3d41cbf839a283217033dd67834cdfff0919cc10694d801737c5dd3af4bfe610

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
29/06/2026, 04:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-27_9de5c7b74219219d95a593c60e0ad561_icedid_njrat.exe
Size 1.9MB
Sample260629-e76rzaet8m
SHA256 3d41cbf839a283217033dd67834cdfff0919cc10694d801737c5dd3af4bfe610
MD5 9de5c7b74219219d95a593c60e0ad561
SHA1 485094fb5646e3a33b80d7aefbfa3d36365c20bc
SHA512 1e9bd6bfb11c4aa4136d6e41a910f8b09896fd3418bbef3494206b545a671ca43ec8b9258528b8654a7b161c21cf575ec076fd3cbe5ffde379b42a0d520d2d27
SSDEEP 49152:Se/G5I3EJbIzqxgvXXL6sArVQSGoWZykiLvbIvsaXBk3IGejsx5kWxAQgAT76sQr:PlXL6sANxCW6qGsQr
TLSH
T1B1956C06F6F712D9D1B7D63885B371B7F939781A87319ADB43814B071B22B50983AB23
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
2924	alg.exe
4628	DiagnosticsHub.StandardCollector.Service.exe
4264	fxssvc.exe
4796	elevation_service.exe
4508	elevation_service.exe
2096	maintenanceservice.exe
372	msdtc.exe
4544	OSE.EXE
1832	PerceptionSimulationService.exe
4784	perfhost.exe
4928	locator.exe
3048	SensorDataService.exe
3664	snmptrap.exe
3904	spectrum.exe
4744	ssh-agent.exe
2900	TieringEngineService.exe
552	AgentService.exe
1640	vds.exe
3336	vssvc.exe
4372	wbengine.exe
4600	WmiApSrv.exe
3652	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 31 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-06-27_9de5c7b74219219d95a593c60e0ad561_icedid_njrat.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-06-27_9de5c7b74219219d95a593c60e0ad561_icedid_njrat.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-06-27_9de5c7b74219219d95a593c60e0ad561_icedid_njrat.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-06-27_9de5c7b74219219d95a593c60e0ad561_icedid_njrat.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-06-27_9de5c7b74219219d95a593c60e0ad561_icedid_njrat.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-06-27_9de5c7b74219219d95a593c60e0ad561_icedid_njrat.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-06-27_9de5c7b74219219d95a593c60e0ad561_icedid_njrat.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-06-27_9de5c7b74219219d95a593c60e0ad561_icedid_njrat.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\9c5f3f22d44b5a9.bin	alg.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-06-27_9de5c7b74219219d95a593c60e0ad561_icedid_njrat.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-06-27_9de5c7b74219219d95a593c60e0ad561_icedid_njrat.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-06-27_9de5c7b74219219d95a593c60e0ad561_icedid_njrat.exe
File opened for modification	C:\Windows\system32\dllhost.exe	alg.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-06-27_9de5c7b74219219d95a593c60e0ad561_icedid_njrat.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-06-27_9de5c7b74219219d95a593c60e0ad561_icedid_njrat.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-06-27_9de5c7b74219219d95a593c60e0ad561_icedid_njrat.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	alg.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-06-27_9de5c7b74219219d95a593c60e0ad561_icedid_njrat.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-06-27_9de5c7b74219219d95a593c60e0ad561_icedid_njrat.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-06-27_9de5c7b74219219d95a593c60e0ad561_icedid_njrat.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-06-27_9de5c7b74219219d95a593c60e0ad561_icedid_njrat.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	alg.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-06-27_9de5c7b74219219d95a593c60e0ad561_icedid_njrat.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-06-27_9de5c7b74219219d95a593c60e0ad561_icedid_njrat.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-06-27_9de5c7b74219219d95a593c60e0ad561_icedid_njrat.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	alg.exe
File opened for modification	C:\Windows\system32\AgentService.exe	alg.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-06-27_9de5c7b74219219d95a593c60e0ad561_icedid_njrat.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	2026-06-27_9de5c7b74219219d95a593c60e0ad561_icedid_njrat.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	2026-06-27_9de5c7b74219219d95a593c60e0ad561_icedid_njrat.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	2026-06-27_9de5c7b74219219d95a593c60e0ad561_icedid_njrat.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	2026-06-27_9de5c7b74219219d95a593c60e0ad561_icedid_njrat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-06-27_9de5c7b74219219d95a593c60e0ad561_icedid_njrat.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2026-06-27_9de5c7b74219219d95a593c60e0ad561_icedid_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_103203\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-06-27_9de5c7b74219219d95a593c60e0ad561_icedid_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-06-27_9de5c7b74219219d95a593c60e0ad561_icedid_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	2026-06-27_9de5c7b74219219d95a593c60e0ad561_icedid_njrat.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-06-27_9de5c7b74219219d95a593c60e0ad561_icedid_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-06-27_9de5c7b74219219d95a593c60e0ad561_icedid_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	2026-06-27_9de5c7b74219219d95a593c60e0ad561_icedid_njrat.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	2026-06-27_9de5c7b74219219d95a593c60e0ad561_icedid_njrat.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-06-27_9de5c7b74219219d95a593c60e0ad561_icedid_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	2026-06-27_9de5c7b74219219d95a593c60e0ad561_icedid_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-06-27_9de5c7b74219219d95a593c60e0ad561_icedid_njrat.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	2026-06-27_9de5c7b74219219d95a593c60e0ad561_icedid_njrat.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-06-27_9de5c7b74219219d95a593c60e0ad561_icedid_njrat.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	2026-06-27_9de5c7b74219219d95a593c60e0ad561_icedid_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-06-27_9de5c7b74219219d95a593c60e0ad561_icedid_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-06-27_9de5c7b74219219d95a593c60e0ad561_icedid_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-06-27_9de5c7b74219219d95a593c60e0ad561_icedid_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-06-27_9de5c7b74219219d95a593c60e0ad561_icedid_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	2026-06-27_9de5c7b74219219d95a593c60e0ad561_icedid_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-06-27_9de5c7b74219219d95a593c60e0ad561_icedid_njrat.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-06-27_9de5c7b74219219d95a593c60e0ad561_icedid_njrat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-06-27_9de5c7b74219219d95a593c60e0ad561_icedid_njrat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-06-27_9de5c7b74219219d95a593c60e0ad561_icedid_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-06-27_9de5c7b74219219d95a593c60e0ad561_icedid_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-06-27_9de5c7b74219219d95a593c60e0ad561_icedid_njrat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-06-27_9de5c7b74219219d95a593c60e0ad561_icedid_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	2026-06-27_9de5c7b74219219d95a593c60e0ad561_icedid_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-06-27_9de5c7b74219219d95a593c60e0ad561_icedid_njrat.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	2026-06-27_9de5c7b74219219d95a593c60e0ad561_icedid_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	alg.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-06-27_9de5c7b74219219d95a593c60e0ad561_icedid_njrat.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000026e7dcd08007dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000189269d18007dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000165cf2d08007dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000eba83ed18007dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001dd026d18007dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000af5a30d18007dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000caacc2d08007dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000d4988dc8007dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
5096	2026-06-27_9de5c7b74219219d95a593c60e0ad561_icedid_njrat.exe
5096	2026-06-27_9de5c7b74219219d95a593c60e0ad561_icedid_njrat.exe
5096	2026-06-27_9de5c7b74219219d95a593c60e0ad561_icedid_njrat.exe
5096	2026-06-27_9de5c7b74219219d95a593c60e0ad561_icedid_njrat.exe
5096	2026-06-27_9de5c7b74219219d95a593c60e0ad561_icedid_njrat.exe
5096	2026-06-27_9de5c7b74219219d95a593c60e0ad561_icedid_njrat.exe
5096	2026-06-27_9de5c7b74219219d95a593c60e0ad561_icedid_njrat.exe
5096	2026-06-27_9de5c7b74219219d95a593c60e0ad561_icedid_njrat.exe
5096	2026-06-27_9de5c7b74219219d95a593c60e0ad561_icedid_njrat.exe
5096	2026-06-27_9de5c7b74219219d95a593c60e0ad561_icedid_njrat.exe
5096	2026-06-27_9de5c7b74219219d95a593c60e0ad561_icedid_njrat.exe
5096	2026-06-27_9de5c7b74219219d95a593c60e0ad561_icedid_njrat.exe
5096	2026-06-27_9de5c7b74219219d95a593c60e0ad561_icedid_njrat.exe
5096	2026-06-27_9de5c7b74219219d95a593c60e0ad561_icedid_njrat.exe
5096	2026-06-27_9de5c7b74219219d95a593c60e0ad561_icedid_njrat.exe
5096	2026-06-27_9de5c7b74219219d95a593c60e0ad561_icedid_njrat.exe
5096	2026-06-27_9de5c7b74219219d95a593c60e0ad561_icedid_njrat.exe
5096	2026-06-27_9de5c7b74219219d95a593c60e0ad561_icedid_njrat.exe
5096	2026-06-27_9de5c7b74219219d95a593c60e0ad561_icedid_njrat.exe
5096	2026-06-27_9de5c7b74219219d95a593c60e0ad561_icedid_njrat.exe
5096	2026-06-27_9de5c7b74219219d95a593c60e0ad561_icedid_njrat.exe
5096	2026-06-27_9de5c7b74219219d95a593c60e0ad561_icedid_njrat.exe
5096	2026-06-27_9de5c7b74219219d95a593c60e0ad561_icedid_njrat.exe
5096	2026-06-27_9de5c7b74219219d95a593c60e0ad561_icedid_njrat.exe
5096	2026-06-27_9de5c7b74219219d95a593c60e0ad561_icedid_njrat.exe
5096	2026-06-27_9de5c7b74219219d95a593c60e0ad561_icedid_njrat.exe
5096	2026-06-27_9de5c7b74219219d95a593c60e0ad561_icedid_njrat.exe
5096	2026-06-27_9de5c7b74219219d95a593c60e0ad561_icedid_njrat.exe
5096	2026-06-27_9de5c7b74219219d95a593c60e0ad561_icedid_njrat.exe
5096	2026-06-27_9de5c7b74219219d95a593c60e0ad561_icedid_njrat.exe
5096	2026-06-27_9de5c7b74219219d95a593c60e0ad561_icedid_njrat.exe
5096	2026-06-27_9de5c7b74219219d95a593c60e0ad561_icedid_njrat.exe
5096	2026-06-27_9de5c7b74219219d95a593c60e0ad561_icedid_njrat.exe
5096	2026-06-27_9de5c7b74219219d95a593c60e0ad561_icedid_njrat.exe
5096	2026-06-27_9de5c7b74219219d95a593c60e0ad561_icedid_njrat.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
668	Process not Found
668	Process not Found

Suspicious use of AdjustPrivilegeToken 45 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5096	2026-06-27_9de5c7b74219219d95a593c60e0ad561_icedid_njrat.exe
Token: SeAuditPrivilege	4264	fxssvc.exe
Token: SeRestorePrivilege	2900	TieringEngineService.exe
Token: SeManageVolumePrivilege	2900	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	552	AgentService.exe
Token: SeBackupPrivilege	3336	vssvc.exe
Token: SeRestorePrivilege	3336	vssvc.exe
Token: SeAuditPrivilege	3336	vssvc.exe
Token: SeBackupPrivilege	4372	wbengine.exe
Token: SeRestorePrivilege	4372	wbengine.exe
Token: SeSecurityPrivilege	4372	wbengine.exe
Token: 33	3652	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3652	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3652	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3652	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3652	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3652	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3652	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3652	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3652	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3652	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3652	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3652	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3652	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3652	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3652	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3652	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3652	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3652	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3652	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3652	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3652	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3652	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3652	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3652	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3652	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3652	SearchIndexer.exe
Token: SeDebugPrivilege	5096	2026-06-27_9de5c7b74219219d95a593c60e0ad561_icedid_njrat.exe
Token: SeDebugPrivilege	5096	2026-06-27_9de5c7b74219219d95a593c60e0ad561_icedid_njrat.exe
Token: SeDebugPrivilege	5096	2026-06-27_9de5c7b74219219d95a593c60e0ad561_icedid_njrat.exe
Token: SeDebugPrivilege	5096	2026-06-27_9de5c7b74219219d95a593c60e0ad561_icedid_njrat.exe
Token: SeDebugPrivilege	5096	2026-06-27_9de5c7b74219219d95a593c60e0ad561_icedid_njrat.exe
Token: SeDebugPrivilege	2924	alg.exe
Token: SeDebugPrivilege	2924	alg.exe
Token: SeDebugPrivilege	2924	alg.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3652 wrote to memory of 4240	3652	SearchIndexer.exe	111
PID 3652 wrote to memory of 4752	3652	SearchIndexer.exe	112

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-06-27_9de5c7b74219219d95a593c60e0ad561_icedid_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-27_9de5c7b74219219d95a593c60e0ad561_icedid_njrat.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5096

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2924

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:4628

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:1312

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4264

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4796

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4508

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2096

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:372

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4544

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1832

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:4784

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4928

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3048

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:3664

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3904

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4744

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2900

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:552

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:1640

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:2884

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3336

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4372

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:4600

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3652
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4240
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
  2⤵
  - Modifies data under HKEY_USERS
  PID:4752

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 5e86549d7e8c827cb70119b916aa42a261e814c1edf5822288849d691a6b81a5
MD5 044414cea73a43d3ed88135b5b9b5cfa
SHA1 8de7a0597e09a7173002fd9fc8fb932557511b69
SHA512 b63d5277d1f10975fa9adcacd8647b743222a20c2511d7340a2644c8bbc2c47e483ecdb078a345261e24744d513336287ff9a6dbd710f90a2c076aa84c048909
SSDEEP 49152:Zb+632BuPkFKRrdE6ohvstBhuXjfS4LWxneAQgAT76sQuE:v3q6sjBAqGsQr
TLSH
T1C5D59D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 cdfdca6b38d71eb0e8f0e6c63a1bebf5afc417cd5a5391b8c00a9cf6ae8bef99
MD5 e4e44b1ef84798a05eea4d014f9f79bd
SHA1 506a5360aefdc7a0b2948476cff0e2ede22df432
SHA512 2aa48f3d099d310cc71b2f078079d6c17be81566a035ee828d0c54e3272a40ab4394cb5d8036c21a65daec9a5fe3e2b84015f8ed02c6e5509584f61970a1c374
SSDEEP 24576:tXYfDtczAfAfYLH8AcevDN0FImbwQuq3Wia7gD:4tcIAQgAT76sQuE
TLSH
T18475F12963D408F9EC67813DCCB28515E673B8A54360E7DB03A49A6A1F332D85E3EF51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 ec68bcb68f4676ab5caac72b8bb5f3a72e500fb29f66ffbf7763f38eb92df38b
MD5 4b0b2a0955c5c802ad449f77a95ed204
SHA1 a7ca002f331950be8c9c452d97a5f9605da5dfd1
SHA512 c2c85c3235322ad34dcdd07f8e1d788e666808ef9b2b607984a1d87918ab62c62260739ca71a3d7846aa321fc5c176de0db9fe6594b3e645dbba73f56e250c03
SSDEEP 24576:F0Le5ji0hmxxrMWAfYLH8AcevDN0FImbwQuq3Wia7gD:FPji0Aj9AQgAT76sQuE
TLSH
T1B585AE16F6788335D073C0B9C5D2A69EE971308657308ACB4286D77C3F67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 d0b76d656298136a2f1678c877a950f38242d9b8e75089815c48ed0abd42dde4
MD5 9e9523bcf6fd23112793d36c0891d401
SHA1 fcd56a53fb1ef2b3cc31042ecd9390815b13a176
SHA512 526375202c6d99d51fa6b388ba36ee0d2309204262e1f9607ac2b6d2fe1c539f7006375843b96a4a51e30328f022206061fb4e7473d946c8ad79ab251bd598ef
SSDEEP 24576:6a7/ezSC6vUyD/aqgrvWn6q8wyuYAfYLH8AcevDN0FImbwQuq3Wia7gD:t/ezSC6vUzPveHjyxAQgAT76sQuE
TLSH
T1C7755C15F5788323D0B2D0BAC5D6BA9AFE723046573089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 0f25ad2d04e72c8efbc7fbe423a987f0e599bfe75cbddb096ad3871c9c926875
MD5 d7fd68cc6adbe7ebb395d466368770dc
SHA1 e4e7e4f24c5e666285147b912db05e44d4c1ee69
SHA512 327b4f4bf9b5bed02b3d1b36a10aeb4e46422aef13232db2c70ca243e31e62d8b0505bf9c7efc3e4f5227e32042593e9cd5a308366cf8dac383bab296f831e16
SSDEEP 24576:kVbqPb88hv/l+YrAfYLH8AcevDN0FImbwQuq3Wia7gD:kVO88hXl+gAQgAT76sQuE
TLSH
T118559E66F5748331D073C0BAC4D3AA9AEE7234425B318ACB0246D76C3E67AD6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 a7c9c762c07270afa3efd938c3b2c100a9c8cf8948815fe62013116d82512c98
MD5 189647d03ec3ea8f8842860254d6a06b
SHA1 fa89a3202f807620d68d7aadad0e87b89d3e76b8
SHA512 b408a31b8e6ba162fbb84a62bad20d4430824ac5ea8e6d2d3278fe29a0d361e610d76c2635dabda4c9592d926f5dea3b453d86bdefb5a86db1be9c88f000d398
SSDEEP 12288:MLyAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:MLyAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T184552357864C70EAFEFBD1369CBBA5B963D1BCB88244979A00463BCA793D408D0D4D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 6931b713f01d1ab4438237340168c7bf7768b873f8537c88b8b09ad9e701c389
MD5 66a216c1f85978d4e8a51ddd308bda1e
SHA1 b43e9aebae600df2cdd7ec7dfcecde70fe41cc17
SHA512 d845c929f4a5053fe9effe52615192d2159cae825a13fa724a6ceca95c84bda196c523d8b9cd5c46f48f4a381ad1321db66083474294d6131b423e955e29655a
SSDEEP 24576:gJIUDAfYLH8AcevDN0FImbwQuq3Wia7gD:gJIUDAQgAT76sQuE
TLSH
T13C75CF3BEE28FCD2C67E8D795A918600D7B278704B52A3CBD165830EDE235E05E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 fccc20a7968be47bc2b65f4ba7f126a03250b247123af400bf73305409b104eb
MD5 1d11fd477c33fa2c413c4749e7b06aae
SHA1 86f0719a75bfb523325f7013f24b193bc963013e
SHA512 f3b6de3f3883f8c4e995761892f7c0ae998f2cfb14f09ce0ee8c8aabc672741efa1ec0020b4d57d9c5e0c8290d2c161de3747fd7c633d3099f48b90fa5952ba1
SSDEEP 49152:eQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THQ:eQvGAdlCEL8c/DRNw5CdqGsQr
TLSH
T10C266C656BF880F5E0A7E138897AC5B2F7B678520D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 08bee55bb911b20dd641c4f54a821291418f6c7a13a8e4db0d547374f0f4e56f
MD5 c8ab4d4c84c23bc41347e9faa10bf397
SHA1 a5075b8b29cdbed5f4304e2c8fafc9e8167a2675
SHA512 eeffb55b133f9e2b7aea28ade7fdd837e6b54135288c7f4c05ff460a6c6603a956ea41d068bd2d47acd37f7a9a448a5bfa193dd6802df28f7836ad9e0a11951b
SSDEEP 24576:d0ewsAjNAfYLH8AcevDN0FImbwQuq3Wia7gD:GljNAQgAT76sQuE
TLSH
T18575E031FE74E036C6BF0DB21B36C716146CB9604B511AC3E3A85E9E59342D263B6E27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 e20d95ca1da879d7ca68ae4877d8d4879bc3ad9272eb8d0e9f869a9706fdecb2
MD5 40dd0b7360730adcaba6dbb199cc8a0e
SHA1 526f37d73f8df45a86b7e88123269c8c1ad47e46
SHA512 d46097400f96a4a5371cd102f9789aa754d31d624d516d9badc2e9fb92aa5bfa2635ce9779c5fecb9f747efddd5ff265f7d6fb43a406147acea61d3090802cbf
SSDEEP 196608:VUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJH4j:VUEtQevvqc2W1cpV2tI32
TLSH
T1C3474B91BBE843E2E3A6953484B182B6FBB17C1E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 0902d433205b094b07ed1f7ac3f5f277f83ef438fb21d71da425c7dfb558d267
MD5 d99784ab05030212fdb588cf71f2f69e
SHA1 faf9eb8ea701d7141461a61f3cf55dc4bb21ac57
SHA512 b4e7b4ad19de4238efb87a1b578fddbcd8183e6f47c1684bc17dff1ac38dd8429036fe0dd138074380264020392425b62f2ffeaa798d4d6e50688587467ad2b1
SSDEEP 49152:8CbRquA/m2yL5zTfFiV+XenmE3/ztAQgAT76sQuE:1oquVjnmhqGsQr
TLSH
T177D58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 2fe8b880a72fa45e20329f0bcab2ccfd650bcd4438e2d1e2cfea951aebb80965
MD5 19b2ad84f46f9c17f9db1ad3045100ff
SHA1 0c8dd858c43f8eef298fe7198cac06656f657499
SHA512 06a2e9fcfdafcf5b73a67b206a9f12a45c968f737d1b9d85917fff3e10003db3f8ed1961560f1f09f316b90606f89afe0706eff359d1165fc3346f3c1cad5cda
SSDEEP 24576:lAhGL3IFoiwtA5l7S538AfYLH8AcevDN0FImbwQuq3Wia7gD:lAMUFoiq5sAQgAT76sQuE
TLSH
T1DD359D81E7F955D4F5B3AA7899B69170EA76BCAA5E31C20F2150D20F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 ccfacec873398ee3c0094b9b577d0f0272b4c727f775fc5b0e2d023d09c71213
MD5 232a91cf2c09274a1c0c282cf2fbb1a5
SHA1 04bddf3561d84408ec58834613914a9534400d2f
SHA512 31d014afe067d2252221cf81ad36fab9f078da9a21d422dbca0fdffe16c8634ed4ee9f8b8d502171366511abbc5090f93b85de30d3c6c323e8617d5212f4a075
SSDEEP 24576:vwu4OWRAfYLH8AcevDN0FImbwQuq3Wia7gD:vwvOQAQgAT76sQuE
TLSH
T1DF65F14676A81CF9E9A781398997C136F7F2BC152A21D71F0360C75B6F37221AD2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 cd8dacbdf57897cb27ee50d362a94984aa64d52e8e9db853b8513ce7a904e38c
MD5 09c8300aaeb63fbb30fd79f95ef5c72a
SHA1 169fbdfd33bbd6c7de15935164a9f856fd5d062d
SHA512 577d837fee2b4b91b0d4780f03a43370338a8bb3683afca4fb6efa04f4870d19ce8ea03b82da7ac616f47bee716ebbba798eb055361751fc08f2d2ca63533dfd
SSDEEP 24576:RZuuAfYLH8AcevDN0FImbwQuq3Wia7gD:TAQgAT76sQuE
TLSH
T12B55125B239830FAE5A7C139CCF65659E3B278A6532283CF0115079A2F37AC59D78B31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 5a797f663a64cd1cf9add2b25e37ac0838f3be4ee060c6b08a1dc2ef1218cf01
MD5 bb5086bc2509d06838349ce08e8da62d
SHA1 0894bd855cd130dc9aacaa04d3cce1c5da1ff272
SHA512 a0b054edcb3ec688ad21c240c0209931cf339643ad758c007d451e2808ee86176bb442cb80358448e87eab9a2b052d7f0b183f850854327f90c5e7c71b34bb63
SSDEEP 49152:Uj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23Uc:LQRQyi36YOcPbLvw2gAf+PN38qGsQr
TLSH
T129667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 8fc0e7ce7a315cb85076d93aedf45da776f94bff720f4d19efdcb630b701dfd5
MD5 d4f1be387553050c7da5be239734abe6
SHA1 90c2c6258b899f556d7fa2af8e367d31853ec8ae
SHA512 3b1bad540a9acdf265c6f1063ab3198522ef376280e7b8cce42dc30b8fc27c107e7c46ac40efd4e97f62b51f42add56cc27f6ed322f2cd62d127fed195f565fb
SSDEEP 49152:Lj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23Uc:aQRQyi36YOcPbLvw2gAf+PN38qGsQr
TLSH
T113667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 cdcd09cea7202ab56f056101798dff52b1cc569a8a036bb2ddd3c11e6e27c5c5
MD5 020e75b3f0016fd6e442c13bb032f97d
SHA1 1c4e167f83c8467bf51b20813a1983ff18f3dd71
SHA512 ba7f4fba204148cb7865fc56e620c9ad2830fb97b200fada84907295cd0328dae8e005dbd08ad92124c85d3f33d76ede980589f92f49dd38206c052f835b2cef
SSDEEP 24576:YwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0eAfYLH8AcevDN0Z:+68Qg55nhceWu7PNU3/9AQgAT76sQuE
TLSH
T1C2B54933B2F600A9C44DE1769F4A873196D17C758FE0E3DB8515720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 a742f897111d46b450f12cd245927887c9d901d4d16741ad8d9883124fb374fd
MD5 b75e90b2bfd3ef4236a1b5eeda00da7a
SHA1 299f978e4c7d323713b01fb3528826dfdb174068
SHA512 c5547bc46ac64e2f4e1e10a9a1fba62a13753898d6c87c8597bb6b7a080670f18c76cbba83dcb001949f8667ffe108faadbff1d74d541dbf5688139716d21e2b
SSDEEP 49152:K3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99W:by5112gYy5azzVvt69nLKnhZrqGsQr
TLSH
T115167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 7181a51fca14fffb5ea1b7653bfc25ac7148875f2eec0c17f87d2311da542cfc
MD5 bbbcd958f54732526a6c4015d1079d15
SHA1 a2fa0c5e9306fbb89049da9c3adb5eefdf7ad1fb
SHA512 323f9e12e339cf16a43f97694f15920bb488847192f159da0068e5cfbf36bb1b224582dc3f57b6b37a7e1aca90f5899e5c446ad7c3cc22db823cbbe827d0ab40
SSDEEP 49152:pB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glPAQgAT76sQuE:/u6Jmdxd2d0qGsQr
TLSH
T1E5D59D13F1D901E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE4AB3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 8845429ee68fdbaf033caed30a3ee6283ab4cc1f1910910731c9ff35a146d133
MD5 9ea185b93cc353554804180b82d4fc35
SHA1 f2a222936f30772cb55e857d5bbb3d7c667d0f0c
SHA512 d1d1102bc6a346538ee2e6d119f44741ee24fb2dbaea6ddd20ef822eb09064e7458b077203e21fed16dabdcd50822087bafa36741e81b8ba6309acb757de727f
SSDEEP 49152:31hpsNoJpF1A63U44CwH7R4xjAQgAT76sQuE:3mifPWRhqGsQr
TLSH
T1D2B5BE13F2D900E8D06ED17887569232EA62BC460B35B6DF0A9077962F7BEE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 18c771138027fd8a4f5f705f338341dadf5479843e0ed5899eb6fe94cdd317f7
MD5 7f537f7838f34eea6a1ef5e547f5b880
SHA1 b09b154165f6442ba628d4bb4eec2bbfe671eaf4
SHA512 9c8e15c11769e51c3a673a70c0f6cb9ce42856d60ec22de8757ad0f114f7e52bc59a23f4e1259dd2aa6c4fe1e99f4f9aa2f1f59198ab8171103f6ae33e46f38a
SSDEEP 49152:WSuZQIY0Be2KcRVtOnks6NMHquAQgAT76sQuE:45dKii61HqGsQr
TLSH
T146C5BE03F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 7de2ff73be609393caa1e7d14425ab48c2923adffd43c5578acfe60f9e30e5af
MD5 24f537a270dbff667266a55e4d34fb06
SHA1 8e593055425b7a74902845c60d4f58605c9256b6
SHA512 a9727f67c9992968457bd14465b70a0b0bdccd4aa5a260c8176f042b3cae98edb0470bc6ad6683ca7ab6d8ff8bc4b8db7e0f822c966905d06cc48bc4e48621c7
SSDEEP 49152:4htSn8EApI0fig3giDn0AP5wfAQgAT76sQuE:pX2imphlqGsQr
TLSH
T1CF95BE13F2D900E8D06ED178C7568632EA62BC150B34A6EF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 eb6669732a6170537acff322818b6496fb54c7454861875c3547ffd0d20207a6
MD5 2ff279558f8e2f7948cb8d46f92f98e9
SHA1 bfa977e9b5afc0534e8aae9e7b449d94fcb1fae2
SHA512 58ee25661e4a04f70eaf8300fe95a92d214c4093095b3ac6ccc20100b773456f88269d73aa4248bb884900425a6dc87958a6d8f2768ffc7083afde103115a347
SSDEEP 12288:pqAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:pqAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T18F55235B594C70EFFCBAD1368CB791B9A3C07CBD9346939A110A278A7A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 287c103371b66abcdfe2e131fd0d7d4a88e9ef84536300fdcd824f95c0f006ae
MD5 edee66254b12d8e677e2bc45e99a06c4
SHA1 4209d871002eea6caa529f0eaa2fcf4accb45738
SHA512 424d6be6798750ac98be1a942f3da75041f911bb0108f753697ba0b02975511fb85a0d7b827d1bb565332400e31536dec1272edbba622a4d0b5121eb40159e4e
SSDEEP 12288:EZAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:EZAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1FE55235B594C30EFFCBAD1368CB791B8A3C07CBE9346939A150E268A7A3E418D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 7bedfd4987dcfd4bd221bc3dad1bc4d50bba7912bf12f376d4a4a02d757a1c49
MD5 c8ec8fbff3c5bd05ea240d3f7f7c79ac
SHA1 5353d98b56c83a1c5560e3c4c228046e12326c62
SHA512 6adb3f3d598ec5d903fb1b7bd390db29e130374912cba091c0a6c7ade60c6c30b660318b8f1b1197be1d24f657c0d776f3c726124e9f13d51e7626bfa5db60bc
SSDEEP 12288:EbAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:EbAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T17355235B594C30EFFCBAD1368C7791F8A3D07CBE9346939A150A2A8A7A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 7cd4ab14e10d7c1f9a23c69f39bab1f8f837fdfed8ad0e426680a1545927fc20
MD5 189bdb5f97aff0e40b2ab10c433e8d39
SHA1 89af81d0bd8ba8f11bad1d59c47c5c37257d3d3d
SHA512 ad5e001a5f23392b8da1ff9b98586f600f435cb078f39d2084103d05860a752eb3c6eca5c88e59d61b0801eb8ded190168fece04f199afaeeb29a34b0668ead5
SSDEEP 12288:1VcAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:MAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T137552357169C20DAFCB7D135CCB791B9E3E1BCB9930293DF46011A8A2E3A24895F4E74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 6ef291e576289525cebc3a05ae0d811b1d2c179a9b6ecfc59fa30b980eb6a99a
MD5 573c2ccae6be2e635fec2d4d69a256a0
SHA1 f00f7e6b82aa5c92a1aabf33eb8e4f0126f6a7df
SHA512 74847226118b4266b8de3c1fdf2c276410a891c9b37269ce05181de11483fe6401dbecc26afac2aed5698c00d9583ae845c7c25e8007f55ac982de503ebeb11b
SSDEEP 12288:/kAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:/kAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T19B55235B594C30EFFCAAD1368C7791F8A3D07CBE9346939A110E268A7A3E408D1D8D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 51ee11effe88e6547f14959cab18a2116572d3ba5cdc8a7f6ecdc3d5fc688fe8
MD5 df7ea1d93ba9124af33ec0a1aa6f0728
SHA1 a99930760db37eb065bf643226898926d94a10ee
SHA512 3626f3db54fe0c4d3919e551a16089a0bdd133399d630cafc9371f625bb33ddd32e2cbd524ac0669836512e23cbf80483ac19e0f52553578f889554b0dcecf4f
SSDEEP 12288:OlAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:OlAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1C855235B594C24EFFCBBD1368C7791B8A3C07CBE9346939A110A268A7A3E418D1D8D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 a56f8010de999149f12838ff1b8c215fa0501fd0df864e78fcad99e4cbdc5b70
MD5 3b6c19357cda32d0468e7029e8a37557
SHA1 4ea0b497082d364841b2d57b2863ea1e578be364
SHA512 6a74ad8c0de222ac5bd7b7f7c6e3982217bf1d6a3e83b5635121cfac4b54c799829b6d27b361dcd2f5eddb980bed27c9a72f78bfa07091d370a7c35424797684
SSDEEP 12288:UBAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:UBAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1F755235B594C24EFFCBBC1368C7791B8A3C07CBED346939A150A2A8A7A3E418D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 f032b695e581967fa39bd2a76ba849909aca9ce97e664c3836d16a7cdd7d2fad
MD5 d39ac08f06663751adbb5423bd69a08c
SHA1 0c49e60ea69b1076194f93a16c87134438c0a0dd
SHA512 ab06db139c6c12c44bb2575102ae2877fdbc080a1febbc28a1c3e40eccc1df913e3d264aa03ed08e2d0f1f0c935dabc331e99d302a586f181d60f6aad86e5e6e
SSDEEP 24576:XZMRzFVSO5AfYLH8AcevDN0FImbwQuq3Wia7gD:XZMRzf1AQgAT76sQuE
TLSH
T1E9750195B39018F8EC67813ECC668916D2B27C6A0760C65F03A4366B6F373A15C3DFA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 db1f2cffa1a31ca389a555941fa3feee90c20391e26abcb9822badd01ab3e61e
MD5 5a19a7686a58e36f9b37c68ef2e7afa3
SHA1 2ae32dc53b8586a2b84db11396f301f689e03809
SHA512 07ef3ddc7c29a297f0f64a19198b66b7b8b0b2b501f34cfd799a18e08c1cd1a9ff6e417140fa5a5830aa481839f9af070cdf1b4574e2eddb34700ebd50f985ef
SSDEEP 12288:M+AfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:M+AfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1DF55235B554C34EFFCBAC1368C7791B8A3D07CBE9346939A150E268A7A3E408D1D8D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 f012c720e8bd3feddd0f21c20af2b9c409322e7fd9dcf79f064f09debdc0ae85
MD5 a526f1416f9e4e44f04ac4d77d157fe4
SHA1 5b5598c94f0f1d407bbcc94ae9c05f22ac52e83c
SHA512 adc0adf46af0a2e35cc7723b722c85b3e38f0ecb9aaf0bd49efec5a37e9da3dbba1c3ff914e952f0f8b08ae7764b3d00df8175457ade87ec128b045dfe4c5da8
SSDEEP 12288:xCAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:xCAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T17855235B594C24EFFCBAC1368D7791B8A3C07CBE9346939A150E2B8A7A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 73413897742011b952999b06db2ba59fb0484f8145efa59f131b596b91b4aadf
MD5 bcc14c55f5d262bb55faf36447cab5fe
SHA1 29d462308a6845c7efd702f8b68c6e6a1ad05795
SHA512 bd300d9a95439e5b0bd5c919cf0b5c4c40af3b82c4fdb1470f8eb7555dc940d155b03b73ad4a3f4c53c58057c0b65ae6cf4c8a4f54e08a325cd391820d37aebc
SSDEEP 24576:IzydAfYLH8AcevDN0FImbwQuq3Wia7gD:IwAQgAT76sQuE
TLSH
T11D65010763A530F9E577C239C8A21A55F3B1B87647108BAF135407BA2E376909E7AF70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 11b5b9d44596cdfe6ce3aec6e23266b26e9323d7211e2dc2346316e29a95b6f0
MD5 a49d5c5889cdd93574f07025c39cedaa
SHA1 63f715ffb8cfa3e2ab57903ba49fed0d86036a32
SHA512 866017a657651fcfe19488e50ac9cedcfed70b698fd2ba2d8d33cecf3665a8c39107abdfb3e3634620ee87fad62fde365b31d5b7c15bf025f77a48b01d81b4ca
SSDEEP 12288:k+AfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:k+AfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T13255235B594C34EFFCBAC1368C7791B8A3D07CBE9346939A150E2A897A3E408D1D8D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 8e276d62401db06a72a370a3aa17117927c12ca178390dd1b7ea2ef4622125eb
MD5 539d92f9a56dc7e2b9252d2f53c14a8b
SHA1 e663b2aa1f97357ee8532eeea6c0c69c4cedc8aa
SHA512 d3f8c2d49bdaf56a362cffdc0d5a127506984d5da50e8cc57bd9144aa2f8c6576aea4afc901390fc33bb4e957cb27a9eed59e02326c06fb3bae830ad38dce8df
SSDEEP 12288:7+AfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:7+AfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1B655235B554C34EFFCBAC1368C7795B8A3C07CBE9346939A150E2A897A3E408D1D8D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 a8d36572fba8d06836aa91945fa72addd5ad271d9fe75fc79e0332471f8bbde6
MD5 503188d1a9fabef28fd6344ac66f4f0c
SHA1 4a00179618be2e54d72dafa1c3edb6683c964dcb
SHA512 bce155ee6f9276bd297da6e2b701edd887f998cb7fffdf2f5aeba2c8fb623a3599fb8b76fa24a03711310f155509434a05aab775f89f9317462cee47c491a2ea
SSDEEP 24576:+zydAfYLH8AcevDN0FImbwQuq3Wia7gD:+wAQgAT76sQuE
TLSH
T1FC65010763A530F9E577C239C8A21A55F3B1B87647108BAF135407BA2E376909E7AF70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 bae55e730ecae7c0626186f7f735420368ed5af4153bc8fa7ffc688566405e9a
MD5 ac90d1c77d9108b7a98b96a965ed68c4
SHA1 708a0854a9fad9f29c0b5bc31a29d51305147846
SHA512 78a51d323f3a9e7c9e95c72bafff728cfe06dae63612eb4c201ba1354eb165d763c3aeba80e8aab5586fd71978fce1d07c3733d8a7f1b2cd10a622eb6f82e46d
SSDEEP 24576:mcP4mcvIjkGOxhKP2l71SNKbrh/8KBGAfYLH8AcevDN0FImbwQuq3Wia7gD:hP4m4IpOO67N8KoAQgAT76sQuE
TLSH
T1B665AE2DABDC0096D0BB913885668A49FAB1742A1F3286CB1160933D7F77EE54F35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 062d8731f16997276844e37707b8c0bdd0b06aa299ab21c51632e2495f471261
MD5 0bc53a7efccb7599ec81a386323ab86a
SHA1 2722ac22b91f449811fe41e28ef27bab9d6b517f
SHA512 beef382c71296e9d54a2d1ca2d01a24adc6f34f07160835e7a224b22bd269074bcdbc68acbd5910581079cc16d9306801271c989a2f18b7bfcddabb10b845ba7
SSDEEP 12288:FbsfuAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:guAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1AB65010AD29811E9D46EA139CB664650F3737C6983E1D3CB12C0F57E2F3A6909DE9B13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 b5f648057226c0e3bab1859ffd5d2fb4f3a6c1f2942cb748227766b44872d559
MD5 ea35811d9ba8b9cdf3d4adc63022d3d6
SHA1 91398af2fdf40db82f4535ae29620bd504719e9e
SHA512 31a751779447b6c64c36f01f1e9db98c1d607c41ca24eca3a8eed369ab13e361b2cf8b78392946f78a09c0dd6412bf80ff63ec7b2e616953715571fdc4281744
SSDEEP 12288:WOAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:WOAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1EA552317868C74DBFCBBE2314C7BD17823997DBC8B44D29B600A278A793D854D4E4E29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 b04a3317b760169a337037001a0fb3ddef377d4b17918a412106f281b27a42d5
MD5 6c5cf80cf95adc48abebcfe163cb4189
SHA1 9033390e7016d11082d4ad04339f296b2aa8fb7b
SHA512 e3e53133e666647b953fbcdfc879cd917cc3bc411bc87d157128b422d0bcc8b1b134371886b603cc3b2d5465ade932d63fe7a125eda43d10b465e8737d715581
SSDEEP 49152:Ma0h2GEkuAe73q3pp46zwwQkAQgAT76sQuE:Ma0hNYG4Jw+qGsQr
TLSH
T119859E1E67EC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37DE84E3DB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 7be1939ee134dd1b13bea92f3e6b93a80138679a942fe24b5a418becbfb34c4c
MD5 28d0be3bf69836b345ea3b25f328072b
SHA1 cd1d21e867f95937dcbe5aecda141227c08c1dce
SHA512 1d66584799b38a946cf2dcdfe191cebc53e67c6a452a60867bc33cf9a4988e1c19dc639c549cea511cc6a209c033015cfb3046e96631a6fa4a4417ac03177906
SSDEEP 24576:phbHjPJAfYLH8AcevDN0FImbwQuq3Wia7gD:phbHjBAQgAT76sQuE
TLSH
T13A55027E16AC20D9F576E13D89A6854AD371BC79130193EF128282BE1F3BAE84C74F51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 e514ae74ab989a61177e6e82381beb4f8b385e0199c4bd8fbf7ab8e9d285d081
MD5 5d47af02820384637d7aa7fb1f959e2e
SHA1 636bd713cae9a5a8a66532b724affdf3c3bc649e
SHA512 440dd4ba4e7fed8b74a61954cb73148f521ee5db1aeb8b6df67b0564e87fabd0e02de4181f16238672d4874407fea4258f5552e3add63a5d2c93d77d2a688b1e
SSDEEP 24576:43YgnJcRTk4yti+R5dpR/RAfYLH8AcevDN0FImbwQuq3Wia7gD:4IgnaTk46ppR/RAQgAT76sQuE
TLSH
T1F645BF2EF2B910F9D8AAD136450147B5FB71782D1F209ACB0170C538AF1AEE89E35F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 645fd3b47a08a81d9575225f59e2481a5a095c396a260f03d7f1ef8b8da09b9f
MD5 ff4770dc6b04122c56cb278f0f5ebe0e
SHA1 7422ec59abc2ed20bc9b8e1cca48d0e94530d968
SHA512 8a08cf3e58ecea707c705151e16a6edda2526ee81b776a8b7f4fbb39a4ff47101aa7968142357723920fa9a77abf13f51a4e2f01079ab8db95b9918992ef59cc
SSDEEP 12288:TSAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:TSAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1FE55235B464C74EFFCBAD1368C7795B863C07DB8834653DB100A268A7A3E899D1F4D24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.6MB
SHA256 19ffa4886cc4dad1f9391b85f2822e095351fd07cc51e2c33ecf2b7dd0c4e4e9
MD5 f116b5175f6100d8b90209c3fae7e3de
SHA1 1ff0d23fc1c31e0f1caa4b0efd9027fa85d06184
SHA512 7bc9b288c615f2fd8b42ad6c778786c7f519cb65e5ae510e056b98a25221535615286bf0cb9aaab00918ae204f764ccb4c91945ceef0adcf70f17775d68d8d86
SSDEEP 24576:DbL3UTfAfYLH8AcevDN0FImbwQuq3Wia7gD:DbL3UDAQgAT76sQuE
TLSH
T1F275F155E79400F9E87BD13CC9B68526E2B2B8AD0354E7DF03684B551F236E58E3EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 ba71b55493beeea3f6df17d1bf153f2c8e7610303dbf20e58f5b1098c7593ab5
MD5 bbe05fd34403a822a9b63e9855a9b27a
SHA1 67897be189a83de27b0fff8857202d385b203f5e
SHA512 634511f8cc6f8d8082e35bef45c2c4e6f7d3a460d0b0483327d0e746835242688eecc6011f7f5a31b73742df1d4341e8056e6992d8a6638a855b2441bacbf395
SSDEEP 12288:LpFtIOjAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:eOjAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1B955021A36DC20E9E47AE13D89A3825DD3B1B875071253EF029041BE1F77EE89C79E61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 003826b7cc2a2e1b8c30bc5b9578bbbcb5d556df1ff52c6092ca17e1b57f8f86
MD5 4e44677822db91e9e476b3178e4f8943
SHA1 f631b2b446c3795e158d50555b8edfd271c883f2
SHA512 0bbb395dccac0cdb824d3267a69cc4e78415f206ef58903e675a9792dbb41fef74e3f49c832aea1c83f8347cd86c0a053d78199f6adf845c226b49578a86f127
SSDEEP 24576:u7NM9YmZqmWMUkPjZM48Mv6bEhs+AfYLH8AcevDN0FImbwQuq3Wia7gD:u7cBWMpPjN8DbEhpAQgAT76sQuE
TLSH
T1D8659E2E6BAC81E5D477D13DC9A28245F6F2B4611B318ACB1152833E7F37AE44E35B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 99c01999601f4b7cbbbc74c042a866cb36769aaef48606b04c555a2757d3d3ce
MD5 921cdbfe9637b819dc819d40b7ad317e
SHA1 aef56a1cd3f994265503857140d40a3f207c7116
SHA512 f47d9363a824fdeed833ff0c0d277ddb3edb3fc0e7a4b17f0ce9f6d4f4a614129bc9684a7274590e8af47fc4869d1fe23dd43c7082dbc8540735abb46dc51f85
SSDEEP 24576:SW6BApg2YuyuNDYTabvcRvNYf8km1gAfYLH8AcevDN0FImbwQuq3Wia7gD:SF2YuHNETovcvNYf8kmeAQgAT76sQuE
TLSH
T1A5857E2A27ED80A4E0BBD27D45B7D146FAB2B8551B3056CF0255862E1F33AF44D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 be1efaeb667b1b4e2a5d14e58c625ee41ccab4a33a7fad728e36c0eda293ceed
MD5 c39cf47c2cf440b827eb81263b2d51f9
SHA1 2eea5e0b24f1d6d690e60f7d899f8f03c1e4235d
SHA512 273e02ffd671951aa337c9f7d52197d2f7f2b242b90293ed830f7b764dbd959a618a5df731b3675350b96d0ee8037c36abaff461a77e3c9040d3a6585d4b6581
SSDEEP 24576:5AFs06+OmlfkNXEbTo3AfYLH8AcevDN0FImbwQuq3Wia7gD:+Fs060lwXuEAQgAT76sQuE
TLSH
T18665BF2F62AC00D5D07ED17E8997C91AF3B1746703255ACB0260867E7F6BEE85E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 b71bd2516a3b97354bacac229338dbae17582b9e331b80456ac2add442d36f89
MD5 1d9b14dd2a2ef36a7f192d7bb6e73154
SHA1 afaa9a3db007499e78970d6b35adcc31d38a973f
SHA512 3abf720460ecb72b5a5fc5db84d9c8121476653788190602dccb22cc12136acae92a6ccafa15865f663fdb015f3b3abd75c6f02a83b4577321e686d91cd93e16
SSDEEP 24576:AJnJ5D3WtEAfYLH8AcevDN0FImbwQuq3Wia7gD:AJnJ5DGtEAQgAT76sQuE
TLSH
T10475D02DD2A810F8E4B7C274815A1796FFB2387D2B226AC72474D5353F22EE09979F14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 1edb7f79dccc094306925d599b478681531a3c58d635f9e2ed54123a7a06c39a
MD5 00a2cc539de23406bbb0e3f381a58d3f
SHA1 a58b37bf596ae0ab55e1f29de36a3de6fc6cd1b0
SHA512 467ed97d1e51dd38bfc5902f138ae63a38f1340b9eb66dad9b669d9822b467ea1a59f1b2f0dfb5245a834592e9164d2bf8321ff2c95f92c99709b3899c10c9af
SSDEEP 49152:Mo06DIKdwc+eQnSt65aVqAQgAT76sQuE:BVqGsQr
TLSH
T1DE956C16B7EA5294E8B3CAB1C96295169B327C509B34F7DF0AC0C92E1E33BD1D934B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 13c7114eb86caad57c98a4ecc437320e904f19e0cc7174552ce39c261ec6bfde
MD5 eb1fd3094b4954390ce1feb61ab21708
SHA1 fce1b3b40e93ee1a69e913f18d13289c47ee417c
SHA512 4810dd5421ae65e0d3c59029bfdd360528afb06450d4dfb447e73b45c20d71755b474def71e277221045ac3aa29dc88135bcf25df01493e8ad333c44a996155b
SSDEEP 12288:wEP3Rr4AfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:Lr4AfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1C755126E279C70EAE47AD03D88A28259D3B2F474174227EF1191827E5F3B9E95D38F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.4MB
SHA256 026bb83583fc6ea1e693dbdff3adcb4e2863b12110d6fefa94b45f11cf4fcf02
MD5 adf3836ae6dc28a9cf024d49d465fb0e
SHA1 4e1475f194dffdc59629d981d221af69117b628b
SHA512 968cff1a7c487092dcd4939bd3957e09359c6d21e12cce8d5bb630548799b8648473558c0196e3e27d91e98467a75c1bb03bf940ee3eba995e5a77e81d4845f2
SSDEEP 24576:wIyZAfYLH8AcevDN0FImbwQuq3Wia7gD:wI0AQgAT76sQuE
TLSH
T15465120A539860D9E9BA81398D7381B49BB1BC745B1193DF5080B73E7F3ABD4A874F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 901daa6f7e222602e4af541d5804d57f272666a558003b4b38de3f9d35322f3e
MD5 27c83b5dbbb235b2c281fef58def4b36
SHA1 341131b919279fce7ed68c64777b77c6184111f6
SHA512 189374bcfd15be05cb4a8468119a38b0d04ea19ccdcdbd4f03687a7a41ca0d0b6a2c87bb9a67987cf3c17d9b306f055fc0e284caf1d200f8412b20c98599948f
SSDEEP 12288:LFzAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:JzAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T17855235F125C30EEFC7AC135887796B853E07CB8530562EF108566BAAE3E48991F4D64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 e5763b9709dd3b398c1d17df1b3a134e902769794893396fd5e50b311eb99adf
MD5 32caa28f13d16a0627c5aa241762f8b6
SHA1 183e25ddc77b572ddcb6ba9d81a5b9c4d5dd751d
SHA512 2635063492535d82302fb65ae7945933fd5fc81ed714ed4db2fc661aa18da775c784488ed9a7321cb9584b80d527db63e4ec6a5f418fae6967e0810d3b51be31
SSDEEP 24576:uQ9MxZKdcz97w32AfYLH8AcevDN0FImbwQuq3Wia7gD:uVKX2AQgAT76sQuE
TLSH
T154558C2DABE9059AE177D23994B250C3A673B4311B31D6CF2448D03D4D7BEE8AA74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 99812e8e58212ea230450c00a9624bf58034acec42adac029644ee913ad8764f
MD5 b8d9aee6b83c47999c817cf84b125c65
SHA1 c1b60c12588a59cbd257364054dbdba0d8106db7
SHA512 549149ad7e742e4971a9124704130d41ddf72c5b65b47655aaa5f8bb0ec3e3e2ea47b9c9d503e6e23818ed40f57f01ad12fabb7443609c69cde09a7646bc4e84
SSDEEP 24576:qyocxApNAfYLH8AcevDN0FImbwQuq3Wia7gD:3ocxApNAQgAT76sQuE
TLSH
T1BB65EF1FBB6D40E2E076C13C89968255E7B3B4745B5253CB6581833E8E37AE8BD38B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 c49d8a0f2a53657d422eee48147d47c72eb03b67fe1d41c947cf6b4ff7844390
MD5 295faa8d7ce338455f39ab520f385eee
SHA1 b18689040789ceff678f518be5e4e6120ae8f143
SHA512 8731be0664b0c1972afa5e4b9dd5c0f1cbce8a08d948ea049321d074fb90f72d48486e1ad71e03f0b67c2c187722437890b10543551a813cc1f53d76a62cdcbb
SSDEEP 49152:4WcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIKNAQgAT76sQuE:a0zuNIKqGsQr
TLSH
T10EA57C3DA2BC00A9D8AAC375C54613A5EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 85a8dce3aa5ebe1091a0a80da440652a6fa28f500f290af944cba00029a7db35
MD5 9e01baf7e8b4442400bc80d647752e67
SHA1 16e82a2fbdddf3416bfc3f21ed0399f565d1c933
SHA512 eaea72a4297967f3ecaff3be015cb964596c8fc78f5454c29c380aadf8c118b5fa37ecbf6282f536305e5ccb253346ede9c2d8820c32b58c457f1291463f4cec
SSDEEP 24576:R1QT7EcpfxR+N5AWAz3ooiYujMqb4AfYLH8AcevDN0FImbwQuq3Wia7gD:0TDxR+N5YzT4jMDAQgAT76sQuE
TLSH
T13D55B02EA7F815E9D1BEC5799A23C512FA727821033193CB42A0C17E1E7B5D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.5MB
SHA256 ef40a3d7c041edc962586bbf21f19d470e00f4dff2d634d754644873276eef45
MD5 081f44f0d528ad051448be03a5079f89
SHA1 d671c3fb2f9352428a38252ea52c0ae2490e71cc
SHA512 8ab8e66fdc5cbe82cc366170380653207a3e7eb39e79c89dee1c6e3c0f75207bcab1124e23ad56e253cb7b4407376e1b10cd33c8f9b07c9f2b681b45ce7559f8
SSDEEP 24576:4TMdOz0FFS+bmSLcAfYLH8AcevDN0FImbwQuq3Wia7gD:Q0K+bmSLcAQgAT76sQuE
TLSH
T17775F13EA36D14E5E47BC17CDA538906E67238750312A6DB0690C1B93F6BEE47979F00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.3MB
SHA256 c10ec09e0f70253a567a844471bd1370d6e3c37976378f43c8a0aa76c0b48b25
MD5 8c5a9319ac3de4a90a89afe97080dcb8
SHA1 14976aa06f96e1674cb5007cbc5f3e6afe272177
SHA512 4d83db58877b4a2894bbf54c397ad07f1bc071219d8938d06e781eaa0d8431b3a0b40d5175751b2e64c0813fbfab15b6a77b0f04eb69954320dd9d8777d8662c
SSDEEP 12288:d47fAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:IfAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1F655121E13DC30D9F8B6D2358A37416992B0BC79130156FF24C49ABA6F3A9D8C5B8F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/372-420-0x0000000140000000-0x0000000140210000-memory.dmp

Download

memory/372-89-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/372-95-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/552-193-0x00000000004F0000-0x0000000000550000-memory.dmp

Download

memory/552-184-0x00000000004F0000-0x0000000000550000-memory.dmp

Download

memory/552-190-0x00000000004F0000-0x0000000000550000-memory.dmp

Download

memory/552-195-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/1640-199-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/1640-206-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/1640-405-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/1832-110-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/1832-394-0x0000000140000000-0x0000000140202000-memory.dmp

Download

memory/1832-116-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/2096-81-0x0000000001A50000-0x0000000001AB0000-memory.dmp

Download

memory/2096-85-0x0000000001A50000-0x0000000001AB0000-memory.dmp

Download

memory/2096-75-0x0000000001A50000-0x0000000001AB0000-memory.dmp

Download

memory/2096-391-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/2900-180-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/2900-404-0x0000000140000000-0x0000000140239000-memory.dmp

Download

memory/2900-174-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/2924-13-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/2924-14-0x0000000000700000-0x0000000000760000-memory.dmp

Download

memory/2924-21-0x0000000000700000-0x0000000000760000-memory.dmp

Download

memory/2924-20-0x0000000000700000-0x0000000000760000-memory.dmp

Download

memory/2924-449-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/3048-138-0x0000000000610000-0x0000000000670000-memory.dmp

Download

memory/3048-132-0x0000000000610000-0x0000000000670000-memory.dmp

Download

memory/3048-398-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3048-455-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3048-453-0x0000000000610000-0x0000000000670000-memory.dmp

Download

memory/3336-216-0x0000000000700000-0x0000000000760000-memory.dmp

Download

memory/3336-406-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/3652-263-0x0000000001B00000-0x0000000001B10000-memory.dmp

Download

memory/3652-247-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/3652-279-0x0000000001DB0000-0x0000000001DC0000-memory.dmp

Download

memory/3652-419-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/3652-316-0x000000000A1F0000-0x000000000A1F8000-memory.dmp

Download

memory/3652-451-0x000000000CD00000-0x000000000CD08000-memory.dmp

Download

memory/3664-401-0x0000000140000000-0x00000001401ED000-memory.dmp

Download

memory/3664-149-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3664-143-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3904-402-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/3904-159-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/3904-153-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/4264-68-0x0000000000530000-0x0000000000590000-memory.dmp

Download

memory/4264-46-0x0000000000530000-0x0000000000590000-memory.dmp

Download

memory/4264-40-0x0000000000530000-0x0000000000590000-memory.dmp

Download

memory/4264-39-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4264-70-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4372-226-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/4372-220-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/4372-413-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4508-66-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4508-72-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4508-60-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4508-489-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4544-100-0x0000000000410000-0x0000000000470000-memory.dmp

Download

memory/4544-106-0x0000000000410000-0x0000000000470000-memory.dmp

Download

memory/4544-392-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/4600-418-0x0000000140000000-0x000000014021D000-memory.dmp

Download

memory/4600-236-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/4600-230-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/4628-27-0x0000000000680000-0x00000000006E0000-memory.dmp

Download

memory/4628-36-0x0000000140000000-0x0000000140200000-memory.dmp

Download

memory/4628-37-0x0000000000680000-0x00000000006E0000-memory.dmp

Download

memory/4744-403-0x0000000140000000-0x0000000140259000-memory.dmp

Download

memory/4744-164-0x0000000000440000-0x00000000004A0000-memory.dmp

Download

memory/4744-170-0x0000000000440000-0x00000000004A0000-memory.dmp

Download

memory/4752-465-0x000002327EF30000-0x000002327EF40000-memory.dmp

Download

memory/4752-472-0x000002327EF30000-0x000002327EF40000-memory.dmp

Download

memory/4752-456-0x000002327EF30000-0x000002327EF40000-memory.dmp

Download

memory/4752-457-0x000002327EF30000-0x000002327EF40000-memory.dmp

Download

memory/4752-466-0x000002327EF30000-0x000002327EF40000-memory.dmp

Download

memory/4752-467-0x000002327EF30000-0x000002327EF40000-memory.dmp

Download

memory/4752-464-0x000002327EF30000-0x000002327EF40000-memory.dmp

Download

memory/4752-463-0x000002327EF30000-0x000002327EF40000-memory.dmp

Download

memory/4752-471-0x000002327EF30000-0x000002327EF40000-memory.dmp

Download

memory/4752-470-0x000002327EF30000-0x000002327EF40000-memory.dmp

Download

memory/4752-462-0x000002327EF30000-0x000002327EF40000-memory.dmp

Download

memory/4752-458-0x000002327EF30000-0x000002327EF40000-memory.dmp

Download

memory/4752-469-0x000002327EF30000-0x000002327EF40000-memory.dmp

Download

memory/4752-461-0x000002327EF30000-0x000002327EF40000-memory.dmp

Download

memory/4752-468-0x000002327EF30000-0x000002327EF40000-memory.dmp

Download

memory/4752-459-0x000002327EF30000-0x000002327EF40000-memory.dmp

Download

memory/4752-460-0x000002327EF30000-0x000002327EF40000-memory.dmp

Download

memory/4784-395-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/4796-50-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/4796-71-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4796-487-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4796-56-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/4928-397-0x0000000140000000-0x00000001401EC000-memory.dmp

Download

memory/4928-128-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/5096-83-0x0000000140000000-0x00000001401E1000-memory.dmp

Download

memory/5096-8-0x0000000140000000-0x00000001401E1000-memory.dmp

Download

memory/5096-0-0x0000000001EC0000-0x0000000001F20000-memory.dmp

Download

memory/5096-9-0x0000000001EC0000-0x0000000001F20000-memory.dmp

Download