379338cfa75ae3188f8806475c274dc9dd4cab005cda9bc23388f6f590e1fdd6

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/07/2026, 00:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-19_b8f1e9a1fafdfa3fc5b1c6b1e1d94293_icedid.exe
Size 816KB
Sample260720-a2na8aat6j
SHA256 379338cfa75ae3188f8806475c274dc9dd4cab005cda9bc23388f6f590e1fdd6
MD5 b8f1e9a1fafdfa3fc5b1c6b1e1d94293
SHA1 782ba4213f2e289e1b04b23a1344b7143310fb15
SHA512 e5dbbdf4d31c94dc7237db41dc2f543b7e83be09c01fcf7d9ac51af27c10dff8dcf76f6a15365db628ce42c5bce24c85dae985a9a865d34510f4a70fe6ce0888
SSDEEP 24576:XAhY35SSiVw6uAX8DS52tpz9ZRzbPmSZyo:Xl5SW6H8DS52tdDpbRZy
TLSH
T1DD05E0567B5090F6D0650D318661E76D9325B869C8074F6B36A07ECFFFF2AC28E25A30
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
2100	alg.exe
4308	DiagnosticsHub.StandardCollector.Service.exe
2132	fxssvc.exe
4172	elevation_service.exe
1996	elevation_service.exe
2064	maintenanceservice.exe
3632	msdtc.exe
3940	OSE.EXE
4076	PerceptionSimulationService.exe
4764	perfhost.exe
116	locator.exe
3796	SensorDataService.exe
4164	snmptrap.exe
2964	spectrum.exe
5080	ssh-agent.exe
4728	TieringEngineService.exe
1452	AgentService.exe
572	vds.exe
4432	vssvc.exe
4020	wbengine.exe
468	WmiApSrv.exe
1732	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 38 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-19_b8f1e9a1fafdfa3fc5b1c6b1e1d94293_icedid.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-19_b8f1e9a1fafdfa3fc5b1c6b1e1d94293_icedid.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-19_b8f1e9a1fafdfa3fc5b1c6b1e1d94293_icedid.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\1424a07c2d44b5a9.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-19_b8f1e9a1fafdfa3fc5b1c6b1e1d94293_icedid.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-19_b8f1e9a1fafdfa3fc5b1c6b1e1d94293_icedid.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-19_b8f1e9a1fafdfa3fc5b1c6b1e1d94293_icedid.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-07-19_b8f1e9a1fafdfa3fc5b1c6b1e1d94293_icedid.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-19_b8f1e9a1fafdfa3fc5b1c6b1e1d94293_icedid.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-19_b8f1e9a1fafdfa3fc5b1c6b1e1d94293_icedid.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-19_b8f1e9a1fafdfa3fc5b1c6b1e1d94293_icedid.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-19_b8f1e9a1fafdfa3fc5b1c6b1e1d94293_icedid.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-07-19_b8f1e9a1fafdfa3fc5b1c6b1e1d94293_icedid.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-07-19_b8f1e9a1fafdfa3fc5b1c6b1e1d94293_icedid.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-19_b8f1e9a1fafdfa3fc5b1c6b1e1d94293_icedid.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-19_b8f1e9a1fafdfa3fc5b1c6b1e1d94293_icedid.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-19_b8f1e9a1fafdfa3fc5b1c6b1e1d94293_icedid.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-19_b8f1e9a1fafdfa3fc5b1c6b1e1d94293_icedid.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-19_b8f1e9a1fafdfa3fc5b1c6b1e1d94293_icedid.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-19_b8f1e9a1fafdfa3fc5b1c6b1e1d94293_icedid.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-07-19_b8f1e9a1fafdfa3fc5b1c6b1e1d94293_icedid.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-19_b8f1e9a1fafdfa3fc5b1c6b1e1d94293_icedid.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-19_b8f1e9a1fafdfa3fc5b1c6b1e1d94293_icedid.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-07-19_b8f1e9a1fafdfa3fc5b1c6b1e1d94293_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-07-19_b8f1e9a1fafdfa3fc5b1c6b1e1d94293_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-07-19_b8f1e9a1fafdfa3fc5b1c6b1e1d94293_icedid.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-07-19_b8f1e9a1fafdfa3fc5b1c6b1e1d94293_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-07-19_b8f1e9a1fafdfa3fc5b1c6b1e1d94293_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2026-07-19_b8f1e9a1fafdfa3fc5b1c6b1e1d94293_icedid.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	2026-07-19_b8f1e9a1fafdfa3fc5b1c6b1e1d94293_icedid.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-07-19_b8f1e9a1fafdfa3fc5b1c6b1e1d94293_icedid.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-07-19_b8f1e9a1fafdfa3fc5b1c6b1e1d94293_icedid.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	2026-07-19_b8f1e9a1fafdfa3fc5b1c6b1e1d94293_icedid.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	2026-07-19_b8f1e9a1fafdfa3fc5b1c6b1e1d94293_icedid.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2026-07-19_b8f1e9a1fafdfa3fc5b1c6b1e1d94293_icedid.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	2026-07-19_b8f1e9a1fafdfa3fc5b1c6b1e1d94293_icedid.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-07-19_b8f1e9a1fafdfa3fc5b1c6b1e1d94293_icedid.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	2026-07-19_b8f1e9a1fafdfa3fc5b1c6b1e1d94293_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-07-19_b8f1e9a1fafdfa3fc5b1c6b1e1d94293_icedid.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-07-19_b8f1e9a1fafdfa3fc5b1c6b1e1d94293_icedid.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	2026-07-19_b8f1e9a1fafdfa3fc5b1c6b1e1d94293_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-07-19_b8f1e9a1fafdfa3fc5b1c6b1e1d94293_icedid.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-07-19_b8f1e9a1fafdfa3fc5b1c6b1e1d94293_icedid.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	2026-07-19_b8f1e9a1fafdfa3fc5b1c6b1e1d94293_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-07-19_b8f1e9a1fafdfa3fc5b1c6b1e1d94293_icedid.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-19_b8f1e9a1fafdfa3fc5b1c6b1e1d94293_icedid.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000043d988b7e017dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000108e4b1e017dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000462e0ab2e017dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000056905b2e017dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e3eba9b2e017dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bdd6b5b2e017dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a48d4ab2e017dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f7db58b2e017dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000beff9db2e017dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000532febb1e017dd01	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4308	DiagnosticsHub.StandardCollector.Service.exe
4308	DiagnosticsHub.StandardCollector.Service.exe
4308	DiagnosticsHub.StandardCollector.Service.exe
4308	DiagnosticsHub.StandardCollector.Service.exe
4308	DiagnosticsHub.StandardCollector.Service.exe
4308	DiagnosticsHub.StandardCollector.Service.exe
4308	DiagnosticsHub.StandardCollector.Service.exe
4172	elevation_service.exe
4172	elevation_service.exe
4172	elevation_service.exe
4172	elevation_service.exe
4172	elevation_service.exe
4172	elevation_service.exe
4172	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
672	Process not Found
672	Process not Found

Suspicious use of AdjustPrivilegeToken 39 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	764	2026-07-19_b8f1e9a1fafdfa3fc5b1c6b1e1d94293_icedid.exe
Token: SeAuditPrivilege	2132	fxssvc.exe
Token: SeRestorePrivilege	4728	TieringEngineService.exe
Token: SeManageVolumePrivilege	4728	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	1452	AgentService.exe
Token: SeBackupPrivilege	4432	vssvc.exe
Token: SeRestorePrivilege	4432	vssvc.exe
Token: SeAuditPrivilege	4432	vssvc.exe
Token: SeBackupPrivilege	4020	wbengine.exe
Token: SeRestorePrivilege	4020	wbengine.exe
Token: SeSecurityPrivilege	4020	wbengine.exe
Token: 33	1732	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1732	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1732	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1732	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1732	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1732	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1732	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1732	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1732	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1732	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1732	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1732	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1732	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1732	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1732	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1732	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1732	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1732	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1732	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1732	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1732	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1732	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1732	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1732	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1732	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1732	SearchIndexer.exe
Token: SeDebugPrivilege	4308	DiagnosticsHub.StandardCollector.Service.exe
Token: SeDebugPrivilege	4172	elevation_service.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1732 wrote to memory of 2512	1732	SearchIndexer.exe	111
PID 1732 wrote to memory of 2136	1732	SearchIndexer.exe	112

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-07-19_b8f1e9a1fafdfa3fc5b1c6b1e1d94293_icedid.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-19_b8f1e9a1fafdfa3fc5b1c6b1e1d94293_icedid.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:764

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:2100

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4308

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:1844

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2132

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4172

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1996

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2064

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:3632

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3940

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4076

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4764

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:116

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3796

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:4164

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2964

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5080

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4728

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1452

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:4128

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:572

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4432

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4020

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:468

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1732
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2512
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:2136

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 31991e80a40d9224c01403fdea743bd360256c2cea7c18dc300128dbc56e732e
MD5 06ceb7dd93e268353073624a9e9edfa8
SHA1 310cc29dd5017bc945094cf0665034e029ddd4f6
SHA512 04a912ddb299f05286f7e6e170cf30bd3350dd931c51d629273062acc0c1ff0db96becf94f24937a65ee93e438f92083c9942031f75dddf18337c83c33d76006
SSDEEP 49152:hb+632BuPkFKRrdE6ohmstBhuXjfS4LWxn15SW6H8DS52tdDpbRZy:n3q6HjB05SSDntdDpbRZy
TLSH
T1D9D58D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 4e534fc29b2bf78467ed67bccef97e959fdc38ecfcec7c3c70c722eed73a13c9
MD5 7b4ccd2da023cb7dbe8b5eb4b69b3ba0
SHA1 00e0e5a39b88d99de8f025dc33ebb62cce4f5704
SHA512 0a26fd0b66dd9f4d4cdb92c5d7996ded9e6589f1ac5a23e4e92ddf25ca333bacabcddb37eb9060e12c9af7dbe3d233fbeebda9d6bf42831427a0677c8d4717b5
SSDEEP 24576:fXYfDtczAY5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:qtcX5SW6H8DS52tdDpbRZy
TLSH
T12A05022873D008FAED6B8279C8B28511EA33B8954760E79B03F495664F337C95E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 421fc7e9ec455717c5fa48f0a3c1f8f80a9c0857295f7a8cc530772fb33018da
MD5 4e2c4f936d2df2fa6ad2b197eb8789f8
SHA1 e72959787bc6d43092845212794c0be10c1b13a5
SHA512 25dd3a0cf2bc8dd3a222f3fa7c71ad1ebfbcc90f1a42223aa395ad8fa5f88029852e904c86d63eb0ccb92fcf4297dd6636804936e55a858736855af4a9804ff6
SSDEEP 24576:H0Le5ji0hmxirMN5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:HPji0Ac+5SW6H8DS52tdDpbRZy
TLSH
T182359E15F6748332D073C0BAC5D2A69EE971308657308ACB4286D77C7F67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 5ffa8d8a619cc0c3929e88228570563312e79c12f39e96f75eee0a7aa3100890
MD5 ca54d967c39695f2eb763f98d6248483
SHA1 441a69a49c727fe66662efdaf72a514f806a09ed
SHA512 8b289734b14b3a1ccecdda462fe77547b4963625c66e7eb0c1d34374590203ca66ef3bfbd9766223594d93959318713ed1ab3bbac47e9ef784a49e47d89780f6
SSDEEP 24576:Oa7/ezSC6vUyD/aqgrvWE6q8wyun5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:J/ezSC6vUzPvxHjyy5SW6H8DS52tdDpO
TLSH
T1D8755C15F5788323D0B2D0BAC5D6BA9AFE3230465B3089DB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 287de30cb89b3421f2b3c6e107a63232a7991c215bc9a64da022200cb9aaf508
MD5 94d259176f34389891324d4131cfea43
SHA1 62fb3bd49df51ffd9d4ee7e5e72e0de6c39bae4d
SHA512 373ba93c0e3fd04098920a27e40bd2794bbb0851a8c1fc650be52c4c72a473816811355ebb0cb66043753901209eac543b097e87d5dec79e20c71f55f2b8088f
SSDEEP 24576:YVbqPb88hv/l+6E5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:YVO88hXl+R5SW6H8DS52tdDpbRZy
TLSH
T1CF559E65F6748331D073C0BAC5D3AA9AEE3234425B318ACB1246D76C2E67BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 e34f581e5d91a36f503974484e872bdf637cc25772cba8a72d5a59f856d8d099
MD5 a377f5a7fe9edd5f3569be717df2b585
SHA1 bccb86ba2a0b195389f6a2de29df0ae999891218
SHA512 af49b1d655ab7dde9a2e9c00673e08cb14ef5d2b2f547b2554eff7ab12d74fd2579c3d36ae788bacba1441cffa0debb3a270820f22ef0df61b80c4829db8a9e6
SSDEEP 12288:ZR55OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6:ZR55SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T1D6C423C4479030E7E71F0AB3B1FA96E5DA18DDED8408553B4E71B687CA3998FC672026
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 1aed225f7c81bbb28eb83b3172d811585febe6f847a8bb90f5af1bf45a976b67
MD5 b3c13d3b860c941f22ba555e4947ffab
SHA1 fe232d7ea21c623e4168afd0136d7cd3b352df05
SHA512 acb6e85b574650d49f40a37c0ecb507f4ed74c9987f9a3f0398712d10208ac0da2f9a2d40fcc0dbfdc667cd20583062c8b0f050108ad27607057d3ef49567b38
SSDEEP 24576:DJIUc5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:DJIUc5SW6H8DS52tdDpbRZy
TLSH
T1F505DF7BEE28FCE2C27E4DB956918640D77278704B21A3CBD175820EDE235E14E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 149da8ff2c389158d9236a6cfb34620f7949f46e4c4838cc8c950597d6597091
MD5 cdce13f7caea93c5a8a8c08be38f25ed
SHA1 b5fc5933ce5cdb72f2f6e88f5dd46e2051474d1c
SHA512 6d245c42fe80c8e47fe0a795de0681f54836da865b0096054dff6659a298b8f70967bf8b7ad30af20387e45bc6e06a967cf3415177f6bf430d2fd32826b23f59
SSDEEP 98304:+QvGAdlCEL8c/yRNw5C35SSDntdDpbRZy:PvyEYc/y3w8JSintdDFRo
TLSH
T1B4267D656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 5d96f8f3fc2d99e09ca39f0bd58e936455347b1f30843c83679dd000f0e58314
MD5 4f7610ceb94e383ff34ffaffb5bdd986
SHA1 ba11f9fd7e6b61d5c59ea7e84ee04485b6356eeb
SHA512 8cd4d167e5dfbe6e87978810cf7b004352ca835a8173ef8bcd2c7b3b61c40b0e0f7f3ec0575489ce39881de9ea3f279d1abee82923e2d1c019cbccf8ebc71e99
SSDEEP 24576:/dewsAjO5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:lljO5SW6H8DS52tdDpbRZy
TLSH
T1D615E030FB74E037C37F0DB21B76C716582CB9604B511AC3E3A89A9E59342D26776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 18811dbe0f11a8ba0ef7c5724c9494f6b5295d0a82caabfe114db87556bb951f
MD5 f7d26efe973c29bcde4a70edd3c4e125
SHA1 d5f2c5b3312a37a139cfa965b8291a04ba601572
SHA512 be3e60aafd6da811664696890f5cc7705a6fda0d37edb20af3c6f59c7d7c7366b7c8c66a599787e3f0c7e1f5b9f8a4834045f635d2eaed3318983121921a208f
SSDEEP 196608:VUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHsSintdDFRo:VUEtQevvqc2W1cpV2EI32pedDFRo
TLSH
T107474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 92852e3fa0155679c3ef0eebf57ea3ab99285879f34cbf156ee8d9d88d87a090
MD5 5c39eeea33513dd32ca50e4452a67812
SHA1 1c786c2b5e0757b1f3ac04a2fbd89ece0518982e
SHA512 ade7cb9294f1da0ab288a88de49a9901547ea9772446c8a35e41a1d504c07191e75c2c079d4191ec496ef38bea7741b9347619f75581b9bb23f7a9bf7d3797c0
SSDEEP 49152:ECbRquA/m2yL5zLfFiV+XenmE3/zu5SW6H8DS52tdDpbRZy:Noq2VjnmL5SSDntdDpbRZy
TLSH
T1DDD58D0976B8C1E4D1F6C77886A2C647F37178154B34A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 4ef20bce1b5aba8ead2f539faf34a676b6fc71dbd39aa5343da869185c237dda
MD5 38ed8717c61cc0b69b1d19846f32bb1d
SHA1 72c77b6dabfc5c018e87a3f513abeab28481a770
SHA512 06b24eff583c711dcc164001478a6dfe982dd990942cdccf1b9df88647dfc9aa989397da1353eb8f552650a0a3ef1055413567b8839810980322a2431085fb17
SSDEEP 24576:sAhGLJIFoiwtA5l7S53r5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:sAMyFoiq5b5SW6H8DS52tdDpbRZy
TLSH
T19B35AE80E7F955D4F5B7AAB899B69170EA76BCAA5E30C21F1160D11F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 36bb328cfcf613e023acbdddbe6ef58dd52d814105dfd498226773a66f733a90
MD5 8872e4c5ffa76dd65816f0133715e3d4
SHA1 e325210f319040a0d39b4cef3e191c8aa1fec9d9
SHA512 b7956d7424466ecbf38dd7a948c012cc570eac834ffe13b1a088bbed64d4548ec83a1c0a7696e0551fc222018c90a570f13234a7d84298e9a81cb6763a0055ef
SSDEEP 24576:0wuoOWS5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:0wDO/5SW6H8DS52tdDpbRZy
TLSH
T1A705F14533E41CFAE96B4239C597C136F7B2B8162A24D72F0760C65B5F37252AD3AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 91ccc8071d9ba8a3e7b4228750d197df0339deee7ef8699f5dcc61de50e59e2b
MD5 04b0f12d303fad2a3203b9c396f1dbd6
SHA1 b17daf4167f6fb8e32eda2266d678c4909771457
SHA512 5c0ae2b918f20eb8380b3eb62a9b6184a871da92e7546650c5d7bffc70bf603a7ada3880dc716b3ab7ebb227f35b7609a05d14cc28cb53a49cc0096cf468f082
SSDEEP 12288:ZBZ1Iye5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6:3ZuF5SSiVw6uAX8DS52tpz9ZRzbPmSZP
TLSH
T16AE4128923E430FBE25B427AD9F54685D731B4AA533443DF0A61429B5F33AC64E3A732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 ea40a26df1bf8627175dcd17c3508571c1a491301b8477366eb57ba2d4fea5e0
MD5 9760363c9dbae772043505d02a23bf23
SHA1 b78238bb1b132f34edb37de5d4eda8978b47c6b9
SHA512 cf344609cf58eb22f5a2f1de42d46879cb332d90463d49cf2f8b362c4e37b5bf55ffbabb5ac0e5f8945660bdf4db214e48377d90a8f626587999001817257c91
SSDEEP 98304:WQRQyi36YOcPQLvw2gAf+PN3Q5SSDntdDpbRZy:dQyiKayX+PNWSintdDFRo
TLSH
T11F667C43F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 b9d9d67448e80d0ef9d670f23860dc30f7f16ab405397610a9c67efda0a5142b
MD5 b09caf2c1f02cf438448390a8186b032
SHA1 9038d3e5f86d9abe950a2dfd75e8a4fc36d97cd1
SHA512 f748e8ab1a8b3ed4fa57d7958c825d42ef29990ab738ba7aa2d97f4b387007279f3d32d21eb829ec374eea471fb119783378e0d874329d60b54b50ff2591103e
SSDEEP 98304:3QRQyi36YOcPQLvw2gAf+PN3Q5SSDntdDpbRZy:mQyiKayX+PNWSintdDFRo
TLSH
T127667C43F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 143340ca2f6dabeca6b21fc8bc198669f139740d1bb6eabecba8741dce0e62e9
MD5 c782c2e0faa0c597ab49923d9f03bdae
SHA1 0f5f13dfa6210596a85f43efa6a31b594cfe7fcd
SHA512 15698a0680e141df9560dd8e45b56e9dfdae330b46ba60edcfa02e4f677e6751f7a6ad22d2ad6c1176d2a27eb6efda54c258a7feb38702877a22a67dd88eea90
SSDEEP 49152:h68Qg55nhheWu7PNU3/+5SW6H8DS52tdDpbRZy:fthWRc/+5SSDntdDpbRZy
TLSH
T1FCB54933B2F600A9C44DE1769F4A873196D17C758FE0E3DB8551720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 eaac720604df8c8316009ddfef0c595b44f0939b465427ad8584479240797eda
MD5 010c48ae16faa2cf6e605c18912f56b6
SHA1 c54f5a59801aaa8366e402b7d82667cd70d03408
SHA512 92512d8bd94fb53ea4c503d72b1ecdfc08fdd25285c675a5a42d23c3c8a4828edd450a27957d666932d14eaab7df6256f00ee3a5befe0dabf3d5ace74120005e
SSDEEP 98304:py5112gYy5azzVvL69nLKnhZ55SSDntdDpbRZy:ELIHmWhlSintdDFRo
TLSH
T182167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 4a3bdaa4cb9176fe7c2211d290dbb99743aaa6ce136049dc2240753e4a8d11a5
MD5 5dc9846fd154fea11ffb345ef6cd6192
SHA1 d186b41c54f41195f375936ed54e7e5faf635f8a
SHA512 a8f98a22f6240a0bc49639486a497dbc3457130649d9ec472bd4d5d57ab8059ad8746146948c344b4c449785655775f1c830e97bbb9783734b65ffa0e04f6919
SSDEEP 49152:/B+taZ3usBWOBr4tEGT0bqx0z+n217aau1glI5SW6H8DS52tdDpbRZy:Bu6JmVxd2dI5SSDntdDpbRZy
TLSH
T1A8D59D13F1DA01E8D05ED479974A9233EA62BC490B34B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 36a1595c4e5032e41d101dd44e7d22f9ae01ef0410ebc4f5ceedec56a836bac8
MD5 66ac31ff9d3cefa26f44dd25a36ecebd
SHA1 6de2b1973da4fe4634d3d8ce0cd1138a3e2ec6f5
SHA512 83968fa60de9f4dcba4987ef92e178c0a3e81b0fb16acc61a11564388b6d84c54bb3f57a02c6ba199871b856555855ed2cf4b8dea0c959a74c4b85cfac0c9a5a
SSDEEP 49152:K1hpsNoJpF1A6UU44CwH7R4x85SW6H8DS52tdDpbRZy:KmifPbRL5SSDntdDpbRZy
TLSH
T1DDB5BE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 8ba9900d7b24732b2f2e928d943d510175b26ca3adf380a9b1e3f86020de84ca
MD5 cf3661c54d67baed17cefaa93e2956cb
SHA1 e1bab219f1ddecc44ce5cf23b0057604eb4c7140
SHA512 2afbf58045b6cbd3d50ead796a5b613615245b0a59845fa5ec0c2ae24a4f85a452b1410249336fd2894370aca324aacdea15030d6cc00ce364dfbaf6e712739c
SSDEEP 49152:oSuZQIY0Be2KRRVtOnks6NMHqF5SW6H8DS52tdDpbRZy:y5dKTi61F5SSDntdDpbRZy
TLSH
T136C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 f1a2adbef33e006efe72eb53002b1b1db070a09f1b0f2ca7859f7af5175afbca
MD5 da0834a3fbd6eb143cde11462a302f21
SHA1 6445832b8616715a8014ce498cf2656d0d19d20a
SHA512 a40250efbf557c389ab21f72793363c346e7f2f2a39ca965750f9ff6033bd477a4869df78df502cb614da3998e9f4a8d4b2d95c41383e29462e993528519f9d1
SSDEEP 49152:ThtSn8EApI0figngiDn0AP5wY5SW6H8DS52tdDpbRZy:SX2iyphf5SSDntdDpbRZy
TLSH
T1E095BE13F2D900E8D05ED175C7568632EA62BC160B38A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 0202fe95eb1c2d1265481132f7ce4e66522456af8bb719917487211d50e8aa12
MD5 649dc1b79739f04c1fdc89ff0cdb83f8
SHA1 ac0515d41de9201cb6f50d6fa7459efe4908d81b
SHA512 01d9a5a1cb5311d775169b7cd0210b695ea50943c8fac6fc80b9c83a5a18cc16590bf61d6c91e0694cc7608570fa5c4111268b7ce0807b5cf44d33b7f577f9a1
SSDEEP 12288:lR5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6:lR5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T186C423C457A121EBE30E0AF3E1F696D4DA0CE6EFD408623B5E729147CB35D8B4672429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 c7761ecca69f147922fc58bffe46fada5cac4f2d53e40d65a4629b994159d239
MD5 30aeea9ed9367028f2b39ffafeb11983
SHA1 5f2d0ef859e1ff093a23e204a4475668a4ab1497
SHA512 bd16635923039d592e30ed202f397afe033b9509b2721bc46e142c3f96760868acda2ed9533bfc356dd9c3a71c1000f4bcb9c434b2d3a3871f66208be66e556f
SSDEEP 12288:965OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6:965SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T16FC423C457A121ABE30E0AF3E1F686D4CA0CE6EFD408523B5E729147DB35D8F4676429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 544c2444c12ce95907df9c690baf3efe6a92fa61fd9611b14df2f8762b50a12b
MD5 e32468bba4b79f9c1bb24d798ea22e2c
SHA1 11a2e1975963de4e15f639dcc51322a88700895c
SHA512 810aa187faeb8d25825650fcd368769f4de6c4f2762ce3f2dfd0f56bda7f03878f5f981d1640ae0e886d70e46c871d7d8acd48d261344b9a8bd72eb4fc88d3cd
SSDEEP 12288:D05OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6:D05SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T1FCC423C457A121ABE30E0AF3E1F686E4CA0CE5EFD408623B5E769147DB35D8F4672429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 5e9327430c9860842b77b097f0bab08dfbadf24afabb23f625015563e420a399
MD5 6d2b92a189a141989d0853c7a191efdc
SHA1 b7807cc8ed91a3c1b97ec2748a0333c1ff18277c
SHA512 79cc7e197f676484637b3fd2366b99c40a6dabbfa49359066029177a843477fa2590068a869fd656664807a0f13eba3c4aa5d21dcc1c95deec729bf4ce95b5f0
SSDEEP 12288:VVL5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6:b5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T197D4238417A511E7E61F86F3D1F682E4D728F8EED624637F4F21054B4F31A8B8A31A25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 52a392f9772b1bf5f20b669c17659c9256296a85480e28d5df7c1f01ed64220a
MD5 1ac3925cf6b35faf9665fb16a5a9face
SHA1 8199b43353cc55e07556deb8e2c0ddde46915b6d
SHA512 6b7449a2cb948324d20de63d1676cacb7724cf4894148eeb0595ec6f1fea14d68ab4bbca84516e6b210d84a821cc522a9a02656829c42c2ddcaad203bdf57fe8
SSDEEP 12288:fz5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6:fz5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T14EC423C457A121ABE30E0AF3E1F646E4CA0CE5EFD408623B5E769147DB35D8F4676428
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 acbc7476185a5a42b6255392385fe3098cef1112240af8dbd1d689156e400ecf
MD5 d154da6dde5d73f10db15dbedfe2920f
SHA1 765e6b511a0ad6c05f62f41357ada86d1fe78a9c
SHA512 66736625ddb6b299c0cbdcb0ccd5c7510c94d4036a70c152732d9b41c2e0c6dc32e951b362fb02a41870546ff46cb569487490c1b68df4e862cff9e62337565a
SSDEEP 12288:bG5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6:bG5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T1CDC423C457A121ABE30E0AF3E1F686D4CA0CE6EFD408623B5E729147DB35D8F4676429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 21176d0d36b5738bdac37cf2b2230bc6019720e117d5e12e21489f8303609e5e
MD5 03c12fc7eb7f80e8b457ba4c5d190eb8
SHA1 a10e6d5132dd60a9738e03644596cf6e869fbf36
SHA512 41eebafb52f433c885b816f6546a1340e8dd83de54cffe6d6ace8225027f2138e64a4043282039538b68210e8625b4e79990d4a7da39a88f4737b74c7debe0b4
SSDEEP 12288:FC5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6:FC5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T146C423C457A121ABE30E0AF3E2F586E4CA0CE6EFD408523B5E729147DB3599F4672429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 3b743cb867acb4fbd3b39f2d1429c127afb2149cabeee02eed7a63db082156da
MD5 90e55ed05e7ca0e323bb9ef87f93a1d3
SHA1 c57228a80e24425a66aa898c6dab314498371e0d
SHA512 04177f7d053b6f0d4989212c6fde22608577dcc5919517df76b9f19a1d57bd795fbce968890ff18ad39cba912a79109baa3de4fae6a5ca8dfbf61a8d0084dfbf
SSDEEP 24576:yZMSzFVSOa5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:yZMSzfW5SW6H8DS52tdDpbRZy
TLSH
T1E3050294B39018F9EC67823FC9658945D6B2BC5A0760C62F07B436675F333920D3EB69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 f9fe7b34d712e650cdbf3dd2716fdf95cd47a49641f388fc494893dbb7ed2bf2
MD5 4e8a538d76e7454695209d0ca8488c41
SHA1 a0d3ec44bbdd55166323be5bce54e3a73a87ed01
SHA512 5873036cdc15f1245acc827487f29fe63b7b074819c3a4474b57ff8652076b43684aff1b6669211e6bf9131c078d9f857dd577365d94597e8796d703607b89eb
SSDEEP 12288:BV5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6:BV5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T115C423C457A121EBE30E0AF3E1F686D4CA0CE6EFD408623B5E7691479B35D8F4676428
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 4da627bb35cf31d9457e3eae3b4de31b2f645b7355f9f02f9691495a1f114abf
MD5 9685d0b49c62f9bb43738558ebcb00de
SHA1 dfaf79e0ab3e27fdee835e8f6e1db3aae7e6d921
SHA512 5c7acb25a129c4b126629afd352a7c3405e857ccfaefa8ba390f259ddfeb42589110d26d87405dfdef8f29a6919f6e6a8ca6d339a0a19cc33f78f311f9ec8614
SSDEEP 12288:sJ5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6:sJ5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T191C423C457A121ABE30E06F3E2F686D4CA0CE6EFD408623B5E7691479B35D8B4672429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 9d3cc358dec71b1c1123d8a77c76af62ab9dd1562d7c014a4dcbcb0ca04f3efe
MD5 922ad0a45e3a244eeb0639ff2aa58713
SHA1 965b9ca864a2fe2470e6de7be8112a2b6f989509
SHA512 ebac5ab315d2d97bfa6fb2ad4abdb92e673e46a6450d40cc5d6f9b6f9a33d11c3e44193a1962dffb4833b3b4b9f475e1ce9a6dd4d6da1b6d92a92e619d8fe155
SSDEEP 12288:TyPz5L8e5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6:ezye5SSiVw6uAX8DS52tpz9ZRzbPmSZP
TLSH
T1DFF4024773A130FAD12B8275C8A20A41F775B87647248ABF1BA043775F376D19E3AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 cd42645f6bc2554824e1869edfac477ca546a9b6b598422a361e69a7116831eb
MD5 d37da896c8e864bc3f37e2a3c87b9061
SHA1 3a7abc567bf39b1d89e5fb753527885feb4e7f32
SHA512 8ddb6345d7042e3a33b4365100b1d86bca39b3052b7771243c52991bb339c24354f31f75ed89bc09427e5dfcb331a16c0bc0664eeca17f3d7ef533109aec86df
SSDEEP 12288:OV5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6:OV5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T108C423C457A121ABE30E0AF3E1F646E4CA0CE6EFD408623B5E769147DB35D8F4676428
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 0985b00feb3f6031c865b200be892722eb36d05d65f819fea79d21bb32c9aaec
MD5 fb60b65305af42e68b207c45f879b00c
SHA1 635febfe07eccc41cc23c2d11d484284ae230603
SHA512 e52fff8a2ce9ca29770fd997048263978a419b6e300388a4b1e2af837aaa262fcd068b36760367ede7181494aead6598906230836e512083d261df940f16d8f2
SSDEEP 12288:BV5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6:BV5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T1F6C423C457A121EBE30E0AF3E1F646E4CA0CE6EFD408623B5E7691479B35D8F4676428
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 9634ef68988d343d13f42483b36bad4b922b72e5dcb6fa9edff8f2473d675b0c
MD5 f715511c8326b132637a2620f8641039
SHA1 d36cdd1ad2ede82e9abc3eac12eb9ac096a99628
SHA512 f381d4cf6205d30fa7f9831d82c128b5b88bd6f0418ad2d74e93127aadc567441f5b8855ccea95cd114bdb3ec9c6d4e281efe8ac0a3b6275f258cc06681a269f
SSDEEP 12288:LyPz5L8e5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6:mzye5SSiVw6uAX8DS52tpz9ZRzbPmSZP
TLSH
T1A4F4024773A130FAD12B8275C8A21A41F775B87647248ABF1BA043775F376D19E3AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 4f8942db02b0d16e62a124704b5fa3b1c643cab4bd5597406cd200572677f8da
MD5 569274a96dddb93e5df97f02bc0aa86e
SHA1 74edce2b60ec3b213ef8e7af3e9ac7f042046b49
SHA512 0b406adb2b41c7a6553a5dad77c283f2cee36c84b619eca0dad7095adcae497122cdd431c538a025cae9dcc1b0e7dde26d08f43467b3c7c75c2bd0aceead041f
SSDEEP 24576:BcP4mcvIjkGOxhKP2l71nNKbrh/8KB95SSiVw6uAX8DS52tpz9ZRzbPmSZyo:WP4m4IpOO67W8K35SW6H8DS52tdDpbRo
TLSH
T15B65AD2DABDC0096D0BA917886658A49FAB1742E1F3286CB1160933D3F77EE54F35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 c9eed3a643bdf0349b7454b004b4f0f63f9e6d2af93ca09dfeabbec4589e0f7f
MD5 f767c8c302063ae2992d8cdff000b223
SHA1 dafc513db86bee97d94a7d5dc204016e582e6082
SHA512 1f688b82ecf3cfb4fc4526d5f1dd5773217789a8fd33c42f2aadbed5d7a5b2112fcf4c06531ed6f909849988bc0be6a97a7cfbb14d1064def5d3fd1a361e82c6
SSDEEP 12288:cNsfF5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6:NF5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T169E4F149D39412EAD01E5276C7A64A80F3277C6983E0D3DB5AD0F53E0F366858EFA613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 09dc72e56ddd32ba1cff37b45eb9b2df8da2591d25c29aa5480df399037e0372
MD5 e91a47b296898b0b1b1501594f877f6f
SHA1 56c1a70ed4c9a221c854f9e0ffc8212eaf2cc2da
SHA512 b703d8b67375c6657c383a5ca669e120e0294b56ee468e9d605b57ceba528a97ad46bc808867e99b19995530669ad2878f8de0d6dad1b16726c2940cb5191ef0
SSDEEP 12288:al5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6:al5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T17FD4238453E46557F21F1BF3A1F6C2F4D60CF6BE8904913BAE2152478B35D8B8E3252A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 243684a798ecfd3e153b7bb69b04394c27324a91b3e288c1cb141323f3290e04
MD5 7355ae311aa18264e0eb330fa04c9ffb
SHA1 1a94bb20bda62239f707e0f6cb63b28d767c319e
SHA512 e94ec9a1900dabc62fd0b7763d78a82f97314e4487420003e54b80c06c99ffdecaeb7b525ea7dbd049e7e285ce4f36c1b63aeb5da6fd47847be4ff6b6a64e19a
SSDEEP 49152:3a0h2GEkuAe73q3pp46zwwQz5SW6H8DS52tdDpbRZy:3a0hNYG4Jw25SSDntdDpbRZy
TLSH
T18285AF1D67EC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37DE84E3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 659KB
SHA256 33c4dab9aa5d2de37c1a69ec4b3892befa7a53171a61d06cfdfa70815c6f1e5d
MD5 31c2c2bec80407e6c240e023944f0343
SHA1 313d80d48edd60fca3863189319bd09096cc5634
SHA512 7efd7e898d09e885b09917edc083dfc1dee3e674170abefc809c7937e9af188ff80f8b218ef74ddbf93badf282405041c2e859c971dba281f637fe454cad916c
SSDEEP 12288:UhbHjfXq5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6:UhbHjPq5SSiVw6uAX8DS52tpz9ZRzbP/
TLSH
T1F9E412AD13AC20DAF13A92BE91A68646C730B86A071093FF1B91827B4F37DD94D35E11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 b8bb97dbf0f04db085fb8ae2131e54d00b897c01eb155eeeded9a1ac23fac9d0
MD5 046d9ddf05e140446dbeafba8a9d98cf
SHA1 bd8f3da348b5ab4d315a85ab1e517c4a50a2d685
SHA512 a99402de5aa415ef55f97ce275a0906d2db4f49f7f70fecced1121681a49e996df4dfd4da2348047f6fb4655a00e712fa585ef13de1db729ca8c2c86bc3b161e
SSDEEP 24576:Z3YgnJcRTk4yti+R5dBR/S5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:ZIgnaTk46pBR/S5SW6H8DS52tdDpbRZy
TLSH
T17F45BF2DF3B910B9D8AAD236450147B5FB71782D1F209ACB0170C539AF1AEE85E35F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 578KB
SHA256 866b03c075f17fe10e5292bd58fc362b05c5682fa403c597beb75b07cda5b06d
MD5 d0a538fdcd821323026574e1d730f73e
SHA1 3536ce0b8c5bd296de25aa8c0f6892df627722ed
SHA512 6b670b2458f1f40b0a387f6c5f8a719d4ae64cc61c2448555b571eaa101f409413ca63dce0fbd44e39a877555d5adaf6535bc24fea3cf76b72b94c6440d53e6c
SSDEEP 12288:HZ5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6:HZ5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T15DC423C4539125ABE30E0BF3A1F686E4D60CE6EE871812FB5D72A1478B35DDF8672025
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 940KB
SHA256 37e0f5a38ce466a55ff95822a90169b1386be86f1ec18f94844ec8277234e5b8
MD5 42d0994314517c191837cc729ae83523
SHA1 fd6fd7885789cbb28e829c93411be9cc5e4ac62f
SHA512 04548a37cfee6f5b101c77bc687de44535ef7c54aa750344d0d4cf37d12e017ef13a4e1255dc08c7008a3033ce814f265983c2f11ff6b076812e84080529e93e
SSDEEP 24576:ipL3UTY5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:ipL3Uc5SW6H8DS52tdDpbRZy
TLSH
T137250154E7A400FAE96B813DC5B28A16D272B49D0324E7EF07A84B561F237E64E3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 671KB
SHA256 790385c88ecfe4472141bec2a94ad0896885770caf9a432b9a90ac409337efff
MD5 a7275d5eeb9d8fa270db42f39cb29709
SHA1 09c5258a4ff7fcaaef25e5664759525c9c9c0aa4
SHA512 5e87803d9c3ad5e712d77061a66844b20adb29ab2d40c67d880c2053bd1ea29e8b6435229b7ae49341b0ef1d5d886c1316db8ba8b6f8d56d297fecfe007ead28
SSDEEP 12288:apFtpO85OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6:YO85SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T172E4025933ED20E6E13A927E95A2834DD371B4A6071153FF0AE0816F4F73EE95C36A21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 eaeb8f1642c1b9ac1b4320c4af7465fc80e0ad6598432bba9117c7f136ef9654
MD5 ea41259bc1d267f9ff275629e97b9798
SHA1 2cc4362d1174c428c8d94d78fd9e04e781377018
SHA512 a7bf88eb4033cd3f659532a944cd204eb612277c94e4c47a15774894dcb00f022252df0e8cb4a9b24e844225189699824e5bfd8ca24a51dc3ec7e88e3432f097
SSDEEP 24576:M7NM9YqZqmWMUkPjZM48Mv6bEhsV5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:M7cBWMpPjN8DbEhK5SW6H8DS52tdDpbK
TLSH
T19865AE2E6BAC81E5D477D13DC9E28205F6B1B4611B318ADF1162833E6F37AE44E36721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 4c31e27fdeb6d3f3c4803f044288fafe726af02821a34bb98a8bdb445e657d86
MD5 5a8e12f5c61c5b856a4e68961f5f9ec3
SHA1 ad7ae70c39d123d67d16ae6211a7019e81938113
SHA512 f09f5888ef214b2f5e867c624dd1740daa45b33f850c3793c399fcc297ec67a478cc27461cb241cec826512ec505c040f890d089d1675e9c9f5af23273e4fc31
SSDEEP 49152:MF2YuHNETovAvNYf8km15SW6H8DS52tdDpbRZy:p6BCf8k85SSDntdDpbRZy
TLSH
T14F858E6927ED80A4E0BBD27D45B7D246FAB2B8511B3056CF0255862E1F33AF44D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 0169bc284816ce74a28dbaa0a6a576b7062329e7b63f5050e1fdfa9db3db53fa
MD5 e7b5a729d03ac1791febe7d560aa4938
SHA1 b4a4dcd4a4354996478d81c2e08eb1023db65074
SHA512 c5bad4a19fc8c2da6e37ae7f4012cc500471303a89423d85ffe4d553a92d98f642a98f598781b47bcf74d0af407479d31d07cd51124aa50e43c84cdd7c54cd16
SSDEEP 24576:YAFs06+Omlf3NXEbTow5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:dFs060lVXuT5SW6H8DS52tdDpbRZy
TLSH
T1CD65AF2F62AC00D5D07ED17E8997C91AF6B1746707255ACB0260863E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 885KB
SHA256 6c11fd235e471db3a9cca36d0d9fc16178c0b96493f549e2c1b3487e3ae3053a
MD5 b832949f8a4be6c7e68cfabcfb0c63ff
SHA1 9c52aa15e2c5f15b35a8b327cf4c36564b182e8b
SHA512 fa780bfd364a64f3197c454412e63fa4168d6a296d9aa0c82329bd8d8eb8c21dcd891d4258768112ea523126ea79738b5020341e27393c07f1f16155685ebf1c
SSDEEP 24576:XJnJ5D3WXT5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:XJnJ5DGXT5SW6H8DS52tdDpbRZy
TLSH
T1BB15E02CD2A810E9D4B7C2B4819A1795FF72347D2F216ACB28B4D5353F12EE09A79F14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 13113a42da4ff6a91a8389ce0e3248ea2c3cea920d17c3d0dc40eb4c6fab9fb6
MD5 e77dd31990ad0d10db62ca18acee1de5
SHA1 fe7501731c3f1c505a0e1cd3ebf3c9d2e814245a
SHA512 3f9dd2fdd45fbcc6904b178267a93129d0687362b1cf9a2f1808ed368b7f3bef49186ff2dc561dfb34630fa2f583a240879ccf5536701656e93d2f94db0e3d21
SSDEEP 49152:dg06DIKdwc+eQnSt65aVR5SW6H8DS52tdDpbRZy:2v5SSDntdDpbRZy
TLSH
T150956C05B7EA5295E8B3CAB1C962A1169B327C509B34F7DF0AC0C92E1E33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 661KB
SHA256 5dec711e9da78f230ab87332129e639fad98d833ded5d4e14cafcfd95b12d2ed
MD5 beba884c27fad313300a7ec45710ef26
SHA1 23db0339d3aa7eb42d415b58711e2fd0f6c2d8b6
SHA512 94af5be57cad5ffbfde86939dfe7c0df9ade32dcb685c3366dba147b2f36437bf94575afc0bb8d6826b6b6adc6027dd226655dbf5c3a9374e123f596bafafa47
SSDEEP 12288:DEP3RnH5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6:InH5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T147E4129C27AC70EBD12E917A91A18644D371F0B5571127FF1AA1C23F8F379EA1E39A10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 712KB
SHA256 1631d6f80c6534fd6a234e2f73f08043a1fc7f588a4b77630b5a32df46df08d6
MD5 c8ab2ad601e3a98ae0320464629558fb
SHA1 b7e1012610b2e8b25ba31f354abf7eca322aebd7
SHA512 ed88ff942e0f0743bc89e5fba1cffa8bade0390e438c99421f4f40a5fb648fecf2639b7533de54def9e1e29eadb97c9797f6c276d070082e7f948697a07c4cda
SSDEEP 12288:ijky65OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6:iIy65SSiVw6uAX8DS52tpz9ZRzbPmSZP
TLSH
T1ACF41244239460D7E66E0676D5B382E4CA38FC709B1053FF5990E22F9F36BD69931B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 584KB
SHA256 29176c7a36d0bd01676d0189339a9743940d37fcbd40d90e0b54f6b2984509fa
MD5 b8c48a340305e34192daf3ee65946dc8
SHA1 d8dc7a7dc2d48d40fdff28dd022a91ba692815bc
SHA512 9ac6ae92b2e8a354bd32c3fccac3747654a2636f8c04da2b2d0c34851717d6a1127d377567d863c1cea33e02959deaf52eed0486d26270d86b37ef2b268b1a53
SSDEEP 12288:ZyM5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6:IM5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T1AED4238813A131ABE60E06F3A1F68BD4C618B5BE971421BF1DF1E177CB369CB4672815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 ddd69b7270ac28e4af1b4e4d37738cd891f9ef6da97f8ebf1cbe0bde266250f2
MD5 f3680fbb28918753a9b16a99bd5207dc
SHA1 252209aa23433309f6a8fd84305968e531618d25
SHA512 f101bd5e43cd3a886b0fb3ed79a1acad7f0086456967f68afbe994d244fd9b7332ea6d2fb7eb5314fc51e91f527b53b3ed2e8ba4433a024e7caa12cd487dc472
SSDEEP 24576:YQ9MxZKdcz9dw3t5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:YVKZt5SW6H8DS52tdDpbRZy
TLSH
T1AB558C2DABE9059AE177D27595A240C3A633B4311B31D6CF2448D03D4E7BEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 772KB
SHA256 5fbadb4fa389f2b29edcd68377596122dc7c537a98049efd7d9d0b361d580f1e
MD5 82cd048b186d1995b52eb38c5c346a28
SHA1 b475a8a27f85f688de2bc1ed67a11d7d94fa4213
SHA512 8a0a2091b00bfabc414395443e808e04176b77e10c8a66e1de42076bb86209835ed375d734d20d0deb2a0b9ac42ac173f5a4929289e05e0ffb6557842408eed1
SSDEEP 24576:yyocDApO5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:vocDApO5SW6H8DS52tdDpbRZy
TLSH
T1D4F4E05FB7A940E2E126823C89858385E773B0745B2153DB5A91C33E8F27AEDBD34B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 1e7adc260c159c60966b381fe7eee94e1e13394c41243d2c0ef6ee41a6690a9c
MD5 583d5cd29a4cbc5dac3892931eb03002
SHA1 dc4aa41752e88318db68b0630b250f7b94572efe
SHA512 17651d89ef3da869e63b0b4e9c199329839c8b6095054789b03906abd2f8ede2cd21bb1138b527d6bb9be3c3eca2120e431b0049cc80c72f0665afbb68a25124
SSDEEP 49152:+WcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKO5SW6H8DS52tdDpbRZy:Y0zuNIY5SSDntdDpbRZy
TLSH
T158A57B3DA2F800A9D9AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 6f346657659f40da6440c3d61dd17fe059abde14459bf60921b4dbba91268538
MD5 06567ba962898a412c4df67237544315
SHA1 f9f2cdfe5577724e0f27bfb206bac5082d239b72
SHA512 584e12389880313ccb1fb85cc085ef9ede54e18a92f6fd595a6a43507f36ca5f9100cf8ec47170b059b92329d8a46ae7aaaf4b9941438c551eba10660a1dd186
SSDEEP 24576:g1QT7EcpfxR+N5AWAz3ooiYtjMqbH5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:dTDxR+N5YzTfjMc5SW6H8DS52tdDpbRo
TLSH
T16A55B02EA7F815E9D17E85799A23C512FA727821033193DB42A0C17E1F3B9D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 877KB
SHA256 0913a16a323f3787d2987ce03fab5f00e093b6df677b79ffde359a2d5082cbed
MD5 fe02af07bb97f83f485133e50bd867a6
SHA1 a3b4cff5cad6e43a1c5796f1722d3a3b442a73ed
SHA512 8010301df46af10e56cdc5afcb9df4a12402025422dbea3b8fa0539c9609b7030fd8bca9ea59538548c536ef836a3b9eaa5cb0b1521a95f850cddb06a091940c
SSDEEP 24576:QTMdOz0FFS+imSLL5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:Y0K+imSLL5SW6H8DS52tdDpbRZy
TLSH
T13615F17E63AD14E5E43FC27DD6538906E6727466032166DB06E0C17A2F5BFE43A3AB00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 635KB
SHA256 8e3f0fa7032e4f6b48c992587a5fea0b3f5fc4b99712d632e7beedda2bfe504c
MD5 715c6874ccbc217144d527779be7afef
SHA1 cda9f7fcab24db1a4f8d7cb708c5fb515b7b932f
SHA512 dcaac09bd9ea8116411cccf31f1d5dd3e3b93225f7ac5bdcd2f1ba8f16ec8a0ca1450e47f891865fef0d01a06d82ce474d5168749b32a0af6838dd27ffd39130
SSDEEP 12288:r4KY5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6:3Y5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T1C7D4124C13E830D7F12A56B6D6B64295C630F87A132466FF2DE0C57B8F36ACA8535B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/116-113-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/116-168-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/468-169-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/468-475-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/572-157-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/572-382-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/764-9-0x0000000000180000-0x00000000001E0000-memory.dmp

Download

memory/764-437-0x0000000140000000-0x00000001400D1000-memory.dmp

Download

memory/764-86-0x0000000140000000-0x00000001400D1000-memory.dmp

Download

memory/764-438-0x0000000000180000-0x00000000001E0000-memory.dmp

Download

memory/764-0-0x0000000140000000-0x00000001400D1000-memory.dmp

Download

memory/764-1-0x0000000000180000-0x00000000001E0000-memory.dmp

Download

memory/1452-151-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/1452-153-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/1732-495-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/1732-363-0x000000000C960000-0x000000000C968000-memory.dmp

Download

memory/1732-198-0x0000000001A20000-0x0000000001A30000-memory.dmp

Download

memory/1732-220-0x0000000009E60000-0x0000000009E68000-memory.dmp

Download

memory/1732-182-0x0000000001780000-0x0000000001790000-memory.dmp

Download

memory/1732-173-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/1996-43-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1996-63-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1996-49-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1996-147-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2064-54-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/2064-60-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/2064-62-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/2064-67-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/2064-69-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/2100-14-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/2100-112-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/2132-66-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/2132-30-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/2136-385-0x0000020351740000-0x0000020351750000-memory.dmp

Download

memory/2136-367-0x0000020351740000-0x0000020351750000-memory.dmp

Download

memory/2136-372-0x0000020351740000-0x0000020351750000-memory.dmp

Download

memory/2136-374-0x0000020351740000-0x0000020351750000-memory.dmp

Download

memory/2136-375-0x0000020351740000-0x0000020351750000-memory.dmp

Download

memory/2136-378-0x0000020351740000-0x0000020351750000-memory.dmp

Download

memory/2136-381-0x0000020351740000-0x0000020351750000-memory.dmp

Download

memory/2136-380-0x0000020351740000-0x0000020351750000-memory.dmp

Download

memory/2136-379-0x0000020351740000-0x0000020351750000-memory.dmp

Download

memory/2136-377-0x0000020351740000-0x0000020351750000-memory.dmp

Download

memory/2136-373-0x0000020351740000-0x0000020351750000-memory.dmp

Download

memory/2136-376-0x0000020351740000-0x0000020351750000-memory.dmp

Download

memory/2136-370-0x0000020351740000-0x0000020351750000-memory.dmp

Download

memory/2136-384-0x0000020351740000-0x0000020351750000-memory.dmp

Download

memory/2136-383-0x0000020351740000-0x0000020351750000-memory.dmp

Download

memory/2136-407-0x0000020351740000-0x0000020351750000-memory.dmp

Download

memory/2136-406-0x0000020351740000-0x0000020351750000-memory.dmp

Download

memory/2136-405-0x0000020351740000-0x0000020351750000-memory.dmp

Download

memory/2136-404-0x0000020351740000-0x0000020351750000-memory.dmp

Download

memory/2136-403-0x0000020351740000-0x0000020351750000-memory.dmp

Download

memory/2136-402-0x0000020351740000-0x0000020351750000-memory.dmp

Download

memory/2136-401-0x0000020351740000-0x0000020351750000-memory.dmp

Download

memory/2136-400-0x0000020351740000-0x0000020351750000-memory.dmp

Download

memory/2136-399-0x0000020351740000-0x0000020351750000-memory.dmp

Download

memory/2136-398-0x0000020351740000-0x0000020351750000-memory.dmp

Download

memory/2136-397-0x0000020351740000-0x0000020351750000-memory.dmp

Download

memory/2136-396-0x0000020351740000-0x0000020351750000-memory.dmp

Download

memory/2136-395-0x0000020351740000-0x0000020351750000-memory.dmp

Download

memory/2136-394-0x0000020351740000-0x0000020351750000-memory.dmp

Download

memory/2136-393-0x0000020351740000-0x0000020351750000-memory.dmp

Download

memory/2136-392-0x0000020351740000-0x0000020351750000-memory.dmp

Download

memory/2136-391-0x0000020351740000-0x0000020351750000-memory.dmp

Download

memory/2136-390-0x0000020351740000-0x0000020351750000-memory.dmp

Download

memory/2136-389-0x0000020351740000-0x0000020351750000-memory.dmp

Download

memory/2136-388-0x0000020351740000-0x0000020351750000-memory.dmp

Download

memory/2136-387-0x0000020351740000-0x0000020351750000-memory.dmp

Download

memory/2136-386-0x0000020351740000-0x0000020351750000-memory.dmp

Download

memory/2136-371-0x0000020351740000-0x0000020351750000-memory.dmp

Download

memory/2136-366-0x0000020351740000-0x0000020351750000-memory.dmp

Download

memory/2136-369-0x0000020351740000-0x0000020351750000-memory.dmp

Download

memory/2136-368-0x0000020351740000-0x0000020351750000-memory.dmp

Download

memory/2964-122-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2964-338-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/2964-128-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2964-131-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/3632-71-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/3632-150-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/3796-116-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3796-365-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3796-172-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3940-81-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/3940-75-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/3940-156-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/3940-84-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/4020-433-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4020-165-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4076-87-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/4076-159-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/4076-94-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/4076-88-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/4164-295-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/4164-120-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/4172-33-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/4172-130-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4172-53-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4172-39-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/4308-26-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/4308-18-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/4308-25-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/4432-431-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/4432-160-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/4728-362-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/4728-148-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/4764-164-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/4764-103-0x0000000000520000-0x0000000000587000-memory.dmp

Download

memory/4764-98-0x0000000000520000-0x0000000000587000-memory.dmp

Download

memory/4764-106-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/5080-361-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/5080-143-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/5080-141-0x0000000000440000-0x00000000004A0000-memory.dmp

Download

memory/5080-135-0x0000000000440000-0x00000000004A0000-memory.dmp

Download