505f885501a1e432948b4b413afce905d38e35279c5207347fb91db86216f577

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 14:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_93bcb46e242291cc3552f29f4da5c390_icedid_mespinoza_njrat_ryuk.exe
Size 14.0MB
Sample260804-sa296szycw
SHA256 505f885501a1e432948b4b413afce905d38e35279c5207347fb91db86216f577
MD5 93bcb46e242291cc3552f29f4da5c390
SHA1 423a6963cf791ae1d28389ace21ed3b7b8d22932
SHA512 b42a88adf1148f0c889e13522801d0776f95fa0ec779fae14e7659162e4ce5f11dd6a628572644d8514404b34bb1cb08b6f33168b837bc2da8b92fd40e2152f3
SSDEEP 98304:MMmoXIjMTOdGN6cPs60ShPslo5gGC9AALHGOIcCFhXzeloomqrWETR9b:M+CUUShsd9b
TLSH
T182E6B3364578CAA9C1526837C4494CF693ADBC10C6B352B7D6443D37FABE4C2CA7E286
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
1872	alg.exe
1728	DiagnosticsHub.StandardCollector.Service.exe
1944	fxssvc.exe
1748	elevation_service.exe
4272	elevation_service.exe
5084	maintenanceservice.exe
468	msdtc.exe
4024	OSE.EXE
1468	PerceptionSimulationService.exe
3456	perfhost.exe
4740	locator.exe
1268	SensorDataService.exe
3708	snmptrap.exe
4608	spectrum.exe
3984	ssh-agent.exe
816	TieringEngineService.exe
3164	AgentService.exe
4332	vds.exe
2124	vssvc.exe
2444	wbengine.exe
1036	WmiApSrv.exe
4972	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 37 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-08-04_93bcb46e242291cc3552f29f4da5c390_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-04_93bcb46e242291cc3552f29f4da5c390_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-04_93bcb46e242291cc3552f29f4da5c390_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-04_93bcb46e242291cc3552f29f4da5c390_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-04_93bcb46e242291cc3552f29f4da5c390_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-04_93bcb46e242291cc3552f29f4da5c390_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-04_93bcb46e242291cc3552f29f4da5c390_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-04_93bcb46e242291cc3552f29f4da5c390_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-04_93bcb46e242291cc3552f29f4da5c390_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-04_93bcb46e242291cc3552f29f4da5c390_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-04_93bcb46e242291cc3552f29f4da5c390_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-08-04_93bcb46e242291cc3552f29f4da5c390_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-04_93bcb46e242291cc3552f29f4da5c390_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-04_93bcb46e242291cc3552f29f4da5c390_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\b540a8c668b29bb.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-04_93bcb46e242291cc3552f29f4da5c390_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-08-04_93bcb46e242291cc3552f29f4da5c390_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-04_93bcb46e242291cc3552f29f4da5c390_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-08-04_93bcb46e242291cc3552f29f4da5c390_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-04_93bcb46e242291cc3552f29f4da5c390_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-04_93bcb46e242291cc3552f29f4da5c390_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-04_93bcb46e242291cc3552f29f4da5c390_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-04_93bcb46e242291cc3552f29f4da5c390_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	2026-08-04_93bcb46e242291cc3552f29f4da5c390_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-08-04_93bcb46e242291cc3552f29f4da5c390_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	2026-08-04_93bcb46e242291cc3552f29f4da5c390_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-08-04_93bcb46e242291cc3552f29f4da5c390_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2026-08-04_93bcb46e242291cc3552f29f4da5c390_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-08-04_93bcb46e242291cc3552f29f4da5c390_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	2026-08-04_93bcb46e242291cc3552f29f4da5c390_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	2026-08-04_93bcb46e242291cc3552f29f4da5c390_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	2026-08-04_93bcb46e242291cc3552f29f4da5c390_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-08-04_93bcb46e242291cc3552f29f4da5c390_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	2026-08-04_93bcb46e242291cc3552f29f4da5c390_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_95875\javaw.exe	2026-08-04_93bcb46e242291cc3552f29f4da5c390_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-08-04_93bcb46e242291cc3552f29f4da5c390_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	2026-08-04_93bcb46e242291cc3552f29f4da5c390_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	2026-08-04_93bcb46e242291cc3552f29f4da5c390_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-08-04_93bcb46e242291cc3552f29f4da5c390_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	2026-08-04_93bcb46e242291cc3552f29f4da5c390_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	2026-08-04_93bcb46e242291cc3552f29f4da5c390_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	2026-08-04_93bcb46e242291cc3552f29f4da5c390_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-08-04_93bcb46e242291cc3552f29f4da5c390_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2026-08-04_93bcb46e242291cc3552f29f4da5c390_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_95875\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	2026-08-04_93bcb46e242291cc3552f29f4da5c390_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-08-04_93bcb46e242291cc3552f29f4da5c390_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-08-04_93bcb46e242291cc3552f29f4da5c390_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-08-04_93bcb46e242291cc3552f29f4da5c390_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	2026-08-04_93bcb46e242291cc3552f29f4da5c390_icedid_mespinoza_njrat_ryuk.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-04_93bcb46e242291cc3552f29f4da5c390_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ac431e722124dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9933 = "MPEG-4 Audio"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000faccfa6e2124dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d9df296d2124dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000192e576d2124dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
1728	DiagnosticsHub.StandardCollector.Service.exe
1728	DiagnosticsHub.StandardCollector.Service.exe
1728	DiagnosticsHub.StandardCollector.Service.exe
1728	DiagnosticsHub.StandardCollector.Service.exe
1728	DiagnosticsHub.StandardCollector.Service.exe
1728	DiagnosticsHub.StandardCollector.Service.exe
1728	DiagnosticsHub.StandardCollector.Service.exe
1748	elevation_service.exe
1748	elevation_service.exe
1748	elevation_service.exe
1748	elevation_service.exe
1748	elevation_service.exe
1748	elevation_service.exe
1748	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
668	Process not Found
668	Process not Found

Suspicious use of AdjustPrivilegeToken 39 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3060	2026-08-04_93bcb46e242291cc3552f29f4da5c390_icedid_mespinoza_njrat_ryuk.exe
Token: SeAuditPrivilege	1944	fxssvc.exe
Token: SeRestorePrivilege	816	TieringEngineService.exe
Token: SeManageVolumePrivilege	816	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	3164	AgentService.exe
Token: SeBackupPrivilege	2124	vssvc.exe
Token: SeRestorePrivilege	2124	vssvc.exe
Token: SeAuditPrivilege	2124	vssvc.exe
Token: SeBackupPrivilege	2444	wbengine.exe
Token: SeRestorePrivilege	2444	wbengine.exe
Token: SeSecurityPrivilege	2444	wbengine.exe
Token: 33	4972	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4972	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4972	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4972	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4972	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4972	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4972	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4972	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4972	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4972	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4972	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4972	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4972	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4972	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4972	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4972	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4972	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4972	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4972	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4972	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4972	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4972	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4972	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4972	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4972	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4972	SearchIndexer.exe
Token: SeDebugPrivilege	1728	DiagnosticsHub.StandardCollector.Service.exe
Token: SeDebugPrivilege	1748	elevation_service.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3060	2026-08-04_93bcb46e242291cc3552f29f4da5c390_icedid_mespinoza_njrat_ryuk.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4972 wrote to memory of 4936	4972	SearchIndexer.exe	109
PID 4972 wrote to memory of 4632	4972	SearchIndexer.exe	110

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-08-04_93bcb46e242291cc3552f29f4da5c390_icedid_mespinoza_njrat_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_93bcb46e242291cc3552f29f4da5c390_icedid_mespinoza_njrat_ryuk.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3060

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:1872

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1728

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:1156

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1944

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1748

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4272

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5084

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:468

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4024

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1468

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3456

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4740

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1268

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:3708

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4608

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3984

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:816

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:652

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3164

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:4332

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2124

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2444

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:1036

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4972
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4936
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:4632

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 88c93e077949c854f4f14f07ebfb7b5ad1f25a965655391ffd2d8322d17a4231
MD5 4160591ff47555ca8f802ad42c2847e7
SHA1 16af41e0263c0b6bc683b53c2a581a754041940b
SHA512 3c99b5ef13698d247fedaba98d528d42ad785484fd7fb44fa769b76c7f80cbe34a2049642c38789b62f58fd5f839f533e4b3c6d2a6a4483cbefe002c79a2f3d2
SSDEEP 49152:nb+632BuPkFKRrdE6ohmstBhuXjfS4LWxn8m+brLC2hTR9quLB:V3q6HjBZmqrWETR9b
TLSH
T144D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 b48014700e7112777b6978aae21a40142717f532e94ae426e04a4a150c9179c0
MD5 835df789fa8183090710255d63d181f2
SHA1 f0eb2dee80a622453c43a75495ec1029f366a216
SHA512 4577d1a3f7f7972bd54182ae9f2239c8e882ba46f16967915a4404dcfdc9f2a9e8f6f0bc8b1780973c74489c0fd15f684a1df9bebb0837003a6bca0178dfb495
SSDEEP 24576:4XYfDtczAtRmlh8t0D+7y8G2G9yL0cMoThTR9PyuLzpQo:vtcSm+brLC2hTR9quLB
TLSH
T1B305022867E408F9ED6B827CC8A2C501EA73BC914760E78F03E499651F336D85E3EB55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 13248b9bda09d3556ff391f5818d5bf4c46054b2937898093aba010c3674001a
MD5 210c2693cbbc21d3859e4958803e4ebe
SHA1 378ce8e25b6ea85e3b19a975902770cca9e1fb2a
SHA512 72cf20bb35967bab7e21f509467fb68a3f320f210f1f0a9a1a5ebf4f875849c9973ef29f6a66ff3f8ed285c6fca5fdb9fdc7903da392b82113f4dbe4244e4b4f
SSDEEP 24576:v0Le5ji0hmxirMkRmlh8t0D+7y8G2G9yL0cMoThTR9PyuLzpQo:vPji0Acfm+brLC2hTR9quLB
TLSH
T1D9359E15F6788335D073C0B9C5D2A69EE97130865B308ACB4286D77C3F67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 e2edb47b6953ae77a135c8b6cd255fc2e7f994c44ea2b67c05799c081b071bed
MD5 c5ff151aeaea9298522c4fe3db8f37c1
SHA1 326fc9c7d7dd95248279d39f3183f71e7d901d04
SHA512 963829ebb4f1e3a88bb9359e3bfe86ae90702363a5b1b190338e33b6181caa4140ef8485445e3dec88326f087e2d5b389d459ea06c21ac42c2ba0e61e5d61b60
SSDEEP 24576:la7/ezSC6vUyD/aqgrvWE6q8wyuCRmlh8t0D+7y8G2G9yL0cMoThTR9PyuLzpQo:s/ezSC6vUzPvxHjyzm+brLC2hTR9quLB
TLSH
T174755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 d00bf408dcac04a869f3a18e5e848bfa4f96d35317e7ee76d6b3dffedfc2ecde
MD5 0c86842570cd500468443805544c9c06
SHA1 871f9a4eecd57bc1227559143977d53105e6ea09
SHA512 9b111dec06c80d1f308f786e5e2ac5e6eb2d84ffcd3fe4b7029611c2a90c3b1484ebf766a904e5534f997575eddfeea0e48a22bd81a66c7a3278134d43a8b160
SSDEEP 24576:GVbqPb88hv/l+6JRmlh8t0D+7y8G2G9yL0cMoThTR9PyuLzpQo:GVO88hXl+4m+brLC2hTR9quLB
TLSH
T18F55AE65F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C3E67BE6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 1083b781d5a98fdbb1351cdb9245f98671106a0f8d8afdb0b9a3410ab6348b45
MD5 1184bdbf41c89aaf6921e61c2c17fb06
SHA1 af45759ca8189503618e4a19f09cd597dec4c04a
SHA512 3063887f1f154745352ff2645b3b319cec65771160b3bd1fb5b16123778f6d360f7fe5e8e0b35197c69c5c7de52680e92bfc7fda3524413ee92666d0031b35f8
SSDEEP 12288:zRVWRPelh8t14F4YfDY+o7KO68G2G9Ih40cjs31K6fq+hTR9PyuV5xFpQoT:zRwRmlh8t0D+7y8G2G9yL0cMoThTR9P5
TLSH
T147C42358CF2D0082F39FA2B1B2E198C699BDFCF1E984AC0EF1C17DD11674CA4962595E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 c1848ce10fa20d08d5af06af2bc4d34eb33feb6c2e41e14427677e02db7df2cc
MD5 26a47c0231be78fe576b25afd79f1e30
SHA1 8daf46f4fd0e1acf9a108c32cde87abae9ac9ca3
SHA512 01dfa6612263589f20948f5ff109ec20b6fbc7accd797195cd35a306612427e4c00c90bb40e0986193766b3d09e87164cf11abb4a50a45e41f2c57e8df9b7da1
SSDEEP 24576:2JIUxRmlh8t0D+7y8G2G9yL0cMoThTR9PyuLzpQo:2JIUxm+brLC2hTR9quLB
TLSH
T1B705CF3BEE28ECD2C27E9DB85791C640D77278704F51A3CBE165824E9E239E05E39C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 f2a19394f004cbbdb01ab8252b24ae83344b2dcf28acab94c78d456388b7d90d
MD5 b62615d179fa4789f8aa342df8df6481
SHA1 1e96326c2613aeb183afa27db73fb17a60e0d779
SHA512 ff2e371d492645e94f0c9195227ebc932a3f5a700ce9d42523f9246dfa254981d92e5c91644266d139176fe46b8e5ff32685f99e3670e8d17bcabe5f0eb7ec99
SSDEEP 49152:LQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THX:LQvGAdlCEL8c/yRNw5CymqrWETR9b
TLSH
T129267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 f718bee5b0e6e73a7c7b2c0885fc7a42a65b8a21bed1dba70a1091e2d141155c
MD5 6cf7c39c0c11b89bc8b4dbcae26fef0c
SHA1 fbbf9fcdf6b3fe959c14796ff7832f5b71a1cccd
SHA512 f4dff26ab40eaf52e37152d39c39fea31ab1cf17d139ae22310e78509f6861abd2be530662281190dce89250a8190d2c278ed2f6b6e282878355d785057e6227
SSDEEP 24576:JdewsAjPRmlh8t0D+7y8G2G9yL0cMoThTR9PyuLzpQos:XljPm+brLC2hTR9quLB
TLSH
T12215EF31FE74D032C3BF0DB22B62C716587DB9604B511AC3E3A89E9D59706D22736A1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 0608d28ce9056cd37ffbd8fd8bcb1f3fd09b4bec79e4f7314411fc4b88ee4d3d
MD5 5ea5165d48d9cae1681dc704b63931a3
SHA1 4bb404095649af8f20995564fda898ef97f4b79d
SHA512 fb5785413ab55498448f3d3a3227e0521d0a754411c5ed23e072874437ded6bc74f3f19731a1f361083011e0180973d5bd87d5ee6eea3d000b2e34f3bb73e95f
SSDEEP 196608:xUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHB9b:xUEtQevvqc2W1cpV2EI32v
TLSH
T170474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 ed152c606eb4cd5ed54bdb0942125f8898214a379fac4ce0ae514c9071c20af2
MD5 ed67ae1432144a939c4736ff3c30f91c
SHA1 bb44aa73e3434a4430e249b1a714c6829be2a646
SHA512 4272a9900eeac1e89c4f0849c2d3b823b988436dbf5aeef47687b8b67b13bd4badb0a1c79aba5559fbe4a4db498ed80b3800d74a124d9a26e1eccfa7a8eb1374
SSDEEP 49152:LCbRquA/m2yL5zQfFiV+XenmE3/zvm+brLC2hTR9quLB:UoqtVjnmmmqrWETR9b
TLSH
T1BDD58D0976B8C1E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 58166f2e9b21f0b54e7f89b17be2c387549397256afb0f0980e33ad252e07202
MD5 599df4b4c31cfa72a4134a20da20c5e9
SHA1 98d06cace645292f526e192f1f718ccb47850eb2
SHA512 ec5afd88bb5d2d891e80a848a09462c781fce583fcdc12aebd5408918569c1a3b1ad4f1a5b3684770c296007cf3ad4cc2194b419518e61ccc24cd3a7a77a0f7b
SSDEEP 24576:CAhGLJIFoiwtA5l7S53GRmlh8t0D+7y8G2G9yL0cMoThTR9PyuLzpQo:CAMyFoiq5Wm+brLC2hTR9quLB
TLSH
T182359D80EBF945D4F5B3AAB899B68571EA76BCA65E31C20F2150D11F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 b9598520bed695b3bf50ecd938c9fecccfa5d204646a9d9100fba2987a3095eb
MD5 acd2b69c36879efdf2ac87702c2086fa
SHA1 57e59972b0f39b064c863ba30061c8da1048163d
SHA512 54d376cecfdd777ed2d3475fffbf9cdb7eeefb8542e303d54d4a3bdf11f934366751ace54954c1ffb006968733f48559c11f04b0e30d69c7300f2c09ac0b4782
SSDEEP 24576:OwuoOWTRmlh8t0D+7y8G2G9yL0cMoThTR9PyuLzpQo:OwDOKm+brLC2hTR9quLB
TLSH
T12705F14976A80CF9E5679238C193C536F7F2BC122A21DB1F53A0C65B1F376616E2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 dfa634825329e95c72c9d1f38b801cdf34a09474a98ebd947ece6ae799a26c74
MD5 5b0c7a65def199f0faf110deb5d2de6e
SHA1 27cf4982c7ea11518234dbf667467dc2b852b197
SHA512 9048ba929cc851ec6b01436bffb27935869d4b47e0b5df55c878abece184db3212cc3e59e77314033d82b36a97e702ceb43810d05926fe1ee9142e7dc71bf163
SSDEEP 12288:iBZ1IyeWRPelh8t14F4YfDY+o7KO68G2G9Ih40cjs31K6fq+hTR9PyuV5xFpQo:MZusRmlh8t0D+7y8G2G9yL0cMoThTR91
TLSH
T1C5E4224927E820F5E2AB9278D1F18985D7B6BCA2673183CF219056E51F33DD11E38736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 20f44943fe9befa9db4c547ad331be3edcf0eac2debddebc5010f995aa731b47
MD5 fd1e0efb41909c73477be1bc79155bb2
SHA1 a7c5f3017847f026824d285e3d0de37a41411535
SHA512 1950118a3b82ca8aafb234a34bef268746679169aa93b40da2280113b3315a6b6e9cbd48ea72c85208ba28e567e399b8ba5adab2891772bcad8b67eedcaa336c
SSDEEP 98304:VQRQyi36YOcPQLvw2gAf+PN31mqrWETR9b:sQyiKayX+PNf9b
TLSH
T148667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 ae00f06701fd99beedb80fa4fff65fb76b4ab45580f37d959da2cb00213b8d7c
MD5 87c4ed78b71183d3820d96f45de8fd8d
SHA1 51054c2e57b3b27ccc0fa3d7801258eb58d35cb6
SHA512 1e77fe4347bd162e8dae051cb0e1598082967c0dc6185f4a9301add4bac028cbdc48bad145b151921f1a54ccb96e430e8768c8da64484b483c69edfd6510a4be
SSDEEP 98304:HQRQyi36YOcPQLvw2gAf+PN31mqrWETR9b:WQyiKayX+PNf9b
TLSH
T195667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 9f6c4ba297cdb9ab76daf59a969f4e0f56d57e2872eb2f7a5ca8f380c64eed52
MD5 9c642e8d1d94125b14d78288233f2c27
SHA1 2a10a9dd714374923fe15b0fc2a9751cd4ec0cfc
SHA512 4d7b0f97289676925382f03b1e4917aaa25868192065ea828a3ea71444c1e58bfb7eb1c9d34ee934f7cd3764fda0ea5bc9e4f6de27491410ee467dd34e8f753c
SSDEEP 49152:h68Qg55nhheWu7PNU3/fm+brLC2hTR9quLB:fthWRc/fmqrWETR9b
TLSH
T1C3B54933B2F600A9C04DE1769F46872196E27C75CFE0E3DB815172561BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 76fb46d1c5e9ab362bc47bb762b18736e2967375d808fdd654e1be170157897e
MD5 23221743a74dc459c17da782dc634b7c
SHA1 8a3a1d6704cba47fbe058ff5721a7e2194b23401
SHA512 04ffee858b36930d59e2ca8b3d97879dfa88cea3676c96ecb7c2a4d63a006b8df9feb3c948aa023ef34152f62254a4a80a6ced4cb53735cdcc9b8f6b39daf9aa
SSDEEP 98304:Ry5112gYy5azzVvL69nLKnhZwmqrWETR9b:sLIHmWhU9b
TLSH
T1C9167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 3d4cc78417212fccfd4e7608f5fe612ecfbe4a6ae13cc59eacea3ef0f81e0157
MD5 70b93776b2d6dccde0505f672d5fa94d
SHA1 7c57499964f020815c957b191a2db7138ceae7cb
SHA512 7eeb8391ee59b049bdba44b646c6d9d5e5de9f56f4a1b3f0e558b23673147b9ac91341d3186f9f194111a595d2699420d3efb79ded01567499d0e8e4dead997f
SSDEEP 49152:5B+taZ3usBWOBr4tEGT0bqx0z+n217aau1gl9m+brLC2hTR9quLB:vu6JmVxd2d9mqrWETR9b
TLSH
T162D59D13F1DA01E8D06ED178974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 eb6343ba2def337e0331ac8b37e12bcadd330c61c47fbca882a806cf091a5c6a
MD5 f0dfaf31748aaf0ec79371188490e0ce
SHA1 6d81f5fd9aa1c39881c37b5c9fd6b8203c66da35
SHA512 864401b611d31c8982a1fb9a4ac25544648401c8e8550882002581a694b448b7f1b8a6a7f3cbc83ea3b74c9e26170c990aaf7c628e94386211c8dbec9ec68ef9
SSDEEP 49152:c1hpsNoJpF1A6UU44CwH7R4xRm+brLC2hTR9quLB:cmifPbRmmqrWETR9b
TLSH
T1F9B5AE13F29900E8D06ED17887569632EA72BC460B34B6DF0A90B7961F7BEE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 af6fc9265bdf65e5a9dbdbbfe7f1565489709146efc5e6e4505a8a22298abe19
MD5 d4e3e67120f20c8e2cf4d632b0d174ec
SHA1 bf7a6b973de17f66d2f67d2026a9829b88791f59
SHA512 09a4f01a6db89976c5876a27825c3412eee3c6269e30e2139450736066784d9ee14034063850d40760cd4ae972d464a52b4942d7bce378cfd9b0f7bb3880a391
SSDEEP 49152:ASuZQIY0Be2KRRVtOnks6NMHqsm+brLC2hTR9quLB:a5dKTi61smqrWETR9b
TLSH
T1E7C5BE03F2E940E8E0BEE67487669632EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 8de969667ac86aa7958e61f203568245cfbd32e682870ae1300416a0d9a5d761
MD5 f2509c11808aaf7aa74bee46ce12bf3b
SHA1 95e6ac4da6d822c48b01a9a16dedb0268bfc74ce
SHA512 3d0c3a5a135eac112a2b986f47fe324fe51310382d26eb713f8bfb396a0763502b16d00291498912359f7ae531de2c066ba6b098c4e0fd55856c0d6b50b85aa7
SSDEEP 49152:ShtSn8EApI0figngiDn0AP5wtm+brLC2hTR9quLB:TX2iyphqmqrWETR9b
TLSH
T1CD95BE13F2D900E8D05ED178C7468632E962BC160B35AAEF0A90B6561F7BFE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 0d26397f9db075154d0d57de9fff2b2a99d730c6f86c7ae1756591c30331b898
MD5 4b69befef76b1e6d35bd97c4de74188e
SHA1 de4f764e44612b51bfb1444552a101db01205101
SHA512 b3fd3c4057a8634ce4cc843a7e466a0377ddc952d3054a1cfb45e9352486146f7f0c0b1132ac2beaa63e89a7001267b512d71e271215ac669344e63a36978504
SSDEEP 12288:ltWRPelh8t14F4YfDY+o7KO68G2G9Ih40cjs31K6fq+hTR9PyuV5xFpQo:l4Rmlh8t0D+7y8G2G9yL0cMoThTR9PyU
TLSH
T1BBC423188E7E0082F25EA3F1E2E188C5D8BDFCF2FA45644EF1C578E117B5CA4262599D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 53b1681256862dc2dec336aa64b8c65391d67012ddaf0e2d0e61800ed49a905e
MD5 ef2b32f89ea26f7bf6274f117f7c3dc5
SHA1 a2431b781f774e41f34232b1950473a2d1bbe832
SHA512 3c468fc5a40fcba4cbf0487aac294bd6a11c94aa45072bb386535e5d2251d087d4fcef81fe1a84448a95e586ad7211ad54747fcd7c50663cb83ea4ef05fed82f
SSDEEP 12288:UKWRPelh8t14F4YfDY+o7KO68G2G9Ih40cjs31K6fq+hTR9PyuV5xFpQo:UrRmlh8t0D+7y8G2G9yL0cMoThTR9PyU
TLSH
T111C423189E7E0082F24EA2F1E2E188C5D87DFDF2FA45A44EF1C578E01775CA8272599D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 866b6bedef051c157cebb07d8fc21c7545f3c8053049dde616199f77b6cdaec0
MD5 48e8621059f5de024d0e800010af1b0c
SHA1 2facb08740e67fa270e23d87cc8930f82c3e2106
SHA512 3e7df112c73917e3a24278d64dbfb0343e734def72abe9b30513e567f7bf450a8ad5b43ec5f7bef8ab493db61ba97039a6c0cfa83daae04396955bba07af076b
SSDEEP 12288:TUWRPelh8t14F4YfDY+o7KO68G2G9Ih40cjs31K6fq+hTR9PyuV5xFpQo:TZRmlh8t0D+7y8G2G9yL0cMoThTR9PyU
TLSH
T1A4C423188E7E0082F24EA2F1E2E189C5D8BDFCF2FA45644EF1C578E01775CA8272599D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 dce561f3907adc2a4145d8e2873def4a70904ec3472aafa81f50b99ce4ccb572
MD5 da73af8bb02efe65f77b2e1fff3897e1
SHA1 8ab3d6d0359ca7b279473c8f11faece795fbfe3f
SHA512 e6d3078e341f17e00df3ce1b88de2cc97b23aa9f5a24fa2d5e5a646d48da38fe58a7765f5b1af5f073d714231dd5c47a7fa127b4990ef6b1d0319c8dfeee0252
SSDEEP 12288:cV3WRPelh8t14F4YfDY+o7KO68G2G9Ih40cjs31K6fq+hTR9PyuV5xFpQo:NRmlh8t0D+7y8G2G9yL0cMoThTR9Pyul
TLSH
T123D423185B7D00C2E16BE3B1D2E184C5D5BDFCE2EB51A68FE28028D50F71DA46A34E9D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 7ccca287f5cea454a49ef04e5df667c64b211518171a4d7b9e7ccfe1cfb8aa33
MD5 c5ddde7ca9a9146e28489014f75153c9
SHA1 b7a81fd44c4730e1b1646925176f1c12956ae8d5
SHA512 df99077798bb97e3237039bc7626f24ccd5264281bd341907429f130629776257146bfcd0f3eb5f534886cfd57acf99453989eb51bba06a3742b979eb190f85b
SSDEEP 12288:gfWRPelh8t14F4YfDY+o7KO68G2G9Ih40cjs31K6fq+hTR9PyuV5xFpQo:g+Rmlh8t0D+7y8G2G9yL0cMoThTR9PyU
TLSH
T183C423189E7E0082F24EA2F1E2E185C5D8BDFCF2FA85644EF1C578E01775CA8272599D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 f8b3eb3feec532a28bd1f89696944902762d0bde94b1293544682930cf3342ee
MD5 71905f07620e82c1d6c5db380717a3fd
SHA1 7bfc2b1220dcb024e5b451aa750d4b344f4e661f
SHA512 a2420d97f3d3f0ff1a4917e0d78691cb8658009cd50839646d5760fda882d791344d09ffbe827032f402e1260f6c72a7d757cf42976d3b026cdfcf1e9d6372a9
SSDEEP 12288:8GWRPelh8t14F4YfDY+o7KO68G2G9Ih40cjs31K6fq+hTR9PyuV5xFpQo:8XRmlh8t0D+7y8G2G9yL0cMoThTR9PyU
TLSH
T155C423188E7E0082F25EA2F1E2E188C5D87DFDF2FA45A44EF1C578E01775CA4272999D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 fe463ad1cc2a73f3072ed5104fb229eb476ad30792dedc078c9c236f72e5c896
MD5 4f7ca83bf53bd84a2ca862ab763584a8
SHA1 a1041ae98a86e8b31895a69b80bd1ddc9044b6c2
SHA512 2db50dc2c592fff6bcf90805eaa6cb52805f61842064144d3f7b8708df11d255a1714774f25b3264d251c1bb5a02b23b442a692a82b9991f73dfb1648f4d4460
SSDEEP 12288:7yWRPelh8t14F4YfDY+o7KO68G2G9Ih40cjs31K6fq+hTR9PyuV5xFpQo:7jRmlh8t0D+7y8G2G9yL0cMoThTR9PyU
TLSH
T1FAC42318CE7E0082F25EA2F1E2E188C5D87DFDF2FA85944EF18578D017B5CA42625D9D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 e194b28386fc644ccfa31c456ad766a68b1d2d734c5013cefc542e3a37b34a00
MD5 9a5b61aece662f89b841cb469428ff1b
SHA1 5273cfd1fb44f6151e6fa652651692e893420e67
SHA512 9405e8732d2bbf4881f1658759e19123952d4e7e149b363de70077040f31176a412269fbaca0991de5de5f79b96f3b18a1d120a27139c3253baa3797dbecd968
SSDEEP 24576:jZMSzFVSOLRmlh8t0D+7y8G2G9yL0cMoThTR9PyuLzpQo:jZMSzfHm+brLC2hTR9quLB
TLSH
T14A050294B36408F4EC67827EC9618946D6B2BC664B60C60F13E436671F337A11D3EFA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 6aa085349809608a3ca75a6db946157dcd287d19ed436775cb8d52506f9c4d50
MD5 32541babfc0fa889c68fbf3b1c3d1a2a
SHA1 f2230040228da78850b52110cf50e791030d5a59
SHA512 ad9bf74615a1aa0952326d16378e071cf5fb8e76bb0efe004da076473a7b1eca8449566034d34f2554fa034e18783a598a614478040bfc34b3e3e59476d1b29d
SSDEEP 12288:zhWRPelh8t14F4YfDY+o7KO68G2G9Ih40cjs31K6fq+hTR9PyuV5xFpQo:zcRmlh8t0D+7y8G2G9yL0cMoThTR9PyU
TLSH
T107C423188E7E0082F24EA2F1E2E189C5D8BDFCF2FA45A44EF1C578D01775CA4272599D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 f4464b5be16301e0e2ebb4859640f4c00ba37f5570b31aa715f3ec58809f4939
MD5 64205d0b6db172266b1570a203858ce2
SHA1 67732153920035b433186141d4603b434fa74830
SHA512 caebd9c09aae76ca9b115287407bd0e164e492e878401306dcd6ef2e404ee61ca61792803c8df60061672a8c3e4e5717b66afe3150c1542e349f37137b024b69
SSDEEP 12288:8FWRPelh8t14F4YfDY+o7KO68G2G9Ih40cjs31K6fq+hTR9PyuV5xFpQo:8gRmlh8t0D+7y8G2G9yL0cMoThTR9PyU
TLSH
T1A2C423189E7D0082F24EA2F1E2E188C5D87DFDF3FA45A44EF18578E01775CA8272899D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 3b4dc5afda920b3a74e91a082c0566485f6023b23b941141ba8714b36590deed
MD5 acba4410b97ae034e6a76445bb5a1719
SHA1 56173eb675268fbb9f8e4f7bf62ed113585b42f0
SHA512 7c445d980361333ecc56a2f61a6d44dabe5468a8917fd1006c3dc99fb056f104a6929ae26f1c7f52e499dd66ac9d4032e4f8861d1361c423b4a997343b68ef0e
SSDEEP 12288:syPz5L8eWRPelh8t14F4YfDY+o7KO68G2G9Ih40cjs31K6fq+hTR9PyuV5xFpQo:1zy/Rmlh8t0D+7y8G2G9yL0cMoThTR91
TLSH
T185F4120777A520F9D17B9274C5A20942F775BC725B208E9F639016B62F33AE05E3EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 2238e2906941fe997c19e4d1ec6fda6d92c1219abb07137cafe5c02019e86fd8
MD5 fd2ae2283e2205c02bdf23b708d88621
SHA1 9423780ee6d322412604f55fe85ec0c7b8ee1f0c
SHA512 ff6129b27f9c2aea3ebed7a5e70fda3fd0618f65bc173c98730da0ab672a1784f09ac4facc2e1ff97b8c375a89918fa62b25803a3342ba70e92ac4c52a446e81
SSDEEP 12288:mhWRPelh8t14F4YfDY+o7KO68G2G9Ih40cjs31K6fq+hTR9PyuV5xFpQo:mcRmlh8t0D+7y8G2G9yL0cMoThTR9PyU
TLSH
T138C423189E7D0082F24EA2F1E2E188C5D8BDFCF2FA85644EF1C578D01775CA8272599D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 0b08cfe4feb6b2e5a087b50569d38326cc752481b0449b66ac4974cc025bbce8
MD5 224bcdcbb4f33d4cb2260c9581f676b0
SHA1 d5a021837c968cc509427b99d87a77f7bfd5eb85
SHA512 767d6cec0a83f5dc2bbad1efd20e327f9f064d4af750f6ee93d88e08531236434697db0ab616d1185bf7052cd2aaf996a4261151e8985d95ee02a0c9d13f26cc
SSDEEP 12288:2hWRPelh8t14F4YfDY+o7KO68G2G9Ih40cjs31K6fq+hTR9PyuV5xFpQo:2cRmlh8t0D+7y8G2G9yL0cMoThTR9PyU
TLSH
T19FC423189E7D0082F25EA2F1E2E188C5D8BDFCF2FA85A44EF1C578D01775CA8272599D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 ede49d91e53c68ed7289ae7b1fccac1f06e84e06e69fb1d2d15f4bfe36992699
MD5 24bb2305a16d36321ac862553d660f42
SHA1 974e3fbbab97d6d955fc36f201fe38ae1afcc2c6
SHA512 a9de62b0402f2f9ea2a1865b131b29fdd91f7199bc09841add5dc325d9990b25ed999df4f2d862a0a3933872597451ff19ba57c87e68b76e9b51c43ae1731e7f
SSDEEP 12288:WyPz5L8eWRPelh8t14F4YfDY+o7KO68G2G9Ih40cjs31K6fq+hTR9PyuV5xFpQo:rzy/Rmlh8t0D+7y8G2G9yL0cMoThTR91
TLSH
T1C1F4120777A520F9D17B9274C5A20942F775BC725B208E9F639016B62F33AE05E3EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 8b78acd86884f7a0079aa70c365adef1f16753e48e392ed129a887dbab06b5c6
MD5 8eed81f25952f731173b0dfa31a14f64
SHA1 f8515890249eaee472039e55c12be371f3e2725a
SHA512 122d966918d701be4f0dc328e0e9cbf2b65ed898596afb81534e724811f6767d7a689d134cb1c62103adfedbcaf6ebc3c3fadd011bc9b79d8b66b96b1c26cb67
SSDEEP 24576:aTHaLl3z0zDpRmlh8t0D+7y8G2G9yL0cMoThTR9PyuLzpQo:aT6LljCm+brLC2hTR9quLB
TLSH
T13F050294B36408F8EC67827EC9618946D6B2BC6A4B60C61F13E436671F337A01D3DF99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 a6fbe74381b6a20ffc7d735aa411ca4a88203b997c0f35ac51329db0cff7361c
MD5 4a574382974484e2a3fa71e96fb7cade
SHA1 5e9c933a53ec470478d6e9ff302c4fa94de742af
SHA512 429bcdb93a06a9d84465b89ba896a4d8fe670b2e61a90bf7532d0200e0bce61b6283259cc32384ac839ae8a81dbe364d6f8ba21b6fbbadb44ec282b896464ad6
SSDEEP 24576:ucP4mcvIjkGOxhKP2l71nNKbrh/8KB0Rmlh8t0D+7y8G2G9yL0cMoThTR9PyuLzt:JP4m4IpOO67W8Kym+brLC2hTR9quLB
TLSH
T15865AE2DABDC0096D0BA917481658A4AFAB1742A2F3286CF1160937C3F77EE54F35F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 9b13d3965f793f5e597aa92fd7677442d3cbd59588c6547cafbc78908a3687f2
MD5 8299280d162b728e123afbfd9eab036f
SHA1 3e0fbdecc0030628c3468655380f39285ff12214
SHA512 a2d6ddacb111ce718d23872416cf7aa2a68e5c99fd811cc2ac6f2609188c94796f9825d850a49541efa766f47f124cbcefc05cabfb3307dd5f6e0cd2a6652bdb
SSDEEP 12288:BNsfxWRPelh8t14F4YfDY+o7KO68G2G9Ih40cjs31K6fq+hTR9PyuV5xFpQo:GsRmlh8t0D+7y8G2G9yL0cMoThTR9PyU
TLSH
T1DFE40119D2A801D8D06EA275C3928A81F337BC6197E1D3CB62C0F47E1F769905EE9B47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 4a307b6969ac45536a11aedec8a222acd6542561340fab67d5a214b36430d988
MD5 037bdd6ba8ad05102d3f6419f29a095b
SHA1 576eea98a178b92c425651e452792dda740d4308
SHA512 24f9285da1843e5606b03767db83dd723b80407cf6508dd8065c4f02398bab3c39508280f61ffb2a4793cebe480e70483e024fd907b146eed71285808e4d092b
SSDEEP 12288:VRWRPelh8t14F4YfDY+o7KO68G2G9Ih40cjs31K6fq+hTR9PyuV5xFpQoK:VMRmlh8t0D+7y8G2G9yL0cMoThTR9Pyj
TLSH
T11DD42318CB6D4442F2AEA3B0A2E1C4A5A57EFDB1EF44D84FF08179E01674CE45E34A5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 35c8f3aa7e3824dac7643f5f1f00538aca03eec0a230880c652382e953aab603
MD5 4bd8ed803de8bcf0e6bddd0ffdca20b4
SHA1 e5657baaca15045887cf59a1e81eae2e6bd190fe
SHA512 cb5ac0f8e5b75c2513953f5558bb40ea3755aaf77d32231cf9c576b71764e0e61622389fef4809b663c3ad8e8b902bc960c71ee956f93ae0354992eeb77c1e47
SSDEEP 49152:Ha0h2GEkuAe73q3pp46zwwQ+m+brLC2hTR9quLB:Ha0hNYG4JwnmqrWETR9b
TLSH
T11C85AF1E67EC82B5D0BAD278C9A6814BE6B2B4260B3156CF1191853D3F37DE44E3DB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 659KB
SHA256 677ca4f3a2cdd9b74f1ccaa896ca9b23b5f279798015be979bef2572a33e8833
MD5 08a40f5daefb9fa4505d177e19eeeb3e
SHA1 a71e90c5131e1c03702ee4ce2d6e1b7d3869a366
SHA512 04f017de9aeaf995014d84ba6675e67ea29aa1d67c06e1d39ff183ceaef34f415ec63c097b0d2efc7f6148590398f71ccdb856d402b05cb3a0278cf59aa62fab
SSDEEP 12288:2hbHjfXaWRPelh8t14F4YfDY+o7KO68G2G9Ih40cjs31K6fq+hTR9PyuV5xFpQo:2hbHjP7Rmlh8t0D+7y8G2G9yL0cMoThh
TLSH
T1CAE4017D1AAC10C5F276E2B99292858AD731FC662B11A3DF62C181B90F37DE41D39F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 cd18ce72e819ceb41721fb6fc8e43987b4134ae506d5e265dd0a67da6da42553
MD5 5bd37c249229fa18580f330c960480d1
SHA1 7ba696c2572bf0e008cb3dd37915f885960af9f6
SHA512 a8810055c66432e7a9cb57ea6b85af9570d4684e4789d3339f1a92c11dcb2f55425f73940103e4c69c1d5c4034cef6e73355c5e1f370da9fa474e35b5a702d77
SSDEEP 24576:f3YgnJcRTk4yti+R5dBR/TRmlh8t0D+7y8G2G9yL0cMoThTR9PyuLzpQo:fIgnaTk46pBR/Tm+brLC2hTR9quLB
TLSH
T11145AF2DF2B910B9D4AAD236814147B5FB71782D1F209ACB0170C538AF1AEE85E39F5D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 578KB
SHA256 20b4f0fe55ae78c4bba6f7543eef9f0eec21e03164f836277735276a23161ea1
MD5 416f85c1e6cb2ab2204dc1e4d17931f6
SHA1 068f9272132fbc71a21f47841bc95818c7b27fcc
SHA512 87cef05565071c11fd62314b1797938cc0ea454f3c4cd5e2e5eca70263765213c375f5550642f57e135812c7859ebfa5ff92acfe1354b4f3eded2e1b75feaad7
SSDEEP 12288:41WRPelh8t14F4YfDY+o7KO68G2G9Ih40cjs31K6fq+hTR9PyuV5xFpQo:4QRmlh8t0D+7y8G2G9yL0cMoThTR9PyU
TLSH
T1A3C423588A2D0482E25EE3F1A2E1C8C5947CFDB1AB4569CFF0C5B8E01775CE92A3499D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 940KB
SHA256 31a3448136ac6e02e99edfd021b3798863daecebb611b35b3c3a43f85114054c
MD5 12bf76ded382fe97b661f7c0dad34693
SHA1 d541455daca14c8c9ba323ea62d6c33a82fa9e13
SHA512 44e27b022ab1088fef03d7f6d9cfb4b8877f30e08ee76478107898a4b22baa34adfc90b82c2b021901d9f14b49e43efc8c28f601a844143677eea8e8326d895b
SSDEEP 24576:/pL3UTtRmlh8t0D+7y8G2G9yL0cMoThTR9PyuLzpQo:/pL3Uxm+brLC2hTR9quLB
TLSH
T16C250254E7A800F5E97BD13CC5B28916D672B89D0764E7DF03A84AA51F23BE14E3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 671KB
SHA256 5f07fe9e7db824097fba2cfb1aac667a67225602a0926efe9b335afe38d09098
MD5 950601c539d8c95a2009de1c209cecc7
SHA1 547a9e93f77083c85d265ad416345a3bfb095e44
SHA512 0bdedb5044ede4f438595fe3864817a1ba8ac70c5d795ea74755161256d5b67b4767298768c6ab6e3ec20d83083cdc606f059676067302b7d5445cc0a035a240
SSDEEP 12288:mpFtpO8WRPelh8t14F4YfDY+o7KO68G2G9Ih40cjs31K6fq+hTR9PyuV5xFpQo:sORRmlh8t0D+7y8G2G9yL0cMoThTR9PN
TLSH
T1CBE4021D37ED00E5E17AA27C9292824DD375B8A21B1257DF42D080BE1FB3EF86C39A55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 e212432cfbec01ae64062a1731c0d7e8bc602b5f55f232316af4f220dff1d0fe
MD5 e61c9b6c95293d26543eefe45414e12c
SHA1 793b84a218bbecbb4144b29edf42de00fc504466
SHA512 3a914bde881659c45fed400c94a86639d739027c8721858dd20835e3d93a79b5d249c8df0a5c7ad36725193005b581dde43a8984d8a0db27fbc5ec133b39d955
SSDEEP 24576:s7NM9YqZqmWMUkPjZM48Mv6bEhscRmlh8t0D+7y8G2G9yL0cMoThTR9PyuLzpQo:s7cBWMpPjN8DbEhbm+brLC2hTR9quLB
TLSH
T15465AE2E6BAC81D5D477D13DC9E28206F6B2B4611B318ACF5152833E6F37AE44E35B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 7dd47aed9a8a2ed650ffa69e39050193992d1a76d56c099e6d2fa296a242be95
MD5 bec191cdb8bb54524becfd3bc26f8d65
SHA1 d7b93ab7184ce42715db55cf83a3166049d4a223
SHA512 bc7d2ef9938493efc664be702ad8522c800c6718f7ced1803e6de2edff9f7ae90b3bbb12f5315f30c3a95724d79f42871ebba02c3c3aea3fae9d1ab78bd3069b
SSDEEP 49152:fF2YuHNETovAvNYf8km8m+brLC2hTR9quLB:m6BCf8kRmqrWETR9b
TLSH
T180857E2927ED80A4E0BBD27D45B7D286FAB2B8511B3055CF4255862E1F33AF44D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 24097c55d39931299966d1af62ae2a412dac638341aa06cc1cd939bb79f31fe4
MD5 50e76266a77e756a103a74f5ecd43afe
SHA1 a6b21f63eea54250a496182e0da510d13cc62836
SHA512 a9ddafe7a488cf2ba7c793031ea96d58d2b4d1a1aa46e1c093590f6e22f56e648663cf6eda16912d1cc9482cf8718fd135832196885b76958cecaaf450de9d82
SSDEEP 24576:XAFs06+Omlf3NXEbToVRmlh8t0D+7y8G2G9yL0cMoThTR9PyuLzpQo:wFs060lVXuem+brLC2hTR9quLB
TLSH
T18165BF2F66EC00D5D07ED17D8A97C91AF6B1746307255ACB0260867E3F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 885KB
SHA256 4b6736835fdc91a69dd7cd68689e193ebcec0e6b5f0a9385350432452f8023ae
MD5 dcb002f20eea31a16cc538c217f286e0
SHA1 2bf7c10244879fea565e542abadbb17cd112a39a
SHA512 8907185e99b46d16a883a9ceb43c3e309f30d8c5371f56d8d64772e3ae99a7a1f0bc73dcc92fc5fcd778bfefa5766c4ef4c83b33164c017ae4bc2d74f96dcba3
SSDEEP 24576:dJnJ5D3WXeRmlh8t0D+7y8G2G9yL0cMoThTR9PyuLzpQo:dJnJ5DGXem+brLC2hTR9quLB
TLSH
T1E315E12DD2A810E4D0B7C3B4819A5795FE72387D2F2269CB64B4D5353F12EE09A39F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 afb3ca6d1b84b370a6e5141508bf3adcc0c2bf81c3b10a4021a67c125b1fac38
MD5 307db6a0b6c554116fe9312d2257df17
SHA1 7c04b8e262791cd71a3055779132ff90fb9681db
SHA512 5192379034d2f2b0605fd4be4feef4e267a874561a52b3f5eff58bfeef2183c650295f4e6fe6fa738797979b462e2ae0ffa26f8299167bc3bc6a6cf8af4b660a
SSDEEP 49152:cg06DIKdwc+eQnSt65aV4m+brLC2hTR9quLB:NamqrWETR9b
TLSH
T10F956C15BBEA5294E8B3CAB1C96295169B327C509B34F7DF0AC0C92E1E33BD1D934B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 661KB
SHA256 733f4eb6e3439777273a08f914bedd5b50d89745fc32a67354489caca514166e
MD5 77b01a55b7ac1e5048d1e6f1b08dbedc
SHA1 6fe743fa3231421393af1d809057b597e69c86a0
SHA512 04546e898d11cfdde2d20965c1234ae0b0edff636bba0333fcef909da63e173c37db4d9cbc766804161c432f4e8e9f9c23f5ebda2309840b548ea615be600826
SSDEEP 12288:/EP3RnTWRPelh8t14F4YfDY+o7KO68G2G9Ih40cjs31K6fq+hTR9PyuV5xFpQo:EniRmlh8t0D+7y8G2G9yL0cMoThTR9PN
TLSH
T1FAE4126C6BAC20D5E12AA17C91E18585D3B6F4B16B4227EF61D1C1BD0F73DE92E38E00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 712KB
SHA256 ac3a7e6d62b81ab2efa6f1f6d69fb884fc7663a5b7b752345888a978710a3763
MD5 02c70db9096ac31cd94ab590be751d7e
SHA1 ff4420c86bf50d17d4dd39b9d1c9433f28f73043
SHA512 6ba871099e06c3ee626e40e77991973947a3f78f4d283695dcdfc8a7e14e9277fdbfaac900679c03c903f984b515a437b4ad28ca3eb88d07aa8e4af325c87945
SSDEEP 12288:TjkyKWRPelh8t14F4YfDY+o7KO68G2G9Ih40cjs31K6fq+hTR9PyuV5xFpQo:TIyrRmlh8t0D+7y8G2G9yL0cMoThTR91
TLSH
T1BCF4120857AC50C5E2BA5274D2A281D49A79FC70AF1196CFA0C0F67E2F32EE46D34F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 584KB
SHA256 5d17a7577122cf32ec86cfd263db14e4c08320f716a853134517b3c9a1929de4
MD5 57126e90ee88ae89a576cf10cc82e7b1
SHA1 7565e06a13ddb9a2b49497666f517c309f3efc8b
SHA512 e5f45e288d25001680d46f0411d46e7e3e002aaf1a0b32a979199034997c1ad49ae82952b2a1941aed38103d1749f1c3a80bade30dbab57d441e2c8bb62e840b
SSDEEP 12288:mysWRPelh8t14F4YfDY+o7KO68G2G9Ih40cjs31K6fq+hTR9PyuV5xFpQo:PBRmlh8t0D+7y8G2G9yL0cMoThTR9PyU
TLSH
T1DAD4231C9A7E0086F25AA2F0A2E189C5957DFCB1AB4568DFB0C0F8F10B75CE52635D8D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 5f4945dccec88f808ad595da41037288100ef3b63335090365dcd08147df70e3
MD5 97034a1adb503462054e28f1388d6a39
SHA1 e42e165856c4c10634e7c8236c07d5b685ab15a5
SHA512 ebf312226b22ac2fd60960b4dd32a98fe0f3da9ea82bb4d9120db4628f5fa15d30791a7016318213a10125793a836e8d1797bf238b6b1bb68402e21778b90f7f
SSDEEP 24576:rQ9MxZKdcz9dw3ERmlh8t0D+7y8G2G9yL0cMoThTR9PyuLzpQo:rVKZEm+brLC2hTR9quLB
TLSH
T1C1558C2DABE9058AE177D27595A250C3A673B4311B31D6CF2448D03D4E7BEE8AE34F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 772KB
SHA256 6c1da8eb8d3022b5353ab2791fb2e7fc4171ae573c04da547a4f1418f6b260d0
MD5 02ea205163b859a456dc5c2694de5792
SHA1 d92f739f8b330401f6b19ad821d7960ef9ab21ca
SHA512 75a6ada83bdcbcf729c00988125f1facf6e5987c165b1e0b1cfa84c06940296fc923b1792235951421afbe04dcd8ea8b6a740d43e27a0e1b0658a773a06e3b12
SSDEEP 24576:dyocDApPRmlh8t0D+7y8G2G9yL0cMoThTR9PyuLzpQo:gocDApPm+brLC2hTR9quLB
TLSH
T1EBF4E01FBB6E40E2E176923C89818685E7B3B4705B6267CB6181C33D4F639E8BD34B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 328861716e4dde7e49513b2577be77ae84e3fc2a3fbb00fd3f8bab239c9f58d4
MD5 9c410b93dbfa628097b96d0b5cea00e2
SHA1 e1dc95a19606dbf2f9a4a3bd182c4ff3d32cda88
SHA512 addae15ce4cb1683440a4df417fc0b6262e6285ba0321692ae2f47f289da827942a4f1957fe722bd4f94b30713b610af579005b794214c6b15f487bbbcd555e3
SSDEEP 49152:gWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKPm+brLC2hTR9quLB:S0zuNItmqrWETR9b
TLSH
T156A57C3DA2BC00A9D9AAC375C14513A5EA71742E3F2055DB01B0C57CBF2AEF19A38F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 3ac54e52fa004a8e74a4a7fc9bee15a38a2c04264682af4a78d48ea61657d8c1
MD5 0d3d4e48316db62da4026fc1c1304603
SHA1 7c889638e2131e3871a2249aca96d8fe1467d833
SHA512 8c38af234722bff42ddf71749cecb9359f13183f8a864d0d8448e5ed26a2e45a524c8d2cc336e4f1a21c3545f4d0f536aee2200eedae0b260a00d51357812c49
SSDEEP 24576:K1QT7EcpfxR+N5AWAz3ooiYtjMqbiRmlh8t0D+7y8G2G9yL0cMoThTR9PyuLzpQo:3TDxR+N5YzTfjMxm+brLC2hTR9quLB
TLSH
T13355B02EA7F805E9D17EC5799A23C512FA727861033193CB42A0C17E1F6B9D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 877KB
SHA256 0e227029a7d7e74bc0b051562cdb32549eb9c08fe694ce6e5276604599813ca1
MD5 ca1b5d043850cb6ac0b248e4c711cb49
SHA1 b34af3a9cbd4613814e86c9da28e19c6f0a5722f
SHA512 9d03c3399fd4e45f1de2387ecd36ee591f9612fc8883538a59743a48f9a9fc8847cbb863f9f0c800dedfb7526a6b72dc6ac8072871e7621ba18fcd71bb912267
SSDEEP 24576:HTMdOz0FFS+imSLmRmlh8t0D+7y8G2G9yL0cMoThTR9PyuLzpQo:10K+imSLmm+brLC2hTR9quLB
TLSH
T10815E13EA76D04E5E17BD27DD6538906E67278720321A6DB06D0C0B92F67EE43A39F40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 635KB
SHA256 cbcc13475fd3e997f4b7af1ebb311de8681c3e3ea22d15f8e8792dd0f8158125
MD5 a1b6b1a96884670097aa60d549467595
SHA1 e32ca92a1b5cdedfd726bb38a4dfbdbb65de1d38
SHA512 485b82dfd282c55e5f7fc42df2fff2eb71744f964e4b35838676ac9b41eefba0595402ad08c726bb4a6db5ac08804866aeae25228d6252481ece0971e1aff2ac
SSDEEP 12288:Q4KYWRPelh8t14F4YfDY+o7KO68G2G9Ih40cjs31K6fq+hTR9PyuV5xFpQo:GtRmlh8t0D+7y8G2G9yL0cMoThTR9PyU
TLSH
T15AD4121C57EC20C5F176A2B4D2B28185C674FCB267156AEF30D0D9BA0F36DE49A38B16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/468-397-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/468-69-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/816-266-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/1036-270-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/1268-396-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/1268-262-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/1468-83-0x0000000000B20000-0x0000000000B80000-memory.dmp

Download

memory/1468-89-0x0000000000B20000-0x0000000000B80000-memory.dmp

Download

memory/1468-273-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/1728-16-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/1728-22-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/1728-25-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/1748-40-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1748-38-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/1748-32-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/1748-351-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1872-272-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/1872-14-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/1944-28-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/1944-30-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/2124-268-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/2444-269-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/3060-0-0x00000000029C0000-0x0000000002A20000-memory.dmp

Download

memory/3060-6-0x00000000029C0000-0x0000000002A20000-memory.dmp

Download

memory/3060-13-0x0000000140000000-0x0000000140E12000-memory.dmp

Download

memory/3060-350-0x00000000029C0000-0x0000000002A20000-memory.dmp

Download

memory/3060-258-0x0000000140000000-0x0000000140E12000-memory.dmp

Download

memory/3060-359-0x0000000140000000-0x0000000140E12000-memory.dmp

Download

memory/3164-136-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/3456-260-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/3456-101-0x00000000006C0000-0x0000000000727000-memory.dmp

Download

memory/3456-96-0x00000000006C0000-0x0000000000727000-memory.dmp

Download

memory/3708-263-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/3984-123-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/3984-129-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/3984-265-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/4024-259-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/4024-73-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/4024-79-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/4272-52-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4272-372-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4272-49-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4272-43-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4332-267-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4608-264-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4608-112-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/4608-118-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/4632-424-0x0000018612780000-0x0000018612790000-memory.dmp

Download

memory/4632-419-0x0000018612780000-0x0000018612790000-memory.dmp

Download

memory/4632-434-0x0000018612780000-0x0000018612790000-memory.dmp

Download

memory/4632-435-0x0000018612780000-0x0000018612790000-memory.dmp

Download

memory/4632-436-0x0000018612780000-0x0000018612790000-memory.dmp

Download

memory/4632-431-0x0000018612780000-0x0000018612790000-memory.dmp

Download

memory/4632-432-0x0000018612780000-0x0000018612790000-memory.dmp

Download

memory/4632-433-0x0000018612780000-0x0000018612790000-memory.dmp

Download

memory/4632-418-0x0000018612780000-0x0000018612790000-memory.dmp

Download

memory/4632-412-0x0000018612780000-0x0000018612790000-memory.dmp

Download

memory/4632-420-0x0000018612780000-0x0000018612790000-memory.dmp

Download

memory/4632-421-0x0000018612780000-0x0000018612790000-memory.dmp

Download

memory/4632-400-0x0000018612780000-0x0000018612790000-memory.dmp

Download

memory/4632-399-0x0000018612780000-0x0000018612790000-memory.dmp

Download

memory/4632-401-0x0000018612780000-0x0000018612790000-memory.dmp

Download

memory/4632-402-0x0000018612780000-0x0000018612790000-memory.dmp

Download

memory/4632-404-0x0000018612780000-0x0000018612790000-memory.dmp

Download

memory/4632-403-0x0000018612780000-0x0000018612790000-memory.dmp

Download

memory/4632-405-0x0000018612780000-0x0000018612790000-memory.dmp

Download

memory/4632-407-0x0000018612780000-0x0000018612790000-memory.dmp

Download

memory/4632-408-0x0000018612780000-0x0000018612790000-memory.dmp

Download

memory/4632-409-0x0000018612780000-0x0000018612790000-memory.dmp

Download

memory/4632-410-0x0000018612780000-0x0000018612790000-memory.dmp

Download

memory/4632-413-0x0000018612780000-0x0000018612790000-memory.dmp

Download

memory/4632-425-0x0000018612780000-0x0000018612790000-memory.dmp

Download

memory/4632-414-0x0000018612780000-0x0000018612790000-memory.dmp

Download

memory/4632-411-0x0000018612780000-0x0000018612790000-memory.dmp

Download

memory/4632-406-0x0000018612780000-0x0000018612790000-memory.dmp

Download

memory/4632-415-0x0000018612780000-0x0000018612790000-memory.dmp

Download

memory/4632-416-0x0000018612780000-0x0000018612790000-memory.dmp

Download

memory/4632-417-0x0000018612780000-0x0000018612790000-memory.dmp

Download

memory/4632-430-0x0000018612780000-0x0000018612790000-memory.dmp

Download

memory/4632-429-0x0000018612780000-0x0000018612790000-memory.dmp

Download

memory/4632-428-0x0000018612780000-0x0000018612790000-memory.dmp

Download

memory/4632-427-0x0000018612780000-0x0000018612790000-memory.dmp

Download

memory/4632-426-0x0000018612780000-0x0000018612790000-memory.dmp

Download

memory/4632-422-0x0000018612780000-0x0000018612790000-memory.dmp

Download

memory/4632-423-0x0000018612780000-0x0000018612790000-memory.dmp

Download

memory/4740-261-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/4972-155-0x0000000001770000-0x0000000001780000-memory.dmp

Download

memory/4972-398-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4972-348-0x000000000C900000-0x000000000C908000-memory.dmp

Download

memory/4972-171-0x0000000001A20000-0x0000000001A30000-memory.dmp

Download

memory/4972-201-0x0000000009E60000-0x0000000009E68000-memory.dmp

Download

memory/4972-271-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/5084-64-0x0000000001AA0000-0x0000000001B00000-memory.dmp

Download

memory/5084-60-0x0000000001AA0000-0x0000000001B00000-memory.dmp

Download

memory/5084-67-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/5084-54-0x0000000001AA0000-0x0000000001B00000-memory.dmp

Download

memory/5084-62-0x0000000140000000-0x00000001400D5000-memory.dmp

Download