da6a472833f11b56560b1787d037aed1c2593e28aa940569cb735de855bb37fe

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/07/2026, 15:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-03_c9ca0944a52d561fa4cb6a22135b7abb_icedid_mespinoza_njrat_ryuk.exe
Size 1.5MB
Sample260703-s16ehsbz6s
SHA256 da6a472833f11b56560b1787d037aed1c2593e28aa940569cb735de855bb37fe
MD5 c9ca0944a52d561fa4cb6a22135b7abb
SHA1 3d6669c3ad9ac89210d4905c7cdc161c62800ec7
SHA512 1bd4552d3ad08b00abd27cd26a18752af54b4504d31d3ae45fb1a95cdd17e97e087bc2e0900d9117494433fbb1d37a45cc85bcc53b40e3a42966a384190bcdd7
SSDEEP 12288:JyVOd/emcJAmfPNZsOytPT3pbwNCdmDFbzX78dRB00JvDvMqbtsSrfirRKAZFs7T:Jy+fcSmf1ZutbpcNBw1FhtCrRhZV
TLSH
T1A175CF0163E84194F5F7AB789AF295269A337C925B38C68F0354455A2FB3F81CD39B32
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\International\Geo\Nation	2026-07-03_c9ca0944a52d561fa4cb6a22135b7abb_icedid_mespinoza_njrat_ryuk.exe

Executes dropped EXE 22 IoCs

pid	Process
964	alg.exe
4452	DiagnosticsHub.StandardCollector.Service.exe
4180	elevation_service.exe
4524	elevation_service.exe
3228	maintenanceservice.exe
4020	OSE.EXE
1556	fxssvc.exe
4572	msdtc.exe
1180	PerceptionSimulationService.exe
3232	perfhost.exe
4144	locator.exe
3764	SensorDataService.exe
4860	snmptrap.exe
2400	spectrum.exe
3300	ssh-agent.exe
1684	TieringEngineService.exe
1688	AgentService.exe
996	vds.exe
1856	vssvc.exe
648	wbengine.exe
224	WmiApSrv.exe
2076	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 28 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\4473efe53a3ba122.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-03_c9ca0944a52d561fa4cb6a22135b7abb_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-07-03_c9ca0944a52d561fa4cb6a22135b7abb_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-03_c9ca0944a52d561fa4cb6a22135b7abb_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-03_c9ca0944a52d561fa4cb6a22135b7abb_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_89984\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_89984\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_89984\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_89984\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003f7e30f9010bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ec81d3f8010bdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000050bcedf8010bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002d798df9010bdd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002c8adef9010bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000033f6ccfa010bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9908 = "Wave Sound"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9923 = "Windows Media playlist"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b9b9d1fa010bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4452	DiagnosticsHub.StandardCollector.Service.exe
4452	DiagnosticsHub.StandardCollector.Service.exe
4452	DiagnosticsHub.StandardCollector.Service.exe
4452	DiagnosticsHub.StandardCollector.Service.exe
4452	DiagnosticsHub.StandardCollector.Service.exe
4452	DiagnosticsHub.StandardCollector.Service.exe
4452	DiagnosticsHub.StandardCollector.Service.exe
4180	elevation_service.exe
4180	elevation_service.exe
4180	elevation_service.exe
4180	elevation_service.exe
4180	elevation_service.exe
4180	elevation_service.exe
4180	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
664	Process not Found
664	Process not Found

Suspicious use of AdjustPrivilegeToken 40 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4348	2026-07-03_c9ca0944a52d561fa4cb6a22135b7abb_icedid_mespinoza_njrat_ryuk.exe
Token: SeDebugPrivilege	4452	DiagnosticsHub.StandardCollector.Service.exe
Token: SeTakeOwnershipPrivilege	4180	elevation_service.exe
Token: SeAuditPrivilege	1556	fxssvc.exe
Token: SeRestorePrivilege	1684	TieringEngineService.exe
Token: SeManageVolumePrivilege	1684	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	1688	AgentService.exe
Token: SeBackupPrivilege	1856	vssvc.exe
Token: SeRestorePrivilege	1856	vssvc.exe
Token: SeAuditPrivilege	1856	vssvc.exe
Token: SeBackupPrivilege	648	wbengine.exe
Token: SeRestorePrivilege	648	wbengine.exe
Token: SeSecurityPrivilege	648	wbengine.exe
Token: 33	2076	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2076	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2076	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2076	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2076	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2076	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2076	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2076	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2076	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2076	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2076	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2076	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2076	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2076	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2076	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2076	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2076	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2076	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2076	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2076	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2076	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2076	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2076	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2076	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2076	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2076	SearchIndexer.exe
Token: SeDebugPrivilege	4180	elevation_service.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4348 wrote to memory of 1752	4348	2026-07-03_c9ca0944a52d561fa4cb6a22135b7abb_icedid_mespinoza_njrat_ryuk.exe	88
PID 2076 wrote to memory of 4488	2076	SearchIndexer.exe	136
PID 2076 wrote to memory of 1688	2076	SearchIndexer.exe	137

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-07-03_c9ca0944a52d561fa4cb6a22135b7abb_icedid_mespinoza_njrat_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-03_c9ca0944a52d561fa4cb6a22135b7abb_icedid_mespinoza_njrat_ryuk.exe"
1⤵
- Checks computer location settings
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4348
- C:\Users\Admin\AppData\Local\Temp\2026-07-03_c9ca0944a52d561fa4cb6a22135b7abb_icedid_mespinoza_njrat_ryuk.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-07-03_c9ca0944a52d561fa4cb6a22135b7abb_icedid_mespinoza_njrat_ryuk.exe" uninstall
  2⤵
  PID:1752

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:964

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4452

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4180

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4524

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3228

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4020

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:3760

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1556

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4572

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1180

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3232

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4144

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3764

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:4860

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2400

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3300

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:4780

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1684

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1688

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:996

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1856

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:648

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:224

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2076
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4488
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:1688

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 d9129c723d310298d0683e75664e51d0d0b040b51fb94c79dabb590327856f44
MD5 62e40ac41a630bf07c51da290193b301
SHA1 00702948a5f1936af5b1ce090954fed48c45b581
SHA512 5f624fb7fefde0d5d7081b052d9c1abd1fa2d8bdabb6ec70dd4234a4422ba329bc4b2a96640d175f08cf24de5cdce386c44599dde81bb04a9ba58f2800ceee79
SSDEEP 49152:cb+632BuPkFKRrdE6ohrstBhuXjfS4LWxnxtlcQQD:G3q60jBqlc3
TLSH
T142D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 d0b9ce98c797c0c6b87c1520cfa6fd5bd25a42e03d7688900c134d394612a7e8
MD5 3d7f030e6fd8c2422b790d12d3697133
SHA1 82f5f853faff29c68e4c8772ad77c786bd87d822
SHA512 482eda5002e0caf802f222d7ca438f9687de19f35c284c3ff05cbcce9b3b27471acfc4d378fcac106503df3759c86c267b6ba4f30d98c861500031176b92cca5
SSDEEP 12288:v1XLsswWkxy2lRq2czAkOytPT3pbwNCdmDFbzX78dRB00JvDvMqbtsSrfirRKAZl:NXYfDtczA2tbpcNBw1FhtCrRhZV
TLSH
T14C650228A3E505F9EC6B827CC9A18512E63378924760E7CB03E4D9661F337C95E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 7c14852130a02bfb1539ac2388b098765e3695e0373186f9f3ef14e20efc38ad
MD5 152f6e5bdd7737c95a7f4f6dbe38ea74
SHA1 2e5f58c887d62ececb37e42524bb433f09e09b3b
SHA512 02175dcc1a917ce7c20d0bfb15ebfd1059390aec0faa7cce8ffbfd5a066e11a4c772b33377e377a937d173edaf0c1838a18606c4ec4253aac510320943f604fc
SSDEEP 24576:+0Le5ji0hmxNrM5tbpcNBw1FhtCrRhZV:+Pji0A7MtlcQQD
TLSH
T14F859E15F6748371D073C0B9C5D2A69AE97230825B308ACB4286D77C7F67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 d506784a5123cdf747da182c10f73fd74a79b63866f42f825a991106831d0ad8
MD5 e1ce189549fff749aa0e46a3ed1ed58c
SHA1 5a09ec61f64d4141401f2b248ec1f1fd53c78863
SHA512 d08668e14d2d14517da30018ed0895a912a14bdf6d0b2a41f699b00bd693480c4ba2f4f19a4a5f3e6cfb645fd0a6e41d76390aa492603f083e1e4dda2410e803
SSDEEP 24576:ea7/ezSC6vUyD/aqgrvWr6q8wyuLtbpcNBw1FhtCrRhZV:Z/ezSC6vUzPviHjyAtlcQQD
TLSH
T10A755C15F5788323D0B2D0BAC5D6AA9AFE7230465B3089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 9f02b6d90b3d57aa58c900ac1080b617099347650ede51df12ab0ff2bbe91bc9
MD5 a0e9609829f5c7ebbdf461dfe9eefc9e
SHA1 70a9edca6e7d14f109b9c9f4ab0141babc78cc57
SHA512 fde38cd8ad871a25bfb82ace676e0368920db051c5fb14427f83635dcf215033d4cd6669438cd8d62ffbdf9d423d4385962c7fa558cfc325f741e12728a019a2
SSDEEP 24576:GVbqPb88hv/l+bCtbpcNBw1FhtCrRhZV:GVO88hXl+utlcQQD
TLSH
T154559E66F5748331D073C0BAC5D2AA9AEE3234424B318ACB1246D76C3E67BD6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 4ebf6741f447ddf759bf7184f57c14d430ca844dc6d3fb8e348cdd4482c29a55
MD5 90a7204e8ddc99f3ff1ab324af636f43
SHA1 d932c7d200ecaaf17efd9bcfdec68a06b8ba15e5
SHA512 38c55c07a70515b3276210a5d3d0bb119889309ef74e959af799df87b59c8149a6a13a573ab694faef002d7723d1c3705120db0474e294b2f63681a238837bc5
SSDEEP 12288:EjVOytPT3pbwNCdmDFbzX78dRB00JvDvMqbtsSrfirRKAZFs7KJ/:EjVtbpcNBw1FhtCrRhZV
TLSH
T130452394C15992D1E6AFCFBC73611DD6262E3C938C8809C7CFA2BC876FB154BE166460
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 2a01bb1c905be8f7a9d1e465d693b5d6fb64f0f4b88aa339f384fbd714344bbb
MD5 16b588c07c52752aa5b7c1d0f53be3eb
SHA1 065bcbc75f71714cbdedc9621cb62835a86ba045
SHA512 0cbe216463a215772c14b3cac7b750ef477d0c51e8a2829d920b609004b1e83852d2f5f06f3e448725ebcd2116997db64f1ddc974ee2c2684910beb82b224484
SSDEEP 12288:oeBNUbTVO86UwOytPT3pbwNCdmDFbzX78dRB00JvDvMqbtsSrfirRKAZFs7KJ/V:oJIUqtbpcNBw1FhtCrRhZV
TLSH
T11665CF3BEE28FCE2C27E8DB857918640A77278314F5293CBD165820EDE235D15E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 ef6fa986c39f3088eeaaf959948182c69c1ac2834637b37ad8f5a1551c44f3d3
MD5 b6056651995f927a560971ae3508f731
SHA1 8614b764ff772fd054808e426782055bafbc8cb0
SHA512 c0438b121196ecb2d9407e9ba1535170f558b4fe1c9503d9b3e2d6b5123948bbcd2dd66d31c062560c86474608d46eb08334bb752e5682c8b51803eb90589ac1
SSDEEP 49152:6QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJR9DN5J8NRV3THL:6QvGAdlCEL8c/RRNw5Cplc3
TLSH
T123266D656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 772fe20e6cf90cd739ba5a1fd09029969c9d8bdefcc20dfc9758e1f3c5b4fca2
MD5 cf8fa510b64e63cf97a4ddf1f5aceb09
SHA1 2110a935a6da368b133f825ea095b5a8195d867e
SHA512 c1569c6ca9fd47650a8a063c8dbf34888e13e4d7bf1bb1cf285b72c3e647e50c76b75062da91e565b120b5f226b27e10eff85d3f0ee5fe18cf50226d219edc7b
SSDEEP 12288:gAwSfxL/2Dc3DDLLmt0LDQewsAjqOytPT3pbwNCdmDFbzX78dRB00JvDvMqbtsSS:1SewsAjctbpcNBw1FhtCrRhZV
TLSH
T1BA75E031FA74E036C6BF0DB61B36C716183D79604F511AC3E3A89D8E5A702D26376A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 94b85dcbf6658a8d88f563f82cd67d334952960bba710ee215b689c536d93d47
MD5 818d272a15afec6a4bf9d779761e4f3e
SHA1 bae1ae4e7a42d87a4251752c47659beb931d983f
SHA512 60e4b8744e16d96d2b75827fd489b3ad65c8b40c4ab79eb3fd1859588f14a01aa640e76bad4513a4cd754b274dc479efcc4d371cc868280c2a87232f638703c2
SSDEEP 196608:2UEtQeTbvf2zlO12sJTv6Ja1cpVLyRIldPlbuJH:2UEtQevvqc2W1cpV2RI32
TLSH
T130474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 cbb1e0d6a3e5e43e59f9a7531453017d13b0d00b860cd1388d3843be907c122f
MD5 77a7dd5542779562ecf60938c2113d12
SHA1 e5d00a84b762016efc964d991171488ce776910e
SHA512 4c3fd4e69014bcefc9cdea0b9517c1388bab2e23e21712dfe648b102abdb5d0665bc74977d57257decc44895e089715f5c52047b66181eca671f07fc76ff8795
SSDEEP 49152:wCbRquA/m2yL5zQfFiV+XenmE3/z8tlcQQD:ZoqtVjnm1lc3
TLSH
T1B4D58D0976B8C2E4D1F6C77886A2C647F37178154B319BEF4266461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 d1d62c1e2710561a8f390e4514a5a984a69d357bcb3e18ebc50b2356c92cb10a
MD5 9b12e3ab427381886a97b63b75127b48
SHA1 8981049170bef700be791e650d1554401605ba55
SHA512 b917aa4b4a16279c4eb297b3c8a86d32e6e32fb6ece1743d1eaea96b85142fc5ab33192feca8350a3999d7b1a6029c64261023cc9b0e1ee5a6950e10842a0d39
SSDEEP 24576:MAhGL2IFoiwtA5l7S53ftbpcNBw1FhtCrRhZV:MAM1Foiq5PtlcQQD
TLSH
T1E6359D80E7F951D4F5B3AAB899B69571EA76BCA65E31C20F2160D10F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 6c63f4001d1b7b4ecbd15688b114ea509581c0898595755505f68b83d133e999
MD5 d356fabc30e10baa774c444e69b844f8
SHA1 adc49bd47205ae7accdf018956af509eafa957fe
SHA512 08e0bebc49aaec281728f8ca7acc84f16895d2aa97ae43358bced42becb4a1c597bea497b5c6fc87e1dc6b68b329f012a27cf85b5bddef59f1834e632d7a2676
SSDEEP 12288:Rmw5HEjsChNSBFgl0WDm+C7OytPT3pbwNCdmDFbzX78dRB00JvDvMqbtsSrfirR6:MwuXOWgtbpcNBw1FhtCrRhZV
TLSH
T14C65F14572A50CF9E9A7863886578536F7B3BC022925CB1F4760CA5B6F33351BD2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 732ef6742a2da2ee668ee7436118b4ecc653bb1df8d66425c6de533a33d42e6c
MD5 c0ed4f6fb0c9d1f8646a65d715010929
SHA1 7a26e256f5a2a6c902911d10a43f6fd9e9d380ae
SHA512 18f0f384f6f9cc60cb2b37de2abd08ef28ae86fc88d7fd58da96123f810fccd1b147b86f35c40299615896bce1d62f8b8e64dae1198e89dcb6a67f44e29f44bc
SSDEEP 12288:A/Z1IyaOytPT3pbwNCdmDFbzX78dRB00JvDvMqbtsSrfirRKAZFs7KJ/1:kZuBtbpcNBw1FhtCrRhZV
TLSH
T14255229922E461F5E1AB877CDAE10A46D7323893573503CF0A6199872F33AC69D39731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 72e2421a4bc0a956c9c87a70d20894cf71a3997d6840bcb0bf242b35976d5eab
MD5 fa51cefe08c95b78f71b09e22b1a3183
SHA1 95262e7e474d34bb3c88712ce19354eca619dce5
SHA512 f44f09263a1b06a2fa5c55d17f1d196429624bd48cce8853bf19a753317de85e0500ae6d3accd3f2fd8f6e4992c03a9a0c9ddec2669496e1925358e7fcaa5914
SSDEEP 49152:Ej8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGexAaLSF259ruMHwpXMi4FqJLd23U3:bQRQyi36YOcPhLvw2gAf+PN3elc3
TLSH
T106667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 961349356f703a5ca0b3789638ab408e1cb6b6ea8c725956edac7daa20190d8c
MD5 9abb074b8e6613cbd868b4b12347bcdc
SHA1 d10490aba88942ff12807e49936820d662218711
SHA512 a2ee7e51115cd48679b7d97f11ff9f02cb750764085c8beca37628ce7e065a42bd6617e16ce5dbfae8b27a97fd39203f9fad50fa5da227e50513e54583191691
SSDEEP 49152:3j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGexAaLSF259ruMHwpXMi4FqJLd23U3:GQRQyi36YOcPhLvw2gAf+PN3elc3
TLSH
T17A667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 5059ab941cd4388961374d26636fe362f27c9b0016b864ae52a4968d0f9d9615
MD5 e3a60128010a49191a66657f7f09412f
SHA1 f7de035fe7b74e8ad6b92acba57c2370a62e2d87
SHA512 32a00b69974d60a79c05155708ba8b9cbaa79e8df5e225ad0f99c9c663b416c1bd9c439a38985162c3d047a365e17f3604d6126a1cdfdf6306b374b0fa765c5f
SSDEEP 24576:zwvLof6SRQ+rn/fDboqxN1nnh6D7DaHGTNHu7PNU3/5W/ohL0xtbpcNBw1FhtCrr:L68Qg55nhceWu7PNU3/MtlcQQD
TLSH
T1ADB54933B2F600A9C44DE1769F4A972196D27C758FE0E3DB851172061FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 66d95a7c23bb313cf8c422cfe12609f286988fd417229310b8980a9f9c2797a4
MD5 50290263fc7fb7254c7b82baf3e9dffe
SHA1 a2a233bb7b54b9994806d4d41be7d6266870af76
SHA512 a9a74e3988b477b5f438e3dff9dafcc78da26f2e7761ba5498a0b00a19f798bfe26ab9232831bb954101db47d1d7ad66ac04eda3334a7e1d60c610df8dc0fa65
SSDEEP 49152:n3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbpN3Oh6tznm2FQ/nho2qkrk99R:Ky5112gYy5azzVva69nLKnhZXlc3
TLSH
T1D9168B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 b1a23bd7a56f2f9df88e44e649a42047050d853ae2074e9551f2b55765c5b824
MD5 2078367b72d9c8e16bbd214ba4efe29b
SHA1 cb2412057bc0d54ad760e7e253a27c6d9816c1ac
SHA512 3cfe5e64e66075a616953e34c24407d75ebf6bf759f8662d4c32b8f4f589b99474f1f45630ef8374238cf37cb7b6c76bbdf6c69b48b04bbd0f476f36a4e15d0b
SSDEEP 49152:8B+taZ3usBWOBr4tEG20bqx0z+n217aau1glmtlcQQD:Wu6JmUxd2dWlc3
TLSH
T1C0D59D13F1DA01E8D05ED578974A9233EA62BC490B34B6DF0A9073562E77EE4AB3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 2dbbe755f6ae19240a66e3046cc28977672192db9ea7e41de0cf5d5b32788c23
MD5 839c6a497d6e8a529d35e5360508d82d
SHA1 f610149ae5abc013829f0da6db41b783c2d7a42e
SHA512 7ba21ed7ba3b6b7dc0b5701af952ceaf5bbec71b195bcfd5b334d34a4c5133df5a8bba2e3deb1c417cd362e18859867ea55d2cf858cd1f1199b9263b4eacd7c9
SSDEEP 24576:Uhv8E1hps0+ogd2z615uCMVF1Agz6iUQ1zNOgLLwH7ReaQXx3atbpcNBw1FhtCrr:Y1hpsNoJpF1A6BU44CwH7R4xKtlcQQD
TLSH
T19DB5BE13F2D901E8D05ED17887569232EA62BC460B34B6DF0A90B7961F7BBE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 52d23d7bbf3fd14985d81f0e97d92f807bd9bcdcfcb4266766fef4cae1ddc9ae
MD5 095be8e92ce31bdac948a6f66f508d63
SHA1 057b89008c03f2d0a4945fb83a9908a27e05c8c6
SHA512 8450ff00a0fd888834d0661e3b5defac63e08871a41cc77dc56ad5e95fccd24f87797de4ffdc53dfb4e9a00d242d61d135a1ee0218924c0f40476264b44eb15b
SSDEEP 49152:0SuZQIY0Be2KNRVtOnks6NMHqBtlcQQD:m5dKvi61rlc3
TLSH
T14CC5BF03F2E941E8E0BED67887659232EA72BC464B34A6DF064072551E77FE09B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 f41f9452bc59c17ab6ad33cbd86849b174c6e862858db3a68e14f52d8ed5e294
MD5 28c5e5eb2e71aa00d3a7af7e75fd8cd1
SHA1 19eaa00391dbb021eb45f94154913f2164f172da
SHA512 7e4c17103f8e72c00e358c76c9d3299ac992644240847e30ae0b486a3465dc6c1701cb1aafb43c2cb437f1d0c5dc510cd210f25d675ca31eae8a7f088df4b8c7
SSDEEP 24576:IhiavrPSLT8EARn+FgyUgd0fJY6BXi3iy9CTn0AP5+2QLatbpcNBw1FhtCrRhZV:IhtSn8EApI0figXgiDn0AP5w2tlcQQD
TLSH
T12B95BE13F2D901E8D05ED178C7468632E962BC160B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 7034277f845f3975c30f208d01e9f73278e3271cb2d932644cc40f5f22500b4d
MD5 55b6b0d1cb842f2443d7b5c9eccf5bfb
SHA1 716eb168771f9cecf0c5fdd02a0a6a0d6322c88a
SHA512 da9b2bfbb4fecdcf16175426e30eeb206dd9c1290dff4464387f13383d4792b8a6228027d21f433bc44fbe98b00eec3f0fd39fe38745c3b515370f1eafd9ce1e
SSDEEP 12288:OtOytPT3pbwNCdmDFbzX78dRB00JvDvMqbtsSrfirRKAZFs7KJ/F:O9tbpcNBw1FhtCrRhZV
TLSH
T11D452354C06A82D2E55ECBFC636119DA652E3CD7CC8901C7EF56BC436FB1A4BE126870
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 c3137d7492e6008c6807c64545e7aebf88f848c6b71a9b6e8b6c8ffdd4a4623e
MD5 a0a366a2214d1b6fdd393ca0398ac251
SHA1 d66b15c7cc1eb9d98fd3cbde0521cad8ad99490b
SHA512 42df69a1ac02a95b740de11028fff75fb6675a0dec589599897a46f639d51d857e3e15ed972e4a7a5dcef5b54ef85635e995a1272d0adcee77f07c7373bc50be
SSDEEP 12288:yuOytPT3pbwNCdmDFbzX78dRB00JvDvMqbtsSrfirRKAZFs7KJ/F:yYtbpcNBw1FhtCrRhZV
TLSH
T1A9452354C06A82D2E55ECBFC636119DA652E3CD78C8901C7EF96FC436FB1A4BE126870
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 1b0fbb67f28ba01827c7c3b081537c7122fe6342417f3a3510d6e651ce993144
MD5 d6ba855b87a0c21e73bff159fbd7f85e
SHA1 8981e4f7f087fe8e0b9c76848a93050271e9c481
SHA512 abac693fdfe1008da77041a16187976ea292a9cabb36bf153f44fc5bd770acb97142afde2e5c65e7c735a6063a334d32428de1cc19496b6a9f2fe8a4c0e598ec
SSDEEP 12288:VIOytPT3pbwNCdmDFbzX78dRB00JvDvMqbtsSrfirRKAZFs7KJ/K:VytbpcNBw1FhtCrRhZV
TLSH
T147452354C06A82D2E54ECBFC636119D6652E3CD79C8901C7EF96FC436FB1A4BE1268B0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 4645bfdf369396db3509f8b4a0ee9dee4195a1f94c34a8e702e1d744acac8cc2
MD5 e772f29b8650d33920c9d55f0531981f
SHA1 6b5af4989285f5ca16a9f846e5a285e83cd91e22
SHA512 8229aa6f60389d8a1fc42ded778937e856f47214de7d06e6ffb0380884ba65c27c617fd9c2c0bddeda8f0a2fd8f21b05c49cc043171a7beac4d62f50d228bbfc
SSDEEP 12288:aVHOytPT3pbwNCdmDFbzX78dRB00JvDvMqbtsSrfirRKAZFs7KJ/6:4tbpcNBw1FhtCrRhZV
TLSH
T10D45235582AA82D1E86FCBBCD3611996A63A3CD3881502CFDF517C871FB178AE135E70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 a8aa9ea899922d8547f51fc95c320b2f258242b6160e5d9de2b63eaf007a906f
MD5 0f34e83f42290ee2523fb2218dbe31aa
SHA1 7f97f19b14d7d70f663eba0a1f330435a19b30a6
SHA512 bb335944d5f900c4f20319355e8bb77a6b22da9c4782f9836fc5114dbbdacfadcbd1afaabc9c185cb3e3f9dd7eafbac9212ff4c70ffbe5aba5d6882f479d3e2f
SSDEEP 12288:XvOytPT3pbwNCdmDFbzX78dRB00JvDvMqbtsSrfirRKAZFs7KJ/f:X3tbpcNBw1FhtCrRhZV
TLSH
T1C2452354C06A82D2E54ECBFC636119D6652E3CD79C8901C7EF96BC436FB1A4BE1368B0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 dcbd2d4c71ef91516ac1915944a3d7f2e94130b86224b9a1b96771081e78452f
MD5 659dfa04adf4a108b0694182cca3040f
SHA1 c65b5517c95a30226706273065b542c383fa572f
SHA512 d8ab29d4ef10328dd29ddd924c1ba7bbbaec69de590dc651046125ee363a8d4f0f91dfed2f237acb309ccf856166ebb20cdec5d49ea4aed3ce526a40cca6ed4f
SSDEEP 12288:wCOytPT3pbwNCdmDFbzX78dRB00JvDvMqbtsSrfirRKAZFs7KJ/r:wktbpcNBw1FhtCrRhZV
TLSH
T113452354C06A82D2E55ECBFC636119DA652E3CD78C8901C7EF96FC436FB1A4BE126870
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 229d479c529df525eda10fcb786dc6ac53f8bfacd866010764394eae8d0a311a
MD5 bbffb7abb8ca8a34708ee5482356217c
SHA1 6bf200294e557a732f71bdb570dbd7be1cd00c5e
SHA512 8bb92881bb247c9c89a8367cd633d9f020325d8d14a1d5ef26d29e5075a8b60ba1819dfcba17ec62c6402d20b88e64062da6d5054c618d029c3eb7e60dc577f9
SSDEEP 12288:v2OytPT3pbwNCdmDFbzX78dRB00JvDvMqbtsSrfirRKAZFs7KJ/T:vQtbpcNBw1FhtCrRhZV
TLSH
T16F452354C06A82D2E55ECBFC636019DA552E3CD78C8905C7EF66FC836FB1A4BE126870
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 4b92279a1a480d5969ff133f7122a2281ffadab7e70aa3a2dbb4b86e562539f2
MD5 3862c6cfa7e0ff5e1ef27646aedd00b8
SHA1 ddbd5a272782a1f01858b593392e73fd6762fd35
SHA512 eb5f31ad80e1a8e45ec4bd3f532b53156068c6f46f1afcb8425ab3db14a95fcd7c157eb71ac34189b471d1e2c9a2d0f1411b3fadbcb72c883f9a4ea1cc6a8bc1
SSDEEP 12288:IiZwbczzFEoS2cPvyOOytPT3pbwNCdmDFbzX78dRB00JvDvMqbtsSrfirRKAZFs8:LZMMzFVSO4tbpcNBw1FhtCrRhZVH
TLSH
T1E76502A4B3A018F4EC67827EC9218906D6B27C5A0A60C64F07F43A675F733915D3EFA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 d7c7a101a6815630162e99455d9caa1c1b2bf44af93ba1b0fbb41065cb5418aa
MD5 0e1ed10893834c1f1b700db08eb81f26
SHA1 efc40b61a6349598d786e0247b2ad4650c7e2ab5
SHA512 ceaebaf7ca78db92631c9672aee24149e0b873b7a5704821667089c2ae00702ebae6061af382396f3788eae01b91a3282ee1097ca886e85e66c90996c86045c2
SSDEEP 12288:rpOytPT3pbwNCdmDFbzX78dRB00JvDvMqbtsSrfirRKAZFs7KJ/F:rRtbpcNBw1FhtCrRhZV
TLSH
T1FB452394C06A82D2E55ECBFC636119DA592E3CD78C8501C7EF96FC436FB1A4BE126870
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 93c6fef424d1b668bd8baa2718751803619255c4b4c19eea014cc66b43e84e55
MD5 43c7038796a10cb68d307b4681eed067
SHA1 92d8f8fd51d13a4b987915073e657774b933f1e5
SHA512 8f7aa97a7cb60a3fab5d616f5c3c41abe756916e39fff695110497446d8eddb1d78e47ef50c1a2076e3b47b9c333488152d370eb362c4007788ca28e2e2ac053
SSDEEP 12288:UFOytPT3pbwNCdmDFbzX78dRB00JvDvMqbtsSrfirRKAZFs7KJ/F:UltbpcNBw1FhtCrRhZV
TLSH
T1F8452394C06A82D2E55ECBFC636019DA592E3CD79C8501C7EF56FC836FB1A4BE126870
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 407d82773d22cd7fff6b2ebbd1d04b36668101c2aae1f96977360ea25df427ca
MD5 6041ed6d7a04fa6650d5565500cd07d0
SHA1 2bcc12217ea8fa8cb85ddf6d87d8e7737f837bdf
SHA512 a4ea5a3a97c5d8b7a39f24b8ac2cc56e9c0229b2cdcdc6e7e1dd206c003f539ef2b012e9517303fc0ee4252fb51aa16cc76e991609474b77e6a33be9f2bf5fb3
SSDEEP 12288:iyPz5L8aOytPT3pbwNCdmDFbzX78dRB00JvDvMqbtsSrfirRKAZFs7KJ/a:/zystbpcNBw1FhtCrRhZV
TLSH
T18755120762A531F9D16BC378C9621A42F73678734B204ADF57A05A772F336919E3AB30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 736f0730938ec921c216b382b3e8f7e67fe0fdf5b7cea3152d6c68f2d0808b1f
MD5 6a160769b80c1120b4831241c7587c7f
SHA1 4c7ddfb8f8e2e24fd5f3b307f8e2e6ec98c9b95d
SHA512 6c61541c4d08e0c95ecd2379c8ac7b42a7bb5d157a4f8ec5e4730d28df441d532ad15c443f65fd8b2cfa34432a9d47f40179b5fe85a921f2b9fdd4b6aaaefb4d
SSDEEP 12288:ApOytPT3pbwNCdmDFbzX78dRB00JvDvMqbtsSrfirRKAZFs7KJ/I:ARtbpcNBw1FhtCrRhZV
TLSH
T141452354C06A82D2E55ECBFC636119DA592E3CD78C8901C7EF96FC436FB1A4BE126870
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 cd5fb9b63f24dc207d917bbf9176517bf4f5eee914702410182bbc5d044b130e
MD5 f76b0189752a5fd5dc823106360e680e
SHA1 1b5115c56fcf1acd8b93ff4a4a55b40857d1c271
SHA512 bbdcd06365537547952720f70c512bea329c9480bf2da676d15225cf07c92c32b5a3fa0e76ba3b99c7442da7251baf9a717a191e548d1d829de56aa1034273fe
SSDEEP 12288:QpOytPT3pbwNCdmDFbzX78dRB00JvDvMqbtsSrfirRKAZFs7KJ/I:QRtbpcNBw1FhtCrRhZV
TLSH
T189452394C06A82D2E55ECBFC636119DA592E3CD78C8501C7EF96BC436FB1A4BE136870
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 b7ac6a65b4c1334103faacdf066a78b82cfab902221f1f4a7a5d48edc43c460c
MD5 4825d42ac1ecff3fd21f42735cd7afd0
SHA1 30febc033f98bc5c6a7a6ed15d2bb40086220fbe
SHA512 ac6aa49c786d1fc8501477996a0a8a079b1b914c782aaf9139c307882362cbd3e7c1cdb9983b265d34b510f1a46f28e7cdc5d331aae5b14f75f72c5005512a4f
SSDEEP 12288:myPz5L8aOytPT3pbwNCdmDFbzX78dRB00JvDvMqbtsSrfirRKAZFs7KJ/y:bzystbpcNBw1FhtCrRhZV
TLSH
T1A955120762A530F9D16BC378C9621A42F73678734B204ADF57A05A772F336919E3AB70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 92bbc0e32bb9680f517b8cf3b0f9a35bad488b0b18a546e90ec8a6ec39072159
MD5 baa2c871932eb4241a1b452e767c3bd7
SHA1 b1e4ad472d8842c985166f55d707c447349743d9
SHA512 7a15ee831496ee86518dd2ba5094ac0d1c33fc101e3a77139799ebc062b44f2e704edf3a2e25a6d72780de2746c82fc82e6cca0695b16f11aafbd87f64883ded
SSDEEP 12288:oCd9MWYoaLHF3z0z04PDvhYOytPT3pbwNCdmDFbzX78dRB00JvDvMqbtsSrfirRw:xT9aLl3z0zDitbpcNBw1FhtCrRhZV
TLSH
T1D96501A4B3A018F8EC6B827EC9614946D6B27C5B0A60C64F07E43A575F333915C3EFA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 e43613f3dda790863915e79adf4911f649929fec5d6a7d25d8f016cc6c89dc7e
MD5 23f8b02d199587014cf6ca83ec1c93b2
SHA1 06d156f8b5c0f373afd6c27882de7dfd24cec6c9
SHA512 fd80d8177dedb72eac2c92791f50b59a70fc5b743e83b33160b23125d3c539a67f7f88b514d09cd8c3baff649637ab1b8a1a555132a9a49f75cd7c6ddc8fd4be
SSDEEP 12288:ii4e7oRdTfgwCHKy7GLbbdIvDOytPT3pbwNCdmDFbzX78dRB00JvDvMqbtsSrfi8:i3td9CHKy7GZetbpcNBw1FhtCrRhZV
TLSH
T12475CF90F3E410E8F0B7CA3989765512DA767C9A5B21CE8F03A4655A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 afc4ee24aff01e0c58d9fe17e43e5d52bebb0115d2daf76190f2fb0c3917ca3a
MD5 69cbf5b6378b9be24176d99b1b415c38
SHA1 31b2c87d3800bcb7e7c239cff1cfa0b939d4bc8d
SHA512 334a89ea75cbd47742e670402d1e0619fbbfcef6082217c8c26098db6cb90e5591404c63adb7fd4fadaa8382094121c166e7dfac57250b5bb15a070d38261651
SSDEEP 12288:ioOytPT3pbwNCdmDFbzX78dRB00JvDvMqbtsSrfirRKAZFs7KJ/D:iStbpcNBw1FhtCrRhZV
TLSH
T1FF452354C06A82D2E54ECBFC636119D6652E3CD78C8905C7EF96BC436FB1A4BE1368B0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 11f1a4e4b1c943c1ab4c3e9a41a0683be760449eb60e7614a72eea7c38e95ad4
MD5 c713b1cdfd10ff2bee54abb58a63793d
SHA1 1994fe0b3418ca38e8f65be03b43da3391a179fa
SHA512 c152465cfeee40057dcea9bf0cb390705174beef7d78f78000f4edf15b1e1648f2524632794fc4d0280f1dfc4b2aa96aeee9fec7cec55fa327334ae3b4f8a50a
SSDEEP 12288:e6OytPT3pbwNCdmDFbzX78dRB00JvDvMqbtsSrfirRKAZFs7KJ/7:eMtbpcNBw1FhtCrRhZV
TLSH
T181452354C06A82E2E55ECBFC636119D6692E3CD7CC8505C7EF96BC436FB1A0BE126870
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 be5d20a8c8c28208c9118a6b65c04535f7b6ee3737e985edf2bfed608b7c7a23
MD5 abcd024aa7fb48bd84e3a7f436980fdc
SHA1 6f6ba8040faba12502af93a6f9221e06612a302c
SHA512 be8ee5f734e798c4e25eac433d618c1a597e0847b5b199fa055f2579778e708e20d3a93c5c3a8d0f068b9dcdb3edd1ba0e49ad4218694efaa1b8dc8d36f76361
SSDEEP 12288:4DOytPT3pbwNCdmDFbzX78dRB00JvDvMqbtsSrfirRKAZFs7KJ/H:4DtbpcNBw1FhtCrRhZV
TLSH
T12F452394C06A82D2E55ECBFC636119DA592E3CD78C8501C7EF97BC436FB1A4BE126870
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 bcc4c06c2af26ea29127eb1d0270ef80bf471f4e978f0b637f6ac5a88eddf9b8
MD5 f85753c6823fcee89832200c76bf4d49
SHA1 ea5593e38552b83b4a70c404f626e6f51081a63f
SHA512 6f42440f1b4952876b34c4bc9ae0ba46f421051c842ab41da9aa70aef5a2d7a76016c713f3d02bc9fb0365d2302513175b8e1bfc11f9986adb6630004c7af838
SSDEEP 12288:SGsf5OytPT3pbwNCdmDFbzX78dRB00JvDvMqbtsSrfirRKAZFs7KJ/r:OBtbpcNBw1FhtCrRhZV
TLSH
T1F6550119C29842E8C06E9279C7514A81B3373C6687E183CB57D0F87E1F76685ADFAA13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 acebf78bc7e0e1ca72e736dc2117ebdf0f8a4589d688fb00c87839834d43298c
MD5 170d40c43a8860fc636568a39d12d3af
SHA1 426c9229fb92806b31ada7bceaf89349d57f13ab
SHA512 483623b959bfdb5d59bcf489ae0a728aa458479a10a2357226267b301243a182e1f0d615437cd7e6663d910c3f91636c829d08355b45cbae0f4424ed30df39ad
SSDEEP 12288:XdOytPT3pbwNCdmDFbzX78dRB00JvDvMqbtsSrfirRKAZFs7KJ/:XNtbpcNBw1FhtCrRhZV
TLSH
T1CB452355C1ADD2D2E5BECFF8232149A6262F38A78C4405C7EF52BC876F71A47E536820
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 8837bceda1fb3d5e6758bb4fa636ed92dd6fc83383a52269b919cf2b359f32a8
MD5 8c494934a47073c6631687ed68d5223d
SHA1 5ac3472ccdeb898be7da8a849e5e91bd9e1f15ab
SHA512 c99372041dea3cb86cc55be25053b3dc73c7798ca690233d257e09ca55d448cd28464b20bb168749bf82a73fe566e57a403d55a98ed4ef79e0f1a3e1a8eb6128
SSDEEP 24576:KoiQ0h2Hm7EkuAK3xV3tk3tLjN2VMbxR86mHx/YY/izSI2sBu9EzwwXg/bTtbpc7:Ka0h2GEkuAe73q3pp46zwwQ3tlcQQD
TLSH
T12785AF1E67EC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37DE84D3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 ff08b72b66c3fbc19229c5f1e583506a7e54b061aaa2cb57c9e2de44b3c1db2c
MD5 986ba7dc471c4c0c2e32b18892af8d58
SHA1 ea4eb8f9503bedbce6d0d00a4d01f5e75b86a79b
SHA512 61c9a3341ffc661eb3a1ef8e633404dab29fbbfb1109c2a0dd992f2f25ef4a40b6dc419fa36ba315504cc0088ed2127bf6a5acc48bdfe6f4c949d7c8daa90a3a
SSDEEP 12288:jhbHjfXkOytPT3pbwNCdmDFbzX78dRB00JvDvMqbtsSrfirRKAZFs7KJ/o:jhbHjP2tbpcNBw1FhtCrRhZV
TLSH
T13955127E12AC20D5F176D2BC92924A4AD332BC620B1143DF27D291BA4F37ED99C36E50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 9a05ee4779b777374b3b776c5d7bad5dad22cd071976c744939e3a1976e09172
MD5 2bef0f33c05fe7a012ab839ed3c2953f
SHA1 c1b76bc4e978d65c05c454571f319716cdd46431
SHA512 5a35f53e55b285c485d3219034b5cf1bca810a9305e1b7ef37db5428f0bdad5f41bc91a1ce88a26506251de10ba7bd112695a6e980609dcf7a095243c2d00f06
SSDEEP 24576:e3YgnJcRTk4yti+R5dBR/wtbpcNBw1FhtCrRhZV:eIgnaTk46pBR/wtlcQQD
TLSH
T11045BF2DF2B910F9D8AAD236450147B5FB71782E1F209ACB0170C538AF1AED89E35F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 0a8c2f43ac1c731bb4070e3b5aca45e4611e0a592d227adb3fc25a57af28b60d
MD5 bc4bc9cf7ea3cf1f8e72813f57596a85
SHA1 55cae6c230b31152ed06d2f06350139567bf6add
SHA512 e7edf76db38cfe693a51d7b7b1a37d1be081006809e93c4239c2b23dc126e174aa3821f9760fd11d99211beded48d2c559290268f187f520dc68d701114aa636
SSDEEP 12288:aBOytPT3pbwNCdmDFbzX78dRB00JvDvMqbtsSrfirRKAZFs7KJ/n:aZtbpcNBw1FhtCrRhZV
TLSH
T1E5452394C06AD2D2D55ECFFC636119DA252E38938D4501C7DEA6FC836FB1ACBE136860
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.5MB
SHA256 7235963c8611ebd4aa79026921abba939c982317e96ea185580a60d67083a48a
MD5 e57ebed512359a66b35fe063a3aa95fa
SHA1 d6b45b6cf11391cf406542db78f5c789b9875501
SHA512 953d55d2218d326713ed19509c05f5ae3b6de5adb16cc9fb360828d24b4d31470633549a5d0340db5ab9af8845413357f0bc052c143682c80ac1595fbed58a51
SSDEEP 12288:/ObvA4LWOsvAYFToOytPT3pbwNCdmDFbzX78dRB00JvDvMqbtsSrfirRKAZFs7Kq:ArL3UTStbpcNBw1FhtCrRhZV
TLSH
T14D750155E3A400F5E87BC23CC5628916E272789E0764E7DF07A84E561F637E68E3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 e4a3397482e0632f259c5703bf034c5c5fb7b3a464331d94c38ccc3a3338ab35
MD5 dfd775b7efa7ba1ac73d6f443b1cd767
SHA1 dfbeab700231ad9624e111fc69692cdfaddb4a5a
SHA512 ca915a036e69f1415bbff02a87eb479b4c832f925cc688291cc9244ecdc92b8a3bee225259023a80d61afc100e004c75b78eb7737ef1746f3d960b478bf63701
SSDEEP 12288:kpFtYOMOytPT3pbwNCdmDFbzX78dRB00JvDvMqbtsSrfirRKAZFs7KJ/l:/OOtbpcNBw1FhtCrRhZV
TLSH
T16855121932ED10E5E57AD27C8692424DD37278630B1207DF47D094AE5FB3FE8AC3AA61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 12a2ff13228d999f7527b687fbf31a952229e75d40af100b493fc71488252eef
MD5 2194a43b8b2a9fed5f60fae0c6b4fc57
SHA1 5ea20037dfd87ba64586738c02f8ba9e05b26fc6
SHA512 778ff3434e3c0d51d40f5ca71b3deb4efa447cf6ffd81f72a81c17ac56dd3e8e61d65e5d06bd6f5bcc61438fdfa8ac785b3359ce9d6f6351583b636dc9d0315f
SSDEEP 24576:L7NM9YqZqmWMUkPjZM48Mv6bEhsdtbpcNBw1FhtCrRhZV:L7cBWMpPjN8DbEhYtlcQQD
TLSH
T1DD65AE2E6BEC81D5D477D13DC9A28206F6B2B4611B318ACB5162833E7F37AE44E35721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 75a50147b36f57d1a941d6b115bc7cace3c41a32af752fd17d94b8e67f749847
MD5 9733e5aa7118d78768ccfc210ac612e7
SHA1 2fab534abdc59b0655941170fe506dcf93cd564a
SHA512 3fcbba5a75a35e2c90da8d82b6666a0e40f55ae6aa41a2221385e5a567a7c614625fa759abd381e304d2c7f252b8ccb49e6175146f4ff35c80c8015d088fc083
SSDEEP 24576:WW6BApg2YuyuNDYTabvcdvNYf8km1LtbpcNBw1FhtCrRhZV:WF2YuHNETovAvNYf8km9tlcQQD
TLSH
T12B858E2927ED80A4E0BBD27D45B6D246FAB2B8511B3056CF4255862E1F33AF44D3DB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 efca06986f179893be132b2e5571a929816c38939f52bc837ae24ffe24e93810
MD5 69534913be70986f1b7624826192e2b7
SHA1 06f7855c9422f88b084b20833c00cd51201efc6d
SHA512 36b9eaa0f2e0f50e95652cd8c73314ac8c2e10ff1858ad05b6a5c4383b4cee9b8bf3e80a55716031550b55eb66c98d546184868951a45c34b94c358beeae1ef4
SSDEEP 24576:zAFs06+OmlfQNXEbToatbpcNBw1FhtCrRhZV:8Fs060lcXuXtlcQQD
TLSH
T13765BF2F62AC00D5D07ED17D8A97C91AF6B1746307255ACB0260C63E7F6BEE85E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 f7514a85cd1a0660eb4d40afdf835fcbb52f236e7cab8cb0e12b2c269a596c13
MD5 6aeb216a7c67e843b0ce4f96b3ca6dfd
SHA1 a0cfedff1878876fad8655bb747fc5f1d20e3923
SHA512 2ad3375b66e7e718f08aa268acd5df733a61181f399a27799cade51b8f74ab1ae7395cb2eb49e9e813eff3a137564e834f8d04f44b6841e7455b457095c0b696
SSDEEP 12288:bCJnJ5D3VkrDzxtOytPT3pbwNCdmDFbzX78dRB00JvDvMqbtsSrfirRKAZFs7KJ4:WJnJ5D3WXXtbpcNBw1FhtCrRhZV
TLSH
T1D975D02DD2A810E4D4B7C3B4825A1B96FE72387D2F2269C728B4D5353F12EE09979F14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 a9d2e4c0e60bff42da80a8317ea0c7eb68c07c735111a0dd9300db1c89f8c2ac
MD5 812a33da7892d9af19d9d7729bcc9995
SHA1 08ed35c085a747cf58d2e8062ad11cbf0049454d
SHA512 d2e3eedbf86526ddc4aa450fea38a4b47d8fb1de99b001b2bd2bf2f23ce0cec0ec87700043b3a44aba5800f9788709fd7e227cbf3c8e1d29fc691299cfcf4a85
SSDEEP 24576:gEPghm6/7IIXdwcXrif7qQncjlP65i3VuwtbpcNBw1FhtCrRhZV:fg06DIKdwc+eQnSt65aVhtlcQQD
TLSH
T13E956C15B7EA5294E8B3CAB1CA6291169B327C509B34F7DF0AC0C92E1E33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 416f525abe582f18a9c61107324c91c98a6998759eaf7e15eb87f090774a2cbb
MD5 8bf4e344edc8070eb855ad1071a76efc
SHA1 7e28f921afc2b17868a3adfb9885b1a4ddfac1c0
SHA512 aa057dd1b58fc8c19098f081fb5a61f0a14dcca43b548f621896709c81ab4703cd858a9bd7d34b21efc8f5a3aa099365d0c02a32f4de55ae99eb0b5da5253b4c
SSDEEP 12288:xEP3RnxOytPT3pbwNCdmDFbzX78dRB00JvDvMqbtsSrfirRKAZFs7KJ/Q:inptbpcNBw1FhtCrRhZV
TLSH
T13555126D63ACA0E5D02AD27C82908645D332F0B21B4217DF5AE1D57E4F73ADAAD39E10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.3MB
SHA256 ed1f2c5fd5535d0fc6abd6d46e0fb458b8688fe5fadd6675e94090dddc55452b
MD5 e969cee9d32e01a509755d22ac783dd0
SHA1 9df5e6842e33dd771da8d78f2488bfc5cb3de9f4
SHA512 618008a630e8735ec551c40bbb6dcfeebec0e7b4f39dfe1bea0be67c40184e621678ebafa75d251b4ab29fd2bb336ae0c2f1f84aebb40d01272f41c981ede584
SSDEEP 12288:JjkyeOytPT3pbwNCdmDFbzX78dRB00JvDvMqbtsSrfirRKAZFs7KJ/B:JIyotbpcNBw1FhtCrRhZV
TLSH
T157551208939891D4E5BA8B7C967341D59A39BC229F1103CF9590FA2F6F72BC5E831F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 0c221ae0e872f8d7ef5e2c7c09ca41bd99a09f0863f029cf58d0ee5d93429990
MD5 e32b810e7366cf69947dd935213bf6ce
SHA1 13f2743bd14a85a363ecb625113f9e3374cbf308
SHA512 8136f444b4f140b3b912faaa95838c2a0f2ec8c4a361d69c2751d67b4909650bbe66d29d0562bd7d0451afcdeda1c37f124a9f6d7a3ae0262ddbddca82fce2f3
SSDEEP 12288:tycOytPT3pbwNCdmDFbzX78dRB00JvDvMqbtsSrfirRKAZFs7KJ/p:M+tbpcNBw1FhtCrRhZV
TLSH
T15845235C816AA2D5E95ECBFC53211ED6513A38A34D4405CB9EE1FCA39FB26CBE132C50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 ca46a25571cae35cfc936a2c6533b31100efd844523eb4dbec7197f3b5246aa2
MD5 beffa8635a1d2636123841c3929b636c
SHA1 1112c75338783ca74c55d016a5e39908bd1d0a90
SHA512 2533fd924e6dffe46a43c268feaccd8cc2e8afb15b18dfedcf63ecec7ec91f95108b19531398aec5697d8553404b85a07b70ea4d63983c6f4b3ea902ba0affcb
SSDEEP 24576:kQ9MxZKdcz9dw3ltbpcNBw1FhtCrRhZV:kVKZltlcQQD
TLSH
T1A8558D2DABE905DAE177D27995A250C3A633B4311B31C6CF2448D03D4D7BEE8AA74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 42a2a62e7c9ba7174434269e7bcb082e236d2d91d57acf34d55f54556f0629cf
MD5 414413f6298de7c1e570842b1a7dbae3
SHA1 20729cddc287019810d5d45427945550e24db402
SHA512 375421e4eefd2605c878ea967cd352c4779578b01c4a4654d86eb6737613273786427578dc701bf9f7d6290f14c443b98e95cc4ae2e4c4ac0425d8442d76086f
SSDEEP 12288:+yoKo2JRple9pCOytPT3pbwNCdmDFbzX78dRB00JvDvMqbtsSrfirRKAZFs7KJ/e:+yocDApktbpcNBw1FhtCrRhZV
TLSH
T1BC65E01FB76E40E2E066823C89818745E773B0715B6213CB6691C73E8F63AE9BD34B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 3d6bacf2af7f466b29ea461aa329fe2ca8003dcbf1c42216f8ba1dddea4e834d
MD5 edb7602761ca79ddc7e3144dc3321d1e
SHA1 f5cb827f3fe8dc9ab886dcf9e0ae1f953f8f7fd1
SHA512 265b76655e2f15d0d59a421abf607729e9e58a45a49179223efaf8aed799319bad85959ca3f841e3977316e9143dcdf48cfeb03a7466a0dd2b742ef4fc0e108a
SSDEEP 49152:xWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKktlcQQD:p0zuNIKlc3
TLSH
T127A57C3DA2BC00A9D8AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 486b5960015755e0e9044a820722d72fc477801cf4ec72244bd5e69d6552edd9
MD5 af926391dbe4ea048be8f7c211f403b0
SHA1 503006067346345f3d5bbe5baee448012e1577b9
SHA512 904f9e75bcdf95840b0bc29cbcc1df030c5266e41710efb06cd1fd90bac88a565e322a9ed12afb248d096589fa0224e7aae7cf5bc68d95292228a0fdd50349b9
SSDEEP 24576:v1QT7EcpfxR+N5AWAz3ooiYsjMqbptbpcNBw1FhtCrRhZV:STDxR+N5YzTujMctlcQQD
TLSH
T11B55B02EA7F915E9D17EC6789B238512FA727821033193CB42A0C17E1F679D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/224-506-0x0000000140000000-0x0000000140205000-memory.dmp

Download

memory/224-337-0x0000000140000000-0x0000000140205000-memory.dmp

Download

memory/648-333-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/648-457-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/964-241-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/964-13-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/996-327-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/996-439-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/1180-267-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/1180-282-0x0000000140000000-0x00000001401EA000-memory.dmp

Download

memory/1180-261-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/1180-326-0x0000000140000000-0x00000001401EA000-memory.dmp

Download

memory/1556-257-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/1556-252-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/1684-318-0x0000000140000000-0x0000000140221000-memory.dmp

Download

memory/1684-422-0x0000000140000000-0x0000000140221000-memory.dmp

Download

memory/1688-452-0x00000162C9040000-0x00000162C9050000-memory.dmp

Download

memory/1688-438-0x00000162C9040000-0x00000162C9050000-memory.dmp

Download

memory/1688-446-0x00000162C9040000-0x00000162C9050000-memory.dmp

Download

memory/1688-443-0x00000162C9040000-0x00000162C9050000-memory.dmp

Download

memory/1688-442-0x00000162C9040000-0x00000162C9050000-memory.dmp

Download

memory/1688-441-0x00000162C9040000-0x00000162C9050000-memory.dmp

Download

memory/1688-425-0x00000162C9040000-0x00000162C9050000-memory.dmp

Download

memory/1688-424-0x00000162C9040000-0x00000162C9050000-memory.dmp

Download

memory/1688-423-0x00000162C9040000-0x00000162C9050000-memory.dmp

Download

memory/1688-322-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/1688-428-0x00000162C9040000-0x00000162C9050000-memory.dmp

Download

memory/1688-427-0x00000162C9040000-0x00000162C9050000-memory.dmp

Download

memory/1688-444-0x00000162C9040000-0x00000162C9050000-memory.dmp

Download

memory/1688-454-0x00000162C9040000-0x00000162C9050000-memory.dmp

Download

memory/1688-456-0x00000162C9040000-0x00000162C9050000-memory.dmp

Download

memory/1688-430-0x00000162C9040000-0x00000162C9050000-memory.dmp

Download

memory/1688-431-0x00000162C9040000-0x00000162C9050000-memory.dmp

Download

memory/1688-432-0x00000162C9040000-0x00000162C9050000-memory.dmp

Download

memory/1688-458-0x00000162C9040000-0x00000162C9050000-memory.dmp

Download

memory/1688-460-0x00000162C9040000-0x00000162C9050000-memory.dmp

Download

memory/1688-455-0x00000162C9040000-0x00000162C9050000-memory.dmp

Download

memory/1688-433-0x00000162C9040000-0x00000162C9050000-memory.dmp

Download

memory/1688-461-0x00000162C9040000-0x00000162C9050000-memory.dmp

Download

memory/1688-462-0x00000162C9040000-0x00000162C9050000-memory.dmp

Download

memory/1688-463-0x00000162C9040000-0x00000162C9050000-memory.dmp

Download

memory/1688-459-0x00000162C9040000-0x00000162C9050000-memory.dmp

Download

memory/1688-447-0x00000162C9040000-0x00000162C9050000-memory.dmp

Download

memory/1688-449-0x00000162C9040000-0x00000162C9050000-memory.dmp

Download

memory/1688-321-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/1688-453-0x00000162C9040000-0x00000162C9050000-memory.dmp

Download

memory/1688-434-0x00000162C9040000-0x00000162C9050000-memory.dmp

Download

memory/1688-426-0x00000162C9040000-0x00000162C9050000-memory.dmp

Download

memory/1688-436-0x00000162C9040000-0x00000162C9050000-memory.dmp

Download

memory/1688-451-0x00000162C9040000-0x00000162C9050000-memory.dmp

Download

memory/1688-445-0x00000162C9040000-0x00000162C9050000-memory.dmp

Download

memory/1688-450-0x00000162C9040000-0x00000162C9050000-memory.dmp

Download

memory/1688-437-0x00000162C9040000-0x00000162C9050000-memory.dmp

Download

memory/1688-435-0x00000162C9040000-0x00000162C9050000-memory.dmp

Download

memory/1688-429-0x00000162C9040000-0x00000162C9050000-memory.dmp

Download

memory/1688-448-0x00000162C9040000-0x00000162C9050000-memory.dmp

Download

memory/1752-90-0x0000000140000000-0x000000014022D000-memory.dmp

Download

memory/1752-85-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/1752-74-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/1752-68-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/1752-32-0x0000000140000000-0x000000014022D000-memory.dmp

Download

memory/1856-330-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/1856-440-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/2076-420-0x000000000C990000-0x000000000C998000-memory.dmp

Download

memory/2076-396-0x0000000001A30000-0x0000000001A40000-memory.dmp

Download

memory/2076-380-0x0000000001780000-0x0000000001790000-memory.dmp

Download

memory/2076-412-0x0000000009E70000-0x0000000009E78000-memory.dmp

Download

memory/2076-341-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/2076-507-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/2400-417-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/2400-301-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/2400-302-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/2400-295-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/3228-87-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/3228-91-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/3228-57-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/3228-65-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/3228-63-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/3232-279-0x00000000007E0000-0x0000000000847000-memory.dmp

Download

memory/3232-274-0x00000000007E0000-0x0000000000847000-memory.dmp

Download

memory/3232-283-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/3300-314-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/3300-307-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/3300-419-0x0000000140000000-0x0000000140241000-memory.dmp

Download

memory/3300-313-0x0000000140000000-0x0000000140241000-memory.dmp

Download

memory/3764-418-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3764-340-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3764-288-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4020-245-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/4020-83-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/4020-89-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/4144-285-0x0000000140000000-0x00000001401D4000-memory.dmp

Download

memory/4180-243-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4180-35-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/4180-44-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4180-41-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/4348-34-0x0000000140000000-0x000000014022D000-memory.dmp

Download

memory/4348-29-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/4348-1-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/4348-0-0x0000000140000000-0x000000014022D000-memory.dmp

Download

memory/4348-9-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/4452-17-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/4452-26-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/4452-25-0x0000000140000000-0x00000001401E8000-memory.dmp

Download

memory/4452-242-0x0000000140000000-0x00000001401E8000-memory.dmp

Download

memory/4524-52-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4524-244-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4524-46-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4524-55-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4572-325-0x0000000140000000-0x00000001401F8000-memory.dmp

Download

memory/4572-256-0x0000000140000000-0x00000001401F8000-memory.dmp

Download

memory/4860-414-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/4860-292-0x0000000140000000-0x00000001401D5000-memory.dmp

Download