480a774781cc5d058d3a4ecb17a7781f9b73dea7dd2a92bf1b31bd054dd8bc9f

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/07/2026, 18:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-30_04cfb0b046c5bf7c6ef40be28f2020cb_icedid_njrat_ryuk.exe
Size 1.4MB
Sample260730-wwmcmadd86
SHA256 480a774781cc5d058d3a4ecb17a7781f9b73dea7dd2a92bf1b31bd054dd8bc9f
MD5 04cfb0b046c5bf7c6ef40be28f2020cb
SHA1 344f82e683ea03a51e1da0026f49e3549dd596af
SHA512 d4132ca01f687037c55d380819b0c635710247f6b59054d8ed508aced93969bdf88baa6ace318d9f618adc7d2fdc94b26a6766de1f787380a0c1c4efbcffd3d3
SSDEEP 12288:j06BaAhjk3j2V8tM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:oMjG486mctvE/BT76+1NCE
TLSH
T1B2650241B2A904F8E9B38274CA55C112E9737C561725DA9F0360926BDF336E1BD3EF22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
432	alg.exe
4860	DiagnosticsHub.StandardCollector.Service.exe
1476	fxssvc.exe
4856	elevation_service.exe
4264	elevation_service.exe
2328	maintenanceservice.exe
4248	msdtc.exe
1316	OSE.EXE
1012	PerceptionSimulationService.exe
1036	perfhost.exe
2664	locator.exe
3288	SensorDataService.exe
1432	snmptrap.exe
3956	spectrum.exe
2584	ssh-agent.exe
2044	TieringEngineService.exe
2224	AgentService.exe
1952	vds.exe
2960	vssvc.exe
4800	wbengine.exe
4000	WmiApSrv.exe
1760	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 31 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-30_04cfb0b046c5bf7c6ef40be28f2020cb_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-30_04cfb0b046c5bf7c6ef40be28f2020cb_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-30_04cfb0b046c5bf7c6ef40be28f2020cb_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-30_04cfb0b046c5bf7c6ef40be28f2020cb_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-30_04cfb0b046c5bf7c6ef40be28f2020cb_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-07-30_04cfb0b046c5bf7c6ef40be28f2020cb_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-30_04cfb0b046c5bf7c6ef40be28f2020cb_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-07-30_04cfb0b046c5bf7c6ef40be28f2020cb_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-30_04cfb0b046c5bf7c6ef40be28f2020cb_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-07-30_04cfb0b046c5bf7c6ef40be28f2020cb_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-30_04cfb0b046c5bf7c6ef40be28f2020cb_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-30_04cfb0b046c5bf7c6ef40be28f2020cb_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-30_04cfb0b046c5bf7c6ef40be28f2020cb_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-30_04cfb0b046c5bf7c6ef40be28f2020cb_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-30_04cfb0b046c5bf7c6ef40be28f2020cb_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-30_04cfb0b046c5bf7c6ef40be28f2020cb_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\c28ce95a19fe9b3.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-07-30_04cfb0b046c5bf7c6ef40be28f2020cb_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-30_04cfb0b046c5bf7c6ef40be28f2020cb_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-30_04cfb0b046c5bf7c6ef40be28f2020cb_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-30_04cfb0b046c5bf7c6ef40be28f2020cb_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-30_04cfb0b046c5bf7c6ef40be28f2020cb_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-30_04cfb0b046c5bf7c6ef40be28f2020cb_icedid_njrat_ryuk.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	2026-07-30_04cfb0b046c5bf7c6ef40be28f2020cb_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-07-30_04cfb0b046c5bf7c6ef40be28f2020cb_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-07-30_04cfb0b046c5bf7c6ef40be28f2020cb_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	2026-07-30_04cfb0b046c5bf7c6ef40be28f2020cb_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_85093\java.exe	2026-07-30_04cfb0b046c5bf7c6ef40be28f2020cb_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	2026-07-30_04cfb0b046c5bf7c6ef40be28f2020cb_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	2026-07-30_04cfb0b046c5bf7c6ef40be28f2020cb_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-07-30_04cfb0b046c5bf7c6ef40be28f2020cb_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_85093\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-07-30_04cfb0b046c5bf7c6ef40be28f2020cb_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	2026-07-30_04cfb0b046c5bf7c6ef40be28f2020cb_icedid_njrat_ryuk.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	2026-07-30_04cfb0b046c5bf7c6ef40be28f2020cb_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-07-30_04cfb0b046c5bf7c6ef40be28f2020cb_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	2026-07-30_04cfb0b046c5bf7c6ef40be28f2020cb_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	2026-07-30_04cfb0b046c5bf7c6ef40be28f2020cb_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2026-07-30_04cfb0b046c5bf7c6ef40be28f2020cb_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-07-30_04cfb0b046c5bf7c6ef40be28f2020cb_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-07-30_04cfb0b046c5bf7c6ef40be28f2020cb_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-07-30_04cfb0b046c5bf7c6ef40be28f2020cb_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	2026-07-30_04cfb0b046c5bf7c6ef40be28f2020cb_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-07-30_04cfb0b046c5bf7c6ef40be28f2020cb_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	2026-07-30_04cfb0b046c5bf7c6ef40be28f2020cb_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	2026-07-30_04cfb0b046c5bf7c6ef40be28f2020cb_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	2026-07-30_04cfb0b046c5bf7c6ef40be28f2020cb_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	2026-07-30_04cfb0b046c5bf7c6ef40be28f2020cb_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	2026-07-30_04cfb0b046c5bf7c6ef40be28f2020cb_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_85093\javaw.exe	2026-07-30_04cfb0b046c5bf7c6ef40be28f2020cb_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-07-30_04cfb0b046c5bf7c6ef40be28f2020cb_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-07-30_04cfb0b046c5bf7c6ef40be28f2020cb_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-07-30_04cfb0b046c5bf7c6ef40be28f2020cb_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-07-30_04cfb0b046c5bf7c6ef40be28f2020cb_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-30_04cfb0b046c5bf7c6ef40be28f2020cb_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007491b3934f20dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000257ade934f20dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c63c21944f20dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000084c8ec934f20dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001641c4934f20dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000879f04944f20dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000049a3c6934f20dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe

Modifies registry class 20 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	2026-07-30_04cfb0b046c5bf7c6ef40be28f2020cb_icedid_njrat_ryuk.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	2026-07-30_04cfb0b046c5bf7c6ef40be28f2020cb_icedid_njrat_ryuk.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	2026-07-30_04cfb0b046c5bf7c6ef40be28f2020cb_icedid_njrat_ryuk.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	2026-07-30_04cfb0b046c5bf7c6ef40be28f2020cb_icedid_njrat_ryuk.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	2026-07-30_04cfb0b046c5bf7c6ef40be28f2020cb_icedid_njrat_ryuk.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	2026-07-30_04cfb0b046c5bf7c6ef40be28f2020cb_icedid_njrat_ryuk.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	2026-07-30_04cfb0b046c5bf7c6ef40be28f2020cb_icedid_njrat_ryuk.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	2026-07-30_04cfb0b046c5bf7c6ef40be28f2020cb_icedid_njrat_ryuk.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	2026-07-30_04cfb0b046c5bf7c6ef40be28f2020cb_icedid_njrat_ryuk.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	2026-07-30_04cfb0b046c5bf7c6ef40be28f2020cb_icedid_njrat_ryuk.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	2026-07-30_04cfb0b046c5bf7c6ef40be28f2020cb_icedid_njrat_ryuk.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	2026-07-30_04cfb0b046c5bf7c6ef40be28f2020cb_icedid_njrat_ryuk.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e80922b16d365937a46956b92703aca08af0000	2026-07-30_04cfb0b046c5bf7c6ef40be28f2020cb_icedid_njrat_ryuk.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	2026-07-30_04cfb0b046c5bf7c6ef40be28f2020cb_icedid_njrat_ryuk.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents"	2026-07-30_04cfb0b046c5bf7c6ef40be28f2020cb_icedid_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	2026-07-30_04cfb0b046c5bf7c6ef40be28f2020cb_icedid_njrat_ryuk.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings	2026-07-30_04cfb0b046c5bf7c6ef40be28f2020cb_icedid_njrat_ryuk.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	2026-07-30_04cfb0b046c5bf7c6ef40be28f2020cb_icedid_njrat_ryuk.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	2026-07-30_04cfb0b046c5bf7c6ef40be28f2020cb_icedid_njrat_ryuk.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	2026-07-30_04cfb0b046c5bf7c6ef40be28f2020cb_icedid_njrat_ryuk.exe

Suspicious behavior: EnumeratesProcesses 42 IoCs

pid	Process
2364	2026-07-30_04cfb0b046c5bf7c6ef40be28f2020cb_icedid_njrat_ryuk.exe
2364	2026-07-30_04cfb0b046c5bf7c6ef40be28f2020cb_icedid_njrat_ryuk.exe
2364	2026-07-30_04cfb0b046c5bf7c6ef40be28f2020cb_icedid_njrat_ryuk.exe
2364	2026-07-30_04cfb0b046c5bf7c6ef40be28f2020cb_icedid_njrat_ryuk.exe
2364	2026-07-30_04cfb0b046c5bf7c6ef40be28f2020cb_icedid_njrat_ryuk.exe
2364	2026-07-30_04cfb0b046c5bf7c6ef40be28f2020cb_icedid_njrat_ryuk.exe
2364	2026-07-30_04cfb0b046c5bf7c6ef40be28f2020cb_icedid_njrat_ryuk.exe
2364	2026-07-30_04cfb0b046c5bf7c6ef40be28f2020cb_icedid_njrat_ryuk.exe
2364	2026-07-30_04cfb0b046c5bf7c6ef40be28f2020cb_icedid_njrat_ryuk.exe
2364	2026-07-30_04cfb0b046c5bf7c6ef40be28f2020cb_icedid_njrat_ryuk.exe
2364	2026-07-30_04cfb0b046c5bf7c6ef40be28f2020cb_icedid_njrat_ryuk.exe
2364	2026-07-30_04cfb0b046c5bf7c6ef40be28f2020cb_icedid_njrat_ryuk.exe
2364	2026-07-30_04cfb0b046c5bf7c6ef40be28f2020cb_icedid_njrat_ryuk.exe
2364	2026-07-30_04cfb0b046c5bf7c6ef40be28f2020cb_icedid_njrat_ryuk.exe
2364	2026-07-30_04cfb0b046c5bf7c6ef40be28f2020cb_icedid_njrat_ryuk.exe
2364	2026-07-30_04cfb0b046c5bf7c6ef40be28f2020cb_icedid_njrat_ryuk.exe
2364	2026-07-30_04cfb0b046c5bf7c6ef40be28f2020cb_icedid_njrat_ryuk.exe
2364	2026-07-30_04cfb0b046c5bf7c6ef40be28f2020cb_icedid_njrat_ryuk.exe
2364	2026-07-30_04cfb0b046c5bf7c6ef40be28f2020cb_icedid_njrat_ryuk.exe
2364	2026-07-30_04cfb0b046c5bf7c6ef40be28f2020cb_icedid_njrat_ryuk.exe
2364	2026-07-30_04cfb0b046c5bf7c6ef40be28f2020cb_icedid_njrat_ryuk.exe
2364	2026-07-30_04cfb0b046c5bf7c6ef40be28f2020cb_icedid_njrat_ryuk.exe
2364	2026-07-30_04cfb0b046c5bf7c6ef40be28f2020cb_icedid_njrat_ryuk.exe
2364	2026-07-30_04cfb0b046c5bf7c6ef40be28f2020cb_icedid_njrat_ryuk.exe
2364	2026-07-30_04cfb0b046c5bf7c6ef40be28f2020cb_icedid_njrat_ryuk.exe
2364	2026-07-30_04cfb0b046c5bf7c6ef40be28f2020cb_icedid_njrat_ryuk.exe
2364	2026-07-30_04cfb0b046c5bf7c6ef40be28f2020cb_icedid_njrat_ryuk.exe
2364	2026-07-30_04cfb0b046c5bf7c6ef40be28f2020cb_icedid_njrat_ryuk.exe
2364	2026-07-30_04cfb0b046c5bf7c6ef40be28f2020cb_icedid_njrat_ryuk.exe
2364	2026-07-30_04cfb0b046c5bf7c6ef40be28f2020cb_icedid_njrat_ryuk.exe
2364	2026-07-30_04cfb0b046c5bf7c6ef40be28f2020cb_icedid_njrat_ryuk.exe
2364	2026-07-30_04cfb0b046c5bf7c6ef40be28f2020cb_icedid_njrat_ryuk.exe
2364	2026-07-30_04cfb0b046c5bf7c6ef40be28f2020cb_icedid_njrat_ryuk.exe
2364	2026-07-30_04cfb0b046c5bf7c6ef40be28f2020cb_icedid_njrat_ryuk.exe
2364	2026-07-30_04cfb0b046c5bf7c6ef40be28f2020cb_icedid_njrat_ryuk.exe
4860	DiagnosticsHub.StandardCollector.Service.exe
4860	DiagnosticsHub.StandardCollector.Service.exe
4860	DiagnosticsHub.StandardCollector.Service.exe
4860	DiagnosticsHub.StandardCollector.Service.exe
4860	DiagnosticsHub.StandardCollector.Service.exe
4860	DiagnosticsHub.StandardCollector.Service.exe
4860	DiagnosticsHub.StandardCollector.Service.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2364	2026-07-30_04cfb0b046c5bf7c6ef40be28f2020cb_icedid_njrat_ryuk.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
648	Process not Found
648	Process not Found

Suspicious use of AdjustPrivilegeToken 43 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2364	2026-07-30_04cfb0b046c5bf7c6ef40be28f2020cb_icedid_njrat_ryuk.exe
Token: SeAuditPrivilege	1476	fxssvc.exe
Token: SeRestorePrivilege	2044	TieringEngineService.exe
Token: SeManageVolumePrivilege	2044	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	2224	AgentService.exe
Token: SeBackupPrivilege	2960	vssvc.exe
Token: SeRestorePrivilege	2960	vssvc.exe
Token: SeAuditPrivilege	2960	vssvc.exe
Token: SeBackupPrivilege	4800	wbengine.exe
Token: SeRestorePrivilege	4800	wbengine.exe
Token: SeSecurityPrivilege	4800	wbengine.exe
Token: 33	1760	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1760	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1760	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1760	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1760	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1760	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1760	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1760	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1760	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1760	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1760	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1760	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1760	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1760	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1760	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1760	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1760	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1760	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1760	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1760	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1760	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1760	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1760	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1760	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1760	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1760	SearchIndexer.exe
Token: SeDebugPrivilege	2364	2026-07-30_04cfb0b046c5bf7c6ef40be28f2020cb_icedid_njrat_ryuk.exe
Token: SeDebugPrivilege	2364	2026-07-30_04cfb0b046c5bf7c6ef40be28f2020cb_icedid_njrat_ryuk.exe
Token: SeDebugPrivilege	2364	2026-07-30_04cfb0b046c5bf7c6ef40be28f2020cb_icedid_njrat_ryuk.exe
Token: SeDebugPrivilege	2364	2026-07-30_04cfb0b046c5bf7c6ef40be28f2020cb_icedid_njrat_ryuk.exe
Token: SeDebugPrivilege	2364	2026-07-30_04cfb0b046c5bf7c6ef40be28f2020cb_icedid_njrat_ryuk.exe
Token: SeDebugPrivilege	4860	DiagnosticsHub.StandardCollector.Service.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2364	2026-07-30_04cfb0b046c5bf7c6ef40be28f2020cb_icedid_njrat_ryuk.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1760 wrote to memory of 4732	1760	SearchIndexer.exe	113
PID 1760 wrote to memory of 5000	1760	SearchIndexer.exe	114

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-07-30_04cfb0b046c5bf7c6ef40be28f2020cb_icedid_njrat_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-30_04cfb0b046c5bf7c6ef40be28f2020cb_icedid_njrat_ryuk.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2364

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:432

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4860

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:1524

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1476

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4856

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4264

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:2328

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4248

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1316

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1012

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1036

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:2664

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3288

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:1432

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3956

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2584

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2044

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:4312

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2224

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:1952

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2960

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4800

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:4000

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1760
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4732
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:5000

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 a7bc5e1a0afdb9649fc4bef0f6c70dc3cccc2f3bba0293f30bc577c8e28998f4
MD5 9b4c0e5dec6fa9146e28aff8dbe1135e
SHA1 eb589058c405e2ad7980333ea7448cbeae1fc4bf
SHA512 12c3db50e32faa764666d5e75b0325d9a5cf2cc4c8b57f318a2081af9d739860d90cae5bbb70e5ca61a383ef40f4d1d5523dd0f7ea2fe8318e417b417f3044d9
SSDEEP 49152:Db+632BuPkFKRrdE6ohrstBhuXjfS4LWxnQ6mGvKVO+n1:h3q60jBHXeN+1
TLSH
T1B1D59D03F29900E9E06AD178D7469133E9A2BC890B34B6DF0790B7562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 a31c3157a194d5d9316bb950c6821070b0787da9afbbb460a138d7dd6cffcae9
MD5 d9e362dc931ff0d85b50da3232592c1c
SHA1 d7e8d7f54e78a3b6b08f8c14210bdd7160ddcfc4
SHA512 07358a3529d24a1f0958b9208d727945a32cd51a857170aa85b78b0409bf98213c0f7f637bee1356c51a60ecf697bd84decfc0f6cc428229dd751b4f5fb5f31e
SSDEEP 12288:X1XLsswWkxy2lRq2czA0UtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:FXYfDtczA0U6mctvE/BT76+1NCE
TLSH
T1CE750224779504F9ED6B4278C9A2C112EA337C9547A4E7CB03E4892A5F333D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 1b51916c5beafa8723231f1ed000635bb38ae8239ac4e132304e485f988927a9
MD5 b1e9245cdf9c81d5775fa2f25364896c
SHA1 c2fa9f341b0f02f487d664840a30bee8c785e79c
SHA512 913a8a91fd0050553bd0cd016b4cb4184febf2e10523be98436a4b7b84cc07807282b7a3094ff2087246d752c602eb7ef1c0c91131b0546088e73e3efd105d11
SSDEEP 24576:b0Le5ji0hmxkrMDU6mctvE/BT76+1NCE:bPji0ASx6mGvKVO+n1
TLSH
T12A859E16F6748331D073C0B9C5D2A69EED7130865B308ACB4286D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 8abc4dac59584c00ae144ef4a86a6019d428442a37a6d425d7bc8a83c04e8f48
MD5 de771d103ee859c411a8bcdc921098e8
SHA1 7c80373a45578104e8a6ea90d57befed60f96e35
SHA512 f967ce48e7c9f4f7614a96302d881a437eada8fc00a0d2c59697fe3428bd5e27fecb04ab3283c67b347be3b47b50233b12b5a8f67db692fc71359ef6d5aeac86
SSDEEP 24576:Wa7/ezSC6vUyD/aqgrvWr6q8wyuJU6mctvE/BT76+1NCE:h/ezSC6vUzPviHjyF6mGvKVO+n1
TLSH
T10A755D15F5788323D0B2D0BAC5D6BA9AFE723086573089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 25b621280e292f0af25af060baebbdf9fb26f741de8fcad5e326de00b09ef5ef
MD5 dd2013493f9902dd00b85f0d10654397
SHA1 3d67ef34d7f0e22ebd86fb19fb2777d1a56cadff
SHA512 0aa4cc935d4a035593b90998ea2585b0ad3b8d4f7532293c0fdb40fa8e677acb1e9fc6bfd2a67142f63d2987f35fca4a71720fb096351d8c80bfe5966e08f9f4
SSDEEP 24576:XVbqPb88hv/l+boU6mctvE/BT76+1NCE:XVO88hXl+T6mGvKVO+n1
TLSH
T19A55AE66F5748331D073C0BAC5D2A69AEE3234425B318ACB0246D76C3E677E6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.3MB
SHA256 0faa74d86bdee3667902182126679fcd04dfeee88b411b0642b728d3c944707e
MD5 a2494c9af3f6984d6880fbf11aff9618
SHA1 2780aab15c954dab17507d31e0c158237600ef89
SHA512 976dc358430b962474ff3156e6b7851c746336916a00dcf32d4a7e4e9e9956b998e005ea7870b164a05c01ca07c46c68fd8d78a2622b92a9db20da6a67a461e6
SSDEEP 12288:pinUtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:pinU6mctvE/BT76+1NCE
TLSH
T142552382881B11D0EFFF07F06395E296E8516EF974DA1C81D322991FAD30162FD4B9A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 db5aed16aaecbb7ae823b0670b31658214cccdd570ad56e28a4f9ab2e0b8da63
MD5 39ac114caf871a2ecc941f890b39c260
SHA1 c9477f036d9c34c77d524f7b9b911e84a88ed8c4
SHA512 67e7a6a0b73d85df473e95074360b3228c31c5625999df0309284cdf4bc56bf8265d6324325709ecd7b53262431cd06c940656b84b1a58b5258bd2d0f0c3bfa8
SSDEEP 12288:YeBNUbTVO86UQUtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:YJIUQU6mctvE/BT76+1NCE
TLSH
T1C675CF7BEE28FCD2C27E4DB85691C240E77278704B52A3CBD165820EDE235E15E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 7284e1d0d8be3c4837f410ad65e86337b385adc2fed44f4cd4b2749f75412cf9
MD5 19fe620eeecd9dfffd0a10f528236d3d
SHA1 fe94392d04e75fce89c9488cf6465c78cbc746e3
SHA512 7ef27f55e1e2cb4784bb80d4f5eb6144b1c44dcdb6244d68886e8e6dfe956018cf4d779c70c81edc16cdd1424cd89aa003b408e9bb248fb29c32e26b66caa724
SSDEEP 49152:MQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJR9DN5J8NRV3THh:MQvGAdlCEL8c/RRNw5C6XeN+1
TLSH
T1B6267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 ec9120b6706e6c411ffa1309ece55f14cf3f03c7c5b1b6fc714f104cdc9e6301
MD5 0c3453d782e6ef2f9928053a6622edde
SHA1 acd95eb4991d5e47e8b755329c24aa2acd0f6dac
SHA512 105c3f48a32199fdd5d0f5d9b58340d67d5aa2052851ee78ab0628855676563e9a1591a9a89b9977eb64e1b10d547e2b8bd2fad0b076732de639177c6afe21db
SSDEEP 12288:4AwSfxL/2Dc3ADLLmt0LDQewsAjeUtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ17:dBewsAjeU6mctvE/BT76+1NCE
TLSH
T19575E031FE75E036C7BF0DB21B26D316546C7A604B9219C3E3A88E9E59302D22776E17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 d3103f20739338d075e2a841d75be1e380e2ef369aa8267095da3fdf07008c46
MD5 b3d6240d92e1fb6c0562c3d7f9d61fb9
SHA1 553bd4a1ac04c4c46415fa508f6ece00a5e1c384
SHA512 b9425a42ac578a05f96f438cb0f91a3ab8d76789f430c35b7458b3e30402a268b2ae5a05c9d3a432ac359cab09dda1f5fb5c9be7037612b4450d3819d14dc2a0
SSDEEP 196608:zUEtQeTbvf2zlO12sJTv6Ja1cpVLyRIldPlbuJHZXeN:zUEtQevvqc2W1cpV2RI325e
TLSH
T1B2474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 67246009ff8ee39292c1014fdf368790d02276f3e67c2a7851099328c3ab0a1b
MD5 3fc003f5bbf946e1eb8c3d34107aff93
SHA1 f961bfae4e7984dffbec3b2a0fe7cae9353d48f2
SHA512 bc14320e85b236bfbf018b6065bc623d84e11e405505523334b020a884bfa2c9c6c6752823308e11a6b09e9c46038633c222e615d5ac2f0bd687cae4c3b468fa
SSDEEP 49152:DCbRquA/m2yL5zQfFiV+XenmE3/zB6mGvKVO+n1:8oqtVjnmeXeN+1
TLSH
T110D58D0976B8C1E4D1F6C77886A2C647F37178154B319BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 b0474a057d3b4efe9263e2c51e4eca37d703bd26910717e0d82b91dfb35f4528
MD5 ba49ce954e130d10928bf36cfe9acc96
SHA1 6eab9f96847134ed00ba984000c9915a6496c261
SHA512 0d3f710e116feb07637e94fa83b573752c1498f4e57efa543d08dace4fbd951016cb9d477c443f4a032c8dbed5d7bfe037f3b8050bfc6b8aa7a1c283ff1a1d88
SSDEEP 24576:JAhGL2IFoiwtA5l7S53VU6mctvE/BT76+1NCE:JAM1Foiq5O6mGvKVO+n1
TLSH
T1D3359E81E7F951D4F5F3AAB899B69171EA76BCAA5E31C20F2150C11F0E33A509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 fa7f6756f4746183e099f5679e4ab3424a2b6f2ae7a5f873cbf1d4a5a2055ba1
MD5 44b457b5bfa82e835f6e2a60c94faeaf
SHA1 f56181ddfcb4511c6ae6594c14ec65be811c80df
SHA512 1f8651a49f5f27624c7a27d19a5ce3a87351462228439bf9b44ef2dec10451cb1131f46f6745fcc2fdbd2121b4c444bd7a6b0560b341134209aafb893fca6bef
SSDEEP 12288:8mw5HEjsChNNBFgl0WDm+CpUtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCr6:5wuUOW6U6mctvE/BT76+1NCE
TLSH
T1AC65F14676A508F9E9A742788697C136F7F2BC513A25CB1F1360C61B5F33261BD2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 6350ddedc4d3de4a4e2c17db42b186367d936077cbdc71856165f42053177afb
MD5 1e99d5108be5196e4bdf400a891743b9
SHA1 89098806b04e4fd01c4950c1c90b3e367b66858e
SHA512 6bb00357f063cb73972acb893d4d5ad205c36bf36fc9a23d3860e0d01f3616ca9df41f8c3917c5ddb1b98c51c693477ea634d391b8585e04cc1c5db2b38ba460
SSDEEP 12288:9+Z1IyOUtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:gZuLU6mctvE/BT76+1NCE
TLSH
T126551286226520F4E5E702B8C9E19246E77178E6377603CF5221466F6F33AD26D3A733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 0fee864a5ff7f73a320bd59ad0a095dbb1ec51be20da82bfad48d95de7669179
MD5 002555b62d5288f552218f1eb5fb702f
SHA1 4b9662695745523d371a2fe3b3297ea9c4e49982
SHA512 1b5325a189060a11f4e56f0193f59c2b8e2f532402895c4da27da7d57ec6cb72c599b5e07d45bd395ba340de95cc93f50c882039ed6cee1356635035bdcc7d22
SSDEEP 49152:pj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGexAaLSF259ruMHwpXMi4FqJLd23Ud:QQRQyi36YOcPhLvw2gAf+PN3DXeN+1
TLSH
T1A6667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 084f69e3b3c05f7c802b4f64a22ebb3cd1585002f5e469391ef485cb1bffc663
MD5 e00666fbaeade614297d9bbccba6fa1c
SHA1 193fab3e007df20bebb41e7202bdd20aec12e6b0
SHA512 acf83bf143f0b9cbee230c81c51c832792a32e3cb3f5bdddc29db39eb4a4165f3f3cf74db533e7edea48c52655615070218632579e8403d733d00839806f10a4
SSDEEP 49152:Zj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGexAaLSF259ruMHwpXMi4FqJLd23Ud:gQRQyi36YOcPhLvw2gAf+PN3DXeN+1
TLSH
T161667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 e0d7923d8c897e627afaa5bdbcb3103e4c934e37f6e9e4de82dacfbe89eee3c2
MD5 ea97d6d80bd994b4e9bf5ea17b35a58b
SHA1 f9d82da91f352e118c8de64d9fdbf7704fd66bba
SHA512 d9caf870ac94f58caf50369e5afa5ef1a54475cfa59dc6a45e4ae3b7064dd04ddff9ce9479a733ff59bac2ad4ff9e1bf8d5c38cb95aab6a712bbb544aab81ed6
SSDEEP 24576:fwvLof6SRQ+rn/fDboqxN1nnh6D7DaHGTNHu7PNU3/5W/ohL0bU6mctvE/BT76+1:H68Qg55nhceWu7PNU3/x6mGvKVO+n1
TLSH
T11AB54933B2F600A9C44DE1769F4A872196D17C758FE1E3DB8511720A1BB2AD07B3A71B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 0d5030ea33ad90fdabe6bb06579e9ac29b0c48118898819c1caec84c258221c6
MD5 2237c23126163a5988c5a40aa887f572
SHA1 d52f5fa957675633380ffe3ced4638c056e447ce
SHA512 db1b0c91e5e513a42dd239a3706fd9c3718ecd9a11cc747c4448a18958332eecf3bc9b15e39d3fe1ad41442c24a439bc25b90288ee64ae844624f221829d4a1a
SSDEEP 49152:L3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbpN3Oh6tznm2FQ/nho2qkrk99T:Oy5112gYy5azzVva69nLKnhZUXeN+1
TLSH
T1B4167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 fb494486b3edd989568e0a988eee133da80819f7e2a93ba88dfa9e72a21ae52d
MD5 852c8d7775b9eb2d19a7f237aae917cc
SHA1 0ee6ae9b9b77a504acc2b64a1a7e04bb3f8159b4
SHA512 b3786d0551639e62800533fe95ff740fe9725af4bfabff3ebc881519fa751af5b4dc428f840da69a2e0bbc894f5595d26df46ef06ba44fee63334c5f89412955
SSDEEP 49152:hB+taZ3usBWOBr4tEG20bqx0z+n217aau1glr6mGvKVO+n1:3u6JmUxd2drXeN+1
TLSH
T12BD59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 5ac25d6204a23eb791e40f8e80d6fc90a65084e9a238601afd2d8cf17719e3a4
MD5 6b0221bd9e2627641138b802d12b7f5c
SHA1 22d3f13d41ff2915f7dd6a2f3791d54dcec0b3c5
SHA512 42c61a239d2a5d264f4de7a46b8dcc730f37db9735594ad34da6c702f9a26edbef3a1cbb9fd2d760d6931d9a364f4993e65bf161b0a064f0e2b051dc7b69329e
SSDEEP 49152:S1hpsNoJpF1A6BU44CwH7R4xf6mGvKVO+n1:SmifPkReXeN+1
TLSH
T140B5BE13F29900E8D05ED17887569232EA62BC460B34B6DF0A90B7961F7BBE46F3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 17f3125dbc2832e27a05808040692d94f8bef8624425d320e43980b1a5b47586
MD5 713d3a05c200c309e7390577b7a767e5
SHA1 93103db0ed0c9d088010b4f2313d526205069e72
SHA512 d996a2ad4aed44ecf927d046c949ba7d2fe9927e10bb1691819826b5e7bb63a294be0e414c9078b1df9ca771e4e5d1cfaafeefaf78fa4671c9fcc64728a50d6c
SSDEEP 49152:2SuZQIY0Be2KNRVtOnks6NMHqA6mGvKVO+n1:Y5dKvi61AXeN+1
TLSH
T1F1C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 222d2733ef744b915addc45d6e9f1cccfd1aec35a1dc322270e1e1a8ff252401
MD5 b87b5d62bbcef65fb453d74f2545653b
SHA1 be6666a45da3b6356c10692141c0f7e6bd38dc95
SHA512 2fe59d2ebd78df18841eb18a6614be36216f730c9ae67996e64605055486813f62ab60cfea9f4c4b2fa92270b7c81818d112dc4037c1b05a8acf769f82fb3f44
SSDEEP 49152:vhtSn8EApI0figXgiDn0AP5wb6mGvKVO+n1:+X2iyphyXeN+1
TLSH
T1BB95BE13F2D900E8D05ED174C7468632E962BC160B39AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.3MB
SHA256 02b1e7ca2c8103895effa30f32af371b8875ffaeab95c0a6170697c1787b1439
MD5 7742673502d55497a7bd03281f68ff3e
SHA1 cb6ff28193569f380835cc34bc7109e324181782
SHA512 756583386f7a0c743c77d4dcef99d76fc6501fa3f656928015f1cfc2be7af485e5a36168163c6a59a8a2be228508c60d8e4e7fd8cf838c09c335233e03b93ddb
SSDEEP 12288:YvUtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:YvU6mctvE/BT76+1NCE
TLSH
T113552381981B01D4E9DF07F09395E29AE8502EFE74DB1881F326851FAE705627D0FDAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.3MB
SHA256 3bc15e2892dc8d1092aeaa52729943feec971de0f3f9f5e423979a5e1a99a352
MD5 c82982d0411b1455961caae03c0e6eb2
SHA1 7b3991d37fa7f01bd925adcc2e481b22c1db15ae
SHA512 34e4a888666a6dc890f27dcff8127afd2dfba76740bee502d5d6a8ab6d67ef5ae7b3df1e6a8f8b235e6a1cf6ab5f22720816eb7e7902fc8166832b6b3076a257
SSDEEP 12288:0SUtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:0SU6mctvE/BT76+1NCE
TLSH
T148552381981B01D5E9DF07F05395E29AE8502EFE74DB1881E326841FAE705A27D0FDAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.3MB
SHA256 a61cf70c3bbd66061c3ed0eaf8e18487f8a0039b02c746b934f48ab14247cbc5
MD5 95be6f8ff2bdcd2568565924f6a2693d
SHA1 3feacda61109b7f1bfcb2893f2aa2812bead7cfa
SHA512 a3fc9cc60e115239fea1a71924e89584c8b0b1a9ee15293812947c972e002ae3f01e18618312294c48128135da698118131a2437275b908b19caf533f48c98a2
SSDEEP 12288:x4UtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:x4U6mctvE/BT76+1NCE
TLSH
T18C552381981B01C5E9DF07F15395E29AE8502EFE74DB1881E326841FAE705A27D0FDEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 b33a67315caba6415d9744c6585faf9708906f2c158eaad7a86bdbd7f32f5750
MD5 841142c896857a0d006c6ab1688fba3b
SHA1 8bd83e89ec2a608dec3a1e4953137bb9db210904
SHA512 5c1c277ae210eb630ef95eec91f77f25af8b846d4ae1e61f4c3f189eae07f9b10ee3b4d885039535ef7d84b8c5751b5714962249254e89e34c7522a1887e8c75
SSDEEP 12288:ZV1UtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:hU6mctvE/BT76+1NCE
TLSH
T103552382692B01C0D8EB43F0C6A2D296E5B07DE975A719CBE311481F5E703917D2BFA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.3MB
SHA256 777aca30aea6440043ef429a7100e11bcc9ce70435f1794046297569e2e784e8
MD5 4591fda1e3c997c41da3cf5ed4b949b7
SHA1 34007700fd4595857e087aae2c03d2c8c5823e83
SHA512 80ea5676abc0a394e1ee92a7b4bb0ce64215d8527ac5aeb9a3eeb77073762f54d6c43e266aba2b31690a69ab58803835218f9b9485077f30a986535ce36e4e62
SSDEEP 12288:zNUtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:zNU6mctvE/BT76+1NCE
TLSH
T1DA552381981B01C5E9DF07F09395E29AE8502EFE74DB1881E326841FAE705627D0BDEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.3MB
SHA256 6883abbc9719ed605a3cac6aa4b412a910717741c3dea228c0af4cb1c0cd0463
MD5 a02e3f235f42780723ea25b4bfa4e04b
SHA1 471ee493955dd6375976d9d4c6cbeec5387363ee
SHA512 bddd35d9be6f92dd0138c3c575d246f919a303419637594f3ad471eed291030708bce9ca7a3e931fd1958250d54abf8bb70a1f1cab404757de1436a88cc0643b
SSDEEP 12288:rGUtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:rGU6mctvE/BT76+1NCE
TLSH
T1D3552381981B01D5E9EF07F05395E29AE8502EFE74DB1881E326841FAE705627D0FDBB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.3MB
SHA256 0882374dabc77e8138c79054cc955a981524030dcf1c4312f27dca2571eaec45
MD5 f55798ceea89585923a854371b91a2f7
SHA1 98d00fdc34264a76d26de008d1d0869b36b0ad5d
SHA512 ca056af113b6663bfa81462c23b6d81a98cd87e83d46d5072fdb8e0105675e5f593d407a8714245002e9b0a004c49546709924470695b72dc4bbcadd6176af70
SSDEEP 12288:1KUtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:1KU6mctvE/BT76+1NCE
TLSH
T14B552381981B01D5E9EF07F15395E29AE8502EFE74DB1881F326841FAE701627D0BDBB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 a51f259e6b617e4ca258f49d14cefc282194f5edb2c926677e3411dbebcac6ce
MD5 97e35a6a687087b6921b22a5cce50819
SHA1 c5f30a02bd91faf6f00e86fb3daefa60b37c259e
SHA512 06afbe9334c66a1c2bb547862b39eae56cfd22653d7b2c2a3852040ef4b72c85a294d27f8ef31a97e84795853c93c666944ed415c36189c67862ce72fc2eb0ea
SSDEEP 12288:xiZwbNzzFEoS2cPvyyUtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:0ZMJzFVSOyU6mctvE/BT76+1NCE
TLSH
T109750295B35118F4ECA7427EC9558506D6B27CAA16B0C60F13B4362B5F333A11C3EFAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.3MB
SHA256 d6d7ee60f7c237c5686c0145961fed680d6241b6f6598ff7a8ce0c98f1608c32
MD5 e0360ecbd378fbe8fd123c46a8085d95
SHA1 616c9c4880494dca41e4f9f71e4e064acdb56db7
SHA512 4c182be76c8b2d4695b93dcf92d04505963d7f4355c03a9e8f14453c0c51f970714d71e0469d85fa9b9936b840ecc0d7fd9009ad17caf85725ffd1b106bee1a9
SSDEEP 12288:f7UtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:f7U6mctvE/BT76+1NCE
TLSH
T131552382981B01C4E9DF07F15395E29AE8502EFE74DB1881E326851FAE705627D0FDAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.3MB
SHA256 6df4b29693515933796e5a6ab7e4e479fd43a392ecdac44c39930155c7f218be
MD5 75c9c3a219dd9b8db4ffcf5121d10cf0
SHA1 39aaee9d3db1e1484f514344c1d18e261661f92b
SHA512 b739f86d9f7fb487023020ffc97a1b30ffd7076d972544372e93aa59865dd5aa24093809be0790195b89b5cc25533fbf85bb6af7e044d305875e1b48f5896dce
SSDEEP 12288:4XUtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:4XU6mctvE/BT76+1NCE
TLSH
T1E5552382981B01D4E99F07F05395E29AE8502FFE74DB1881E326851FAE705627D0FDBB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 771e66dcb4663e6cda5cbad7a6d0ac59223ec1fb183670fd2dd956a6af407f42
MD5 321137dbba9c6706287fe648b24e3699
SHA1 a4ef292eb77c650fe06584257199885f569634ca
SHA512 be66a91faf6f258a62ba24b06c608c295613b9410fc9898ea4e78501e0c81dadbc2a3907651195c52a3a4532ad560292b06d3f7dbb53908ea172b6762bfcc790
SSDEEP 12288:9yPz5L8OUtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:0zyOU6mctvE/BT76+1NCE
TLSH
T19E651143726630F8D5BB4274C9A25202F77178B627654A9F5360463B2F332A1AE3FB71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.3MB
SHA256 2310a9a7bddfd9732217469875f77dba282668f5651321964cf40f252c390b54
MD5 5129d8be517e6c40480aa171b1214d3e
SHA1 6c5d24c9a8ab6b026d77856c0ac30123e6365568
SHA512 7f5a6cb5984246da176285cab21814d438b82191b9c3a045607958fe9c8bcb42ab8a31638dbdc1e0dd53e52fb8b513dc111f3a792f15da6ffa972f3b9ca1cfcc
SSDEEP 12288:c7UtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:c7U6mctvE/BT76+1NCE
TLSH
T114552382981B01C4E9DF07F15395E29AE8502EFE74DB1881E326851FAE705627D0FDEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.3MB
SHA256 56e806f71a4feaa1825513c4f5cc5fe7ea369cd6514f10b8a4a9551dd974d70d
MD5 35801028c81ebe0ee9c4893957c434cb
SHA1 71923ec79377d3019209c16e7caa30cc11f98c8f
SHA512 ce359802daf104b2d2cfc14771977209b83bf5e5dba5f707e44f31e1b8f3070c9b2aa1149f93b042edd2ec82576c42c833dd52923a8a1a018ead1bac395a2ce8
SSDEEP 12288:47UtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:47U6mctvE/BT76+1NCE
TLSH
T170552381981B01D4E9EF07F15395E29AE8502EFE74DB1881E326841FAE705627D0FDEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 85a2a4228db361129d1b20b7139b972c80f7bb219519203072619e266625f392
MD5 637234f3efa4dd5902640045d33c1d27
SHA1 fd3d2255bdbd082a26dd43854f07f79326d7bc88
SHA512 4a04f9282afe2c7654289a251e65ac026236a408e1a29d14cc245b37bc051e78b02327dc6fb15ae4b8f6163ee99f8cfcba57d0b45c35d458dfd1fb44aebb5eef
SSDEEP 12288:MyPz5L8OUtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:VzyOU6mctvE/BT76+1NCE
TLSH
T129651143726630F8D57B4274C9A25202F77178B627654A9F5360463B2F332A1AE3FB72
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 5a8f2341ba92f7a40877cf616e33752d83f091a07fec924c95149a73f67effd1
MD5 adeaffc2e2e0b7f048e0a558503cbe01
SHA1 089753f4b689a28523dae948f1d28a70c12c20f2
SHA512 edff52a2d3f0796679b1d26a2f452108bc12b121ab36c90c604d1c96f735c131dbcc3aa167bc0b69821300270d403c94e52d7de69de00c6300bff1d843789513
SSDEEP 24576:9cP4mcvIjkGOxhKP2l71nNKbrh/8KBTU6mctvE/BT76+1NCE:CP4m4IpOO67W8K66mGvKVO+n1
TLSH
T1BE65AE2DABDC0096D0BB917485658A4AFAB1742A2F3286CB1160933D3F77EE54F35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 83c0732f882be502d9ab8b2d026675de74cf4d5f89061cf8956f10bcb6b8d681
MD5 d8c0ff1995369f5bca0cd7cc23b26071
SHA1 1919ed1aeeae35ebbd737ec73786fafc51b5479d
SHA512 e1b78bc7bae353303c6a74abbe0ec99aaadb0a803ee2543676555f41a02ebe533f6c4dd995124926c0bbc7c7d540b42b5bbd01a6c1020ae6bfd54d2e11bac8ea
SSDEEP 12288:MXsfLUtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:fLU6mctvE/BT76+1NCE
TLSH
T11C65F14AD25902D8C0AE12B5C7569241F7333CA5A7E293CB63D0F53E1F31690ADEAB53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.3MB
SHA256 ab5ca899432c33d36b2f0b91a166fbbca0c0652934de7c8765072bc617d4c886
MD5 7e0a92a0886914de36df7dabca89beef
SHA1 4fbd796b4e1f5f164ae6ad544119029de208ee98
SHA512 eb1e883bc8d444793d6b00f33fbc627484e42af5224fcb144c677ace56aceea572692c1aa9e6d75b74182de0974ff3523126f67df82098c7b655b2dae3ab92f1
SSDEEP 12288:OrUtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:OrU6mctvE/BT76+1NCE
TLSH
T147552382D91F1185E9FF07F05255D26AE4153FF93CDA0883F212851FAD305A2BD2BA6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 f8111b9726a36e3952dea727b32c0b362a5c2d97ddaf847b3875fce5518dd75c
MD5 0a75380107cfa6e9df8b42c3c7a90f4a
SHA1 253492171c12e9c36d71541c5640cbbf03189a02
SHA512 bc208fb8a67256d34d003e4d4ce4261fa8ee89ce70435ecbfa211bfd6904274ae644184576162ce3d0a89e20540f0bff0762d4d1d6923e91ebb8a1cd58db97ee
SSDEEP 49152:0a0h2GEkuAe73q3pp46zwwQ26mGvKVO+n1:0a0hNYG4JwZXeN+1
TLSH
T11A85AF1E67EC82B4D0BAD278C9A6814BE6B2B4261B3156CF1151853E3F37DE44D3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 339e2087f1d37f3ce75c31f62d13417ced4a8f83187cf90987d61bef0b847d06
MD5 8867b54b4badde840e8369812691d57c
SHA1 0a4a9ed01382f3b705226f3d4298e267ddb31809
SHA512 2cb71bc5bdc332202a6e4051453be847dc95aae2ad17aa1a6e5549b0c086477d407bf5f4ff7b5e4fdade7ae64ae903715a2513852f5c5fdc0f33f08605135f5f
SSDEEP 12288:DhbHjfXiUtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:DhbHjPiU6mctvE/BT76+1NCE
TLSH
T11C55126E166E10D4F5B692BC8291824AD730BCB5271253DF6392813F4F33AE55C3AF92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 55beede23837fe1bdffafa123b143295070a92244dc8b899de965f9664cff4b1
MD5 904d4a84ea8c53ea956b6d69af3bbbc5
SHA1 d8414b40340de6c86b30afb733d0884dfe1f7ca2
SHA512 b3c13d8f2356d44e7ed4f8d7728ae6a9e371d8fa5661b9a81bbae467151484eeb9bfe207a3c1bbe407585f15f159f92342e7b5c491477f6a3223a8943ead2df2
SSDEEP 24576:W3YgnJcRTk4yti+R5dBR/6U6mctvE/BT76+1NCE:WIgnaTk46pBR/l6mGvKVO+n1
TLSH
T17B45BF2DF2B910B9D8AAD236450143B5FB71782D1F209ACB0170C539AF16EE85E39F5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.3MB
SHA256 ffc791eb0b4a8012eeedbfd4a9e61b4ad8accc76d767814829d864b294c174bb
MD5 22cfe92e6e30bbcc7007756d3478d6c4
SHA1 668fdf26672b352bd7c0670dbae7aca879a03a54
SHA512 adc8a33032b9ab8457ee4f64dc4d96fb02d8b14d6c9d402299b4558b499e5277d6aa064fec0f358c6ef91a322288272fd8ee71dd97fc487fb2db20f4c8f93a49
SSDEEP 12288:jHUtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:jHU6mctvE/BT76+1NCE
TLSH
T14F552381941B11C4D9EF07F05296D2AAE4503FF936DB18C3E226851FAE305E27D3B9A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.6MB
SHA256 e2d8f5f3a390b65317b7c7c00aab82a62041781fc50576c61477aa151b13c7eb
MD5 fa0512a4ab455facdaa6fe6870a316ec
SHA1 ca85ce13bb63da48eb0c24e396a3953e1f640da6
SHA512 76643d81e0f00f09e72f2a9b18f0c4cc0481c51c75c1afef564b6b31acf99ef92cc37fcadf81b96cf9abfd8c24c5a527da7beb8c8f872c840e5d3f2fc6024747
SSDEEP 12288:wObmA4LWOsvAYFT0UtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:t2L3UT0U6mctvE/BT76+1NCE
TLSH
T1B4750145F69500F8ED7B817CC9A2C616E272789D1364E7DF03684A6A1F237E24E3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 fed4ab92b638a9e48ddf0d46ea4b23b8fdcace200e0908dae96e436df1d963c5
MD5 c79ce31903215dbec1bd45b7cee70fa6
SHA1 527bcca468a9d8a0bba3741bf0e298ae45493e0f
SHA512 5e09bc92d79289331018b4da71b8e13a4b3acb4ba18ccfc36a75bf3b722b8c027c6c7dae9c5ca9fa0b7ed5d2f6b33acd704fbc3b702dd089bb075dd123f73560
SSDEEP 12288:WpFtXOwUtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:OOwU6mctvE/BT76+1NCE
TLSH
T14F55121A36AE10E4E47A52788682834DD37178F6176217DF4290817F5F73BF86C3AB62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 2e9fddbf8c39438d5c15d1b512954cb900c7a7008533788ce5be92217791d725
MD5 3a9409a2949a470f9ed76f608821d32e
SHA1 645f06eb142a9defb3ff6ccb4ba905ce57d33f7a
SHA512 851151745de12671526c3b38b0d7f35b6f7322f7d4986b0fe1bcdd9df2713644b3ac12db8047d975689c9b24128de82b03c527af6b0dd3ed4d53c0530a4eef4b
SSDEEP 24576:x7NM9YqZqmWMUkPjZM48Mv6bEhs7U6mctvE/BT76+1NCE:x7cBWMpPjN8DbEht6mGvKVO+n1
TLSH
T15665AE2E6BAC81D5D477D13DC9E28206F6B1B4611B318ACB1162833E7F37AE45E36721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 c8abd3c8b2def9ca6bfea97745e4a84293ffb60b4d421623754945b4971fef08
MD5 905459e50f5b6db35ebc29671ad530cc
SHA1 cc76e142b38a6f0f7a98692f3ed86a894904084f
SHA512 8e0cd7ab2c967e35a1a6d7f0e0d731b19b8779b63bed071058e13f71798d69d5cd3431daf289cd1108e897ac613308cb424a1213161f6566e092fbe50fc52b4b
SSDEEP 24576:mW6BApg2YuyuNDYTabvcdvNYf8km1hU6mctvE/BT76+1NCE:mF2YuHNETovAvNYf8kmQ6mGvKVO+n1
TLSH
T1CF858E2927ED80A4E0BBD2BD45B6D246FAB2B8511B3055CF4255862E1F33AF44D3DB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 7515f3b9d66bf43b15d2d3ad93620efbeb67456e42cdcb989d43b92d2600c54a
MD5 f2d7ed895c417bb7c664f0acf614a163
SHA1 01377119ab38bd65bd2b2ed7b3bf196f3aa0430a
SHA512 be6cd221a404835e5893bd8b4b97f9aab67b503d5b2da4ebf5a9364d344acdbbd82f4195947c8dfe326e50dbf16c14516cef82b3b0c2ab512308bc96ca9c28de
SSDEEP 24576:nAFs06+OmlfQNXEbTo8U6mctvE/BT76+1NCE:AFs060lcXuW6mGvKVO+n1
TLSH
T13E65BF2F62AC00D5D07ED17D8A97C91AF6B1746707255ACB0260C63E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.6MB
SHA256 3fe33244c6924f67d375064fa03effb4b1ba5d213ff2b19bb3e1bdfa27b63cd2
MD5 60f46e45b214abf7735ab9133bf68df9
SHA1 4ed21f4ae5abb4a50463ffdabed0ee6aa4c692e1
SHA512 419f73cbb4624f9836597dda466db83c3d523278554962be9d727d3b0b992be8c73b5398594da03c158c65c4ccc0ed8195b171bfbcbd135a9c767eedb5137153
SSDEEP 12288:2CJnJ5D3VkrazxbUtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4c:HJnJ5D3WKtU6mctvE/BT76+1NCE
TLSH
T1CC75E02DD2A810E8D4B7C3B4825A1786FE72387D2F2269C72474D5353F12EE0A979F15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 51987f515fe3050c07ef0f283e25dcf900d63b38eff6e53625ed1f21171599a7
MD5 6b82e502989ab4e330015c1e5b72035d
SHA1 9d7b220e55259bf6cc6b40723b0709a6c5fea04b
SHA512 b90a2f25801b6d8f91062133c0bafe520d2d08c7a011fe5d93f33d791b3dbff87b9a3e94e426cbec6c465af63048bb0ea85e40d4658079161f1e35e49d850642
SSDEEP 24576:0EPghm6/7IIXdwcXrif7qQncjlP65i3Vu6U6mctvE/BT76+1NCE:bg06DIKdwc+eQnSt65aVc6mGvKVO+n1
TLSH
T18A955C15B7EA5294E8B3CAB1C962A1169B327C509B34F7DF0AC0C92E1E33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 adcf2b1973fc3966b65f0dd397d8f2f8ec21d070b59b86413a41aed78c57f545
MD5 2e806096981881619b91f8836b458017
SHA1 fb5e08c9f462c2cdb4ca939812d7cd61454b29d7
SHA512 82a50199296628888ff1e4fb6d866be93b4ef2dac2d0a902178c25801feb6e598cc6848de72f58aef623dd1660a2f56bd39a432c08c4b628e178fa137b05a7f0
SSDEEP 12288:5EP3RipUtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:KipU6mctvE/BT76+1NCE
TLSH
T17B55129D2A1E20E4D56B51B88291C245D372F4F43B9227DF52A1C23F4E33AE52D3EE52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.4MB
SHA256 53796e1b23bae0c01eba469068ac5ee11c30e7d37b06928ea3c9e12a1ccb0df7
MD5 68306249a09377ee4d561e1f4f6642b9
SHA1 456b77b35fe114121247c5a70d3e45f7bdd8881b
SHA512 2cd87f6a62c4cdd0bf6e9dbc6c198b38aeaf049ff47a4470e58613cd2a05d10ef01e5c4ef68a459674c8c867d4e184f1293181ed8e2f33841cafc6abbdc213ab
SSDEEP 12288:ZjkySUtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:ZIySU6mctvE/BT76+1NCE
TLSH
T146651241635910C4E9BA06B496A38295DA30BCB07F2616DFA190E63F6F327D0BC36F57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.3MB
SHA256 0152a467a9a9d6fb1d921e26bc9b2eddc6400a3a2cdd29faa1803e7a4aea1027
MD5 e3db768e97f2bc090b187177a70c6c9c
SHA1 60b20e26f4c541dd4e1dc53868cf1173d5489211
SHA512 9f4af5c348cff4481855e4a9bba325215c2c5c4fcb3fa21f3e2cf01021c1a86d38328dd7d366228fb9975fb7990e4ad1e312e8d9911d393c48b8b37b7fc8a119
SSDEEP 12288:8XgUtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:UgU6mctvE/BT76+1NCE
TLSH
T126552385542B21C4EDAB07F04355D296E4203EF93A9A28DBA2A1C43FDF301D2793BD97
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 8192c864dd56ea8527b3aba50aa2c5159e612bde21852cc27c4751814f7089ab
MD5 41b20b4f3efa2a730faa7a7f1274b422
SHA1 0594b7cf8552302322922fe07a02779fa442f70f
SHA512 e7138c5f4786505c8349589db24f251c1889fbe18443a6e8a40d8913aa9ea69731150e602e8c449f96a5ae22a128ea50858ddce23a76ed6bdea6c8121b94528f
SSDEEP 24576:0Q9MxZKdcz9dw3jU6mctvE/BT76+1NCE:0VKZY6mGvKVO+n1
TLSH
T17D558C2DABE905CAE177D27595A250C3A633B4311B31D6CF2448D03D4D7AEE8AE78F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 933c1cbb16f7e59362259a430486b971f47c657122a4de34edca3540fceff470
MD5 a7633ad427a976fa67a241dd7cbb7e42
SHA1 caeaa4233eb7996d91c6e41d270eb217d5c72c87
SHA512 41e058f1fbad8872fed3c1de536ca61d40caaf1c64b92fc9f201160f8fa6a9f2e0481cc6321680c86febf75b5c60840250218898cb9892b2723d8d6c5bcd0c1f
SSDEEP 12288:EyoKo2ERple9peUtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:EyocCApeU6mctvE/BT76+1NCE
TLSH
T17D65E05FBB6E00E1E176813C89858345E773B4742B6217CB6291C33E8E239E9BD35B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 27e5085d1c06bf9c6b1a2e45b07883033d9458b6394232649eb8267f59cecc3e
MD5 c7c835605990fe18af8718348042a794
SHA1 79c39aacc0f13d9c9eeb473edf23524e7674a9a3
SHA512 313c296d93306405be469c0dec09b81b3e16e508ea036dc068d0911887d8c96179500ea47118d21f4a9cf825ef90febf7e0dc99bc8f1725cd67f24390ad85cc9
SSDEEP 49152:3WcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKh6mGvKVO+n1:v0zuNIbXeN+1
TLSH
T1F5A57B3DA2BC00A8D8AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A39F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 de68322db997a437bff504b10c5b0287e7cdf123f0649369ab2a5038df0268e2
MD5 0b4b02d952e68407baa1ba7eaafaa9e9
SHA1 dfbb928acae64ab7d308da743f75a72b09941a0c
SHA512 701b7c6cfbf91a442c9751824f4154451e7ac595819db6f83c186c3156571ab51e59c00eaad620388028bf7ae3d872141f3cd92d8ceb5f0dcf94a3a311030e25
SSDEEP 24576:Y1QT7EcpfxR+N5AWAz3ooiYsjMqbpU6mctvE/BT76+1NCE:lTDxR+N5YzTujM/6mGvKVO+n1
TLSH
T17055B02EA7F905E9D1BE85788B23C512FA727861033193CB42A0C17E1E779D85E7AF11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.5MB
SHA256 1cdd4bf90fa2c33c9786455b9a09f70becb8f9870c83ce606ce3c27203cf8638
MD5 0cc49ddfc820b60b4006cb91f9fe348c
SHA1 549b2e442b52a4c36bfd858ac40a3011780a50dd
SHA512 aa91f2d41d58843882539aed92b37bca4e69e860da9deeebc14155d567b0684d68e0b62fa7885a3dd1d82ec75fb222efe44921758ef427544f8b25cbad397a49
SSDEEP 24576:fTMdOz0FFS+GmSL1U6mctvE/BT76+1NCE:90K+GmSLe6mGvKVO+n1
TLSH
T12A75E17EA36E14E5E47BC2BC9643C506E57234A6032266DB0690C17E2F67EE4393EF41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.3MB
SHA256 9751ab2c7437fb61171e1c1265601f33c4f7e74a6ea095a863a338dfd388ee69
MD5 72a3a286ce7af36fbd9b2f8516e993c7
SHA1 dc5b22eb57990fe85deb467d2c764f688dedd155
SHA512 a85e8cb98dea6fe9da1946138cb718e40cbb68a939128a84d505190128754beb9b80d5e27d67f3498497ed4667d2a6e8235ebaa84eff1a65233b351295906c1a
SSDEEP 12288:k4j0UtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:r0U6mctvE/BT76+1NCE
TLSH
T10B55124962AA30D4E8B752B086668256D530BCF6336619EF31E0C53F5F326D1A93AF13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/432-13-0x0000000140000000-0x000000014015A000-memory.dmp

Download

memory/432-109-0x0000000140000000-0x000000014015A000-memory.dmp

Download

memory/1012-98-0x0000000140000000-0x000000014015B000-memory.dmp

Download

memory/1012-93-0x0000000000B50000-0x0000000000BB0000-memory.dmp

Download

memory/1012-87-0x0000000000B50000-0x0000000000BB0000-memory.dmp

Download

memory/1012-160-0x0000000140000000-0x000000014015B000-memory.dmp

Download

memory/1036-101-0x0000000000620000-0x0000000000687000-memory.dmp

Download

memory/1036-106-0x0000000000620000-0x0000000000687000-memory.dmp

Download

memory/1036-165-0x0000000000400000-0x0000000000547000-memory.dmp

Download

memory/1036-110-0x0000000000400000-0x0000000000547000-memory.dmp

Download

memory/1316-157-0x0000000140000000-0x000000014017F000-memory.dmp

Download

memory/1316-83-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/1316-77-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/1316-76-0x0000000140000000-0x000000014017F000-memory.dmp

Download

memory/1432-274-0x0000000140000000-0x0000000140146000-memory.dmp

Download

memory/1432-121-0x0000000140000000-0x0000000140146000-memory.dmp

Download

memory/1476-74-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/1476-30-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/1760-236-0x0000000001780000-0x0000000001790000-memory.dmp

Download

memory/1760-529-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/1760-174-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/1760-252-0x0000000001A30000-0x0000000001A40000-memory.dmp

Download

memory/1760-272-0x0000000009E70000-0x0000000009E78000-memory.dmp

Download

memory/1952-158-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/1952-397-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/2044-364-0x0000000140000000-0x0000000140192000-memory.dmp

Download

memory/2044-149-0x0000000140000000-0x0000000140192000-memory.dmp

Download

memory/2224-154-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/2224-152-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/2328-66-0x0000000001A70000-0x0000000001AD0000-memory.dmp

Download

memory/2328-68-0x0000000140000000-0x0000000140185000-memory.dmp

Download

memory/2328-64-0x0000000140000000-0x0000000140185000-memory.dmp

Download

memory/2328-61-0x0000000001A70000-0x0000000001AD0000-memory.dmp

Download

memory/2328-55-0x0000000001A70000-0x0000000001AD0000-memory.dmp

Download

memory/2364-0-0x0000000001FE0000-0x0000000002040000-memory.dmp

Download

memory/2364-70-0x0000000140000000-0x000000014017B000-memory.dmp

Download

memory/2364-8-0x0000000140000000-0x000000014017B000-memory.dmp

Download

memory/2364-9-0x0000000001FE0000-0x0000000002040000-memory.dmp

Download

memory/2584-349-0x0000000140000000-0x00000001401B2000-memory.dmp

Download

memory/2584-142-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/2584-136-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/2584-146-0x0000000140000000-0x00000001401B2000-memory.dmp

Download

memory/2664-114-0x0000000140000000-0x0000000140145000-memory.dmp

Download

memory/2664-169-0x0000000140000000-0x0000000140145000-memory.dmp

Download

memory/2960-161-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/2960-398-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/3288-348-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3288-173-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3288-117-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3956-129-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/3956-332-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/3956-123-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/3956-132-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4000-528-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/4000-170-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/4248-72-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4248-151-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4264-53-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4264-50-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4264-145-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4264-44-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4800-166-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4800-447-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4856-131-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4856-40-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/4856-34-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/4856-33-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4860-113-0x0000000140000000-0x0000000140159000-memory.dmp

Download

memory/4860-23-0x0000000140000000-0x0000000140159000-memory.dmp

Download

memory/4860-17-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4860-25-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4860-24-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/5000-368-0x0000017DCA140000-0x0000017DCA150000-memory.dmp

Download

memory/5000-402-0x0000017DCA140000-0x0000017DCA150000-memory.dmp

Download

memory/5000-406-0x0000017DCA140000-0x0000017DCA150000-memory.dmp

Download

memory/5000-369-0x0000017DCA140000-0x0000017DCA150000-memory.dmp

Download

memory/5000-370-0x0000017DCA140000-0x0000017DCA150000-memory.dmp

Download

memory/5000-371-0x0000017DCA140000-0x0000017DCA150000-memory.dmp

Download

memory/5000-372-0x0000017DCA140000-0x0000017DCA150000-memory.dmp

Download

memory/5000-373-0x0000017DCA140000-0x0000017DCA150000-memory.dmp

Download

memory/5000-374-0x0000017DCA140000-0x0000017DCA150000-memory.dmp

Download

memory/5000-375-0x0000017DCA140000-0x0000017DCA150000-memory.dmp

Download

memory/5000-376-0x0000017DCA140000-0x0000017DCA150000-memory.dmp

Download

memory/5000-377-0x0000017DCA140000-0x0000017DCA150000-memory.dmp

Download

memory/5000-378-0x0000017DCA140000-0x0000017DCA150000-memory.dmp

Download

memory/5000-379-0x0000017DCA140000-0x0000017DCA150000-memory.dmp

Download

memory/5000-380-0x0000017DCA140000-0x0000017DCA150000-memory.dmp

Download

memory/5000-367-0x0000017DCA140000-0x0000017DCA150000-memory.dmp

Download

memory/5000-365-0x0000017DCA140000-0x0000017DCA150000-memory.dmp

Download

memory/5000-366-0x0000017DCA140000-0x0000017DCA150000-memory.dmp

Download

memory/5000-407-0x0000017DCA140000-0x0000017DCA150000-memory.dmp

Download

memory/5000-403-0x0000017DCA140000-0x0000017DCA150000-memory.dmp

Download

memory/5000-404-0x0000017DCA140000-0x0000017DCA150000-memory.dmp

Download

memory/5000-405-0x0000017DCA140000-0x0000017DCA150000-memory.dmp

Download

memory/5000-401-0x0000017DCA140000-0x0000017DCA150000-memory.dmp

Download

memory/5000-400-0x0000017DCA140000-0x0000017DCA150000-memory.dmp

Download

memory/5000-399-0x0000017DCA140000-0x0000017DCA150000-memory.dmp

Download

memory/5000-395-0x0000017DCA140000-0x0000017DCA150000-memory.dmp

Download

memory/5000-396-0x0000017DCA140000-0x0000017DCA150000-memory.dmp

Download

memory/5000-381-0x0000017DCA140000-0x0000017DCA150000-memory.dmp

Download

memory/5000-382-0x0000017DCA140000-0x0000017DCA150000-memory.dmp

Download

memory/5000-383-0x0000017DCA140000-0x0000017DCA150000-memory.dmp

Download

memory/5000-384-0x0000017DCA140000-0x0000017DCA150000-memory.dmp

Download

memory/5000-385-0x0000017DCA140000-0x0000017DCA150000-memory.dmp

Download

memory/5000-386-0x0000017DCA140000-0x0000017DCA150000-memory.dmp

Download

memory/5000-387-0x0000017DCA140000-0x0000017DCA150000-memory.dmp

Download

memory/5000-388-0x0000017DCA140000-0x0000017DCA150000-memory.dmp

Download

memory/5000-389-0x0000017DCA140000-0x0000017DCA150000-memory.dmp

Download

memory/5000-390-0x0000017DCA140000-0x0000017DCA150000-memory.dmp

Download

memory/5000-391-0x0000017DCA140000-0x0000017DCA150000-memory.dmp

Download

memory/5000-392-0x0000017DCA140000-0x0000017DCA150000-memory.dmp

Download

memory/5000-393-0x0000017DCA140000-0x0000017DCA150000-memory.dmp

Download

memory/5000-394-0x0000017DCA140000-0x0000017DCA150000-memory.dmp

Download