5e55dbd8e883ef39d941efc8e5e8004bc6be20cfd80f05da8dbd9c7e847cd81c

Analysis

max time kernel
149s
max time network
129s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
08/06/2026, 12:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-08_28ba91b7f4cd765a4c175b4f94005587_icedid_njrat_ryuk.exe
Size 1.6MB
Sample260608-pyfvasdv5r
SHA256 5e55dbd8e883ef39d941efc8e5e8004bc6be20cfd80f05da8dbd9c7e847cd81c
MD5 28ba91b7f4cd765a4c175b4f94005587
SHA1 f63cd6262608147dda34d8d10429e2b32b9f6778
SHA512 f3a4d4eaf04f3c1e248fd19e3d39699e593be062268e5a5ead1251f4a1bfda680dc25c21d52baefd1f643cd633527d2196c16178b059729de351a4b1c4fd64d4
SSDEEP 24576:uVt3+TLIecwXbDDSBhvn/+r1zd/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:Yt3+T73rD2Bh3qzLNiXicJFFRGNzj3
TLSH
T10775014563D804F4E5B78138C962491AE2B67C558B30C79F0364276BDF37BA1EE39B22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
4828	alg.exe
4424	DiagnosticsHub.StandardCollector.Service.exe
804	fxssvc.exe
3748	elevation_service.exe
2056	elevation_service.exe
468	maintenanceservice.exe
4372	msdtc.exe
740	OSE.EXE
4628	PerceptionSimulationService.exe
1096	perfhost.exe
1060	locator.exe
6000	SensorDataService.exe
4740	snmptrap.exe
2416	spectrum.exe
2564	ssh-agent.exe
1640	TieringEngineService.exe
5228	AgentService.exe
900	vds.exe
5032	vssvc.exe
5532	wbengine.exe
3276	WmiApSrv.exe
2336	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\e:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe

Drops file in System32 directory 43 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-06-08_28ba91b7f4cd765a4c175b4f94005587_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-06-08_28ba91b7f4cd765a4c175b4f94005587_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\{17A6A947-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db	spectrum.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-06-08_28ba91b7f4cd765a4c175b4f94005587_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-06-08_28ba91b7f4cd765a4c175b4f94005587_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-06-08_28ba91b7f4cd765a4c175b4f94005587_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-06-08_28ba91b7f4cd765a4c175b4f94005587_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-06-08_28ba91b7f4cd765a4c175b4f94005587_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-06-08_28ba91b7f4cd765a4c175b4f94005587_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-06-08_28ba91b7f4cd765a4c175b4f94005587_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-06-08_28ba91b7f4cd765a4c175b4f94005587_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-06-08_28ba91b7f4cd765a4c175b4f94005587_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-06-08_28ba91b7f4cd765a4c175b4f94005587_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-06-08_28ba91b7f4cd765a4c175b4f94005587_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-06-08_28ba91b7f4cd765a4c175b4f94005587_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-06-08_28ba91b7f4cd765a4c175b4f94005587_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-06-08_28ba91b7f4cd765a4c175b4f94005587_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-06-08_28ba91b7f4cd765a4c175b4f94005587_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-06-08_28ba91b7f4cd765a4c175b4f94005587_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-06-08_28ba91b7f4cd765a4c175b4f94005587_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	spectrum.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-06-08_28ba91b7f4cd765a4c175b4f94005587_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\b33a14e6ee2c9d24.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-06-08_28ba91b7f4cd765a4c175b4f94005587_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	spectrum.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-06-08_28ba91b7f4cd765a4c175b4f94005587_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	2026-06-08_28ba91b7f4cd765a4c175b4f94005587_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	2026-06-08_28ba91b7f4cd765a4c175b4f94005587_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_173093\java.exe	2026-06-08_28ba91b7f4cd765a4c175b4f94005587_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-06-08_28ba91b7f4cd765a4c175b4f94005587_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-06-08_28ba91b7f4cd765a4c175b4f94005587_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-06-08_28ba91b7f4cd765a4c175b4f94005587_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	2026-06-08_28ba91b7f4cd765a4c175b4f94005587_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-06-08_28ba91b7f4cd765a4c175b4f94005587_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2026-06-08_28ba91b7f4cd765a4c175b4f94005587_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-06-08_28ba91b7f4cd765a4c175b4f94005587_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	2026-06-08_28ba91b7f4cd765a4c175b4f94005587_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	2026-06-08_28ba91b7f4cd765a4c175b4f94005587_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	2026-06-08_28ba91b7f4cd765a4c175b4f94005587_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-06-08_28ba91b7f4cd765a4c175b4f94005587_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	2026-06-08_28ba91b7f4cd765a4c175b4f94005587_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	2026-06-08_28ba91b7f4cd765a4c175b4f94005587_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-06-08_28ba91b7f4cd765a4c175b4f94005587_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-06-08_28ba91b7f4cd765a4c175b4f94005587_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tiff\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ico\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dib\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000044db658a44f7dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000dc29748a44f7dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000346cf38944f7dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.txt	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4424	DiagnosticsHub.StandardCollector.Service.exe
4424	DiagnosticsHub.StandardCollector.Service.exe
4424	DiagnosticsHub.StandardCollector.Service.exe
4424	DiagnosticsHub.StandardCollector.Service.exe
4424	DiagnosticsHub.StandardCollector.Service.exe
4424	DiagnosticsHub.StandardCollector.Service.exe
4424	DiagnosticsHub.StandardCollector.Service.exe
3748	elevation_service.exe
3748	elevation_service.exe
3748	elevation_service.exe
3748	elevation_service.exe
3748	elevation_service.exe
3748	elevation_service.exe
3748	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
672	Process not Found
672	Process not Found

Suspicious use of AdjustPrivilegeToken 16 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5708	2026-06-08_28ba91b7f4cd765a4c175b4f94005587_icedid_njrat_ryuk.exe
Token: SeAuditPrivilege	804	fxssvc.exe
Token: SeRestorePrivilege	1640	TieringEngineService.exe
Token: SeManageVolumePrivilege	1640	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	5228	AgentService.exe
Token: SeBackupPrivilege	5032	vssvc.exe
Token: SeRestorePrivilege	5032	vssvc.exe
Token: SeAuditPrivilege	5032	vssvc.exe
Token: SeBackupPrivilege	5532	wbengine.exe
Token: SeRestorePrivilege	5532	wbengine.exe
Token: SeSecurityPrivilege	5532	wbengine.exe
Token: 33	2336	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2336	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2336	SearchIndexer.exe
Token: SeDebugPrivilege	4424	DiagnosticsHub.StandardCollector.Service.exe
Token: SeDebugPrivilege	3748	elevation_service.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2336 wrote to memory of 5468	2336	SearchIndexer.exe	106
PID 2336 wrote to memory of 4268	2336	SearchIndexer.exe	107
PID 2336 wrote to memory of 4808	2336	SearchIndexer.exe	108

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-06-08_28ba91b7f4cd765a4c175b4f94005587_icedid_njrat_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-08_28ba91b7f4cd765a4c175b4f94005587_icedid_njrat_ryuk.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:5708

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:4828

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4424

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:1540

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:804

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3748

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2056

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:468

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4372

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:740

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4628

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1096

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:1060

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:6000

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:4740

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2416

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2564

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:2212

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1640

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5228

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:900

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5032

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5532

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:3276

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2336
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5468
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2912 2924 924 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4268
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2880 2852 924 {85EE815A-7738-4808-A14A-3AD87E32A3BF}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4808

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 a07e55d0d55a31ff350671acf5e23f94bedc27c40bd98f25aac5a0d5dec50bb2
MD5 7c88001a6afcf6c2c7ddca3f7c3c9937
SHA1 b0051af683bd86f98e4e89e80d30cdab78484f7d
SHA512 385853f3449c1d9d6c0ebde18a74150643fc3329ef74762bfe0af64720fc898cfd8f08facdc35bde5e699d89eeb1d6251547187a11c90dea6a9d0c314feae9d5
SSDEEP 49152:1b+632BuPkFKRrdE6ohdstBhuXjfS4LWxniLNiXicJFFRGNzj3:L3q6mjBh7wRGpj3
TLSH
T143D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 2da781588249d1d2abecbcd6cfe8c5d42eed6a4cc485b73835457b7e9de71787
MD5 02db2bfadcf49200ddb6ce3a47a5f6cf
SHA1 68b91215d0b56f6ba28da569a2136cbb4586a89f
SHA512 0abd08a62a742ac91419cf6bc2fbf008c1bbeeaf47ba08af7bf484d58a5e1cf81c150dcf13bd29c3a8ce09867345addd6a8b97f35daa99a85b5ceebf45825cbb
SSDEEP 24576:aXYfDtczAF/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:Btc4LNiXicJFFRGNzj3
TLSH
T18175012963D408F9EDBB813CC8B28411E6727C554760E7DB03A4A92A5F337D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 9ff4bf973826433d0e626aaf6b4a65589ceb91a125dda0276def5f0a41068033
MD5 82aad722d32ba1caf7899ca90be375c8
SHA1 fcf27be121f83e8a803a19ffd7622d8488870420
SHA512 3b1157c47eaef6466548fc3fde1b6198589fad96a4ad989610f45ac30908a4ac71e8aa772f1aaa5287b534c65096560d5eb11fca0226ae9866521d8c2edb8ec9
SSDEEP 24576:w0Le5ji0hmxhrMK/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:wPji0AzXLNiXicJFFRGNzj3
TLSH
T188859E16F6748331D073C0B9C5D2A69EE97130865B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 2212fff21c7be394af438b4f284f9a086ef8126eedd2c5cb7cfef076f2f61685
MD5 0ff63abeaceb274b8a3044385f1ea3a8
SHA1 af8dc19e76d590784f358364482a3ef6a7580598
SHA512 5fe47c98a838bb605d7f6beec8369fa5b853eb3942f22101c7dd042deb7a406f93ae99e2787d90c410bce7251231818921a5361636610c524b1a46b0f813fa6b
SSDEEP 24576:Ba7/ezSC6vUyD/aqgrvWj6q8wyuo/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:A/ezSC6vUzPv+HjyLLNiXicJFFRGNzj3
TLSH
T1FF756C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 6ff0faf3f2d374744131f6c1e93a0ff5add5ddf7e6a59d60db0e546551453217
MD5 dc81bc22dddd0d7b58ebc85ee9c338d4
SHA1 424f513b4ad8309a9590dca482dd32548cd6dc2b
SHA512 927023c878eadb5c2232792a5a7e1bd4ce08d57b899ce3a5fe56904ca0e10f96dc51a1230d74d4fab05cc78a67ba919067be16769491e76d97f009c35d855c43
SSDEEP 24576:pVbqPb88hv/l+BR/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:pVO88hXl+3LNiXicJFFRGNzj3
TLSH
T1F4559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E67BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 8b0beddf2d10e52899adf7f3f913c1e5c20254296900bda06d2976775cf24332
MD5 52953a7bd01121c867b21f9c3398e7ba
SHA1 963181150e3beb5fea91a4815add49855ced053b
SHA512 0a1c64c62d405795cce9004efb71665084981a31d099d24f1d37fdaf2c634c04df2e2e477b11dc35db617f3a8d05cb7effeb80e97c402f02f182acf99c74ef6b
SSDEEP 24576:EGW/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:OLNiXicJFFRGNzj3
TLSH
T13D5523D3468854B1FBFD003A867A5828B5845E2C8A595DE2D2543E5EE13CFEBCF38127
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 ba55faa32b6b2b8d070c802c8d1f37fb3c6fe32a6d9a9d930012ea6e4e3593b2
MD5 9c5375c6f6bd44ede8cd1fb06578d5bb
SHA1 e79cef1d15d5951b85cbc79064a5b69ea305eaad
SHA512 520fe9bacf634ee13b7ef2e8057769eb3010f4a3fc53fd05920336184a43fb560867af23e1003b3977033062b9e30de52f446b095d361dfe5121c81e6c0167ea
SSDEEP 24576:cJIU5/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:cJIU5LNiXicJFFRGNzj3
TLSH
T17B75CF7BEE28FCE2C27E4C7957918600E76278304F6293CBD165820EDE236E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 3304c1a98e4e87c3da0a7446b5154ab306fa658d9dea19134a1108cf7abc03bb
MD5 bce9629919dd00bae297832e06a33c8c
SHA1 081838f74b3d86c39563d615eaea3633f3ea593f
SHA512 d5c40083d0141cfd110eeed5fd2676b3a9c6914e36c8c98af89c73de0a7c1f45c179cc5d8433ab2e50e0d81619a174f8ce94b78d6e2de49a9f5c069ffb2bd514
SSDEEP 49152:+QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THp:+QvGAdlCEL8c/WRNw5CY7wRGpj3
TLSH
T1BF266C656BF880F5E0B7E178897A8572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 534b382ba0057f58fcc371f3141d3ecf0f0ff3bdad8315679a2cc01b6dba6f66
MD5 049c9588515f4245fb8aef9a2b9fc2c8
SHA1 3e14d19857954687cdbead034dbeb6c6797c5510
SHA512 612465468d5e23a927f56cbe682ed8e3dc49fb6837a643ccab1d17ba8e92f10e8b8e72835fe2407ec3f85afa3a9fc96b69b6f64fe59cfbdee7bff383825f058e
SSDEEP 24576:rfewsAjH/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:rljHLNiXicJFFRGNzj3
TLSH
T13475E031FA74E032C7BF0CB61B36C716646C7E204B6119C3E3A85E9E59346D26736A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 c3c57d415d5117e1d90a94602394c3919445ed3cc4d1e6e823ddca44671554e6
MD5 5844a9fa62825754ae5f803dcc8797eb
SHA1 2ccd199a20f61572457858a94b4fb07ab5bee5dc
SHA512 665ac701af3a1209dfdb661badabee5ffbcd8730349212334c19cadca2ac76f5b95765f570b02299584d2bbdd906ae25a636efdd2f8ddf11290e4b5b05a7a247
SSDEEP 196608:gUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHjF9:gUEtQevvqc2W1cpV20I32B9
TLSH
T1AF474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 2ba2763d2720ab67c6ed17b9ab66739c3175d1b1924befeb2ea15690b25f06f5
MD5 bc6e774fdd282a56739da70033a5dc5d
SHA1 aca12d8bde1c0f0faafe7cd1e960c988cc2e3726
SHA512 f5c688883edc8dbb27f633cb86124401a353b560457526f3a9060e6994b37af32efeca83f353b9fa1c163a73a146c2bbe56e807e5bd7ffc1da603a1d4862f070
SSDEEP 49152:XCbRquA/m2yL5zLfFiV+XenmE3/znLNiXicJFFRGNzj3:Aoq2Vjnms7wRGpj3
TLSH
T142D58D0976B881E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 de03cee5fac3499e9a256eee5944c141810e7034e89957b7e68a578cbabecece
MD5 61d1ce91e908934dc39d0e6b82fa4f0b
SHA1 4cb05832f0d17c4121c7fa004d987520ded168a8
SHA512 846a1e6e59a1dc96f5507f6f2f124c0a2d11086851683e7cbe1c68220c6ed2bc169a4ac70d4c67f2f97cd41cd14039da68b85dddbefdfed1f69773398b7c6179
SSDEEP 24576:eAhGL6IFoiwtA5l7S53M/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:eAM5Foiq5cLNiXicJFFRGNzj3
TLSH
T10E359D81E7F955D4F5F3AA7899B68170EA76BCAA5E31C20F2150911F0E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 b3fe3d0d8f27ed50fa5ee140a55922a8b0174afdee163a86a8b69818889abf93
MD5 3370ffa5dbc519bde8a4511205e03a32
SHA1 b0ec70f6f639449debc8d04d3a8e492ebf330bab
SHA512 51d4713f40c425823feafbd8f288332a1f01e5b24e74ba53effa772e69eaea004e995433332132151760482b7941af63a8810cc1a9dbfddc637f874168285159
SSDEEP 24576:JwuROWr/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:JwSOwLNiXicJFFRGNzj3
TLSH
T10A65F18632940CF9E9BA41398657C036F7F2BC152A21DB5F5360C65B6F37361AE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 4b2e5ee3e4391809fe33f7d19cc2af2af15222f0ae0d2cd59e039b8735baad03
MD5 120a8c0ec121cf624882a4272c2fa9dd
SHA1 582560726005fb7ac9706f82979bb137f7f09b14
SHA512 7502ef7d2c2b00812a4112a909588f4b33532db33f8a108a8380669b6a290253e587d4b2e69b4bcbf84dbf111b6171577c957801e4a9323296e195d09b37125f
SSDEEP 24576:cZuS/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ELNiXicJFFRGNzj3
TLSH
T1D455129622C420F5E2BB413DC9F54504E7A17C2A573643CF52242A6E6F36FD69E39332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 4af7f991548e0f5034cb19c00340c576fb6b6ada9676d8679c78b05968ea429b
MD5 433e9c8ddc49b42ffbb34fd69b0bd0db
SHA1 28fdc7563b3b8adbe5c21f58d5aceffdfc691a09
SHA512 2c5e541624a75b44baa18ad25765f869fa3e78104da2fbc1ea9b8965a313607eb7be1cce2fd22a7443c634ea9dc20e2d008ad0272ba5a9c00c2613d763c8fcc4
SSDEEP 98304:nQRQyi36YOcPDLvw2gAf+PN3t7wRGpj3:2QyiKanX+PNBF9
TLSH
T161667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 8144cb5bd77d1a6b89772afc2a672e1bf8d2f4a846acff4ce253d274f54b5a46
MD5 a39ddd8732d46ed568148bdea16013f4
SHA1 488cd40c6d1352325ed4e4dd04c86758d3af1165
SHA512 80ccdbe35a6d6f45c425508ece076075a1046968d4a16f5d8128655e44dcdd1a911948b8ab05e95410c875bb4c563253fb14ed81b0f890a07d461e5634945d0b
SSDEEP 98304:zQRQyi36YOcPDLvw2gAf+PN3t7wRGpj3:iQyiKanX+PNBF9
TLSH
T1B2667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 85aeaad6b49b41cc62f1de913f9a8e543385defa3a64a93957f0a3ff7cbf7e33
MD5 1344b2fc20492f35ba1ecb44387efe1f
SHA1 a5ff8c80166d50a191d53e6b558a4bcdb42d4f30
SHA512 8c1bfd1dcfc36bc840aea618be2f14ead8edb47ee53d81496b4d226e03f4dcb12474b02c1686668f317b02a8dc21e282ffc8fc150e3f5be2b719d42eefee3f74
SSDEEP 49152:v68Qg55nhkeWu7PNU3/XLNiXicJFFRGNzj3:pthTRc/X7wRGpj3
TLSH
T1E9B54933B2F600A9C45DE1769F4A873196D17C758FE1E3DB8111720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 92147f5dfdabf79ba79a9da2934ddaf838844c9da763e1f56cfd927136008adb
MD5 93c833f52481b689b3e3a0fdf74c30dd
SHA1 a52cf364a6af36a4add1296d9f4561bfa4a809f1
SHA512 c66f3e78a64ff13f8e5b454fd705fc8db9e277379b405f028a2c00d04c0cd7cdd914f095e3e1cd040331b67b0cbac1cba996c610df56b923523331b5349bab66
SSDEEP 98304:fy5112gYy5azzVvU69nLKnhZW7wRGpj3:SLIHRWhQF9
TLSH
T1B0167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 0063f0bcf14f70c1f26ec03454307162e426e81ee086ec3edea5bc252b630c59
MD5 7cf2377a309076a74f6e5bb332b2924d
SHA1 f04a22f5fb88e6bc350a788c5ca0dbf60cf0f842
SHA512 28a424040fbfb1747bc9bded877b30606018a3a60781361fdc6ba474b832e90cc8bdfbe06479d1d3574545716b7cf943dad3b4b13dfc1da36e053d77b37a6e0f
SSDEEP 49152:BB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glVLNiXicJFFRGNzj3:Xu6JmIxd2dV7wRGpj3
TLSH
T136D59D13F1D901E8D06ED478974A9233FA62BC490B35B6EF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 65924bbf9f04d23fa2b8c0b39d19174acf840d77332574357397330ecc41b9b8
MD5 51a37a95b7b3ad1450746f5bb59cc2fa
SHA1 5f776de488fe3c3bb701b815d0bb53e0db918c21
SHA512 3861c816c1d0577e9603bbcc84a668d4b92a03dc306a2c0e61f604c8a2707215b684fdf7725692bb983b2041208dec51964645238ab0ebf74377f7bcf1295cab
SSDEEP 49152:U1hpsNoJpF1A67U44CwH7R4xZLNiXicJFFRGNzj3:UmifPqRs7wRGpj3
TLSH
T128B5AD13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 e5e6164b8484e46ae3074ec71633a560ca902c98cb55c758706522d69f52dbbf
MD5 0cb755d7b0785bfe23e389989155206d
SHA1 d3923b1889979fd95d40cca409dfffe67c2d50b2
SHA512 e51f0c7c070e408a5b75a00d883900bc92dd5dee3c9188893fd7ff78ae70e2a82fc9a10996d181117134771a09562075eef9fee8404fcc1d68a9a1452d0fdf00
SSDEEP 49152:NSuZQIY0Be2KkRVtOnks6NMHqSLNiXicJFFRGNzj3:D5dKqi61S7wRGpj3
TLSH
T13DC5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 ee21eb267a2880fdf2280564a4eaf6b317840638834acee1ba32504b9f41ac14
MD5 106768a02be7210d36bd59f61c8fd092
SHA1 66d1e09a06e52757344a125e4fdef81806a409ac
SHA512 c85c749c4310a4d5cd70673d39e4b9969161439b02a05a3c35d9a089ae977b8a09fd96a4c16fdd25c481263195467f77dd90963a99318518090b79b6be1506df
SSDEEP 49152:ihtSn8EApI0figjgiDn0AP5wFLNiXicJFFRGNzj3:DX2iWphQ7wRGpj3
TLSH
T14D95BE13F2D900E8D06ED178C7568632E962BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 880ff1430e176e30021ccc8ff1316fe4105f440f2a4a1f8b40e8b2a9480216e3
MD5 39f548c285c2f80735be4995badd3a5d
SHA1 7d81c1510ea04029504980e02d44006aa402b431
SHA512 16f641dedec31624bdc330d8683889486b8015eca2c0879dd6c43b5ecc6db177e8c3abdf19c4fa8e955849852260cadce06fdbca8a5c77d1555a163c05acb3ea
SSDEEP 12288:h0iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:he/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1F05523D3558955B2FABC0039C6754428F5881E2DEB5618E3E2483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 160b53030b3e36341964dff07ac37477a46eab455f313052c63774d66710c4ab
MD5 bebf0be389e83aca594c3dedd3ddbe54
SHA1 6fdebf2c8af34c3790da73bf662ae4cacbfa9e32
SHA512 095945d6ac4a67604b47323d910c5b7c786f8163639d9d9a97d4f924beac293bc4d9fc51a1b209100accea1060e85326b4b02cedba0cc67a922ba47f474418a8
SSDEEP 12288:LXiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Lj/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1BF5523D3548955B2E6BC003986764428F5881E2DEB5619E3E3483D1EE278FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 6e840c1da01efb11ddda1ba6142f9cb7d2d273b79350af5f790871973313b876
MD5 b0ee52820cdd4c65485b89ee93073fb0
SHA1 f1cb32e23530f158a82d6681666c05b2e56b5c53
SHA512 1883df65bd2c8c1733849ce8d5d19249260f1e0d5377ae8655aeb124050fabb8690d0b93129cc85f2e2c9855a7a610b6fe393f5a60f572836d5e31d30a433d6b
SSDEEP 12288:t9iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:th/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1CD5523D3548955B2E6FC003986764428F5881E2DEB5658E3E2483D1EE278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 49faaba50c6b8d2f598e80875993712cf8d08dc817ef5a98a5269ad8cf36e767
MD5 f73d7986a8480c70c5d6b98095a6b3f8
SHA1 cf68fd6f3e01d2bffd4f161803e66191a7338e12
SHA512 b1e2f806c34e75514ec1fa35305106457b110e20723cb2341cbe0035ba760395fedb59b3cfc63c7c43daf224624dc2ec0911ee297e680c32abf58759470e98cb
SSDEEP 12288:hVqiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:4/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1BC552392168900F1E9FD8039C6764424F2A47D6CDB365AEBD3003D1E5674FEADF38A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 620f362d2992e68520fa93beafe1845451f827812854e47409c4484a5a665fa2
MD5 0889f526bc6d1a55353480a2b48daaed
SHA1 0eef7ec9da79cdfc538302406f3b5e83428d2069
SHA512 f783ff33bb460a2aef5ea65de8c4d5b5b3c95aa420e1d2f497a22499958040f66d418f88c490b1499ca2a27837ce6b46a0703a80b3cf757ad57364fd050a8433
SSDEEP 12288:1iiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:1k/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1325523D3548955B1FAFC0039C6764428F5881E2DEB5658E3E2483D1EA278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 65c962d6dc621afd207846dfd17f54116505cba2e4c5bd42bd01eced6d9340d1
MD5 e7a2a8c8c2ae29d11469965a6dc88d61
SHA1 a6fedf6b4afedc214cf6a9e4e32f11f24d127154
SHA512 d0946d0de8870829fd4ab549e943b7dd12dd8d46963a6ffeda8d3dd7f6efd2b5247f41ce4db97d72a9199d88cef76113aaa3159ad8ac2920267964cb319103dc
SSDEEP 12288:M7iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Mv/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1C05523D3548955B2E6BC0039C6754428F5882E2DEB5619E3E2483D1EE278FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 45d141f615c612c36545f493c74a85c8cec882ee779f11e3b334c3d1e615b640
MD5 1b9270afd8c05037f01be864db1a7ba1
SHA1 8c555076065e43cbb2436e218196862ad96db752
SHA512 4ce05d672086d93e5b3625ae41afa0f53976b57b87cfbf2e8498b9cd4683711bc345f84af2f3d8b052e0788a5309d082d720a8419d2d118f7ddca0725efae6b5
SSDEEP 12288:nPiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:n7/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T18D5523D3548955B2E6BC003986754428F5882E2DEB5659E3E3083D1EA27CFEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 3a1415a5fd15dbb9de112b77714d7f6c289e76054f301d089698e28786870a4e
MD5 c4a2fcdeb907c8a5f19587e616c10c2d
SHA1 c85fc10c7852d3abc2530bb622a9371178376dde
SHA512 19fc2f405912ab5f529edb005d2a5558b269eb028e478ababf43c7dbe2ddc25b35d93c66ce1ec86ef76488e8009ef87a3da91f00873837e539cb60566eab495d
SSDEEP 24576:BZM3zFVSOD/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:BZM3zffLNiXicJFFRGNzj3
TLSH
T1BD750295B39018F4ECB7813EC9258815E6B27C194B70CA5F03A4362B5F337A15D3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 7848ffbb47f0ecbdb69ddadca666b6e96dd254d8d70527c8da85c0819e1acc17
MD5 425000fe611d74b86c9c756695e55ce1
SHA1 81a490c540d4e5b3d368890311d72effd9a744dc
SHA512 59aa259c89027b06a92f9c9eaad309f9c7c58caa054ec04fdf0b8edca23a612a0ff35152e38f682157c9a217a892ca92aff2c5379d98743c8e8b3c3a1f0324f3
SSDEEP 12288:eQiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:eC/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1705523D3548955B1FAFC003986764428F5881E2DEB5659E3E2483D1EA23CFEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 757c494f9e34493693c0a58354130c872973e4c92caffb742c1ab40ab22626d8
MD5 61ec723c1bbb0bb1de846c7ff7403875
SHA1 eeee1656cec02d8dd1036b14cd008b60e4647982
SHA512 11bba06ecae02f8e91367f9e78214d1d4f3c11d058068c959444345db35ffa3b4c6fdb5640639b7414abfb21b26d1ae17bb8886ec333085ab773737a179745e3
SSDEEP 12288:r8iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:rG/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1AE5523D3548955B1EABC003986754428F5882E2DEB5659E3E3083D1EA27CFEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 54c8f83e9a725584afba9cef3b64d0d527aedff06bc09b4fb56f01c7b2e051af
MD5 cc124f1abb4ce57becd8999a7f4ae4f9
SHA1 5153e02cd8f15d86c07234215c07236924be5f97
SHA512 6714988ae31e41122d4a2c701a02a9952f4ff5afcd90a7167723bb11ea156b6a295b86059ebf8223941928a298e729d08b506219a1688edb74c771098edd8bf0
SSDEEP 24576:ezy3/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:eQLNiXicJFFRGNzj3
TLSH
T19F650247629530F9E17A8139C9620911F3B17C3647208AEF53641A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 31263f61d3c5f54339c38d53fe48570a3166615c22a3dd008324c3ff49765121
MD5 b54b353e8433397b41a166caf2748b73
SHA1 1716a75b509f841f508c17c30333bf588226def3
SHA512 48fab49b65102e3648147bdfd941e15e80447f64a76883ac685d96d77bd2a5a41630e84a14aa32c86717f706a4de3a6e74cf2fb045567fb6299efd7e82cf7f81
SSDEEP 12288:TQiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:TC/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T12F5523D3548955B1FAFC003986764428F5881E2DEB5659E3E2483D1EE238FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 994c798ec218c895edf0bde74b2df05311cbd087845375e5c7976d4e8d452a39
MD5 eb83d61f86aef59bd5460cd81d71c675
SHA1 07637505fef66bac7b8080d23e8207fc6925ca3d
SHA512 d0c8376e1b67054adbcf2572b0bbac068cc885c1431e77aa711dae481382381e1590cc8aa1586769610e3d37eccf5fc3af727edc6a8a958610cab3d21fab2267
SSDEEP 12288:YQiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:YC/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1A95523D3548955B1FAFC003986754428F5882E2DEB5659E3E2483D1EE238FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 d700285f532e5e660dd8bc3faba775e8dec0b417c7dda1012223401d0eae2563
MD5 758a8ed55f57ce4b21de9caf7b8e4160
SHA1 d246b1894fafe54102274b5c29694f83d1d713de
SHA512 a80621c441fe8156f1f50dd9f177aa937fccbf4ac579885431ad441106350a8a67669538e3733a1edbf45e07e6dfecd51b11f0e2499088b4a9a6a6b8ea7a200b
SSDEEP 24576:QCUApvPDv4Ex1hfe7i8WVq2lIGU8lrtGUJLPuwvA9/TwSfVcYG3K/cJHlnFR+IGe:QCUAPTY+8Wg2lIL8lrIUJLWwkLNiXico
TLSH
T1E465AE1EA3DC0896D4BB81358A518A16FB723C2E1B2296CF1160C73D6F27ED95E35F06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 cbc270113538caa05eb1d0b2936521e622156b7a90a5e4f1b4ac354fd7f545fc
MD5 f2460259da05f6a3b39e816e567d0d9e
SHA1 a31277359375fe31a9ba844c3958b09d389eaa8a
SHA512 f78642f5bde42159a288926fe729a08c1af20918240f3ac66c237e0c1611aa171b3cc97f9cb57fdf14409338a880218a4a0ae1b606f255e5974a0c0ef0225e92
SSDEEP 12288:VpsfAiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:2S/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1FC65F15AD28802E8D1AE5139C7664900F3637C2987E1D3CB92C0F93E1F79AD59EF9613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 a5492ef89996d73a6fb6e7f00c25c4052706814b0213e3b26eb38a97d6762a48
MD5 69cb2a41f8b2dd90bb713477453c67bf
SHA1 285e46eda55a7d33e76235982054dd306c463b18
SHA512 05678af4a5e9a789884d7e4b1da0a44fd5734a64407dacb96ab31770f1c7708f7a123f94322051ea42bc63b35635b98e13450f00e3ff450fb9f6230f02ee4c92
SSDEEP 12288:zdiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:zB/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T10E552393528C59A1FAFD1039867A9434B14C7E2C9F1598D3E2043A5EA238FDBDF38527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 88d56ef003a9da2c2c7a4283e6e4d58d45f2206abca5d6024cfd9b14ab4fe0f8
MD5 f6574e8c30a2edb3c0d53782d69eb9c7
SHA1 8f8436ed84ad0fb95eccc21509ac42c2feaa62c4
SHA512 3481c20560c4eb770b8ff26a55de719c6bbac85fd839b3bd4451fb553ddb4c661e926229334550ba444bfd8c22f64abd4cebf296523828bacd310941b2b086c5
SSDEEP 49152:cRZwQCyiHiQEaaPnMqLNiXicJFFRGNzj3:i9xvPz7wRGpj3
TLSH
T10F85B01E62DC46A5E0BAD278CDA74407E6B27816573197CF0290C27D1F27EF49E3AB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 18b0ee42f8409d81f2385de8d3c662faf3c572ba70b2bd2f709af24c778c091f
MD5 a155f126064ed1d8abe05b370339487f
SHA1 f0d8ce5f899f896f4b705386b3b426c706e0b57a
SHA512 eeeef240688ee7aa1d7d62096996f1641fb18e77a6ef61a07efdcbc12960b59ed539fee813b42170e7bfe8f1b9cddfa573125293f7ae5446e019eae15a7e310c
SSDEEP 24576:2bxA1UGx/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:2bxA1UeLNiXicJFFRGNzj3
TLSH
T1C255126E128C14F0F5B9903D89A68005E3317C2A572197EF6180927E5F3AFE99E39F52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 68f72d30107e41e123080de966f44637b7d48931b25cb82fe0968c755679080e
MD5 9b7d62f8cbc00597ecf661670c9cbafc
SHA1 8dead96028d5ff488ba662d02c8b7d37c1753f96
SHA512 b621f7c626c891a973d160c03797b77e70fdd941e22499c526381a3a3194494abc5804954816b3a0c8ffd61000d2926f7ef97c2e92fda2b0f3507429a51b4c53
SSDEEP 24576:2jsmP0yHaqrVqHra44KDzMsrnc/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:2jRP0yHfVqzlAsrncLNiXicJFFRGNzj3
TLSH
T1EC45AF2EF2B910B9D4AAC136454107B5FB71782D1F209AC70170C635AF0AEE89F39F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.3MB
SHA256 12f9d746a3424264d4bb878235a97d3b7585177daad6c5eb0065c8e09cc87a2d
MD5 b6cc4bed798cdc421b1a8cba03b90a1f
SHA1 decc621b930df14a76e36c18c5719de2875dc0f3
SHA512 f341efc8f6a25352642885e54e51ce6bf513e749bfcd6af60c9435582994823c51f6e03310ae80bf1065e89758db376d6d2c38c7251915676998d37fe33cd45a
SSDEEP 12288:fbiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:fP/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1425523D2518955F1EAFD003D86794428B1886F2C9B2619E3E1443E1EA27CFEFCF38562
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.6MB
SHA256 cb37c4bf4917b078950a0fe42e39d15be0a95e46d3eabda8a5df76baacba4457
MD5 4f68757e2754e45ab36e15bae5648e50
SHA1 64d3c5afc63d9c4c7b9d492a105f84d6bffb11c1
SHA512 3ad740271780cd5f359592fb8ecacb032efcdbc5dd9031075d4c0e6d6720f4fc3d5471b3968feae6fe79648adecafd7b1c274a735e3332aa8fd2deec1a14ca77
SSDEEP 24576:LALBUTF/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:LALBU5LNiXicJFFRGNzj3
TLSH
T1B2750155E79400F5E97B813CC9728916E2B2785D0764E7DB03A84B6A1F237E28F3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 68b6e9d45bf1dcbdd49f7c3bced3ed38e4d7eacf713a040cb935f77853069082
MD5 fa6cd18e506b22db58f669d009b6b293
SHA1 051d885325c062c67f029aefd55b278be937a543
SHA512 a7b2a6d4105f63820eede372ba9521c31559183ca2dd413cae45c191c933d675487ce9a62a7310b82dca41355c4b4b704d0f757f2884757f5e388fa4771df086
SSDEEP 24576:4fYNHA/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:4fYtALNiXicJFFRGNzj3
TLSH
T1B265F12F629D18E4E67B913DCA828109F2727C66171192DF01A0827E1F27FE9BD3E751
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 6939a79369c78ce31f62f31232bfdf361f10a623f4a1152db15e8780d6cf79ff
MD5 fe39443f3150a6e4f5051d07d5f3ca6d
SHA1 4b0158d0f9d0b45cdfc661e1d3e4bd8ce8355723
SHA512 f55662431cfb9062a0230108973c6c02d4e85fe4f5186627f44c7b6cb0d43aa818200aa3f68944e65ffd2844d251b0e309d654118a5e00d6b74357343285c0fd
SSDEEP 24576:3nXoJjNYH84VVSNAApoEOW66aspcrcHBjSSKHPWdQwPF3hJ8ssmOc+XLxu+x7uKI:3nXoJJYH84VVS6AmETJas+cHBjSSKHP/
TLSH
T15F65BFAEA2BC04E8D5BBD17DC5C24506F5B178651331C6CF026082BA7F27AF59E39B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 a6afc4a6bacc919bc84cefda5bb991f6eeed4c250636e7bac5821842fb83b5a9
MD5 b8c3ff30c913f88e6b8dd9726920d4fa
SHA1 ec7af3ad848fc320d9199b10cfdde21486f40a8f
SHA512 7299a708bb22c4ed96b3671eb7434722033032f050dfb517a07e3f8c03f4328d3e22f0f673c395b5f7ccc7854080d2b86899d55c3493d2aa4a5283fd4dd1a4d7
SSDEEP 49152:VDLL9TuJ0M/TYW2PvLNiXicJFFRGNzj3:m47wRGpj3
TLSH
T17A858D5EA2EC42D4E4BBD6BD85B79046FAB2B855173081CF0291856E1F23BF05D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.3MB
SHA256 aaa3cdaac7dd53de45ce6216a7560ade3308680c78a249fe6db4cc2f91aa9fa7
MD5 c8b8dd1c529c7d23602d12f9457fe112
SHA1 484707b93dac49c85fa17278fe0e58cc913d998a
SHA512 16f816fa1fd67c9c85264b660f4d2154aefe4cf16c74051a0911e015459c44c404afc8e73156c0f4c69f2cd67a05322b93527ab6ecaa5252b9c88a65ddbde0df
SSDEEP 24576:9egJgpwJOmPOHWAKZ8ZguIGyPsxr5Vin10wF/TwSfVcYG3K/cJHlnFR+IGNe8j3w:9ngOJOmPOHkFLNiXicJFFRGNzj3
TLSH
T17A55CF3FA7BC15D5E07EC13D8A968816F6B1782603255ACF0160827E5F2BEE46E3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.6MB
SHA256 7ec1c6105c9cf4a2090a73c66931a5e72a1cc9733190ac3b6ff16be124d061f6
MD5 35aa3b7fe5b191de2231e3a67bae6464
SHA1 33130dc2827eae06a14a53cdd6909db1d5ea874d
SHA512 7fa0a21c68a25777adf3a04e2dd47bf0b77bffc9cae202421b77e3c6172df2002f294bc1216ef4f6599627b9221e450dafece7390bba0f24c306e685b9fdc778
SSDEEP 24576:lLJnJiTk3R3waE4JrOv/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:lLJnJK8R304lsLNiXicJFFRGNzj3
TLSH
T13C75E03DD2A810E8E4B7C2B4825A1656FF31387C2B2169CB55B4D5353F12FE0AA39F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 953544dfa9e62f1bf7ddde91f5374bbbcb831151ef6dd668985ad3396a9d5f07
MD5 95f8d77f240035bb6b13d94913aa63a1
SHA1 c14e4f3583e3425ee807de8eb42ce3fbc47d9ed7
SHA512 abcc7a28b9bb0d1e6efacd434e29316ed875cd8ecb285e04741167c4bddc0ea79f62a8bf60b8e040c4ab24f322b1f9a2c17b98c94419d1ee98cf0511af98928b
SSDEEP 49152:F9GqCzDScAZmlvTcFg8Ph67LNiXicJFFRGNzj3:5g7wRGpj3
TLSH
T1A9955D05F7EB5298E8B3C9F1C96694159B327C409B34F7EF4A80CA6A1E32BD1D934B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 eef54b05e1c6700c58ebe96b7ab91d951190291187c9539447fb5de9a073ad0a
MD5 bc98734a482eab8a7a199dcfd6ba8991
SHA1 c396cd1087834bcf2b8723d6d2edabd0ff87f59d
SHA512 592ef40e23a2b62e8037aa7d9d2d0eb9e91e04b8bbf3e6b454b28851436d7a6c4ac9f8b8336f4538cb589595e3e7d7e00e753e9e55fd17b22ff2ca0bfc61b845
SSDEEP 24576:qlYJeXm5jUuE1/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:qlYJeXmRUuE1LNiXicJFFRGNzj3
TLSH
T12C55129E268C30F1E27E403D85A24414E361B879571217FF91E0A67E8F3AFE65F38A51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.4MB
SHA256 01c854629747313b1aba3b22c571e101e4ff44f67d2388afebc6890c9005ebd7
MD5 0460e88b62b2c489499191e76ea69860
SHA1 a51138e2d0f54e7115a5e7b1569c7be173943028
SHA512 b8c84a4218620809c9fde879ab8e845b17cf01900896fc5366acd0bbd8681fd46a69219477ae5c5fd92d08084461cc83bcc85b6e98bc2705397bf631cb12b02b
SSDEEP 24576:rVty8/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:rVtzLNiXicJFFRGNzj3
TLSH
T13365124562C461E4EABD0538CA734064EA747C249F2147EF9190BA3F6B36FD5EE34B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.3MB
SHA256 c9b35656019ce58b03d03ec06cab14a41a6d36a0afb1e324970dbb58a9a4b756
MD5 48c2bc9cbb4b3e07032ac02ee643eda7
SHA1 0b0f0876be3235d9fbc976138a0f864f0a9f1afd
SHA512 49cef1ea5aef018becb647a307a05795fed2cb8a7e9ec0160f9fa147b1d852b24c6ae56fe4023c2612827f36ab5fd6cac5edc3447dcd3b52dd7f64d903ad5c52
SSDEEP 12288:+PZiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:KF/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1CD5523DA118964B1EABD003D86364424B1983E3C9B2628F7A194793ED37DFD7CF38952
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 08fbfb98c7629a596eaac09777d8c506f57f542d52f83b0d0f6840e0a4678cb5
MD5 d41648ce4d9b2dbdbf61fd457d7d212d
SHA1 e2c893f50dc7c9004d7d0f6a45bb0c3316c3d8e8
SHA512 556c6f44212109c835bb2316eb844cc43d94fbc1c67cb83d2e6da024b0fd6fd886006013dfd3092575226ec41e72482f9590bd2a1d1e0a665615670b27987028
SSDEEP 24576:HC+TyQIu93VAumZr7jmy/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:H/TfIq+YyLNiXicJFFRGNzj3
TLSH
T156558C1DA7E919CAE2B6C575C8A34493E633B872137186CF2044C07D499EFE9AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 de42136c855a31a6f4eb096e878ec239faa1142a1bc928133878387868c7d124
MD5 ee4878d8dcad3ff5b295cbcf28b41ab8
SHA1 b1a275ab032ef785598caa3e9bbef4ea699b924b
SHA512 6a82561bbaf1b84bb8e32b6c323a126ad97bf5ac51eb64f882f7ff9adfb37ea18a7158c94566953473ee0a513b5cc7d7d2694600a9363c34e98eadce43300a26
SSDEEP 24576:sLQikZJ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:iQikHLNiXicJFFRGNzj3
TLSH
T11465F10FB3AA00A5E1BB813C88554115F6B37834571267DF4290C77E4B7BAEABE38B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 3fd989d13aa2386be1841d518349089aca2fab10b7fb7951716747bd78b3209e
MD5 7f75b5063682d76e379d18251fe89b2c
SHA1 9e041a284e7bb18ef6e839abb0dcc7d9f4016fe4
SHA512 e8dd2b57e5a927e569b42e34dcbe8e9c485d977bcf670fce9ef59a6d230248bad910f8b6b8c5191ea22985e2cb09e8345fc9f93bd1b090e4ce15a2a0c2c7966f
SSDEEP 49152:rpJFwrPpGyqWo6cbT2TZ8maJO35NPHXogsS7Q78ZGAvL9vnF35LWAP8LNiXicJFc:ApC7b4+80GTkT7wRGpj3
TLSH
T1BBA57C3DE2B810ADD9AAC375C5461665EE71382E3F2015DB01B0C578BF1AEF19A38F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 4cc2dc99d91a31c0f4eb61fd4f75a83e69bf53ce4f8231132e2ebd9ad048573e
MD5 0a65506e379d35299cd8bd1e1762e144
SHA1 7fc545d8e3576d515eb0ee39da24a291a35e8aa9
SHA512 0a625ba6305f2a64a8ccd5884bee9c2c683d0413d1f57620dbca2cbf1eca88d493a64dd5d6b039594990e384d4ba4d412f149bcaadef66d58877ef2147ed7e1b
SSDEEP 24576:QSAwJPE1IDAo+4Kt+l4413lUQE/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:QqPCIo4Kol4jQELNiXicJFFRGNzj3
TLSH
T12B55B02AA7F956F4E17AC774C663C511FB723822133163CF9290953E0E16AE89E39F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.6MB
SHA256 752089c3067c49cd0eb9b7ce191f0a17f77c9a2ec1bb7a8314587dc4f1fb8a23
MD5 096b9540e06dbd6e8124df1af5481ee8
SHA1 c3e3c8b60816ead1a6551c3a09d8e0a2d4d946aa
SHA512 177b564a319ecdb9003906c5fbf731c6656d3d9c3ec9048861ef4e70d685b3c7805e6569ce0f304e20e068dac3c88c7ece9f99380bad94bd891ab31c43459587
SSDEEP 24576:+yLXPLcT94t0/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:+y7Poqt0LNiXicJFFRGNzj3
TLSH
T1D175D03ED66D04F4E57AC13CC6A38906F6723CAD033166CB15A0957A1F6BFE4A939B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StructuredQuerySchema.bin

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin
Size 414KB
SHA256 e67e330837a6b2f6d5f76815e7235a512b54b1c90f2ad62a3e9d142ae6939c8d
MD5 16b9618962f5623ca791a1366eee5708
SHA1 f0d257511952f075b2a0ec7d8e8730c3e464461a
SHA512 18e1d5a105b87fc72df94645685f5a8d3f593df2d3a9b8652b3b4a4ceaf92d3c7a67b0c08847186149dd608428cae8f1b3bc844bc7aacfc9e3219da823ca2fe2
SSDEEP 12288:vMUC7+vlk3n61mSkplXZ5RwmF9n4w/TSD:vXhl6V/i
TLSH
T124945F36BF88CB22C59A15748897C01A2E30A7C49E04CF6B73DC513CFA576685FBA359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.4MB
SHA256 0e123cf38ae29f00764c1e37da2040bf113c6df6e4959d794a1aba08b2bb330b
MD5 3089544fda35fa1bbc77f166709d006b
SHA1 7e9d027ccba66e7d654f149b75be441a529a9fc7
SHA512 54f4762ab7a62a6f762baedf6318f87a20eb79b79bbbc6d58abe61edf2d0bfc1ae029379256c2cf7e8ba9f7768871daeef8cac6a5204fb3956955eecce9bb72c
SSDEEP 24576:KWv8qjpZ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:KWv8MLNiXicJFFRGNzj3
TLSH
T18965129E52C424E4E5BD4138C636802490B17D3A176599FFB1C4A97F8738BD6CA3EF22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/468-55-0x0000000001AD0000-0x0000000001B30000-memory.dmp

Download

memory/468-66-0x0000000001AD0000-0x0000000001B30000-memory.dmp

Download

memory/468-64-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/468-61-0x0000000001AD0000-0x0000000001B30000-memory.dmp

Download

memory/468-68-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/740-75-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/740-129-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/740-81-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/804-30-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/804-69-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/900-157-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/900-370-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/1060-125-0x0000000140000000-0x00000001401ED000-memory.dmp

Download

memory/1096-98-0x0000000000900000-0x0000000000966000-memory.dmp

Download

memory/1096-103-0x0000000000900000-0x0000000000966000-memory.dmp

Download

memory/1096-124-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/1640-369-0x0000000140000000-0x000000014023A000-memory.dmp

Download

memory/1640-146-0x0000000140000000-0x000000014023A000-memory.dmp

Download

memory/2056-169-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2056-53-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2056-44-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/2056-50-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/2336-222-0x000000000A5A0000-0x000000000A5A8000-memory.dmp

Download

memory/2336-183-0x0000000001CB0000-0x0000000001CC0000-memory.dmp

Download

memory/2336-199-0x0000000001F60000-0x0000000001F70000-memory.dmp

Download

memory/2336-436-0x000000000BE20000-0x000000000BE28000-memory.dmp

Download

memory/2336-178-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/2336-181-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2336-375-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2336-172-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/2416-128-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/2416-114-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2416-120-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2416-224-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/2564-142-0x0000000140000000-0x0000000140259000-memory.dmp

Download

memory/2564-139-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2564-368-0x0000000140000000-0x0000000140259000-memory.dmp

Download

memory/3276-170-0x0000000140000000-0x0000000140219000-memory.dmp

Download

memory/3276-374-0x0000000140000000-0x0000000140219000-memory.dmp

Download

memory/3748-33-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/3748-164-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3748-39-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/3748-42-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4268-447-0x0000025300120000-0x0000025300130000-memory.dmp

Download

memory/4268-443-0x0000025300120000-0x0000025300130000-memory.dmp

Download

memory/4268-445-0x0000025300120000-0x0000025300130000-memory.dmp

Download

memory/4268-444-0x0000025300120000-0x0000025300130000-memory.dmp

Download

memory/4268-438-0x0000025300120000-0x0000025300130000-memory.dmp

Download

memory/4268-454-0x0000025300120000-0x0000025300130000-memory.dmp

Download

memory/4268-461-0x0000025300120000-0x0000025300130000-memory.dmp

Download

memory/4268-455-0x0000025300120000-0x0000025300130000-memory.dmp

Download

memory/4268-439-0x0000025300120000-0x0000025300130000-memory.dmp

Download

memory/4268-448-0x0000025300120000-0x0000025300130000-memory.dmp

Download

memory/4268-449-0x0000025300120000-0x0000025300130000-memory.dmp

Download

memory/4268-456-0x0000025300120000-0x0000025300130000-memory.dmp

Download

memory/4268-457-0x0000025300120000-0x0000025300130000-memory.dmp

Download

memory/4268-450-0x0000025300120000-0x0000025300130000-memory.dmp

Download

memory/4268-451-0x0000025300120000-0x0000025300130000-memory.dmp

Download

memory/4268-459-0x0000025300120000-0x0000025300130000-memory.dmp

Download

memory/4268-453-0x0000025300120000-0x0000025300130000-memory.dmp

Download

memory/4268-458-0x0000025300120000-0x0000025300130000-memory.dmp

Download

memory/4268-460-0x0000025300120000-0x0000025300130000-memory.dmp

Download

memory/4268-452-0x0000025300120000-0x0000025300130000-memory.dmp

Download

memory/4268-441-0x0000025300120000-0x0000025300130000-memory.dmp

Download

memory/4268-446-0x0000025300120000-0x0000025300130000-memory.dmp

Download

memory/4268-442-0x0000025300120000-0x0000025300130000-memory.dmp

Download

memory/4268-440-0x0000025300120000-0x0000025300130000-memory.dmp

Download

memory/4268-425-0x0000025300120000-0x0000025300130000-memory.dmp

Download

memory/4268-424-0x0000025300120000-0x0000025300130000-memory.dmp

Download

memory/4268-434-0x0000025300120000-0x0000025300130000-memory.dmp

Download

memory/4268-435-0x0000025300120000-0x0000025300130000-memory.dmp

Download

memory/4268-433-0x0000025300120000-0x0000025300130000-memory.dmp

Download

memory/4268-432-0x0000025300120000-0x0000025300130000-memory.dmp

Download

memory/4268-431-0x0000025300120000-0x0000025300130000-memory.dmp

Download

memory/4268-430-0x0000025300120000-0x0000025300130000-memory.dmp

Download

memory/4268-429-0x0000025300120000-0x0000025300130000-memory.dmp

Download

memory/4268-428-0x0000025300120000-0x0000025300130000-memory.dmp

Download

memory/4268-427-0x0000025300120000-0x0000025300130000-memory.dmp

Download

memory/4268-426-0x0000025300120000-0x0000025300130000-memory.dmp

Download

memory/4268-423-0x0000025300120000-0x0000025300130000-memory.dmp

Download

memory/4268-422-0x0000025300120000-0x0000025300130000-memory.dmp

Download

memory/4268-421-0x0000025300120000-0x0000025300130000-memory.dmp

Download

memory/4268-420-0x0000025300120000-0x0000025300130000-memory.dmp

Download

memory/4372-122-0x0000000140000000-0x0000000140211000-memory.dmp

Download

memory/4372-180-0x0000000140000000-0x0000000140211000-memory.dmp

Download

memory/4424-17-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/4424-26-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/4424-25-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/4628-85-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/4628-91-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/4628-123-0x0000000140000000-0x0000000140221000-memory.dmp

Download

memory/4740-127-0x0000000140000000-0x00000001401EF000-memory.dmp

Download

memory/4828-145-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/4828-15-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/5032-371-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/5032-161-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/5228-149-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/5228-154-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/5532-372-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/5532-165-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/5708-380-0x00000000004A0000-0x0000000000500000-memory.dmp

Download

memory/5708-9-0x00000000004A0000-0x0000000000500000-memory.dmp

Download

memory/5708-387-0x0000000140000000-0x0000000140253000-memory.dmp

Download

memory/5708-71-0x0000000140000000-0x0000000140253000-memory.dmp

Download

memory/5708-8-0x0000000140000000-0x0000000140253000-memory.dmp

Download

memory/5708-0-0x00000000004A0000-0x0000000000500000-memory.dmp

Download

memory/6000-373-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/6000-126-0x0000000140000000-0x00000001401C1000-memory.dmp

Download