b338b227900_icedid.exe	80
PID 4068 wrote to memory of 936	4068	SearchIndexer.exe	106
PID 4068 wrote to memory of 5108	4068	SearchIndexer.exe	107
PID 4068 wrote to memory of 1720	4068	SearchIndexer.exe	108

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-06-04_a8d825ca88714362bd317b338b227900_icedid.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-04_a8d825ca88714362bd317b338b227900_icedid.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1708
- C:\Windows\SYSTEM32\rundll32.exe
  rundll32.exe qcCoInstaller.dll,qcMonitorDevice
  2⤵
  PID:2180

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:5048

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:500

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:3312

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4484

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1052

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5072

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4244

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:1028

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2924

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1324

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3812

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4368

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1692

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:1536

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5060

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:932

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4888

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:4112

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4892

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:2732

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3408

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:764

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:784

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4068
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:936
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 3020 3004 924 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5108
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 3040 3032 924 {85EE815A-7738-4808-A14A-3AD87E32A3BF}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1720

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 1229d7c9c44d59463a85d2b5b06f3bf80825fa404e71a6a4f6ff5451c365d089
MD5 fff4b18f36a7b2c85aea77d24c4f3abb
SHA1 99c646c9c4f44d7240dd3027000af0966fad010c
SHA512 5c75df184cab656a787aaf8a48787c94b5aaa3b6d8835e0bee107b34a9d8ba1d95b68022b57b5e88b8a197392c6c93bae1acb84a2a261dbdcda2fa2053e33d38
SSDEEP 49152:Bb+632BuPkFKRrdE6ohvstBhuXjfS4LWxn4CqT8M2xz:H3q6sjB0
TLSH
T1C5D59D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 dac3fdb747d4dc533b5d70cd855ca2034d050e222dd7bc726a2cfd35c9f19c25
MD5 2fb91ddef30a7677b3330c85d936bdde
SHA1 b686583f6916c7ba4a2e19c59bb8e09709593579
SHA512 ef41940fdca437bd4c68c678efc6ce1483d1a6cf0aaa13ac4fbf7e8e10bafbae3fe7d7b73d328d9e2c275b9f1aec8246a0bb4bdd45286f146eefec921b8646d8
SSDEEP 24576:SXYfDtczAqmXCYBOQ8QprdUHc0/T3iaV:5tcqCqT8M2xz
TLSH
T16A65012973D404F9EDA78239C8A2C511EA33BC844364E7DB03A4A9655F737C85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 45dd378a6e7d33dbbc12d40ad8cd4adad76bbe34098e182c5d4096175c9ad5b5
MD5 a030efdb1b92dd7e122f69c5f8728ecc
SHA1 325d1a07ae7302ab31f689cabeaaebc1cea5dbad
SHA512 68decf23b3b61c72f2ca3fa46eef812d2c89070e8b90489189413b091d7c49adbecd5299cc90937fa7cf85f2f16fd7ebe1b0d03e8aaad6de2f377d1d965a43f0
SSDEEP 24576:e0Le5ji0hmxWrMtmXCYBOQ8QprdUHc0/T3iaV:ePji0AYbCqT8M2xz
TLSH
T133859E26F6748331D073C0B9C5D2A68AED72348557308ACB4286D77C7F67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 40d6e5efc7ec57b5bd94c29e965027e9910961a7956e8d884fdd896a894e80f7
MD5 e558ead518954bd6f8647301354baf4c
SHA1 ee3205f567c6b2095f5554a9eff833d98f17ac5c
SHA512 e155aa0f7f86976eb3511b3373751c159a316f9c4025fd1dc5371eb38a6da424a29aff8eaad05c3db1f9d6844d62c9d1463db655dc1d75a181c8424cfcee048a
SSDEEP 24576:ya7/ezSC6vUyD/aqgrvWn6q8wyu7mXCYBOQ8QprdUHc0/T3iaV:V/ezSC6vUzPveHjyfCqT8M2xz
TLSH
T1EB755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 8d23c61273caa372e06a5b6229ce58d74849fba6bb346591eaf17f9dafc17913
MD5 f929fe4608684881f869cd91a4101dce
SHA1 b0f8e1db79df87316cc8af410fc0d58c6c28f34e
SHA512 9222c0fd6a3ea6c369c9b210c15492b0d923ae5a086e8004a3e52bef524efda5afd3ae19dd06a8d3e6539341d40f18e109147dfa38716a04bc8958dda48231e3
SSDEEP 24576:wVbqPb88hv/l+YumXCYBOQ8QprdUHc0/T3iaV:wVO88hXl+yCqT8M2xz
TLSH
T1D7559E66F6748331D073C0BAC4D2AA9AEE3234415B318ACB1246D76C3E67BD5D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 2834e4d3a40b57991542b46f9944b99961ef1d70459faaf82a67aa553d87b1eb
MD5 be19bcdadfc99f22d1346886dc47280b
SHA1 002341a2edb0041712302ae4237fc63043a5c545
SHA512 10b630e32b59d72f0520430543dbba6a68cce4887de97d7800431d0b136cc62b9f3806cc0c4ad7a0b9db9efb5b325fc4f2ac7cfde213c8415bb7b917d001c5c6
SSDEEP 12288:shhmSuBsYx/s6OQgDY7HkJIrpBLhUfQcjQ0/kv+j3ezIOt1Ta0z0AWTaxCY:shhmXCYBOQ8QprdUHc0/T3iaV
TLSH
T1AF45239FB35970B2FFE94271645FB8113A6FBF8C900A655AC1547D80A6FDD80E82C84B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 0b1993e4f4f0bce4882645c4a3cd819b8d9d8245869453d06b445aaf0140607d
MD5 6ca426366a29319629b7165afa5905b9
SHA1 fdb00660c89a0fa2950389bbc21db3a996a2e50b
SHA512 e0055684f4b68a197a2deffe02024932c7ab4baada7f7e6411dce12b392120385029435a279bcce2338fd6c748d8e2f6da380b3b0d2e232fe51ab19f92c11d0a
SSDEEP 12288:feBNUbTVO86UmmSuBsYx/s6OQgDY7HkJIrpBLhUfQcjQ0/kv+j3ezIOt1Ta0z0A/:fJIUmmXCYBOQ8QprdUHc0/T3iaV
TLSH
T1CF65DF3BEE28FCE2C67E8DB95A91C600E77678704B12A3CBD164820DDE239D05E79C15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 16eaab72a5c92d84a47042966fa07c106d32024884394d2c248fd26f28136a7d
MD5 aeb01c1f5b69dd3c4750455eebf4886a
SHA1 7330568b30a95242e029c6da7a14bc8f5b0a6b92
SHA512 9296c9875d0edf96e1db2d64f064099207cb2d0efa9c2646ab8bf0bd05c6bfbe4277c8dc245516b44c887a77cc46c8c9ba09a18cdd4a7c6ae8f9006fd703ac37
SSDEEP 49152:0QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THE:0QvGAdlCEL8c/DRNw5C1
TLSH
T18D266C656BF880F5E0A7E178897AC572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 ebac758f65d8bd227da630d7f1a19ccac7f0a1fb8789a3cd22ec03579473fa8b
MD5 29d43e6b0b547ae020b67a33975b5308
SHA1 c35517a6e0b64544585cc0251be870fb904e9621
SHA512 a59951e246805405659994570befeac22c157ed78fad1b2b33788dc44a15ce835875c420a3b7e537afa25ad23870c42c3eb9971353920e44a81ddc8f8e663feb
SSDEEP 12288:+AwSfxL/2Dc38DLLmt0LDQewsAjMmSuBsYx/s6OQgDY7HkJIrpBLhUfQcjQ0/kvJ:jRewsAjMmXCYBOQ8QprdUHc0/T3iaV
TLSH
T13A75E031FB74E032C7BB0DB21B26D716282DBE604B5119C3E3A89E8D59746C1277AE17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 e43c07763e78e0193204ec30d87c6de749b8777a2384add7e0d57e6dbc93cbb7
MD5 50c6416d21dff05d60564c87743a5eee
SHA1 bd4fb502e261af8218a944b02eb7c69993c4cfe9
SHA512 9468631e6cbae468e1b77e52cb181e2ad7b4ecc4a17474d5f9eb05e8e3ae32f5dfe4cdaabf958c4a7534baac12f54376de73dc1ca7cb0feb71c227fe4624a337
SSDEEP 196608:BUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJH6:BUEtQevvqc2W1cpV2tI32
TLSH
T11E474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 52ea81c184a9a9fa7105e9e0ebba8150e8a726338d4f640b923a1ccff8b3409d
MD5 bc840acdb0524472f348457c695f5794
SHA1 dba89f5db187b469b675bf77a0e31a3aecc7f6b3
SHA512 f3679566e359c7c41bce254be1db0e6a8fc56ca07bc9e6366d14626437f59dd04f6359db24bf0ad223e87675627dc2d5df9dd36281a07e8e2f88aca205f0f4ee
SSDEEP 49152:KCbRquA/m2yL5zLfFiV+XenmE3/zLCqT8M2xz:/oq2Vjnmh
TLSH
T168D58D0A76B8C1E4D1F6C37886A2C647F37178154B35ABEF4265461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 1e399666bdb580eaacf753c2ba6a08bb4e1dd0d853716136e5a30f031d6023ae
MD5 09d9ae26a21983f215aac0d7556b5d3c
SHA1 285f232d80b5ddd84513db829e09cea107f415de
SHA512 e1f7a6caa17728c3bac4122973949295bf19eaaa9d6695b81fb80d3e4674e74dbbb42cd6ef10af09090efbb72395d6c106909b12952d3ad2eb5c05aa6420a55e
SSDEEP 24576:WAhGL3IFoiwtA5l7S533mXCYBOQ8QprdUHc0/T3iaV:WAMUFoiq5uCqT8M2xz
TLSH
T163359C81E7F951D4F5B3AAB899B69171EA76BCA95E31C20F2160D10F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 dcd877fcd50a43f678273bb124abc6fa4f1b1759119f58e8c2566ffa2fba799e
MD5 a11e6a56d5e0cd1f01f37815ef2f3e3e
SHA1 a424bd1ac7f17654c4646a85484c029a03a4b703
SHA512 2a9e8742893126e3db671731aaf364b549403444d8a597b5462bd90385f38035ec39b70522ed7dbcf2f91312bda9f233f2e2ff88200a0d80448a36c6db785d29
SSDEEP 12288:fmw5HEjsChNDBFgl0WDm+CbmSuBsYx/s6OQgDY7HkJIrpBLhUfQcjQ0/kv+j3ezr:ewuKOWYmXCYBOQ8QprdUHc0/T3iaV
TLSH
T12165F14A73A81CF9E9A782398497D432F7F7BC052A25D71F0360C65A6F37650AD2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 23b7a5251466639fe200795312f7c12df7c38f3fb09d4efd487cdccd438c564a
MD5 7e5a6abc86e05adde1ce34b6bfd91fec
SHA1 af65bb8f52d9e40b95affec4d7a90204860589c3
SHA512 b06ce1461f5b758079d4f7ed184af23b0f2f1749c40af5a4f57c16f26897680b7ab4c04db867ecc0dc30fc696f107d2c9230e7b97063d730b3e295b7f1778634
SSDEEP 12288:gwZ1IycmSuBsYx/s6OQgDY7HkJIrpBLhUfQcjQ0/kv+j3ezIOt1Ta0z0AWTaxCY:nZulmXCYBOQ8QprdUHc0/T3iaV
TLSH
T13F55129F33A830F5E6E2423998E6A901E77A7C95633643CF422466546FB7EC05D3C722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 6932fc98e59192ce5940cfea32a817d495a04d7fa830a42674f7c979bf6eb628
MD5 081d657734a8d5d87d4e4aea26b69979
SHA1 3332c335ff22c143600d2404441efd9b7e48e79a
SHA512 bbf5eb55558be6cafecf7d009d1b05057b4d6a7b46980793a054e32409473859ec71f5f541b81d57004a996b5b2d618a8f9f25b3e665f120e90c5a2d9499d8a8
SSDEEP 49152:Rj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23Uo:4QRQyi36YOcPbLvw2gAf+PN3Y
TLSH
T196667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 082522de968966870b9ea51fd45384845462be0a1808f4954fb4f545500718dd
MD5 e77b56959a8c15583ca393f14dd165f8
SHA1 afb7cc0008550bc68fe00eeda3a3bc78244dc815
SHA512 e3f4e02496ce457db9d1f65eb156dd2308e4c8598a996f9641db62e8c34c69ed1e2b2ce4f3b1eb43f4a18985922515418f027fcf99a8b6568867a367563e6b8f
SSDEEP 49152:Ij8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23Uo:vQRQyi36YOcPbLvw2gAf+PN3Y
TLSH
T100667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 73feeb92172ae951fac5aa4c38ffbb705bc0d2e0c48f7afe8d9dc801a46ffbf3
MD5 1f401a5f1d1bc54a46b48cf7d16fcee7
SHA1 8d4ff92dacebb120115a7afa02becf2d7e579004
SHA512 5132a6489e535b729b37a753317ef47792abbea65cfc851dfd20223620508dc03da1a44ba060bb2c827109231a4cbb4301ee7eaba2691f6c93dc46c6ae0232c9
SSDEEP 24576:7wvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0VmXCYBOQ8QprdUr:z68Qg55nhceWu7PNU3/bCqT8M2xz
TLSH
T1D1B55933B2F600A9C44DE1769F4A973196D27C758FE1E3DB811172061BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 fa691740aa7762e05909a8fc6a8856487e388dad27432e0df82a54e98a1edcb0
MD5 8ef256c1a9cf8fce70704b763aac85c4
SHA1 e771e817fe21478015e4d5fd64040dd0bb2380e0
SHA512 5a7f0ccee2e484a1f41596c8093bbf17d50a1223396b1c4f52fce559ae1283278e72f1d53c4baefa875b08773ea452a56db755471268551b9318dc88c4c6c527
SSDEEP 49152:h3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99e:gy5112gYy5azzVvt69nLKnhZj
TLSH
T1D0167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 b0194ddfe62e69f3446c3ede14254c1b861e9aec4df5bb10b3a115d07312f832
MD5 da7b8d85b542f0913026a6702c700540
SHA1 57655e91b0b060163a38e44ad09b6bffec062873
SHA512 e53449056d19ef2fffda48eb31526dc4c05c61609480a2742d22b76514c77c6ad13e650bd2ba7712d3f92c1c8c2f983f0fdda6541feb9a50355844e1698ee437
SSDEEP 49152:bB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glVCqT8M2xz:Nu6Jmdxd2dQ
TLSH
T1E8D59D13F1DA01E8D06ED478974A9233FA62BC490B35B6EF0A9073552A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 e904a9167d7a72228b298f03f19da8ed018405b1195119d8d32bc1b5340bf3a7
MD5 7407c6a687fa8b5e006081f4b6393877
SHA1 ed81749a4809912cdb9f89ea9ee5383d41649cf3
SHA512 d24c3069d26f545a77c45951cafc0e89da0fb7efbf3fbfa159b9300e53ecc54d2af475b1837a50263e37dc69d5d261003925cafffe16243ebf07202ab775f744
SSDEEP 49152:31hpsNoJpF1A63U44CwH7R4xpCqT8M2xz:3mifPWRh
TLSH
T1F1B5BE13F2D900E8D06DC17887569232EA62BC450B35B6DF0A90B7962F7BEE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 1ff185eea059eb7ada2239089dd71d3132fd0f94cd5f08a0735467570e6e6ff6
MD5 0a32ec488e4dedbc7a80428e666e2f6a
SHA1 5d9531ae23398c9fff524318e552148be6146d31
SHA512 1664a11424e74e795ecaa8c758da41f32b88dccbe021e228f70c3ef1c665d892c053a448d5239cd9c6d44a654b19fb9d133c4f0f1905bfcc50493990dce99694
SSDEEP 49152:eSuZQIY0Be2KcRVtOnks6NMHqICqT8M2xz:w5dKii61H
TLSH
T19EC5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072551E77FE09B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 bc33592bcb31fbf06f097200bc9e3d672860f3395dba5b8008d28a220b055ce8
MD5 aac00556284b139e6c247ecc29816445
SHA1 2423dd82a08b517d87d7dadba52708a67519545f
SHA512 8dd868776f182b971db3b8e0d5dd977d1c8c361192266ccdaeb032f6d8385901c3126f85a6695a3503afad80148babb5f29f7b520ea2a93d762c0c2523df506f
SSDEEP 49152:/htSn8EApI0fig3giDn0AP5wlCqT8M2xz:uX2imph9
TLSH
T11E95BE13F2D900E8D05ED174C7468632EA62BC150B39AAEF0A90B6561F7BFE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 a265063a3af58a4320ced6c09c38f460342f6be399e6ce558efe37927c63bac8
MD5 cdda89f21a5da4418ce31f4dbccc75fa
SHA1 782aa902e800d84e10115da566c291123235877d
SHA512 8dd37a9a17a316b0850ef08876b0741f90941c78ba00d42913d4afc801f498129a953356318b584563b594abbb8efe9650039ad758c66ed796c85a13939bb967
SSDEEP 12288:h5mSuBsYx/s6OQgDY7HkJIrpBLhUfQcjQ0/kv+j3ezIOt1Ta0z0AWTaxCY:h5mXCYBOQ8QprdUHc0/T3iaV
TLSH
T16345239FB35E60B6FFD44272645BF4117A6E7F8CB11B219FD2487800A7F9D80682C84A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 314b9b006ab0a12df5286932b8d3629a715a2bd6bd34f1b6b80dc66e12be5a42
MD5 b2f6359d615f5da31f9d5393ef54ec09
SHA1 d160cfca3a8fd34b7cac4a66e9244df1db5ac0e3
SHA512 d803eb701d521a56979ad40c2f8360b7e2540e2ad566d36ab623667fffa25a02e0cfbfdb30bb0e0426327cf1aeb0bc15ae9536182fc0dc3f6de63de857784194
SSDEEP 12288:mgmSuBsYx/s6OQgDY7HkJIrpBLhUfQcjQ0/kv+j3ezIOt1Ta0z0AWTaxCY:mgmXCYBOQ8QprdUHc0/T3iaV
TLSH
T10945239FB35E60B6FBD44272645BF4117A6E7F8CB11B219FD2487840B7F9D80682C84A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 94ab6c1320342dfaef11a0e6fef4d8e30442deda072deb41d35faaf5c56349b2
MD5 e997ffed303db1fe156f1b8fc9d180f0
SHA1 3f3e77a49b2ae719f0b2d7bf0252cdfc7c3fee99
SHA512 59d91df45a861059b5608a673488d58cb210721f057dda2e7557810214224525921eae5595cd03da592635a5b90f505f832e897fa563423a4f16eced6c72b0c6
SSDEEP 12288:UemSuBsYx/s6OQgDY7HkJIrpBLhUfQcjQ0/kv+j3ezIOt1Ta0z0AWTaxCY:UemXCYBOQ8QprdUHc0/T3iaV
TLSH
T19545239FB35E60B6FBD44272645BF4117E6E7F8CB50B219FD2487800A7F9D80682C84A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 c58ec05d63f1e27931c813568976cd4314bc4739a75da80d7d55fbc2bbb4827d
MD5 4284154d52d023318c173e0e550b9a5f
SHA1 7c1c601599855a8df5662d0fb856bb9ae85368e4
SHA512 af27ef7165c41acef0db79d472b12214adf4a5fda2e54afe7b551adedaea2843ef74f79d499e7248034f2c729b73780f18e0aa7190eb29c3fcded5f5707822be
SSDEEP 12288:yVXmSuBsYx/s6OQgDY7HkJIrpBLhUfQcjQ0/kv+j3ezIOt1Ta0z0AWTaxCY:YmXCYBOQ8QprdUHc0/T3iaV
TLSH
T1E855239F735D20F2FDE582719857A411B6BEBE8CA626629FD20039405FF5E80AC3CD46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 4df7548d18ce1a3330150637de81e07c6e5b28d75eec538d985410a0e2055f11
MD5 4e731fa2827faaeeffb21338f58775f5
SHA1 67afdfdb0a57af7724c7ac6890f020a85b874711
SHA512 acc781663328716ad83136200952aed48ec7a4882b8b7a84e9e8ccb30445652353049adec16f6ca7aaefdc9429f68c0ffa0b4e9bde8430bc1520d237ed31d80c
SSDEEP 12288:vfmSuBsYx/s6OQgDY7HkJIrpBLhUfQcjQ0/kv+j3ezIOt1Ta0z0AWTaxCY:vfmXCYBOQ8QprdUHc0/T3iaV
TLSH
T1B645239FB35E60B6FED44271645BB4117E6E7F8CB10B219FD2487840A7FDD80692C88A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 87b6476edc6c90a19d360d293efb9b180d209736c9702582d4825a9d788ac049
MD5 2af154f01f6259793017fe74e085bafd
SHA1 c93b654e6e796c5f1a3b10c7045c639f74621f65
SHA512 62d0ab3a7ab5aa85241c6d28db91414eeff801a3c2ec4bdfb7656410f87004e67aa2c00831429d44532b760f4e717954f44dbb2a219c918f3f677f698c0eac01
SSDEEP 12288:7EmSuBsYx/s6OQgDY7HkJIrpBLhUfQcjQ0/kv+j3ezIOt1Ta0z0AWTaxCY:7EmXCYBOQ8QprdUHc0/T3iaV
TLSH
T1EF45239FB35E60B6FBD44272645BF4117A6E7F8CB10B219FD2487840B7F9D80682C84A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 7b69e5624f98724adb64949751d73378609b232a4a7d36f305ffff0ec5f5c626
MD5 f57d6ec20d1e93c1676c7a94d178b266
SHA1 e08525b9468cdd3cdec9ec7ea80516bb60287f11
SHA512 626c25ec38f07408f67d678f4794a499c256868dd9ddfdb2c6d922983dace302c67c21514b7c09d140e28fede930bb961847f0f3e0cf9551d6d235a25f94b926
SSDEEP 12288:9ImSuBsYx/s6OQgDY7HkJIrpBLhUfQcjQ0/kv+j3ezIOt1Ta0z0AWTaxCY:9ImXCYBOQ8QprdUHc0/T3iaV
TLSH
T10A45239FB35E60B6FFD44271644BF8117A6E7F8CA51B219FD2487840B7F9D80682C84A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 f97f5427a47a1a76aa86d03c89f77d678ba566dd6ef066933c268b053039f13c
MD5 ee2aef110aabd89849e5db0daf8dcea5
SHA1 9a10e11116d4e2de222775357462a350fe5bea1b
SHA512 ff81294e473ab0f0640ad83f066a25cfc37101e79b7ddeed196700eaefdfd1a9a98f70edd4376db1eaaeb3db4a2d46a76c4bfaec6d90c7bd75c97c3516bfc649
SSDEEP 24576:SZMHzFVSOAmXCYBOQ8QprdUHc0/T3iaV:SZMHzfDCqT8M2xz
TLSH
T1CE65029AB39018F4EDA7823ECC569906E6B27C590770C61F03A436665F737901C3EF9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 e89158310404d3bafa79abaec034ed3fd4c4d27d035a38de941416201275861b
MD5 ebad7eacd92ae675986ae15461acc5b5
SHA1 4b0ff9f3e3b51695da83bc1c6c8239afc983171d
SHA512 891a9c87338d4200bbe7a466ffbcc505fee8e8b7b37c2706f03004a1b7dae735aa3d85bf9271f467586d94e21dfcf140b3ac4ad70ec6392907c2f3274fb95c92
SSDEEP 12288:b1mSuBsYx/s6OQgDY7HkJIrpBLhUfQcjQ0/kv+j3ezIOt1Ta0z0AWTaxCY:b1mXCYBOQ8QprdUHc0/T3iaV
TLSH
T10D45239FB35E60B6FBD44272645BF4117E6E7F8CB11B219FD2487840A7F9D80682C84A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 c8d9d478ae829e8955895c39f357e5e2ef7ef512842fc22cd152cca95948dc63
MD5 7e453eea3583cc0c91d87a4551e25347
SHA1 b65d0f1429d1a350ff1f27030ed577bbfab2fcfe
SHA512 bbec286161c9068240255f7c3b521cf8df0902919da5d44d61c56d4db98c3a57d54b645db76084f5b0f9683160f78a76fb330997d506cf2c7e52702e91bc6cd9
SSDEEP 12288:1xmSuBsYx/s6OQgDY7HkJIrpBLhUfQcjQ0/kv+j3ezIOt1Ta0z0AWTaxCY:1xmXCYBOQ8QprdUHc0/T3iaV
TLSH
T16945239FB35E60B6FFD44271545BB8117A6E7F8CB11B219FD2487840B7F9D80682C84A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 5f2401a75ab3eadb5789f0919b6e45ffc6b2c74c39333340c2eb36e66595863c
MD5 3faa1bb572eaebf76cf6cb569c34188c
SHA1 721d1809694d03fbc5d8aa9e5121f2cf9759490e
SHA512 a7791b3580bc1e7a87cae51b88a63ed415478888cfc6fae66c71ce3e97358922931e0b76aba1b80eb401f14fdde1b97b78fe19ee659fb58ca2317c9dd73ce389
SSDEEP 12288:myPz5L8cmSuBsYx/s6OQgDY7HkJIrpBLhUfQcjQ0/kv+j3ezIOt1Ta0z0AWTaxCY:bzycmXCYBOQ8QprdUHc0/T3iaV
TLSH
T13055124B73A530F9E5768234C8522902F77ABC3547249AAF536427722F77AC09D3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 64f6be1839fcda297383bab9b6c1420f941ecb5370dcc78ad5fc63bbee10e28e
MD5 cdbbff343f001c0db0cd3a8cbceeb4e5
SHA1 94a4a26eb86eb926aa2b11a121d62f6d4c1172c6
SHA512 29702d03fdcafaf4e90a981a1cbd53d60d2429dff389244e36766b4ed9700a812d19a7383938b2df03f2f2cfbb422e5c32eea983d9581212d5ad389e3c9df8ba
SSDEEP 12288:b1mSuBsYx/s6OQgDY7HkJIrpBLhUfQcjQ0/kv+j3ezIOt1Ta0z0AWTaxCY:b1mXCYBOQ8QprdUHc0/T3iaV
TLSH
T13145239FB35E60B6FFD44271645BB8117E6E7F8CB10B219FD2487840A7F9D80692C84A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 120fc19b4b4292c274e334eefb4812f4705e38249d6be1139627860c5ae17763
MD5 98b21312101b6c75adb881c7c9a9d8f1
SHA1 d9d2c9cdef2d238d4a2b7b9275283057780eb854
SHA512 a5e0eded31dba43c2a7aff75609611e3a77d8d74bc25b77050096cf3d878e144ac22097c3303381ed2f60ffd01fffb237d558799428c862f9874ff2ae4e56143
SSDEEP 12288:d1mSuBsYx/s6OQgDY7HkJIrpBLhUfQcjQ0/kv+j3ezIOt1Ta0z0AWTaxCY:d1mXCYBOQ8QprdUHc0/T3iaV
TLSH
T1C945239FB35E60B6FFD44271644BB8117E6E7F8CB10B219FD2487840A7F9D80692C84A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 210c25d051ace81980259d601204eb6d78a2e61340bf970287901e2be995db99
MD5 264596be413fdaa1901b0ba95d725001
SHA1 e323afee3a32c3435b114de576e25f5956e46f4b
SHA512 1e4d04fa4501eae1c66c1c0a63aef9658ff0f7acea9d19538221791b7d0bd987abae32f6d78016f063526426cec6e7be37ea976951aeed23f8ab758f3133d0a0
SSDEEP 24576:2CU3pvPDv4Ex1hfe7i8WVq2lIGU8lrtGUJLPuwvAymXCYBOQ8QprdUHc0/T3iaV:2CUZPTY+8Wg2lIL8lrIUJLWwWCqT8M2p
TLSH
T17E65BE1EA3EC0896D4BB813589518A06FB327C2E1B2296CF1160C73D6F67ED55E39F06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 4600dcf7cf354e013aad3612beb19359511581779116bd5cd321d6148c932045
MD5 904ae8bcbd435f004b11744e3f29dd21
SHA1 15882708eb77da7ea8aa46d876ba16c26cf5fea1
SHA512 e5a07dcbab246db2fea95f2e8586443f8262494017aa751956a55ee66bbc722f18cc6eaa8e4fcc92f03d98654d1ee1266807e9bebb9e0b8e3d4bbf08bd1baa5a
SSDEEP 12288:GJsflmSuBsYx/s6OQgDY7HkJIrpBLhUfQcjQ0/kv+j3ezIOt1Ta0z0AWTaxCY:nlmXCYBOQ8QprdUHc0/T3iaV
TLSH
T1F255015AE39811E8D0AE4275C7569A01B73B7C5893E1D3CB53C0F93D1F7AA809DE9A03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 405dd4d43586c5df621dc1d3d5a87435833ce9a79fa96dc7fb58d4c8f704d537
MD5 563415c79ae6c014030c672c7e784d48
SHA1 88e87ba4036ba77f8597bae0f2f4a1017e933302
SHA512 ee573fa3b131592eca009d64b11bd38b053c880d594b76995786187831e1cb476c7a41ecce661cbcbcf6d88ea07799afc11ea40f9c949c9c1f8871b6bf59c736
SSDEEP 12288:/+mSuBsYx/s6OQgDY7HkJIrpBLhUfQcjQ0/kv+j3ezIOt1Ta0z0AWTaxCY:/+mXCYBOQ8QprdUHc0/T3iaV
TLSH
T11F45235FB35D6066FAF94271545FF421362EBF9C971A60DBE1047980A6B9DC0AC3C80B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 8b7f7c60d1524017ed7c1619e7c88c59ececc9ec4a7504fc6146907e26f98ec1
MD5 5391be61a8d429db2835b785e6e2c85e
SHA1 7aafe0ec1b34cdebbdf7c5a0237fe592f168bcc9
SHA512 ace61931ebe753c4ac538087610baa812b118e1f366739b53a917fdefadcf5b0c00eae75195de7a27fe85f55373a57878021acb01d2bf337aa3001347062a63c
SSDEEP 24576:x8RMyNoSFw1d+rC4vrmRcGPiQEaaPnMRTCsmXCYBOQ8QprdUHc0/T3iaV:uRZwQCyiHiQEaaPnMACqT8M2xz
TLSH
T1DD85AF1E63DC42A5E4BAD278CDA74407E6B278165731A7CF0190C27D1F27EE49E3AB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 f623550dd2de3bb91a59516c0c5df17bef6ffe98f022e4dfe31533b49894e921
MD5 c2d1961a91327eec88bb8c1427d8d64d
SHA1 09c81d78a9b113c87f59f7f19095870bcee4d100
SHA512 70dd8acb308d95583d9157682d526f91ab9ba68a768720685fb0517434f5b51563ff601f83708daeb11adc3f7225f6d2bedd30871f2a8abc0ab779f6ff54237b
SSDEEP 12288:QbxA1U7KOmSuBsYx/s6OQgDY7HkJIrpBLhUfQcjQ0/kv+j3ezIOt1Ta0z0AWTaxx:QbxA1UGOmXCYBOQ8QprdUHc0/T3iaV
TLSH
T1B155126F63AC20F1F6B5813988D6D002E736BC596325A3DF5180A2795F7BED09C39E42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 0a3d180e76c5464fc24cef62b0852193ea556329b57562aceb76e362212ffb01
MD5 c078402e896b3aec3b35eb0347e70768
SHA1 637597ef183fde93f780f7b676c159ea60975465
SHA512 62ba71a898326b4e1b82b08157b149e26cde72c630e17d02baa99b00f567d6b91d4f01033e785953991ed2493fdd13d388d014912803153717cba51f96f13650
SSDEEP 24576:ljsmP0yHaqrVqHra44KDzMsrnnmXCYBOQ8QprdUHc0/T3iaV:ljRP0yHfVqzlAsrnuCqT8M2xz
TLSH
T17F45AF2EF2B910F9D4AAC136454107B5BB71782D1F219ACB0170C634AF1AEE49E39F5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 1580643240ffab8ba158f6882d9aae64f4887a86bc8d54a9b0214ece63498a22
MD5 f8f111c365621826aabc4819d73d1097
SHA1 3be506b628ccc536da8913d8d16d2d59592bf2a3
SHA512 9be16e40d5ea518d331f81f27eb4b296232844c656039ded706986cb5a3f85f19ccac0e28e8acd2051bc48d23035236a68a1f05f3ac80d5e8c512a35c33881ab
SSDEEP 12288:UkmSuBsYx/s6OQgDY7HkJIrpBLhUfQcjQ0/kv+j3ezIOt1Ta0z0AWTaxCY:UkmXCYBOQ8QprdUHc0/T3iaV
TLSH
T11355239FB34960B6FEE54271544BF8117A6EBF8C671A22DBD1447840A7FDDC0A83C84A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.6MB
SHA256 45eeb19fabac47fbd9204ed55a96b6482ae8965f8c822eb5ae7cb3b4f648c781
MD5 bfdfd2ce23c523042dac742060c3dfc8
SHA1 1849c31c283f309c8f3ce46026ea8064e27f64a8
SHA512 77fda2eb0c8b002ea8ee94147fbf3f96ed0aa262ceba41dd0993b91cce7cefe9c3211c37a1ca1d8c18cf2c99061ef4595856c5b38e3b63745f245c8276d52b49
SSDEEP 12288:rObVA4LWO+vAYFTqmSuBsYx/s6OQgDY7HkJIrpBLhUfQcjQ0/kv+j3ezIOt1Ta0J:0BLBUTqmXCYBOQ8QprdUHc0/T3iaV
TLSH
T14475F159F39400F9E97B813CC8A69912E676B89C0324E7DF03A85A551F73BE14E3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 fb8572b16aa7b1ae0d66fa6328980929945567e1b8a112e67c150aa86740a904
MD5 26bd5abe05cc7a8b3c8df56c9e181f97
SHA1 b58b74030781c6486196c59ca4969c07fc20733b
SHA512 cbcd81ba4e0c029650314099938b44cac16424e78a7daac73193e2d2a9bdafeeb13475b7f8d2a426660528a462d2b26b1c9016c0188e8aaed5f5ddb0ce1da791
SSDEEP 12288:K70Vm0IYNvUyBppmSuBsYx/s6OQgDY7HkJIrpBLhUfQcjQ0/kv+j3ezIOt1Ta0zd:7wYNHjmXCYBOQ8QprdUHc0/T3iaV
TLSH
T1B165F12FA2AD18E5E57B917989C38509F6737C96131592CF01A0827A1F37EE8BC3DB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 c34302a195867172216be006737bceb23fc6855077a02123b37a7d6d4c40bd97
MD5 e8be555254871689c0062e50da3322c9
SHA1 1406d1b701c58d4964f6c1177e079fb0c0b5643f
SHA512 6920d32131e29f5be19a18d64a88190226177f56f98f46b9743e16b4937c7e6fc3854db0d442286d979aedd4d2e0b3f22b351521c05bca2aacf9cfe0e101af5d
SSDEEP 24576:ZnXoJjNYH84VVSNAApoEmP66aspcrcHBjSSKHPWdQwPF3hJ8ssmOc+XLxu+x7uKq:ZnXoJJYH84VVS6AmEOJas+cHBjSSKHP6
TLSH
T1A765BFAEA2BC04E8D5BBC17DC5C25506F5B278651331C6CF026082BA7F27EE55E39B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 f4210fc980a5ca6a551bda15815d46d8d88b210ce8c89a75ae5487749eb5a566
MD5 d663cfcfa81944bf80220b06e36c7b80
SHA1 c34e98642612cc46731cdbae845d3f9f98a4063d
SHA512 d87738d768bdaa1ec93dbadf4c0bbdd0f4fa28be5cbad2b2673a141461508f530341cb78fc36bf4119c300bba32844d5b1b03bd26512fccd33d5e703885d2eb1
SSDEEP 24576:4v7Xbxd9Tuycf8M/TYlSuxwr2PCBmXCYBOQ8QprdUHc0/T3iaV:4DLL9TuJ0M/TYW2PzCqT8M2xz
TLSH
T143858D5EA3EC52D8E4BBD6BD85A79046FAB2B855173081CF0250856E1F23BF05D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.3MB
SHA256 ebbe89227dade63dd5858cce49b4383ab6876eea4f2877932298a49f9e49cbba
MD5 94b19132d8c38baecc712507689f8c81
SHA1 c4e7fa0b1d9d96b29704ed4038767823f43db38d
SHA512 e1fd5f68ab30c1a92274c931daaa2f4bf7fe7d3e3e84a0bab933bc6fb9e8a3792184e82be60a5632b47f717b358788a994da4327f48d5e66738d24dc1df94247
SSDEEP 24576:vegJgpwJOmPOHWAKk8ZguIGyPsxr5Vin10wqmXCYBOQ8QprdUHc0/T3iaV:vngOJOmPOHzlCqT8M2xz
TLSH
T19955BE3FB7BC15D5E07EC17D89968816F6B1782603265ACF0160827E5F2BEE46E39B01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 eb4206c225954c8d8020cf0acfeb1427306b8da0477bbf19d6c54d8a4c28119f
MD5 d0cc95e8880eb05309a67b6b1d8f3490
SHA1 4db976c02214d81dd6fbd5568cd8d761839e0a2a
SHA512 60ea45ce3ddbea710d0ec950db7ef99a1b0567f1bb00c134f069aa25d6d289cdcb79cc13946aa165f30c913398ef320719bf27257f5e3f51422da013fde24341
SSDEEP 24576:CLJnJiTk3R3waE4JrOEmXCYBOQ8QprdUHc0/T3iaV:CLJnJK8R304leCqT8M2xz
TLSH
T16C75E13DD2A810E8E4B7C2B4815A6756FF31386C2B2569CB55B4D5313F22FD0AA39F09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 830664684fbd6d3cf81230c7318573dd42e050e2b37fc3d59bf77a68f96040e1
MD5 0dad5d41c7fcd80219633d9bd4aeb583
SHA1 5294576f511e327a8ebf8289230f8ac5f8e1aa33
SHA512 11e41fa8111d620e90e68f45c883a01c9f79958b5e1e2999c738ce7a2ca5bf08a96c8b4709e2c2b0dd5965a0a25e37db7eb84ed1b5d454da961d73f26e0f8df7
SSDEEP 24576:3A9GqCceDQncA/BmlvLto8cFVr9og9P/Z6pCmXCYBOQ8QprdUHc0/T3iaV:w9GqCzDScAZmlvTcFg8Ph6vCqT8M2xz
TLSH
T1A9955C05F7EB5298E8B3CAF1C96694159B327C409B34F7EF4A80C96A1E32BD1D538B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 80119a0303c2be2359fcfebfbad718a519b95473a89fc1642b9b0395785f658a
MD5 6ccb987cadd763489f7dccad1025dcae
SHA1 1bdfcb19861002a6e3effbf1756f164c7d7c27ff
SHA512 1562ef787da1f040cfe5a150fc078f80493b2f4655781664b75e475f27aa711492bf049076c5c9843c630e938f05a4808eb133dc9d5cfd1b59a955c75b838d8c
SSDEEP 24576:YlYJeXm5jUuE6mXCYBOQ8QprdUHc0/T3iaV:YlYJeXmRUuE1CqT8M2xz
TLSH
T15155125E739C30F5E66A817994969900E376BDA4230223EF81E0E5758FBBED06D3CE41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.4MB
SHA256 3d177894d43fd2a5054c06409865c7fed809f1e0398a44b0397c690479f080fe
MD5 455b3da0d4d66f5442507cd0e236903f
SHA1 733c83fe9d239e5e8c4e5b3bc90bd71604066927
SHA512 0746979cbb38036bccd96d099b025e557204b1b139c49852ec5a364b34aeeb5c651ab1c236a45194a941cd46a2ffcad647a7443e673516221e3f94d71df20dbe
SSDEEP 12288:2uu6kyHmSuBsYx/s6OQgDY7HkJIrpBLhUfQcjQ0/kv+j3ezIOt1Ta0z0AWTaxCY:2jtyHmXCYBOQ8QprdUHc0/T3iaV
TLSH
T16065124A739860A4FAF9423498639150AF3DBD149B1553DF9190F62E6FB6FC0AC38F06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 42953f9a680c5e3e2cbbae3ba6d0ecfb807f39b7a559040e578cd5f76520d936
MD5 6657ab0b7140938eef7fba117e99562d
SHA1 4f070962edd9d2f199802d4abeeba7ffb40e01af
SHA512 22a94e7e3a1c4ad84d7c6fc8f68c1aceda601cc73c522dde990f44e6b23446637d2a6cd8a74d23cf8ba021993cd22c412cf030da00ffd61cf377d6903811b2a4
SSDEEP 12288:WPqmSuBsYx/s6OQgDY7HkJIrpBLhUfQcjQ0/kv+j3ezIOt1Ta0z0AWTaxCY:SqmXCYBOQ8QprdUHc0/T3iaV
TLSH
T16055239F735970B5FEA44271541BB801766E7F98631A20EF9194B860EBF9DC0A83CC4A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 7c712bb5b61ba1ac09e09118291ff499954545dd3018219db6480f786ef1e308
MD5 07a7dea0f63556fc0e9e211c1306257d
SHA1 a055fa2993bf2b6a1df70ce331501f0725a7af9f
SHA512 5718aa8f8020af6071d348d115414f883728bc85f86ae70ad60a2a04727b104819161e2e19e84feeefc09d718f38cc49a834891e0152f46b2fd44e977314af9c
SSDEEP 24576:cC+TyQIu93VAumZr7jmFmXCYBOQ8QprdUHc0/T3iaV:c/TfIq+YoCqT8M2xz
TLSH
T1BD558D1DA7F919CAE2B6C675C8A35493EA33B871137186CF2044C07D499EEE8AE74F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 b66b164bd5efe3b5e1562ab20dac7ebdd2e2f350d36c934e0dcbd0a7425fb700
MD5 04b25cfb0beb716c2374a535e489b8ab
SHA1 7866eee113ef35ed45917948c375173fff5ae454
SHA512 c86f8c2d8de4080d51cc2188936d71a8096608d23d52ad3170999d453220abb57e8103bfdaa55ee6ce25c53cf1b54cbc815d8e8698df7e75a150cc3045ad33bb
SSDEEP 12288:4cyrWOstaa3kcsWmSuBsYx/s6OQgDY7HkJIrpBLhUfQcjQ0/kv+j3ezIOt1Ta0zd:9LQikZWmXCYBOQ8QprdUHc0/T3iaV
TLSH
T12A65F10FB3AE10A5E5A7C23C88864112F6B37874571263DF4290C7795BBB9E9BD38B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 23039e502284b671e7169fa386fa3757a424aba3937d786a40622f8b2951d671
MD5 83d6e4b03f0b04dd9541410ee2f55493
SHA1 459087353a91d75848d2fe662fe13cd5c198a48e
SHA512 513c1b4d91c2803bbf6980f06e2f5c7c6404ea6e6e1401701b2e77631eeaba1dfd9d2d302c2bb77d1a3676157ed760a7609ebb7b9396bac9a5851a5527d4c3d5
SSDEEP 49152:4pJFwrPpGyqWo6cbT2TZ8maJO35NPHXogsS7Q78ZGAvL9vnF35LWAPOCqT8M2xz:JpC7b4+80GTkW
TLSH
T109A57C3DE2B810ADD9AAC375C5461665EE71382E3F2015DB01B0C578BF1AEF19A38F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 9498489f5b59d2f7ebd81271ee3ad8454163dc2ee2a58848969ad568fdcb6978
MD5 3b5be23b4ea12d5ab0fa9ff23f99f074
SHA1 e6902ef2d25f2ca3eacac611351d273a8d5842c2
SHA512 9bc27a819cddf4fe24a4d1b645cab9db619e5b7597fd3c235ba079aa8c0e7eece9e6a6f9ed7588d0abd1349f2a42b0a9e695c90e5bbb229a019c3fc7d61720ed
SSDEEP 24576:fSAwJPE1IDAo+4Kt+l4413JUQ/mXCYBOQ8QprdUHc0/T3iaV:fqPCIo4Kol4vQ2CqT8M2xz
TLSH
T15055BF2AA7F956F5E17AC7B4D663C501FB727822133163CF8290913E0E269E85E39F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.6MB
SHA256 4182e4e7187ef4c7873edc7a260eb4fddfeb8ba631951a85e5331bbebf0a0baf
MD5 3ad557e1890190d2386e28b5806c0a78
SHA1 100d304127baa2bd6ac907872683b96eb1da883d
SHA512 94f9a8cacc96c6b3dba35702d61053baf2f9c432342961542241b10c9cd267081c1ef06dabca0cf52a669ce9780718a99bc76d5ea8c10b378c1d91c601d28de4
SSDEEP 24576:TyLXPLcL94tPmXCYBOQ8QprdUHc0/T3iaV:Ty7PoytGCqT8M2xz
TLSH
T11275D03EE76D04E5E47AC27CD6A38906F6723CAD032166CB15A094752F7BEE4693DB00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StructuredQuerySchema.bin

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin
Size 414KB
SHA256 e67e330837a6b2f6d5f76815e7235a512b54b1c90f2ad62a3e9d142ae6939c8d
MD5 16b9618962f5623ca791a1366eee5708
SHA1 f0d257511952f075b2a0ec7d8e8730c3e464461a
SHA512 18e1d5a105b87fc72df94645685f5a8d3f593df2d3a9b8652b3b4a4ceaf92d3c7a67b0c08847186149dd608428cae8f1b3bc844bc7aacfc9e3219da823ca2fe2
SSDEEP 12288:vMUC7+vlk3n61mSkplXZ5RwmF9n4w/TSD:vXhl6V/i
TLSH
T124945F36BF88CB22C59A15748897C01A2E30A7C49E04CF6B73DC513CFA576685FBA359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.4MB
SHA256 531dd2ac5ec35cbdbe98ed53e3bfbbee35b127d547a81fa70e54facdabe21493
MD5 0870ff09324a92a26b8ac2d0049e5d6d
SHA1 fcc371d7f9ffaf87aadaa796f0209e9becc1a912
SHA512 f8382f407d70fad4412353354752c7f2cd9ee542ef7bc3fc681a197502f45f5d90fec3503c7a1993bd1d4d68352be4a09a986bbb7e6556fb1fe71ddb655e7a3c
SSDEEP 12288:X9lyvj3IkxjbBzGmSuBsYx/s6OQgDY7HkJIrpBLhUfQcjQ0/kv+j3ezIOt1Ta0zd:XWv8qjpGmXCYBOQ8QprdUHc0/T3iaV
TLSH
T17665125F639820E4F5B94230A4269121A17ABDB9132966FFB1C4F9764B75EC0D83EF02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/500-26-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/500-17-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/500-25-0x0000000140000000-0x000000014014E000-memory.dmp

Download

memory/764-365-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/764-160-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/784-367-0x0000000140000000-0x0000000140166000-memory.dmp

Download

memory/784-165-0x0000000140000000-0x0000000140166000-memory.dmp

Download

memory/932-149-0x0000000140000000-0x00000001401A6000-memory.dmp

Download

memory/932-133-0x0000000000DF0000-0x0000000000E50000-memory.dmp

Download

memory/932-127-0x0000000000DF0000-0x0000000000E50000-memory.dmp

Download

memory/1028-73-0x0000000140000000-0x000000014015E000-memory.dmp

Download

memory/1052-344-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1052-62-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1052-39-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/1052-33-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/1324-154-0x0000000140000000-0x000000014016E000-memory.dmp

Download

memory/1324-86-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/1324-92-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/1536-147-0x0000000140000000-0x000000014013C000-memory.dmp

Download

memory/1692-146-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/1692-366-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/1708-70-0x0000000140000000-0x000000014022E000-memory.dmp

Download

memory/1708-1-0x0000000000930000-0x0000000000990000-memory.dmp

Download

memory/1708-11-0x00000000029A0000-0x00000000029A1000-memory.dmp

Download

memory/1708-158-0x00000000029A0000-0x00000000029A1000-memory.dmp

Download

memory/1708-7-0x0000000000930000-0x0000000000990000-memory.dmp

Download

memory/1708-0-0x0000000140000000-0x000000014022E000-memory.dmp

Download

memory/2732-363-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/2732-151-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/2924-81-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/2924-155-0x0000000140000000-0x0000000140173000-memory.dmp

Download

memory/2924-75-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/3408-364-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/3408-156-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/3812-144-0x0000000000400000-0x000000000053B000-memory.dmp

Download

memory/3812-99-0x0000000000930000-0x0000000000996000-memory.dmp

Download

memory/3812-104-0x0000000000930000-0x0000000000996000-memory.dmp

Download

memory/4068-167-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/4068-184-0x0000000001CB0000-0x0000000001CC0000-memory.dmp

Download

memory/4068-368-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4068-216-0x000000000A5A0000-0x000000000A5A8000-memory.dmp

Download

memory/4068-175-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4068-173-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/4068-200-0x0000000001F60000-0x0000000001F70000-memory.dmp

Download

memory/4244-59-0x0000000001AE0000-0x0000000001B40000-memory.dmp

Download

memory/4244-66-0x0000000001AE0000-0x0000000001B40000-memory.dmp

Download

memory/4244-68-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4244-53-0x0000000001AE0000-0x0000000001B40000-memory.dmp

Download

memory/4244-63-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4368-145-0x0000000140000000-0x000000014013A000-memory.dmp

Download

memory/4484-84-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/4484-30-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/4888-150-0x0000000140000000-0x0000000140187000-memory.dmp

Download

memory/4892-142-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/5048-164-0x0000000140000000-0x000000014014E000-memory.dmp

Download

memory/5048-14-0x0000000140000000-0x000000014014E000-memory.dmp

Download

memory/5060-148-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/5060-115-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/5060-121-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/5060-362-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/5072-49-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/5072-65-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5072-43-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/5108-401-0x000001F497620000-0x000001F497630000-memory.dmp

Download

memory/5108-395-0x000001F497620000-0x000001F497630000-memory.dmp

Download

memory/5108-409-0x000001F497620000-0x000001F497630000-memory.dmp

Download

memory/5108-383-0x000001F497620000-0x000001F497630000-memory.dmp

Download

memory/5108-384-0x000001F497620000-0x000001F497630000-memory.dmp

Download

memory/5108-385-0x000001F497620000-0x000001F497630000-memory.dmp

Download

memory/5108-386-0x000001F497620000-0x000001F497630000-memory.dmp

Download

memory/5108-377-0x000001F497620000-0x000001F497630000-memory.dmp

Download

memory/5108-374-0x000001F497620000-0x000001F497630000-memory.dmp

Download

memory/5108-375-0x000001F497620000-0x000001F497630000-memory.dmp

Download

memory/5108-376-0x000001F497620000-0x000001F497630000-memory.dmp

Download

memory/5108-373-0x000001F497620000-0x000001F497630000-memory.dmp

Download

memory/5108-372-0x000001F497620000-0x000001F497630000-memory.dmp

Download

memory/5108-371-0x000001F497620000-0x000001F497630000-memory.dmp

Download

memory/5108-408-0x000001F497620000-0x000001F497630000-memory.dmp

Download

memory/5108-407-0x000001F497620000-0x000001F497630000-memory.dmp

Download

memory/5108-405-0x000001F497620000-0x000001F497630000-memory.dmp

Download

memory/5108-404-0x000001F497620000-0x000001F497630000-memory.dmp

Download

memory/5108-403-0x000001F497620000-0x000001F497630000-memory.dmp

Download

memory/5108-406-0x000001F497620000-0x000001F497630000-memory.dmp

Download

memory/5108-396-0x000001F497620000-0x000001F497630000-memory.dmp

Download

memory/5108-397-0x000001F497620000-0x000001F497630000-memory.dmp

Download

memory/5108-399-0x000001F497620000-0x000001F497630000-memory.dmp

Download

memory/5108-382-0x000001F497620000-0x000001F497630000-memory.dmp

Download

memory/5108-402-0x000001F497620000-0x000001F497630000-memory.dmp

Download

memory/5108-400-0x000001F497620000-0x000001F497630000-memory.dmp

Download

memory/5108-398-0x000001F497620000-0x000001F497630000-memory.dmp

Download

memory/5108-394-0x000001F497620000-0x000001F497630000-memory.dmp

Download

memory/5108-393-0x000001F497620000-0x000001F497630000-memory.dmp

Download

memory/5108-392-0x000001F497620000-0x000001F497630000-memory.dmp

Download

memory/5108-391-0x000001F497620000-0x000001F497630000-memory.dmp

Download

memory/5108-390-0x000001F497620000-0x000001F497630000-memory.dmp

Download

memory/5108-389-0x000001F497620000-0x000001F497630000-memory.dmp

Download

memory/5108-388-0x000001F497620000-0x000001F497630000-memory.dmp

Download

memory/5108-387-0x000001F497620000-0x000001F497630000-memory.dmp

Download

memory/5108-379-0x000001F497620000-0x000001F497630000-memory.dmp

Download

memory/5108-378-0x000001F497620000-0x000001F497630000-memory.dmp

Download

memory/5108-380-0x000001F497620000-0x000001F497630000-memory.dmp

Download

memory/5108-381-0x000001F497620000-0x000001F497630000-memory.dmp

Download