7a4ab935e6691af9b85bd22a065be2a92d6a342e941ea51ebfcd162f8fc196f5

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/08/2026, 01:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-06_219330b5ab406517e034a7ac567c333b_icedid_njrat_ryuk.exe
Size 7.0MB
Sample260807-bdql4sdc76
SHA256 7a4ab935e6691af9b85bd22a065be2a92d6a342e941ea51ebfcd162f8fc196f5
MD5 219330b5ab406517e034a7ac567c333b
SHA1 ff9ad62f56271b71587fc660488504dceac45bca
SHA512 1c8abda46826efa994443b25414864aa06e510fc264d1354c990ec5b8fbfd82d7c7cabd14e590961e866b4d0ee239bace4c5a75cf76b6321f1532ab00434fdc6
SSDEEP 98304:7fKGjCavm+W3hLFyjktyQy1YvvSpE0Lm:jKGjCaeLgOraE0L
TLSH
T1BC765A66A2B6C0A8D05AC873FA29D521D7253C4E53F492EB13D475E416F2AC63F38F90
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
4220	alg.exe
4628	DiagnosticsHub.StandardCollector.Service.exe
5044	fxssvc.exe
2340	elevation_service.exe
2480	elevation_service.exe
1512	maintenanceservice.exe
4536	msdtc.exe
4880	OSE.EXE
4920	PerceptionSimulationService.exe
228	perfhost.exe
1076	locator.exe
760	SensorDataService.exe
2964	snmptrap.exe
1872	spectrum.exe
2556	ssh-agent.exe
4912	TieringEngineService.exe
3308	AgentService.exe
3740	vds.exe
2912	vssvc.exe
3488	wbengine.exe
5088	WmiApSrv.exe
2796	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 38 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-06_219330b5ab406517e034a7ac567c333b_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-06_219330b5ab406517e034a7ac567c333b_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-06_219330b5ab406517e034a7ac567c333b_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-06_219330b5ab406517e034a7ac567c333b_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-06_219330b5ab406517e034a7ac567c333b_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-06_219330b5ab406517e034a7ac567c333b_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-06_219330b5ab406517e034a7ac567c333b_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-06_219330b5ab406517e034a7ac567c333b_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-06_219330b5ab406517e034a7ac567c333b_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-06_219330b5ab406517e034a7ac567c333b_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-06_219330b5ab406517e034a7ac567c333b_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-06_219330b5ab406517e034a7ac567c333b_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-08-06_219330b5ab406517e034a7ac567c333b_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-06_219330b5ab406517e034a7ac567c333b_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-08-06_219330b5ab406517e034a7ac567c333b_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-08-06_219330b5ab406517e034a7ac567c333b_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-06_219330b5ab406517e034a7ac567c333b_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\742119ea2d44b5a9.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-06_219330b5ab406517e034a7ac567c333b_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-06_219330b5ab406517e034a7ac567c333b_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-06_219330b5ab406517e034a7ac567c333b_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-06_219330b5ab406517e034a7ac567c333b_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-06_219330b5ab406517e034a7ac567c333b_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-08-06_219330b5ab406517e034a7ac567c333b_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-08-06_219330b5ab406517e034a7ac567c333b_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-06_219330b5ab406517e034a7ac567c333b_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-06_219330b5ab406517e034a7ac567c333b_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-08-06_219330b5ab406517e034a7ac567c333b_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-06_219330b5ab406517e034a7ac567c333b_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-06_219330b5ab406517e034a7ac567c333b_icedid_njrat_ryuk.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-08-06_219330b5ab406517e034a7ac567c333b_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-08-06_219330b5ab406517e034a7ac567c333b_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	2026-08-06_219330b5ab406517e034a7ac567c333b_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-08-06_219330b5ab406517e034a7ac567c333b_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	2026-08-06_219330b5ab406517e034a7ac567c333b_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	2026-08-06_219330b5ab406517e034a7ac567c333b_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-08-06_219330b5ab406517e034a7ac567c333b_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	2026-08-06_219330b5ab406517e034a7ac567c333b_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	2026-08-06_219330b5ab406517e034a7ac567c333b_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	2026-08-06_219330b5ab406517e034a7ac567c333b_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	2026-08-06_219330b5ab406517e034a7ac567c333b_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-08-06_219330b5ab406517e034a7ac567c333b_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2026-08-06_219330b5ab406517e034a7ac567c333b_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_103203\java.exe	2026-08-06_219330b5ab406517e034a7ac567c333b_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	2026-08-06_219330b5ab406517e034a7ac567c333b_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	2026-08-06_219330b5ab406517e034a7ac567c333b_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-08-06_219330b5ab406517e034a7ac567c333b_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	2026-08-06_219330b5ab406517e034a7ac567c333b_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2026-08-06_219330b5ab406517e034a7ac567c333b_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	2026-08-06_219330b5ab406517e034a7ac567c333b_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	2026-08-06_219330b5ab406517e034a7ac567c333b_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-08-06_219330b5ab406517e034a7ac567c333b_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-08-06_219330b5ab406517e034a7ac567c333b_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_103203\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	2026-08-06_219330b5ab406517e034a7ac567c333b_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-08-06_219330b5ab406517e034a7ac567c333b_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	2026-08-06_219330b5ab406517e034a7ac567c333b_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	2026-08-06_219330b5ab406517e034a7ac567c333b_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2026-08-06_219330b5ab406517e034a7ac567c333b_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-08-06_219330b5ab406517e034a7ac567c333b_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-08-06_219330b5ab406517e034a7ac567c333b_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-08-06_219330b5ab406517e034a7ac567c333b_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-08-06_219330b5ab406517e034a7ac567c333b_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	2026-08-06_219330b5ab406517e034a7ac567c333b_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-08-06_219330b5ab406517e034a7ac567c333b_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-08-06_219330b5ab406517e034a7ac567c333b_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-08-06_219330b5ab406517e034a7ac567c333b_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-08-06_219330b5ab406517e034a7ac567c333b_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	2026-08-06_219330b5ab406517e034a7ac567c333b_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-08-06_219330b5ab406517e034a7ac567c333b_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-08-06_219330b5ab406517e034a7ac567c333b_icedid_njrat_ryuk.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-06_219330b5ab406517e034a7ac567c333b_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-06_219330b5ab406517e034a7ac567c333b_icedid_njrat_ryuk.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002865b0690826dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d39fca690826dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d14c386a0826dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a44ea06b0826dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003dd7226a0826dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a699466a0826dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a2f19a690826dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fd86526a0826dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe

Suspicious behavior: EnumeratesProcesses 42 IoCs

pid	Process
4508	2026-08-06_219330b5ab406517e034a7ac567c333b_icedid_njrat_ryuk.exe
4508	2026-08-06_219330b5ab406517e034a7ac567c333b_icedid_njrat_ryuk.exe
4508	2026-08-06_219330b5ab406517e034a7ac567c333b_icedid_njrat_ryuk.exe
4508	2026-08-06_219330b5ab406517e034a7ac567c333b_icedid_njrat_ryuk.exe
4508	2026-08-06_219330b5ab406517e034a7ac567c333b_icedid_njrat_ryuk.exe
4508	2026-08-06_219330b5ab406517e034a7ac567c333b_icedid_njrat_ryuk.exe
4508	2026-08-06_219330b5ab406517e034a7ac567c333b_icedid_njrat_ryuk.exe
4508	2026-08-06_219330b5ab406517e034a7ac567c333b_icedid_njrat_ryuk.exe
4508	2026-08-06_219330b5ab406517e034a7ac567c333b_icedid_njrat_ryuk.exe
4508	2026-08-06_219330b5ab406517e034a7ac567c333b_icedid_njrat_ryuk.exe
4508	2026-08-06_219330b5ab406517e034a7ac567c333b_icedid_njrat_ryuk.exe
4508	2026-08-06_219330b5ab406517e034a7ac567c333b_icedid_njrat_ryuk.exe
4508	2026-08-06_219330b5ab406517e034a7ac567c333b_icedid_njrat_ryuk.exe
4508	2026-08-06_219330b5ab406517e034a7ac567c333b_icedid_njrat_ryuk.exe
4508	2026-08-06_219330b5ab406517e034a7ac567c333b_icedid_njrat_ryuk.exe
4508	2026-08-06_219330b5ab406517e034a7ac567c333b_icedid_njrat_ryuk.exe
4508	2026-08-06_219330b5ab406517e034a7ac567c333b_icedid_njrat_ryuk.exe
4508	2026-08-06_219330b5ab406517e034a7ac567c333b_icedid_njrat_ryuk.exe
4508	2026-08-06_219330b5ab406517e034a7ac567c333b_icedid_njrat_ryuk.exe
4508	2026-08-06_219330b5ab406517e034a7ac567c333b_icedid_njrat_ryuk.exe
4508	2026-08-06_219330b5ab406517e034a7ac567c333b_icedid_njrat_ryuk.exe
4508	2026-08-06_219330b5ab406517e034a7ac567c333b_icedid_njrat_ryuk.exe
4508	2026-08-06_219330b5ab406517e034a7ac567c333b_icedid_njrat_ryuk.exe
4508	2026-08-06_219330b5ab406517e034a7ac567c333b_icedid_njrat_ryuk.exe
4508	2026-08-06_219330b5ab406517e034a7ac567c333b_icedid_njrat_ryuk.exe
4508	2026-08-06_219330b5ab406517e034a7ac567c333b_icedid_njrat_ryuk.exe
4508	2026-08-06_219330b5ab406517e034a7ac567c333b_icedid_njrat_ryuk.exe
4508	2026-08-06_219330b5ab406517e034a7ac567c333b_icedid_njrat_ryuk.exe
4508	2026-08-06_219330b5ab406517e034a7ac567c333b_icedid_njrat_ryuk.exe
4508	2026-08-06_219330b5ab406517e034a7ac567c333b_icedid_njrat_ryuk.exe
4508	2026-08-06_219330b5ab406517e034a7ac567c333b_icedid_njrat_ryuk.exe
4508	2026-08-06_219330b5ab406517e034a7ac567c333b_icedid_njrat_ryuk.exe
4508	2026-08-06_219330b5ab406517e034a7ac567c333b_icedid_njrat_ryuk.exe
4508	2026-08-06_219330b5ab406517e034a7ac567c333b_icedid_njrat_ryuk.exe
4508	2026-08-06_219330b5ab406517e034a7ac567c333b_icedid_njrat_ryuk.exe
4628	DiagnosticsHub.StandardCollector.Service.exe
4628	DiagnosticsHub.StandardCollector.Service.exe
4628	DiagnosticsHub.StandardCollector.Service.exe
4628	DiagnosticsHub.StandardCollector.Service.exe
4628	DiagnosticsHub.StandardCollector.Service.exe
4628	DiagnosticsHub.StandardCollector.Service.exe
4628	DiagnosticsHub.StandardCollector.Service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
672	Process not Found
672	Process not Found

Suspicious use of AdjustPrivilegeToken 43 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1712	2026-08-06_219330b5ab406517e034a7ac567c333b_icedid_njrat_ryuk.exe
Token: SeAuditPrivilege	5044	fxssvc.exe
Token: SeRestorePrivilege	4912	TieringEngineService.exe
Token: SeManageVolumePrivilege	4912	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	3308	AgentService.exe
Token: SeBackupPrivilege	2912	vssvc.exe
Token: SeRestorePrivilege	2912	vssvc.exe
Token: SeAuditPrivilege	2912	vssvc.exe
Token: SeBackupPrivilege	3488	wbengine.exe
Token: SeRestorePrivilege	3488	wbengine.exe
Token: SeSecurityPrivilege	3488	wbengine.exe
Token: 33	2796	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2796	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2796	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2796	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2796	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2796	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2796	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2796	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2796	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2796	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2796	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2796	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2796	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2796	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2796	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2796	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2796	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2796	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2796	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2796	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2796	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2796	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2796	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2796	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2796	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2796	SearchIndexer.exe
Token: SeDebugPrivilege	4508	2026-08-06_219330b5ab406517e034a7ac567c333b_icedid_njrat_ryuk.exe
Token: SeDebugPrivilege	4508	2026-08-06_219330b5ab406517e034a7ac567c333b_icedid_njrat_ryuk.exe
Token: SeDebugPrivilege	4508	2026-08-06_219330b5ab406517e034a7ac567c333b_icedid_njrat_ryuk.exe
Token: SeDebugPrivilege	4508	2026-08-06_219330b5ab406517e034a7ac567c333b_icedid_njrat_ryuk.exe
Token: SeDebugPrivilege	4508	2026-08-06_219330b5ab406517e034a7ac567c333b_icedid_njrat_ryuk.exe
Token: SeDebugPrivilege	4628	DiagnosticsHub.StandardCollector.Service.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1712 wrote to memory of 4508	1712	2026-08-06_219330b5ab406517e034a7ac567c333b_icedid_njrat_ryuk.exe	86
PID 2796 wrote to memory of 3588	2796	SearchIndexer.exe	112
PID 2796 wrote to memory of 3992	2796	SearchIndexer.exe	114

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-08-06_219330b5ab406517e034a7ac567c333b_icedid_njrat_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-06_219330b5ab406517e034a7ac567c333b_icedid_njrat_ryuk.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1712
- C:\Users\Admin\AppData\Local\Temp\2026-08-06_219330b5ab406517e034a7ac567c333b_icedid_njrat_ryuk.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-06_219330b5ab406517e034a7ac567c333b_icedid_njrat_ryuk.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Aloha Mobile\Aloha\User Data\Crashpad" --annotation=device_id=5a83130d-ec86-4f37-a792-b9c75904b51b --annotation=format=minidump --annotation=is_debug=false --annotation=is_release=true --annotation=plat=Win64 --annotation=prod=Aloha --annotation=product_version=4.20.0.0 --annotation=token=9e03b2e36605d475196bcb6e61ae3a9157de20aa775eeae07c234f3b16008d28 --annotation=user_hostname=VGXMSUXF --annotation=user_id=5a83130d-ec86-4f37-a792-b9c75904b51b --annotation=ver=4.20.0.0 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2bc,0x2ec,0x1405d01f8,0x1405d0204,0x1405d0210
  2⤵
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4508

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:4220

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4628

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:2416

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:5044

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2340

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2480

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1512

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4536

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4880

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4920

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:228

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:1076

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:760

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:2964

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1872

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2556

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:680

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4912

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3308

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:3740

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2912

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3488

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:5088

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2796
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3588
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:3992

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 69cc63d84946d581acb397a5ce6dc937c920c72996b0719a29c0319facefc4a2
MD5 d9c3384138e4e787f69625c414926ea7
SHA1 3b0b3320b87cf54318194b8808b145a48cc33430
SHA512 fff6b20e42bac0692d16f84a02f78f5ebb71279a03073e8f632e1bbc8d8a421ad94e295fb027f2bc1ed6bca25bb271a41a888caf98df78f5dcd39bcdc41cf7be
SSDEEP 49152:5b+632BuPkFKRrdE6ohmstBhuXjfS4LWxnjQ/lFTjN4:P3q6HjBPLm
TLSH
T12BD58D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 332dee00e3a877fac583750073587395e7d326ede97113807e1417a9ecb687bf
MD5 4d1d67f2864ef82188241f612f889b47
SHA1 3b7acc89c3e91545c9b9b9e85a4c6223812f0b4a
SHA512 7a8daecf1d94d22f43c9e33835e8156aaa92e346e2ce5159be1a704c12c2a6ebe8a321bad5cfb56e42652d986b93cb77035cb2fd526f72bd544ae7c33ebd2fdf
SSDEEP 12288:s1XLsswWkxy2lRq2czAIGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:aXYfDtczAInQ/tbw/2Mkjy6Fr7g0o
TLSH
T13C75F12877E448F9ED67827DCCA28502EB73788547A0E78B03A495295F373D85E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 1e1b875729b96ce2e6f6126331622fea9caffc63894311987dad910840e13ac4
MD5 6ce7f57d2d32cb727c9009f884151785
SHA1 02562eff542cc1ea19063551258d0725ce417ee7
SHA512 9ef41c7172a3dbb12c6e07be7a10d662a8fe2fcb107b773c124e06ceafc36a0bfa30dea4fc824e8b1cd2c3ac41bce38009de2275a420a672d00727a37abd80f3
SSDEEP 24576:K0Le5ji0hmxmrMrnQ/tbw/2Mkjy6Fr7g0o:KPji0AouQ/lFTjN4
TLSH
T1F2959E15F6748735D073C0B9C5D2A68AEE7230825B308ACB4286D77C7E677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 05abf63e5b163d6a946091aabf57ca5f7c2da96201bca517e8b792637c0bbc8a
MD5 313627c27af2d65d18a549b6ce7c0b17
SHA1 10da1ca9d800bc9f468e82f9e01c632b3b7d682d
SHA512 1b08e811814c789ddb3186ec1433d3fbdfe8236904aa21b32f561121320c46318b90ea6b4405d2a0b4c9b31c12b1ed4d8b28e9cefb654a4115f3b526cb339c56
SSDEEP 24576:Za7/ezSC6vUyD/aqgrvWE6q8wyuNnQ/tbw/2Mkjy6Fr7g0o:I/ezSC6vUzPvxHjyqQ/lFTjN4
TLSH
T1EA755D25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 cce6b0aceaed42c0b96460c7cf773e607af80d6b8a51f8792cdad1f020d7a411
MD5 7e9d9dee2000da2c0ebdd1fa9641f592
SHA1 7ad69e5fc2c8420038eb21cae2f920f07c6f1649
SHA512 dff1ef3493f544f163a80f6ab38090918bc0dd3f8295f84750700092dd028f84496084ebea79824af85f13b406f23ca56bff06d31b8ed41124573286b9dcba99
SSDEEP 24576:UVbqPb88hv/l+68nQ/tbw/2Mkjy6Fr7g0o:UVO88hXl+HQ/lFTjN4
TLSH
T1E4559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E777D6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.3MB
SHA256 fe7b520f38760df5b481fc3575c501f6049481cfe865783bf8402c73b32b243d
MD5 2fb3870af6c231d9eee0aad9fc435016
SHA1 a2a474fa0a80e3c1d3919ac8ae08893c73e0af08
SHA512 e46473ac18078bd70ab04fce8959cdab647bc495beb3dfa2d9e95d4d211d1c36f264c7bf1d513097567c23df77c3b7a1da5a244f7397a99b0b8967ee47df8326
SSDEEP 12288:k9/GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:k9fnQ/tbw/2Mkjy6Fr7g0o
TLSH
T1E85523696624F887FB2B06F15CC38582AB7B0DC1AFD0A74E6B44322DC53C39486DB385
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.6MB
SHA256 8735394626bcc619e627ed2817b6889506a75d4aadb986eb3cde0c798d5ebc3e
MD5 892260c01f0707c0fdbdc3fd2c72a6b6
SHA1 56b75f65cfcb40b7752c9bc9186f21a72c8a4090
SHA512 a13b7c30629c49b571d77fe7100f95f78539133e221422585d5801c151344946840e59961a1ae2cf035964cc08671a2ce3d904341c7d8d7a3e891d48b896a752
SSDEEP 12288:oeBNUbTVO86UkGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:oJIUEnQ/tbw/2Mkjy6Fr7g0o
TLSH
T19975CF3BAE28FCD2C27E4DB85A918640E77278704F51A3CBD164830EDE276E05E7AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 a2fd00a5451b3a871665f19dac5934f63438ca1b468a83d89089f63f61257432
MD5 945036260c9714953015b60372ad5578
SHA1 c68fd3e9dced66dc32436c0f403b07e5f92ead37
SHA512 c40a64886ed80c1896e4fffbc12dc35300590c573ef41d14ebc9d5d01b9d815ad95d14d058188714a35b5ac27c20d9d314ef52067658d5b5772dbc35987eaf78
SSDEEP 49152:0QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THC:0QvGAdlCEL8c/yRNw5CSLm
TLSH
T12E267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 63618c591890638b460c750bbefc76530d135742acb282278977b96dda579d55
MD5 500c92190182047bd027f39a7c77c186
SHA1 5c0a4abbb6fdeda39ea0cf2be5e343799918b762
SHA512 7b4da5a1576a76f082eb089579ae8cafceb8bca70f84063d72d3cfeb5321dece171d589882107d79cfd70669f9e9eb6ea33615ba5dce67d98d1bcb8957f1214b
SSDEEP 12288:bAwSfxL/2Dc3kDLLmt0LDQewsAj+GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsgR:E5ewsAj+nQ/tbw/2Mkjy6Fr7g0o
TLSH
T1A685E031FE74E436C77F0DB21B22C706683D69604FA11AC3E3A85A9D99342D22776B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 771dabab9149df44223c5b0f0e064da07a4fd47d6cce37f9edae3b99853b5c0f
MD5 0a54412d532c6f670c214e9e3f2f4cb7
SHA1 86fb743b7ff924c7510e75de06c27b1e4c917cf6
SHA512 4349eef0972038111e6c72cc7dfe6c3f4d8a4710dcfe285fc237828f63c7d8f3dc7b1e118d0c96fc29ace967384ceafd9f786a14e3c40f199cfe0469f3a5a762
SSDEEP 196608:jUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHBL:jUEtQevvqc2W1cpV2EI32
TLSH
T18F474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 bffba3a83b6585d93d899a539e2bcbdecfc85bf5e621b310f16311abb4a11c7d
MD5 14018d0717211e25bc448e93affdae0e
SHA1 b18067eed4edefe0d03aae77582aebd0fe773fff
SHA512 1465575d1864c6114cb8d8de3ec5fda062624a9cf6d5f15d27cf330147894e2ce46d9c3bd10ca10a76064bc6b344e8698b9212038d2e5606614c3b52cbdbaf47
SSDEEP 49152:aCbRquA/m2yL5zQfFiV+XenmE3/zeQ/lFTjN4:voqtVjnmuLm
TLSH
T1D5D58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 7b9e3bfeb5810ee48a9cbab26f5a3552f8aadb952ee48711e78a5b504327252a
MD5 72a77d7d072b0eec31a1ecbf3dbece4d
SHA1 8ffa1a910d29665aaeaeb6f38f51798e72211272
SHA512 8627477a1083ec0bb258909665bb18e66a3993e66463e7914e2c24d2f40a52274ec4074dade550b513d8a43a3b1062708b15171cd9a7256b7328250b2dce69ad
SSDEEP 24576:QAhGLJIFoiwtA5l7S53ZnQ/tbw/2Mkjy6Fr7g0o:QAMyFoiq5JQ/lFTjN4
TLSH
T17635AD80E7F955D4F5B3AAB899B68171EA77BCA65E31C20F2250D11F0E37A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 4bf65c1289f92553e2c5946d58f215c8999167c70f8d4e954e9ca25e20ebc575
MD5 2639dc6ff6389723127c527b7fe40388
SHA1 ac59330a51a6bf960186b407bab9f2f92bf37571
SHA512 2a72ae713570994f8209eb9f3510b5ffe681a42cf665b255cbbb068314de64b3ba3c1fc77ca46cb744a985bd0b7b1f16412a4887454832d63bc0e3ab7eac6198
SSDEEP 12288:kmw5HEjsChNZBFgl0WDm+CNGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:Bwu0OWKnQ/tbw/2Mkjy6Fr7g0o
TLSH
T11B75F14936A41CFAEA6742398993C136F7B3BC422A61DB1F1760C65B5F373606D2EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.4MB
SHA256 e0324f7300cde6d138c4d3d86fb4e1bfa37545e98373ee136e58b7e2014649f0
MD5 5d0ed57e5488626fe8428efae286bc00
SHA1 9d7c668fe4ffa0d70e0fa4db7298fe135eddbb88
SHA512 7c60b4718aef3c0215c1380cd1bc8d6e5048b7102e6db1d658e0f17ad9709c06a77ce81236c5dcc5cf69fae965ca5424a8c58b517f932ea60d85f283929e420f
SSDEEP 12288:y1Z1IyOGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:4ZuznQ/tbw/2Mkjy6Fr7g0o
TLSH
T1D765126933A470FAE6674278CCE28646E77338826BB193CF275442695F3B7C11E3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 872b8c4d4bfb274ca04bb98a0c0b2dabbb0d381e08b1f7b76a455628d83e5ae1
MD5 75b0d5c61b73470487613f088da3ff37
SHA1 2e0e4fcc3d6a8090ff850b0dbaf0aed755d5fe42
SHA512 01c2da6d54c7e192de643160b3ce2e37dba296a99c7ffcf6b4288ec0cda96cb70ccd10ba0b46d6c9a681ddfc1f4143d1a9ecb4d93c5f45d6a10b789f0ae398b9
SSDEEP 49152:hj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uu:oQRQyi36YOcPQLvw2gAf+PN3jLm
TLSH
T169667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 cc7eb605833a97873f6f4112d89f21b3207b248ab3df47563387acd91e200204
MD5 88b83fb0152c2cdc3fa65520f97c1b9e
SHA1 05166e4f6cf271bfa1bc5aa502b9e58c5fbe2fff
SHA512 c6715c628de49ff245afd8f0b31c43a4a2922fabbae73de7c0b0c954f02d38ef1acf8c40181dc97401d73bb2e33ce008397b8ff83a4b7fa40653d3e4215ce7c2
SSDEEP 49152:ej8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uu:tQRQyi36YOcPQLvw2gAf+PN3jLm
TLSH
T1AA667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 dadee9441b8d28e58940b300867a32a723637da2cd98fad87605fe60062a3336
MD5 31a37ab6011bbad06cce59bd84af6003
SHA1 286caee6b5bc182d09d11115049c9bd5fb216e18
SHA512 d3638b136f7879eb30926bc98cf213e8d7d98cd4361aa6cda6706bcb026adc71cce2ec5e840c5d742e61549fc8938e9321dc2db6ec1ee539d9ade90902d8f5cc
SSDEEP 24576:TwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0jnQ/tbw/2Mkjy6C:r68Qg55nhheWu7PNU3/uQ/lFTjN4
TLSH
T13FB55A33B2F60099C44DE1769F46873196E27C758FE0E3DB8501721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 3397b39ca2ff98f37b60a9c029ba8df25bdafa4bbec88d7d6682a0894c0c9f97
MD5 5d93f539cc15f2c3b48444d17a5e1442
SHA1 4423a7b252fbc6345124dec6d5b381e1a4e6507d
SHA512 a3c31e521ac8b2f083e789730748494a5d4dc805336058eba703f818259df10a7e2fb12da04d3c064b274d7f013e572e3f1a287ad88b40a37a8cdc05f4785cef
SSDEEP 49152:i3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99c:jy5112gYy5azzVvL69nLKnhZULm
TLSH
T1BF167B13F29910E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 e4812ce2dd8a527542b3aef14861cf1ee9c6ad94b778c2eef0c66eb82ea3af3d
MD5 f00c8697992457b6e9e78dcd3ca2f114
SHA1 6b47f476312ac9084a637df0297cc694250463b7
SHA512 4a0114897389b6372dbd204e30471746261dca90a8873df2c0e16bdc00e9d45cd204175f0dce05bf2e5cceebd43dc49264fcd2321d1f448d5edbea7bc49e4734
SSDEEP 49152:FB+taZ3usBWOBr4tEGT0bqx0z+n217aau1gl4Q/lFTjN4:ru6JmVxd2dbLm
TLSH
T1BDD59D13F1DA01E8D06ED478974A9233FA62BC490B35B6DF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 1ec15bb73e091268e1c444464ab405c6d8670f7f6623cb489075177a6de68b20
MD5 a8cd43ed3bfbb221879a72297d9a4435
SHA1 cfbdbf8c3b21d5528e44400c500920298c76d9bc
SHA512 2b6cac7178875d5cec0fd9cadcb0e99e5ba3a9871ca7cdbac7dc622044b82f6c687e657144ce58af6097f47a92ad415b9303dd09308824fc51fd243dd97bbe72
SSDEEP 49152:T1hpsNoJpF1A6UU44CwH7R4xkQ/lFTjN4:TmifPbRuLm
TLSH
T197B5AE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 a423da75fce2609de9bc7b3f00f62f0f1fda3abae1568df538f5506964cc41e4
MD5 b8fdbab3ba1b351112ec9b8d5cddb7b7
SHA1 162ff9ef02602ea8d6267bf2e54c767eee7a6cc6
SHA512 6c0a9cf3dada49d39b4915ee43d5da1758ef78fac739e4d645807e5d0e4ca927acb1549048389a28ee6d6393e25029fbaec3558ca1ffcf042eb876551591b786
SSDEEP 49152:oSuZQIY0Be2KRRVtOnks6NMHqzQ/lFTjN4:y5dKTi61YLm
TLSH
T100C5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 6fad5f59eb5ce3820774e8dc5c9eece152c0cc1303ce32bb1475692e8cf59a7a
MD5 b5e6773489fbd1840184d466435353fa
SHA1 ab3f92d2afadc8304cb932e93fe6b0c979b6800b
SHA512 ac7969e0bb228e746b0c445556886ba5b57eb3bb9edbb4bf1a144efb5d364bfc9170d0a8d6da0f33d4d47bf6d2479477d11ecf677b0eb8de00d19764c5205dc3
SSDEEP 49152:NhtSn8EApI0figngiDn0AP5wIQ/lFTjN4:cX2iyph6Lm
TLSH
T16495BE13F2D900E8D05ED178C7468632EA62BC160B35A6EF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.3MB
SHA256 ee31bb2f70d8cbddc7eea31139f86222ecd75057eb694e44789e8585ce2ae2f7
MD5 82cf377d0877c0e1ae1ba39d8a5c6caf
SHA1 3c9b64b8c0b4b8eb95dadc5d311caf88211f2adc
SHA512 35b0e62c1b090dc7fe26a0a755410413c46d0e59f60b11dc3fc772b25ca861adf851c9f8a19eaf607e33bcaf15e4f79f41bbb67880ab760e8d39286e9acacc86
SSDEEP 12288:InGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:IHnQ/tbw/2Mkjy6Fr7g0o
TLSH
T1785523686965F98BFB1706F188838182A77F0DC6BFD1A38E77482129D67D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.3MB
SHA256 215e0960384fd475b0d8db88b45193420516ac9d7e619866ee452abe189bad57
MD5 67c93c6cc12c657b95d9eaf4a4fb58f6
SHA1 119def2cd8c32a1d0394029fba4e22f713c9f03a
SHA512 3b1279b6ee869beadd47f4ec6cd86d1e24543898ae459edff8c2eb791e7276bcc53aef893f59a4bb5227a0b9eafcf6ae0b51766fb533336489904d6bdab3bd26
SSDEEP 12288:HCGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:HCnQ/tbw/2Mkjy6Fr7g0o
TLSH
T1F45523687564F98BFB1706F188838182A77B0DC6BFD1A38E7B482129D67D39416CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.3MB
SHA256 ac78830a81b219158037dd4c0975402c72cc930061e3705dbfeb2299d70881fe
MD5 deda5fde0c6e13eeb5838fead1b6a968
SHA1 bf7d53bac88996d8791b8add50d768cbddee2903
SHA512 2ca81a01108e12dcb4e48227607b1d0c4361e206f02e66a8ec3b2cef5c84b6325a3e96287b80b1ed47726993afeef4f1f2643b0abefc59044775ece702d96558
SSDEEP 12288:ZsGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:ZsnQ/tbw/2Mkjy6Fr7g0o
TLSH
T10B5523687565F88BFA1706F148834182A77B0DC6BFD1A38E7B482128D67D39416CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 7cb8a00068d8f3d71577b5ba51b71f6778692011e56baed0c79131d84141b2be
MD5 41a74474c02d3344bad8bba2facecf40
SHA1 34e449a76e7423c04574f022e197d3941747ae84
SHA512 35d6f8cb7a9e43dbfeaef61bc006e6c176af99d8875e7a9e51dbc833c2ada576b255100b7f7fb6ef32e1d726346853f599038719771242d782b26daa03be8c5f
SSDEEP 12288:GVpGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:mnQ/tbw/2Mkjy6Fr7g0o
TLSH
T1E85523693669B4C7F92746F4CC938142F7BB3CC5BBA1A3CF6B0411194E793D419AAB80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.3MB
SHA256 a7891d3929593c5ce0005ba358b4b5480e3230012667749a359ddbf3923f9d5e
MD5 ccc0c9fc0329fad1662401b4c0839a8c
SHA1 312468f9a24f53d16e53d44292721dd3e461c3ce
SHA512 b35bf6d403cf52a9916628254088c07f5b84a08421254f9ce2465b568a2828f8bad15527ab7c1570623b2232674117d74bb53f0a1289f262d5c9b13e67ae2c3a
SSDEEP 12288:ihGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:ixnQ/tbw/2Mkjy6Fr7g0o
TLSH
T1A55523687555F58BFA1706F18C838182A77B0DC6BFD1A38E7B482129967D39406CF7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.3MB
SHA256 7614696b278f17ba32399c77f960e5d51c1926ebe6d97d0e4061fd7797293863
MD5 3046901771cd3d4213721f02d528c3ff
SHA1 ee169e749b5b3af6a575dd908482ac13775b2853
SHA512 30cd7a8ed5cc04f0a5989e2564a4905936f5c9100dee0e330317328a0ed8c9d6344a451c106905afe7da435fb3572ddd1b8a0579dba9c148072539ee32e26439
SSDEEP 12288:imGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:iGnQ/tbw/2Mkjy6Fr7g0o
TLSH
T1895523687565F98BFB1706F18C838182A73B0DC6BFD1A38E7B482129967D39416CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.3MB
SHA256 a7190333fd7a86f44131f3a7c79bbe31cc844a6e8508ee9c6a65c07437bc2b0f
MD5 886be3a3f613a47b8788a9a0ca2e5753
SHA1 9810d8c579ef082c948237fd21da141df2ff9967
SHA512 0fecabf78899bf175db6d95087498e3fab57ad1ab61733ffacfafa66a54864d27b4e1ee29f659e60bae48f46834a8164742c62952c7dd22b11292d743635e918
SSDEEP 12288:y6GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:y6nQ/tbw/2Mkjy6Fr7g0o
TLSH
T1DD5523687965F98BFB1706F18C838182AB3B0DC6BFD1A38E7B481129967D39415CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.6MB
SHA256 3e9b90ec39f641e4ad3ec43989fb740bfd7498208e2f44933eebe35ce3ebaa63
MD5 bd9110b81eacfdd4457662473a15d75c
SHA1 6cb0b1d61f8a54abc3d029e34718c1fa5c531921
SHA512 438e36f0c6b52ebce584bfa785df8ffbbfab81be672ca30781f6be6a473adedf1292dd88030f5503fa98d2dd1305fa5e3f92bbe5c11c6a7160c07d189df0fdbf
SSDEEP 12288:ciZwb2zzFEoS2cPvyiGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:/ZM2zFVSOinQ/tbw/2Mkjy6Fr7g0o
TLSH
T1D97501A4B35018F9ED67427ECC528906D6B27C5A1BB0C71F13A4322A5F373A01D2EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.3MB
SHA256 095f75ec678a116eed9b9db4f15c5d78a729fb8290dfcfe6aad7fac9a87b87ef
MD5 be89ef6e7d9117a7b88536c31fcabd38
SHA1 755059de9dc4cb8ce82cf308a1225c11c5aa1297
SHA512 afa7cbb89b6a9a1725632eb45c8c41ab834cb307d9827db1c05e1b81dc2c858b9db343338a9e2853805787fe92d789d3bc785c200cb5ec85c290d808b60bb986
SSDEEP 12288:nTGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:nDnQ/tbw/2Mkjy6Fr7g0o
TLSH
T19B5523687565F98BFB1706F188838182AB7E0DC6BFD1A38E7B481129967D39406CF7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.3MB
SHA256 7b164c7d4a7daa62490f356c349c5c604e116bc11d586c9fb9133905632eca0c
MD5 5bf4cfd7adf74aadc38ad9858b16bb1a
SHA1 6fe1d9dc6c5dbc7d6a8979e4a06a71edda5c86cc
SHA512 5aa38b237c264f76544e7108d64126bc57ec31bffa495d658240c0deb8e82d36e7b4fde9d3d5f438eac7c4c0c7fbe157a7900b050d795e0f6c1b896ad6b9baf5
SSDEEP 12288:ePGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:evnQ/tbw/2Mkjy6Fr7g0o
TLSH
T1475523687565F98BFB1706F188838182AB7E0DC6BFD1A38E7B481129967D39406CF7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.5MB
SHA256 e8e32b545cea81b6231b52166b268faf99a4ff2e5b4f762f2157c3ebafbe8039
MD5 c3e4f030896dc26be38a3c648c04b2b2
SHA1 4395462608bca7770fc65ab058fbd16dd36e58e0
SHA512 c8d6b2e7df73cb83197fb496f955dca92508df46806c0d846d36fabe67c7836eb0cc076b9eb0454f0ab89ef66c86f26121d557bdd4c6591f347cf0edd0ea1a5e
SSDEEP 12288:oyPz5L8OGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:pzyOnQ/tbw/2Mkjy6Fr7g0o
TLSH
T1A065021772A530FAE537427888920A02F77678725B609B9F2794037A5F3B3D05E7EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.3MB
SHA256 44067069494809137288492a890f88962ae56c53c52ffdb9cfa688cdb32869c9
MD5 8f26749827ced039b51b1e2bdc2fda8b
SHA1 2b40f260f6afb8d1b0bfa12d7b8902ec4b6c0efc
SHA512 8d0934bcf13268df136925e2896d757ce24608a03014299a00881e061c87d9edeaae636ee67ec85c587af074c60ad81d0bc47e07e1659f157bf8f60b1c326adf
SSDEEP 12288:zTGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:zDnQ/tbw/2Mkjy6Fr7g0o
TLSH
T1F95523687565F98BFB1706F188838182AB7E0DC6BFD1A38E7B482129967D39405CF7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.3MB
SHA256 cc36de668dba2be81f5403abc408c8a1da3951cb1615ec84e93da54af002f4fb
MD5 a12e52f1809e7aea2778cd32f0bae58c
SHA1 a35127babb10337130087433bd07390beba6bc68
SHA512 0d5c86f64e30066f405ebbe1fd42b0cecf12c2bc2012692954e3cc750c15d6b5c3f820e5e682739531cbbe3608ab1c884d35242d844ccb3ba00cee0abfc7e8d2
SSDEEP 12288:vTGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:vDnQ/tbw/2Mkjy6Fr7g0o
TLSH
T1875523687565F98BFB1706F188838182AB7E0DC6BFD1A38E7B481129967D39406CF7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 f06341d80cf42060031ccab1a3e3d6761c5b21c86d86e5e73d026616ae012bde
MD5 792163344363f9247311343524f823c8
SHA1 f45c85af137d2be542babda3a835e2a94eb309df
SHA512 d0c781b6c1fc64c1a385ac27b5658c02aee3c0fd1db09106cdb5eafbef3196c30973d9331fa5f43d9acb496c8ae1577906f5aed6f2a48dc1c062396103e3a70d
SSDEEP 24576:rcP4mcvIjkGOxhKP2l71nNKbrh/8KBbnQ/tbw/2Mkjy6Fr7g0o:AP4m4IpOO67W8KdQ/lFTjN4
TLSH
T1C465AE2DABDC0096D0BB917485658A4AFAB1742A2F3286CB1160933C7F77EE54F35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 b29d1a690a4d242981c02238275dcc779ef7563f9d28563a404fc1bdbbb18662
MD5 dbd4de6dae8ebf878e51c0864a5b5694
SHA1 aa002adbbcacb067ff8e15fb2b86bb5048e02e0b
SHA512 113430ab47d6e258f675d881e46d9741ad88f85e6502d129db6cf058aa82b7d98e860060535423785105eb0849f039064d4102d29c2cdb5b498701c6a9cc4963
SSDEEP 12288:6RsfDGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:HznQ/tbw/2Mkjy6Fr7g0o
TLSH
T12665F119E29852D9D12E52B5CB828641B3373C9597E1D3CB67C0F13E0F3A2905EEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

742119ea2d44b5a9.bin

Path C:\Users\Admin\AppData\Roaming\742119ea2d44b5a9.bin
Size 12KB
SHA256 fa69b4baa7819688a3e21577b5ca7f7d7478372dea1f28e879965d2b7a72e401
MD5 8d131d26d6e27553be2adfd874532634
SHA1 00dcf13cd67ca441d2764213c09f876fdaa7b1ee
SHA512 31c95b3c188c5e4f844c532a45a5fb838b3312b9796c80d8180f185eb178824eb56caffe78c9cff88a79409f3e0c53d29f7b00a93319f5f348916143d28a6a64
SSDEEP 192:elHF7XDHYGLxGmxRIcOFGBzWPeRf4m2LDYyBEJsLkeum7FjO0pKZUvXcRjjQuvBn:SHFfHpL/RxpWPU4vLshYxC8KZxjPJcPo
TLSH
T18942C09EFCF1CEBC4D278BD4A6341D9479AE079333E7E16A01A5A932803B350252ACD0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.3MB
SHA256 db6ea6492d7e2649b36452ac18cc2f479187d601367c1e8898977fb0538a31af
MD5 e6a5b00d1e74f98ce9a46ff80dde5c44
SHA1 00fcdf864f06d0a00c5efea308f954580fb08396
SHA512 2e72c7276b02639fad85b1718368d337aeec2ca17d90d2e490c73c5af1ce97e4299b314d793c5af3061bd79b270f3bcdcb1f6e32505bea2fe11c92de51e5d2eb
SSDEEP 12288:OjGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWr:OTnQ/tbw/2Mkjy6Fr7g0o
TLSH
T14A5523696668F94BFA3B06F05893C151773F1EC5AF90D38FBB082229963C3D01DAA745
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 8160e107f2333157454f9e9c10aa3119ea6525ac07dc9e2feda2140526c70394
MD5 897421f904f56df2553478c10e7d8c4b
SHA1 7bc38b574be48ee89cb3b4b7b7d34f5e9cd04805
SHA512 c8af83fe6b4863b158faf425e3964f09b8a8024168cb3c9f1b342cbe5c3cbf95757283fc7d0e87e4e4ae95d0528f071ed523cea068afb1d05a805e1d38aa28ef
SSDEEP 49152:Ia0h2GEkuAe73q3pp46zwwQxQ/lFTjN4:Ia0hNYG4JwBLm
TLSH
T19E859E1E67EC82B5D0BAD278C9A6814BE6B2B4261B3156CF1150853D3F37EE44D3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.4MB
SHA256 708e6db9100dd2a1f57b52dd6d472e633ad0b795a5cebb7020351945bfee52c5
MD5 f0cc6760aae3f4d8a2b6da5c3ce63193
SHA1 bc4e478292e62e808ee657de43e39fb67dcb456d
SHA512 0ac7a149ac7d745ef4070d33f349a09647283c2918cd73ea4b372274558be0dd9ee9c8d719ac68979390606c968c69d0da578c641ce009c784b0a1d92228741f
SSDEEP 12288:ghbHjfXyGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:ghbHjPynQ/tbw/2Mkjy6Fr7g0o
TLSH
T1B765027D26AC20DAF63692BD89928546D7327C552B11A3DF2381823D4F3BBD40D7AF81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 8102c6b81744b64d6b505a6bfdfb3f7b6d97d8daec979d19e36491c5bdffe42c
MD5 5f44de6de3b941a4a861d42d24c4a0cd
SHA1 d3923c8cd2cf7f559a72de8de074598cd8fbee4f
SHA512 84180a025611e104d37861bb59c3ed15f842965c31d601a051b06eadd67c5b4480980a47eb8e016dd94366721448d0dd075f403f85a4f1eaf9c471a202c635f1
SSDEEP 24576:w3YgnJcRTk4yti+R5dBR/KnQ/tbw/2Mkjy6Fr7g0o:wIgnaTk46pBR/KQ/lFTjN4
TLSH
T18845BF2DF2B910B9D8AAD236450147B5FB71782D1F209BCB0170C538AF1AEE85E39F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.3MB
SHA256 c663eb4b241b30bf0e4e4bde21626b1d4114c9a4cbd658f87670e7da4780f784
MD5 4845b0caab74bd79a9b4a504046c59cf
SHA1 420d9ec835c6579533e722fc837f6a27b5305830
SHA512 5adcb0748b78f9edb9bee83fe0f6f76bf53c85e5eec51d479c82e7c261031be33c1ae4d25bdff7510e9c1adbf3f411d4b0b2ff119fbe1ff1988f1fcf3b25953a
SSDEEP 12288:2fGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:2/nQ/tbw/2Mkjy6Fr7g0o
TLSH
T17A55236C6554F98BFA2B06F54C838542773A0EC17F91A3CF7B482229967D3D41AFA780
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 4e738cd173234db7e728ab582c88932f83fd59eef2e0511895c4359a7b66b8fd
MD5 309dbe5ba6a784335c745be2ffa48689
SHA1 bfc4e22e026f90445d288ea5dd10cf5861c0615d
SHA512 09405f9c8e8798e80c805c54b96d9edf47dd4bf901fe030ba4c12ed5418fbbc1910ecd239f25737c15036724bdaf591d1eaa847550d510950c215a657d68a31d
SSDEEP 12288:FObZA4LWOsvAYFTIGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:CtL3UTInQ/tbw/2Mkjy6Fr7g0o
TLSH
T12685F155F7A450F9E92B817CC8A28616E372789D1764E7DF03A84A691F333E14E3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 dbd3494612ed799efa3a94b7e1c579df6ad16a53178b7f9119c666603ba17b55
MD5 165bf0343022537697ae286de339ba76
SHA1 7103a40bdfc9652046015eae27ebc7c71af45538
SHA512 897db0666895492857a099bac23d8397409a90f95c6db971aa0cc93dfa4e2fa322ba8c6b6be0f10bf1bcdfd1d0e765e3407b853bf11fc8625e85f94fc135a7a2
SSDEEP 12288:KpFtdOEGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:cOknQ/tbw/2Mkjy6Fr7g0o
TLSH
T11965022D36EC20E6E536527D89838249E37278921B6253DF0780817E5F77BF85C7AB81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 44da7ce60919c0f6b19e93833a40f7f0a8ae360a2c16c0800d82c18c0f8e3f46
MD5 f83af80962691e7bd58100b9e3a9a442
SHA1 6b8805d42a6984359bae237f3ad0862456adaf9b
SHA512 f8ed0a00049eba0511307b9f2aa772b44201aea49e7ff645df7d885f9b49c9fd84bdfa4714f3c9fda4b307e0c839846a96dcf5b1e982cb4548ac21f08803e96f
SSDEEP 24576:97NM9YqZqmWMUkPjZM48Mv6bEhsDnQ/tbw/2Mkjy6Fr7g0o:97cBWMpPjN8DbEhSQ/lFTjN4
TLSH
T15C659E2E6BAC81D5D577D13DC9E28206F6B2B4611B318ACF1152833E6F37AE44E36721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 9338827e8dbcf6fce3ab80c9ba9f55fa1d8dbb24624a9a781fc91eb12828bb7d
MD5 218a1ce68038b0489107c39c8aeb54c4
SHA1 50221532121adc11ac232f97cfcd312baf6e76d0
SHA512 6e2fe4c8bc0f5da489943311157a24c2c9c2047a696c7af506a3fbeff523348cced03b254037e0381ae73c710c382b94c1ab3226f4955e963be1e3aeb5fa785b
SSDEEP 24576:jW6BApg2YuyuNDYTabvcdvNYf8km1FnQ/tbw/2Mkjy6Fr7g0o:jF2YuHNETovAvNYf8kmjQ/lFTjN4
TLSH
T1DA857E6927ED80A4E0BBD27D45B7D246FAB2B8511B3056CF0255862E1F33AF44D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 0641cce53e134051ab2735fe3968ea242a98fd95288e244430a5d1a3a97e8960
MD5 3b81b0d2c206cba0030e50ebeca2db87
SHA1 18a7710d6a25a013233c729b979ed71499798bc6
SHA512 283b781a32f4dd73373b651af826513bfc2f6944850a0e07a5100779c1bfb067748d4e3f4aaeef2023033e787a8b4b510f5f577e59f49dbefbf485288059d3a7
SSDEEP 24576:UAFs06+Omlf3NXEbTownQ/tbw/2Mkjy6Fr7g0o:ZFs060lVXuRQ/lFTjN4
TLSH
T19465AF2F66AC00D5E07ED17D8997C91AF7B1746307255ACB0260863E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.6MB
SHA256 635eef0bb480c9be3f04d99d06d93a7752dfd72bb7d8e585c28ceb6e15bcde21
MD5 54143a6b1c905c55b85a0365687b4789
SHA1 468b366c547dbcf9e0ea609b5bc293fb3ad7c4b9
SHA512 b36072981c64cdf54d99c5e40312ce2fd4f9eac6503eb359013f8d0e7a95347eb322a89c024984c7ade63da136f123c1f908ded97a95bab231648b25f065a9ec
SSDEEP 12288:XCJnJ5D3VkrszxzGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:yJnJ5D3WYRnQ/tbw/2Mkjy6Fr7g0o
TLSH
T1BB75D03DD2A810E9E477C2B4819A1746FF72386D2F226ACB2864D5357F22FE05979F04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 f829e132f1d072bc8a74b3f0b4429cd30040e16f0e1fd2c8cbc1bed2c593e712
MD5 9d563b3171d633882b3fa6409498a577
SHA1 9dcad3ab676c5ba6f7d180b1f0e8e3824778c530
SHA512 91a33d5458b04c9b136d66156836c30b4516507191fc81ae5c34cb0ba99a388aec6b27fc6bfd417924a99fee123af48a2b924e18206361256b5b1e5d2a7c06c9
SSDEEP 24576:dEPghm6/7IIXdwcXrif7qQncjlP65i3VuKnQ/tbw/2Mkjy6Fr7g0o:qg06DIKdwc+eQnSt65aVHQ/lFTjN4
TLSH
T1C6955C16B7EA5294E8B3CAB1C96291169B327C509B34F7DF0AC0C92E1E33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.4MB
SHA256 229fd860aed06c18dedbf74cebce37566aeac70ddea77a100c33cd24c4170022
MD5 8bf0c48ab69b506f938e49ac672c99bd
SHA1 b2a9940553ff3afdd3f5efa505808f94ebdd2262
SHA512 b66968890f0042c0affa05dac11c4b262a6c581bec5a26e16a09643fdab6a42975514916d140fe7f09b8c4bf46f9d4d272fa338b84620ed44122c7008d2389e9
SSDEEP 12288:0EP3RjNGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:vjtnQ/tbw/2Mkjy6Fr7g0o
TLSH
T1A265126D37ACB0DAE52B517D84928145E372F4A12B5267EF2690823D8F3B7E41E3DB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.4MB
SHA256 f35591a9ee7f43eb07e93b0b77de2a07702941d41be91fdbb2dbbf15426dc8cd
MD5 a51613113d3b8446743780910a049f67
SHA1 1ad211f322770ba7755a0fe03825d22493cc5c34
SHA512 0012b1e64f8779c8d9ae87942d8144562830c8a21aa2f004cd4d3aa0f8351f087aef97744a060c572e58ce1122fb094f919dd56ffa6c051c147bc154f2475d4a
SSDEEP 12288:BjkyCGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:BIyCnQ/tbw/2Mkjy6Fr7g0o
TLSH
T1A66512186398B4C6FA7A06788DA381919B367C506F2193DF6280F33E9F3A3D46D75B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.3MB
SHA256 a43df0b4965a0639bf0da0cc5eaa6bfab05d732ec17e3469aef23dba66315e95
MD5 0a20c28275833341ba0f6a4e619f1098
SHA1 a0a63dcf6c28be533223094b083c32ec17ae1883
SHA512 a239dcfb872643912a93517657054ad8ae2f53052d770ecb73873247debba934b77997a87cdae8133bae66fe1cf705e51ed557ec464ed9226fa99b9c4b60e4b2
SSDEEP 12288:DWUGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:a0nQ/tbw/2Mkjy6Fr7g0o
TLSH
T1FC55236C2665F88BFE2706F448938542A73A19D17F9167EF36846239CB7D3C015BBB80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 edcb6b83a67c657e60d68f8f6e0edfa435af516e71becb6fe0816904a58368ff
MD5 5d82edf06ff5b76e29c716f2e2f883b2
SHA1 ea62e26b0cb8e58b10d8fa7aa11231b4214732fe
SHA512 588cee0c5b8df4a6033faa8f9a7c1743a194cb3bd18b60fc0ccff666ad5ec7c936be6e887e83c0924fc7be4a43ac9412fd33f994069391904827b156593be32e
SSDEEP 24576:8Q9MxZKdcz9dw3LnQ/tbw/2Mkjy6Fr7g0o:8VKZLQ/lFTjN4
TLSH
T131558D2DABE9198AE177D27594A240C3A673B4311B31D6CF2448D03D4D7BEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.5MB
SHA256 7843955bb1864cabfbe9a3766450cd3dca2cf7535f260c5b14723536ea4fb75b
MD5 9ffb15f2c87a6535905715bbaa69b6a2
SHA1 23f2c7c23bdabebc607fee02ab09437b52287297
SHA512 e48e4216a3cbbd76086d6e6005a40636da776c9cd377cd19f00a106fce50390e29ac8cbbf1a4ec708e1122427b5712ad73a39ba9a39e2fb05a82de343e882e48
SSDEEP 12288:+yoKo2FRple9p+GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:+yocHAp+nQ/tbw/2Mkjy6Fr7g0o
TLSH
T14675E01FBB6940A2E136813C89818745E773B4706B6263CB6691C33D8F776E87D39B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 124edb4389a42d984f651fe095af321d483aeef823681751eb4a74abcf07af56
MD5 849f3f3bccd7e87fdbc2c7f128d87ff5
SHA1 dfcd6523ffdbeef5553bb13df10d2193b8e7f547
SHA512 d615325c68ea62328db1e41b556baf439d6b225c137c561ab1acf6380c02a869d24e2410471a83005efebc02ef3387b2d6e7deead320b13f914e2499fa114da4
SSDEEP 49152:NWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IK+Q/lFTjN4:t0zuNIrLm
TLSH
T1ABA57C3DA2BC00A9D8AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 707c10650acd0fcc25389980398330a4fc62cb6b7c1bfe1493489e4695398c60
MD5 ec0370a21fb22ceb7a752342566e7587
SHA1 c50d77c9b9fa6d027329fab4fd9c8985737106b3
SHA512 e3ce8bd22b0828825c7f7b1a4cde27a383cad7be31ff3e0e89b53b5e312a01013e301535d71af3f951f4ea520ba459e2ce0e802cf9cfc7347ca5262fc58ba8a5
SSDEEP 24576:G1QT7EcpfxR+N5AWAz3ooiYtjMqbtnQ/tbw/2Mkjy6Fr7g0o:LTDxR+N5YzTfjMEQ/lFTjN4
TLSH
T1F055B02EA7F855E9D17E86798A23C502FB727861033193CB42A0C17E1E7B5D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.6MB
SHA256 8037e1f80d17e62ce28a7b771837fde998e653ea7ae63c70cca71812d19cf394
MD5 c6bb0bdb705e7f8b4af1bc9c53a90081
SHA1 46a48a586546a2e6502b701b139de88ef9d7406e
SHA512 7e3daeaa35c8f85a517ae81e4c02e287f5501795efae434416673125a4049511a914107ba33febd6c67cf609beb83726a470c5b604336da0d92e90e7743bf5bb
SSDEEP 24576:2TMdOz0FFS+2mSL5nQ/tbw/2Mkjy6Fr7g0o:S0K+2mSL5Q/lFTjN4
TLSH
T1E675E17E636D14E5E53BC27DDA438906F67234620322A6DB0690C1792F6BFE4397EB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.4MB
SHA256 001d6f0a7add4967747fef47acaf1759030c97756a93bf37b23cb86901eedeb0
MD5 65f311656d7a81bf836e3de0b854f7ee
SHA1 743d848eb8da8d875681713ab74a30be69ef0b9f
SHA512 fb59a708d7b36051936de5cb8e7785fa14839c07f4e5bdc8932568a22e86023d767eaadd978d78b06a4b2e23d8a7dda9d95766b60e981f87670609e756814a36
SSDEEP 12288:e4+IGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:YInQ/tbw/2Mkjy6Fr7g0o
TLSH
T15165122C23E874D6F93752B48962414297327CA22B6167FF36C4C23E8F3A3D4597AB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/228-245-0x0000000000400000-0x0000000000558000-memory.dmp

Download

memory/228-107-0x00000000006D0000-0x0000000000736000-memory.dmp

Download

memory/228-102-0x00000000006D0000-0x0000000000736000-memory.dmp

Download

memory/760-366-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/760-247-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/1076-246-0x0000000140000000-0x0000000140156000-memory.dmp

Download

memory/1512-74-0x0000000140000000-0x0000000140196000-memory.dmp

Download

memory/1512-61-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/1512-72-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/1512-67-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/1712-6-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/1712-17-0x0000000140000000-0x0000000140764000-memory.dmp

Download

memory/1712-375-0x0000000140000000-0x0000000140764000-memory.dmp

Download

memory/1712-0-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/1712-369-0x0000000140000000-0x0000000140764000-memory.dmp

Download

memory/1872-249-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/1872-124-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/2340-40-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/2340-242-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2340-46-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/2340-416-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2480-57-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2480-258-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2480-51-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2556-129-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/2556-135-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/2556-250-0x0000000140000000-0x00000001401C3000-memory.dmp

Download

memory/2796-177-0x0000000001A20000-0x0000000001A30000-memory.dmp

Download

memory/2796-413-0x000000000C980000-0x000000000C988000-memory.dmp

Download

memory/2796-195-0x0000000009E60000-0x0000000009E68000-memory.dmp

Download

memory/2796-418-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/2796-161-0x0000000001770000-0x0000000001780000-memory.dmp

Download

memory/2796-256-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/2912-253-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/2964-248-0x0000000140000000-0x0000000140157000-memory.dmp

Download

memory/3308-142-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/3488-254-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/3740-252-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/3992-441-0x00000173C6380000-0x00000173C6390000-memory.dmp

Download

memory/3992-446-0x00000173C6380000-0x00000173C6390000-memory.dmp

Download

memory/3992-455-0x00000173C6380000-0x00000173C6390000-memory.dmp

Download

memory/3992-456-0x00000173C6380000-0x00000173C6390000-memory.dmp

Download

memory/3992-454-0x00000173C6380000-0x00000173C6390000-memory.dmp

Download

memory/3992-451-0x00000173C6380000-0x00000173C6390000-memory.dmp

Download

memory/3992-453-0x00000173C6380000-0x00000173C6390000-memory.dmp

Download

memory/3992-452-0x00000173C6380000-0x00000173C6390000-memory.dmp

Download

memory/3992-442-0x00000173C6380000-0x00000173C6390000-memory.dmp

Download

memory/3992-444-0x00000173C6380000-0x00000173C6390000-memory.dmp

Download

memory/3992-445-0x00000173C6380000-0x00000173C6390000-memory.dmp

Download

memory/3992-449-0x00000173C6380000-0x00000173C6390000-memory.dmp

Download

memory/3992-450-0x00000173C6380000-0x00000173C6390000-memory.dmp

Download

memory/3992-447-0x00000173C6380000-0x00000173C6390000-memory.dmp

Download

memory/3992-448-0x00000173C6380000-0x00000173C6390000-memory.dmp

Download

memory/3992-421-0x00000173C6380000-0x00000173C6390000-memory.dmp

Download

memory/3992-443-0x00000173C6380000-0x00000173C6390000-memory.dmp

Download

memory/3992-434-0x00000173C6380000-0x00000173C6390000-memory.dmp

Download

memory/3992-433-0x00000173C6380000-0x00000173C6390000-memory.dmp

Download

memory/3992-432-0x00000173C6380000-0x00000173C6390000-memory.dmp

Download

memory/3992-431-0x00000173C6380000-0x00000173C6390000-memory.dmp

Download

memory/3992-429-0x00000173C6380000-0x00000173C6390000-memory.dmp

Download

memory/3992-430-0x00000173C6380000-0x00000173C6390000-memory.dmp

Download

memory/3992-428-0x00000173C6380000-0x00000173C6390000-memory.dmp

Download

memory/3992-427-0x00000173C6380000-0x00000173C6390000-memory.dmp

Download

memory/3992-426-0x00000173C6380000-0x00000173C6390000-memory.dmp

Download

memory/3992-425-0x00000173C6380000-0x00000173C6390000-memory.dmp

Download

memory/3992-424-0x00000173C6380000-0x00000173C6390000-memory.dmp

Download

memory/3992-438-0x00000173C6380000-0x00000173C6390000-memory.dmp

Download

memory/3992-437-0x00000173C6380000-0x00000173C6390000-memory.dmp

Download

memory/3992-423-0x00000173C6380000-0x00000173C6390000-memory.dmp

Download

memory/3992-420-0x00000173C6380000-0x00000173C6390000-memory.dmp

Download

memory/3992-419-0x00000173C6380000-0x00000173C6390000-memory.dmp

Download

memory/3992-439-0x00000173C6380000-0x00000173C6390000-memory.dmp

Download

memory/3992-440-0x00000173C6380000-0x00000173C6390000-memory.dmp

Download

memory/3992-435-0x00000173C6380000-0x00000173C6390000-memory.dmp

Download

memory/3992-436-0x00000173C6380000-0x00000173C6390000-memory.dmp

Download

memory/3992-422-0x00000173C6380000-0x00000173C6390000-memory.dmp

Download

memory/4220-415-0x0000000140000000-0x000000014016B000-memory.dmp

Download

memory/4220-24-0x0000000140000000-0x000000014016B000-memory.dmp

Download

memory/4508-15-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/4508-9-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/4508-21-0x0000000140000000-0x0000000140764000-memory.dmp

Download

memory/4536-257-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/4628-33-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/4628-27-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/4628-48-0x0000000140000000-0x000000014016A000-memory.dmp

Download

memory/4880-85-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/4880-243-0x0000000140000000-0x0000000140191000-memory.dmp

Download

memory/4880-79-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/4912-251-0x0000000140000000-0x00000001401A3000-memory.dmp

Download

memory/4920-97-0x0000000000B20000-0x0000000000B80000-memory.dmp

Download

memory/4920-91-0x0000000000B20000-0x0000000000B80000-memory.dmp

Download

memory/4920-244-0x0000000140000000-0x000000014016C000-memory.dmp

Download

memory/5044-69-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/5088-255-0x0000000140000000-0x0000000140187000-memory.dmp

Download

memory/5088-417-0x0000000140000000-0x0000000140187000-memory.dmp

Download