c0bbd74bc6bb072e8082b7944d77068de96da46078f537c1e30c8997b315e990

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/10/2026, 16:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe
Size 3.2MB
Sample261024-vgrhcsvzfs
SHA256 c0bbd74bc6bb072e8082b7944d77068de96da46078f537c1e30c8997b315e990
MD5 3508df740870b318419f56cac029c84d
SHA1 c131c83b40737757072082a0bbdd63d86b434289
SHA512 76af9dec02ece9d3a9df1adc990a43768c29ebc7bc3242f18afd3a07f5c6a9b08512ab8895a20fd309caf3a7b54e00265993c2dadd449789331a53072829a983
SSDEEP 49152:oEWLjP1tR+varaPQRN0CWG14fCot2vbExxOkan8AVqAKE5eQ/lFTjN4:oEWLbMCrLNxWGuFgEgka8KK65Lm
TLSH
T197F52369A387B2DCD53785B40C9602EDB37A7B90CB835BAA1BC276356E731D43E16310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution persistence privilege_escalation ransomware spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe	2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe	2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe

Executes dropped EXE 22 IoCs

pid	Process
4700	alg.exe
4896	DiagnosticsHub.StandardCollector.Service.exe
3928	fxssvc.exe
5028	elevation_service.exe
2380	elevation_service.exe
1404	maintenanceservice.exe
2524	msdtc.exe
2824	OSE.EXE
4624	PerceptionSimulationService.exe
4848	perfhost.exe
5100	locator.exe
1524	SensorDataService.exe
4300	snmptrap.exe
724	spectrum.exe
4132	ssh-agent.exe
1476	TieringEngineService.exe
1420	AgentService.exe
4324	vds.exe
1292	vssvc.exe
3024	wbengine.exe
2168	WmiApSrv.exe
3160	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Registers new Windows logon scripts automatically executed at logon. 1 TTPs 1 IoCs

persistence

Logon Script (Windows)

T1037.001

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Environment\UserInitMprLogonScript = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe"	2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\SecurityHealthService = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe"	2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SecurityHealthService = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe"	2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe

Drops file in System32 directory 31 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\15848adb862f6ed0.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe

Direct Volume Access: Opens a physical disk for reading 1 TTPs 1 IoCs

Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

defense_evasion

Direct Volume Access

T1006

description	ioc	Process
File opened (read-only)	\??\PhysicalDrive0	SearchIndexer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	DiagnosticsHub.StandardCollector.Service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	DiagnosticsHub.StandardCollector.Service.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000856524ded863dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bdb251ded863dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000075f00eded863dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f74f4fded863dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003b6ba8ddd863dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000af41feddd863dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cac464ded863dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1748	schtasks.exe

Suspicious behavior: EnumeratesProcesses 42 IoCs

pid	Process
3344	2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe
3344	2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe
3344	2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe
3344	2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe
3344	2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe
3344	2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe
3344	2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe
3344	2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe
3344	2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe
3344	2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe
3344	2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe
3344	2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe
3344	2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe
3344	2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe
3344	2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe
3344	2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe
3344	2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe
3344	2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe
3344	2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe
3344	2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe
3344	2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe
3344	2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe
3344	2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe
3344	2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe
3344	2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe
3344	2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe
3344	2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe
3344	2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe
3344	2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe
3344	2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe
3344	2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe
3344	2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe
3344	2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe
3344	2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe
3344	2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe
4896	DiagnosticsHub.StandardCollector.Service.exe
4896	DiagnosticsHub.StandardCollector.Service.exe
4896	DiagnosticsHub.StandardCollector.Service.exe
4896	DiagnosticsHub.StandardCollector.Service.exe
4896	DiagnosticsHub.StandardCollector.Service.exe
4896	DiagnosticsHub.StandardCollector.Service.exe
4896	DiagnosticsHub.StandardCollector.Service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
652	Process not Found
652	Process not Found

Suspicious use of AdjustPrivilegeToken 43 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3344	2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe
Token: SeAuditPrivilege	3928	fxssvc.exe
Token: SeRestorePrivilege	1476	TieringEngineService.exe
Token: SeManageVolumePrivilege	1476	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	1420	AgentService.exe
Token: SeBackupPrivilege	1292	vssvc.exe
Token: SeRestorePrivilege	1292	vssvc.exe
Token: SeAuditPrivilege	1292	vssvc.exe
Token: SeBackupPrivilege	3024	wbengine.exe
Token: SeRestorePrivilege	3024	wbengine.exe
Token: SeSecurityPrivilege	3024	wbengine.exe
Token: 33	3160	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3160	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3160	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3160	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3160	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3160	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3160	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3160	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3160	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3160	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3160	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3160	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3160	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3160	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3160	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3160	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3160	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3160	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3160	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3160	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3160	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3160	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3160	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3160	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3160	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3160	SearchIndexer.exe
Token: SeDebugPrivilege	3344	2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe
Token: SeDebugPrivilege	3344	2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe
Token: SeDebugPrivilege	3344	2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe
Token: SeDebugPrivilege	3344	2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe
Token: SeDebugPrivilege	3344	2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe
Token: SeDebugPrivilege	4896	DiagnosticsHub.StandardCollector.Service.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3344 wrote to memory of 1748	3344	2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe	110
PID 3160 wrote to memory of 3052	3160	SearchIndexer.exe	112
PID 3160 wrote to memory of 1964	3160	SearchIndexer.exe	115

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe"
1⤵
- Creates a file in the Startup directory
- Registers new Windows logon scripts automatically executed at logon.
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3344
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks.exe /create /tn "SecurityHealthService" /xml "C:\Users\Admin\AppData\Local\Temp\~st0E5922D1.xml" /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1748

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:4700

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4896

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:4636

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3928

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5028

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2380

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1404

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:2524

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2824

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4624

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4848

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:5100

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1524

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:4300

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:724

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4132

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:1672

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1476

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1420

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:4324

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1292

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3024

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:2168

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Direct Volume Access: Opens a physical disk for reading
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3160
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3052
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:1964

C:\Users\Admin\AppData\Local\Temp\2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe
C:\Users\Admin\AppData\Local\Temp\2026-10-22_3508df740870b318419f56cac029c84d_icedid.exe
1⤵
PID:2948

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Boot or Logon Initialization Scripts

T1037

Logon Script (Windows)

T1037.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Boot or Logon Initialization Scripts

T1037

Logon Script (Windows)

T1037.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Direct Volume Access

T1006

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 e17948b3468a7536a32631d67510552f783bbfdebad24cdb690091e01b39d885
MD5 37039ee31fde75ff903cd21926758611
SHA1 a52bfd129557bff708bbc7ff074d2f8f52c125db
SHA512 84b12355b71caafeb749f78a4c2a0a2347e8d89e1fba23708e61a0dedd757f87938897e907066ecacf56e93ae5fd34d366c20bf902e4713d8f626047edb91ef7
SSDEEP 49152:xb+632BuPkFKRrdE6ohmstBhuXjfS4LWxntQ/lFTjN4:33q6HjBFLm
TLSH
T19DD58D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 6d7e6c9de61660cc7d3be89e8fe367642044f235a174c401cf50409d3fda3e15
MD5 e7016bc31c21f5687f614f7e7ce337ec
SHA1 d214e38b6967df89f76a8655ad39ca716192fb8d
SHA512 7680c4e191eaa8350a1ddee224704476ebbe466e3d3c44e8587f2e78f168814bc5a9f14b3fd244c281b6b16f7137df3c02462a39e0bb0a1f1f772175724fad4e
SSDEEP 12288:a1XLsswWkxy2lRq2czAGGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWT:wXYfDtczAmnQ/tbw/2Mkjy6Fr7g0oT
TLSH
T12165F12877E448F9ED67827DCCA28502EB73788547A0E78B03A495295F373D85E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 b34f9dc3a237e6c4a0ece995321539ac0cd4f2ea3126bd692bb1e00c132ba97e
MD5 e6893c3fab8f90dca771e8f9c7ed4b16
SHA1 2c0295a9a9aa5ae1d59b091bfea8b2c612ff2f75
SHA512 290cc23ad5083fd1bb87386be86f3472ead5f0fe91136a73e4f7c56dea6d762f501907408246ac63d0077da16fe3e3d1e3eb76ff10ea19cf13c8312d5dfe0ec9
SSDEEP 24576:q0Le5ji0hmxLrMFnQ/tbw/2Mkjy6Fr7g0oz:qPji0AlkQ/lFTjN4
TLSH
T165859E15F6748735D073C0B9C5D2A68AEE7230825B308ACB4286D77C7E677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 8e73cd6a6c406dd8bf0d832204a8df722421e2ff9b1904da95afb12980614f3f
MD5 f4d7472c06fcaa54ad82ea5c544e5671
SHA1 88f4f1c8370a68fc570df69e2241ad044093e848
SHA512 2a40ac65fe21d501e65648f4db413a8c0b5ea0aaf05ebe304b43c749307e06c37edec57ebaca15d7dd861077c7f9b8c1c2790b4cbf92d24951425884355ef8bc
SSDEEP 24576:Na7/ezSC6vUyD/aqgrvWE6q8wyunnQ/tbw/2Mkjy6Fr7g0oD:E/ezSC6vUzPvxHjyAQ/lFTjN4
TLSH
T10F755D25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 7cdc8d3d1fe3d4b9a5d4fd66c6eeedb4ab801b36a2e3aedeb0baf534bb7eec81
MD5 aba6d2b70f4a5a1d52d262506120d5f9
SHA1 ddbbe4e33e6ade689df2c7d89c43606574df3de3
SHA512 1ec5c8d025ad9f13a0eee8e7627da6e7bb9e6609a4227f85e662f2e85022a5e98351e5affa4ccc0cafdc416331e7ab3c791d3e4711479a7e325f037cc048deae
SSDEEP 24576:mVbqPb88hv/l+66nQ/tbw/2Mkjy6Fr7g0oL:mVO88hXl+RQ/lFTjN4
TLSH
T146559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E777E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 7943804fd35f48fd01796cc896d54a2046283382d5c4094a72b79832fb97e698
MD5 96ee95f2fb2bbf4b4e47b91e1756849d
SHA1 a85a620e68ce6a864f891b0af1a21a7cb7e8d0df
SHA512 59e815d35fdfcc45b4a1847654f7c4e44af66253ed4a0a102849ce556226900e1eaf79a5246443369ae6f85106ed184f3d85d946b7c47349bc30e6433a6e118f
SSDEEP 12288:ozpGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWj:oz5nQ/tbw/2Mkjy6Fr7g0oj
TLSH
T1D05523696A24F897FF2B06B15CC284826B7B0EC1BFD4A74E6B44322D857C39446DB381
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 1334514b4a0910dcd79e607b93148f6f9b9dc97c140c7c645a9b4e83ff8b431d
MD5 ba4ff156c5e574f3f3fda870fc10d5c4
SHA1 deda0ad480e11c8c3817e88f7934e9cc8328f10c
SHA512 71a0e04d341ea56f35b2c7556f2a36976ab93b234a6c762b8bfdc5b49f4c463889afb04d219c4075a4302c7e7c8da7bf6b99b7bd4202476726816600557a488f
SSDEEP 12288:heBNUbTVO86UyGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW+X:hJIUynQ/tbw/2Mkjy6Fr7g0o+X
TLSH
T19375CF3BAE28FCD2C27E4DB85A918640D77278704F61A3CBD164830EDE276E05E7AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 822593828a7d18119f8cb444ed15712e5c9ca71a6274c6d5b268dcd83c2b849d
MD5 cf9b91217f0136d91398b2b18815c14c
SHA1 748c1d08e9c2e5c30cba2d903924d3e60ca2c9c3
SHA512 25393e44c287dacb0b62df1a9e1de9bb751623c7e72814aad65e6fc0ea8c917de88d62fe1999dc4c1485eef970d68d6a545248b77f73f702ebd11de0a173c2eb
SSDEEP 49152:gQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THo:gQvGAdlCEL8c/yRNw5C8Lm
TLSH
T1DF267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 6a0188cf41277236395a22ca5272b9f9d605e1a702a2447f8ec3da1013fa0be1
MD5 8a68d77ddc6ca0f1dfbfd80efcc2dd1b
SHA1 cce51395d51871fdd1a76d126640e2faabf27f3e
SHA512 ee50c648e9027f71de2d41f7883825b07eb733f404ee447e2d674e61b15792eea2a5e7950a36053721f73003b386fded730acf20de2c4e8e4379652429fd891f
SSDEEP 12288:GAwSfxL/2Dc39DLLmt0LDQewsAj0GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsgM:bQewsAjUnQ/tbw/2Mkjy6Fr7g0oq
TLSH
T17C75E031FE74E436C77F0DB21B26C706583D6A604FA11AC3E3A84A9E59342D22776B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 1fa99bceff7834910273a003f30631e0363b019dc718ff5ca11acb7b85d0b2fc
MD5 d9a01bc30a0642e85b065e37c4ecd77e
SHA1 1a3fab4af6ffba8fcb44a29a67534f1129741014
SHA512 6f8a233aa99d38f0f6db5b9676c676f626516e2050008432dc5ffcbeb25f8485b63382c0b9c402f2419e4874b5dd7b3a10bb6f2e2c80a1fdc05b96f1ac35565b
SSDEEP 196608:4UEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHfL:4UEtQevvqc2W1cpV2EI32
TLSH
T10D474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 4a650e4130310d5489bb71d9ab93ea806920b66f30fbcd56cbc3788f19570e9a
MD5 3a3e180d277aaef9988ba86cae77ebaa
SHA1 cb8045d145ebd3ce8e510cbdfb514e06296344b3
SHA512 6bf56433d05da98389aaeca15b2ce4d63d7402745854662789cc8cd78fdbdb3e3ccf4115a2704f56c7fcab8c40b9ea952c08e4b0cde3b1392b2e0a61e1bae23d
SSDEEP 49152:NCbRquA/m2yL5zQfFiV+XenmE3/z0Q/lFTjN4:qoqtVjnmYLm
TLSH
T17CD58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 b4467afbcf4fa98fa16c1b4fdc83032d0962292b05bc4d22100529927453c23c
MD5 b0ed0b678f508fbc3005ebf508657026
SHA1 7023e81c2c3f5cc010cf6d5b4d77b9a9228dec63
SHA512 3bec7acbff4bb0ef3eec5aa96b1de81c1b3f06fa2cf7702a2ec61b703b3836afb7b1dc3fb6a60bb83dbfb06ae76b8e15c287b91030fa421ef9cb8982d8ea5152
SSDEEP 24576:kAhGLJIFoiwtA5l7S53TnQ/tbw/2Mkjy6Fr7g0ow:kAMyFoiq5jQ/lFTjN4
TLSH
T13535AD81E7F955D4F5B3AAB899B68171EA77BCA65E31C20F2250D11F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 bfd1ac015e1105a429d35a671db6f8a195ea258c963fe346376b09d4160d2058
MD5 d670dfc40ff890a649c8ddf2cffb1dc4
SHA1 d038462c76c87367a8fb23ffe7cf5c29be16dab3
SHA512 80c5c79bc6b1222c602a39c81a021002e34d0376881c93963e9bf7bc0c23ae507a2ae709c5462b969f7bdb37ca167e80554e8450abc88146b597e5f6d18760ca
SSDEEP 12288:Rmw5HEjsChN2BFgl0WDm+CnGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMS:MwuHOWgnQ/tbw/2Mkjy6Fr7g0o/
TLSH
T1F765F14A36A45CF9EA6742388993C136F7B3BC422A61DB1F1760C65B5F373606D2EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 6f2ad3e664972d3ed29cb295dc1481c3d8670cae9845b14467e508f671358f8c
MD5 741c63a3181afd08b61fc1b66e8a79f8
SHA1 aab354029200a23526f63b2a7c915a751aabde4a
SHA512 bcf818074220b37aae7afa7944756424bc9264778490c9ed6190d6eed438755666b6e83977530f9a1ddba89c8b9e88bd2cc735d51cced0952fddc07213bcea0e
SSDEEP 12288:4XZ1IykGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWl:AZudnQ/tbw/2Mkjy6Fr7g0ol
TLSH
T11055126933A4B0FAE6674278CCE28646E773388267B183CF275402695F3B7D11E7A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 8dd1a6114a21d54e1cf7eff1d2c9b2ec938a288a82949ba8e097577cb26b1aa6
MD5 da9222437ec2586f5f4996dd69b90d4f
SHA1 373a8e7eb6757a428b6511bff87674209e37ecc4
SHA512 1bae0a7113a097c45ca9fabd949580726703b2cbf0feb95bb606e0da9dc0040289c933b6a7cb7f0bdb33d53141d957be2d788e50f00baa8ea449fb542eab7430
SSDEEP 49152:kj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UE:7QRQyi36YOcPQLvw2gAf+PN35Lm
TLSH
T1AB666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 243683950ab2b45b7b38bd1580c50987109ee120954c4b866184db20e7e4a83f
MD5 b7aef1cc73c3910640a2baf4c1957ce1
SHA1 1bcb6c260e42fb953a587621b3beb4777ee117a8
SHA512 b70f24977b6677beadcbcf45bee53bc0678f5f2744089c97f54827be3414e8b5c94964654e6d531d710ef3a3587411244f0e87aeae71d69603df2381a4ac6ec1
SSDEEP 49152:Bj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UE:IQRQyi36YOcPQLvw2gAf+PN35Lm
TLSH
T12D666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 fbfbd965830c60ec8a7dcd95aa7645a52f4a70c27c4c456c4437cb18ec7a8406
MD5 1094a8ab7387711c5a218ecdc596b750
SHA1 1624b6b08d3ab2dcd84cbf58240e5fd37810e071
SHA512 6e44444a4b6d2eecf7a4d302acb517311618f002bde857605698b1f0d2c9cd281cda25aa983e12a3b9b4ce22a14cc3b51a99406436a3e1e493f99858e57c9398
SSDEEP 24576:TwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0tnQ/tbw/2Mkjy6i:r68Qg55nhheWu7PNU3/kQ/lFTjN4
TLSH
T1CBB55A33B2F600A9C44DE1769F46872196D27C75CFE0E3DB8505721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 b8b931bf81c49c1150c82ad143028b120f8310cc6c7580aa486ad7db76725516
MD5 569bf9bfec45e4896884a01ca2ae0dd3
SHA1 2d0ee79ff3823641b35209c7de6958074f361a9b
SHA512 8f10c264c5dc68d87a5a2c7fb293b77e178b31ddca0c54c4705f69d73ba59130ce81a818ce5aee0d92b76657ac575e376228d1d070c1a794f509e0e491feea94
SSDEEP 49152:33aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk996:6y5112gYy5azzVvL69nLKnhZuLm
TLSH
T151167B13F29910E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 e974b0b15d25ed2f49347b764c97f5c403b9dcb3500f862e2e9dd694b61c2345
MD5 7dc46410ad619d9f62fdcb82ca2bf7e5
SHA1 3dfa6d69594d0b3c686f715e28fc8b494986af98
SHA512 27de9eda5ce68a8731740a03d7fe47e8f9ff0af2584cc71d4ebbd5d7ea01bcd5dcf478ac3fdb2e5f13b96aefff0197f4e623af39b96a1a3ef0fc53cd4009fffc
SSDEEP 49152:HB+taZ3usBWOBr4tEGT0bqx0z+n217aau1gl2Q/lFTjN4:Ju6JmVxd2dBLm
TLSH
T1B4D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 27e26e13cd136604e1bba7ba485cd0ca76396e8975c2d9d3bff62a792c79a7fc
MD5 43bd944e8736ffc14bce0472aa546212
SHA1 0478cd36411dbe42a14298e234204f8a4b81d146
SHA512 c47a87cca8e29b139c65b43178ec394c1d9a3472670257301a4d0a4efde027d012242a63123fa2053b0d6684755050645c47a2341fc8a3f9c348e848e531dc4a
SSDEEP 49152:y1hpsNoJpF1A6UU44CwH7R4xSQ/lFTjN4:ymifPbRYLm
TLSH
T17FB5AE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 0dbc3c086b0da1cdeba9b3064968d6d8e67d4dcfbc30ba62965b989702648923
MD5 9b694fa18d044751ee6247a5d7325fb6
SHA1 9e52af12c49b536fc4fdbbf498a83517feec04ee
SHA512 6bda048676c5fd5b393f23dbc226f48780f17b2508e7d09edf9135a629b695f7cdcc2433420f7723dc0fbdd35d9cda63353af413817c42263024aae808a7c4fa
SSDEEP 49152:qSuZQIY0Be2KRRVtOnks6NMHqdQ/lFTjN4:05dKTi61SLm
TLSH
T19CC5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 e8ae91d72b9ea2c040b59c3e3c182dbdac49a2f8b0912db64789c53f9d939ca2
MD5 a77d2edc32742e0c4c13063c427f0fd1
SHA1 4fc25cbc2d08489ff0e62d56f3cf0fcd27787f7b
SHA512 f9ae66346d6b5768f1f0f10ea51c8594a47ceb5f312d4db96658a4d51325992367e55d38546e49919803543caeeec5193a1695f17b3d6b65af668f6d479b0487
SSDEEP 49152:qhtSn8EApI0figngiDn0AP5wmQ/lFTjN4:LX2iyph0Lm
TLSH
T1C895BE13F2D940E8D05ED178C7468632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 417ff98c2176ce022846c19a096facc73096c23af9cbeb40fac0b14e1063e662
MD5 1a9b8b692e21ab0a140f805a0648a079
SHA1 da69f68e7e5f4acaf8cd050a436ecc135fe53eb4
SHA512 629aa6717e32f02f368d511865dde054e0dce58e427ebb59f0c5dce4cfa1b240a252524879935ed7c63eb341c3fb8b1e753de2064d93fe27868ebbd67475b15a
SSDEEP 12288:hBGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWd:hRnQ/tbw/2Mkjy6Fr7g0od
TLSH
T13A5523697964F98BFA1706F18C828182A77F0EC6BFD1938F77482129967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 38e71b1638fcefdec4fc0274f079c8d1c1663c5ea648dc06b055445e7611de91
MD5 c639497c6409ea51866672ccaebdda9d
SHA1 9a19750fe035cfb9363978fc37621023ef67f378
SHA512 1acd21a58dc7b48ac52430f1d4f58ce5c82c26f9f8f253518d21bfc68f0e6f461a378786a4324c6b85e52b50ef68b3a5ce7459b9875b1f1a122e5ceb2ba5b231
SSDEEP 12288:IIGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW+:IInQ/tbw/2Mkjy6Fr7g0o+
TLSH
T1255523697965F98BFA1706F14C828182973B0EC6BFD1938F7B482129967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 955b64b29617ad093f2dad9b406aca33f4190194e93d11290fdb6eb8d5195dd9
MD5 65a6025fe11110aa5616ef956a753bb3
SHA1 3e4030b734ccc5b9d501b6cb0ecd6d179290288d
SHA512 0062d49fbdd11c59b759a2079a01b4328f55bf2975818de2454d48f635de5ad57990b89286b9d013e3ce98538cc556920c24df45d4b1a03d016267ff9f7fc9f6
SSDEEP 12288:/KGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW+:/KnQ/tbw/2Mkjy6Fr7g0o+
TLSH
T1945523697925F98BFA1706F14C8381829B7B0EC6BFD1938F7B482128967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 8d7e4c4d13b32ebc7d76a0953ad38dbf2b4073c77badd0beb68dab25a9f0c347
MD5 fbd170992c2a8627071baca2c4d451be
SHA1 c18f11755390469d087093cf137d88c984b0f781
SHA512 275a2d6ca77d6055a391fe129dd0f48b9859fa6147c1eec8f2dc17e181cc1d546bb12ccb8255bdcc84d6540a0720eeb7be197e5f4399d9377e71910ef08398d1
SSDEEP 12288:TVDGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWZ:VnQ/tbw/2Mkjy6Fr7g0oZ
TLSH
T1515523693B69F4C7F92742B4CC928142E77B3DC5BBB1938F6B04111D4E793D41AA6B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 c141b23ecef526f5d5a9cd87fac0f327621e9f26377f302c2e7afdee0d497478
MD5 6887e2566918c8315a08700c36595e7d
SHA1 0cce08de126b31f20bfa3e151df798a414808a23
SHA512 dac108b59a6f69a70af638889fc72be3070e399fef3eaf8ea1700d28077042e223481ee9b8c3317de0f07672956a496652a4bf45e389044c5a8bb23f117d5eb0
SSDEEP 12288:ULGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWi:U7nQ/tbw/2Mkjy6Fr7g0oi
TLSH
T1C15523697965F98BFA1706F14C838182AB3B0DC6BFD1938F7B482128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 753678ec0ec75e0bb0f01e6ea37ad1761f66ec38fd8348e88ee1cd521a4b0289
MD5 6ebdb54c69a620c937efb87cd8d7b9af
SHA1 655fb15d3bcfcd36ceb354026cbf8a2f509d46b7
SHA512 fa0cf1373349543f6f0409631827b07ba2a23f3364ac25501d2595579df1e358e9a98e2da395211e68507b0123af31c3592437974263f7807041de65e1c328b7
SSDEEP 12288:UsGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW0:UsnQ/tbw/2Mkjy6Fr7g0o0
TLSH
T1595523697964F98BFA1706F14C828182A73B0EC7BFD1938F7B482129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 825cbd7f2062aefb305bc3d6e0a068f4323e1a83ec9fb67ca9f0312429234415
MD5 4dd7ccf1202f32458cbe8ed95e2d4333
SHA1 8fa59df5b886f8722143d528e9f2d16b57591366
SHA512 0aae73dd823d7c449b4275f378ea5309bb423897c36ebd078470145e19b9d5855e92bb2093a47171b2e39ab0f4ec4c67d7e6486d7b26c35529beceab4488c61b
SSDEEP 12288:IQGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWM:IwnQ/tbw/2Mkjy6Fr7g0oM
TLSH
T1365523797964F98BFA2706F14C8281829B3F0EC6BFD1938F7B481129967D39416CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 4ba194c9fe0a9e99781f2c43065ff1f7f3f2c56c46cdeee321728aa3221ec9cd
MD5 3650e2524cfa1bb20c7cd6870341ddd0
SHA1 e4e51fb4c228ab99aa5cbfbbea095d2b1f6e71b5
SHA512 7bf56327009952018d152e77d2fec28fe7cfaa8b29f26c78ce31f5f253ff601380c00b09189284a35ee2e69eced3a8ad752848c14c6c398d396d46862b257a87
SSDEEP 12288:/iZwbDzzFEoS2cPvyoGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWX:aZM3zFVSOonQ/tbw/2Mkjy6Fr7g0oX
TLSH
T1647501A5B35058F9EC67427ECC528906D7B27C5A1BA0C71F13A8322A5F373A01D3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 e0b595360bb6ce249cf05d78b886b0c4285a90a27c402efd68611764c58d2b76
MD5 d26a3f7c7fb10db49b0010b8ed163f93
SHA1 bfc377d573786cc28711ce9e618b3eaa5c820f4a
SHA512 6d9b2b47271098814ad026ca9731e6af708c4436c611c212c96d93449ae55b9febfc0bca3c1f019547c3e3029e6a5e980514fbce8d70d198e100ee502bd07398
SSDEEP 12288:6tGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWJ:6NnQ/tbw/2Mkjy6Fr7g0oJ
TLSH
T1645523697964F98BFA1706F54C8281829B7F0EC6BFD1A38F7B4C1128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 4b27c4564153edb7a1f955441833f37674084ccc8f0bd033533caed73c73956a
MD5 a83aee75c254ba1235da92b85596d170
SHA1 89ee32db15449a43cc6dd19d84565d08b5111c60
SHA512 b02ebd6f63f4a37455f5cbb8a2ba1e0abdafe87fe544e3ac082b2ee2aa6335fbb051b1cc162083d2e44d6641e1e4eb7cf1cea1da19eb0c006d1cb08c2ab4d0b3
SSDEEP 12288:iZGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW2:ipnQ/tbw/2Mkjy6Fr7g0o2
TLSH
T1725523697964F98BFA1706F14C8281869B3F0EC6BFD1A38F7B4C1129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 0b9ba0fcb3758b22f9a166b594d015b9efde132bd2effcb461f0702de241131f
MD5 2b78f0462f4096b7f46bec2c9569c86d
SHA1 773a67e54bf17791b74df5532336bdad1c828b17
SHA512 ee9e51f5d11930aae7e37bd22dfea66c150eeb19d3941725fb54c32316ecea4e8c791f72cd1ead815c473a8cb7a80f9eb2b04dbbd53c81972d1f2b334e028441
SSDEEP 12288:8yPz5L8kGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWr:lzyEnQ/tbw/2Mkjy6Fr7g0or
TLSH
T12965021777A170FAE537427888920A02F77678725B609B9F2794037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 2819d606cc9ab5760391f7796e024fd726565699fa38476a6285cfc87f7fa903
MD5 daee5f61ba34cae66a0df4ecb8a2d9cf
SHA1 76b626601bbfbdd32ec89dc8c56be47c2e560556
SHA512 e6fc8be767c3e10bc5606558c27e02bfc7252efdf43c5ce3a53df22ec306e21a23532d49c82bcc1d2ba2ea967ebaf739df5f8c23ec068cc9be1c175fd6078158
SSDEEP 12288:StGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW9:SNnQ/tbw/2Mkjy6Fr7g0o9
TLSH
T1755523697965F98BFA1706F54C8281829B3F0EC6BFD1A38F7B481128967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 39eb2d2fb30518e54f5e8407809c58c0c0a66893c3d0acdfd3128549442d2103
MD5 eb1095242b12657dcab4881ca897a2a5
SHA1 8a174754669e30f026a9c0f3d9dbb5651ec1007d
SHA512 6e5863dfbdf53ca2e8ff50980368f4c4a64348938aee1fa0d6ec25c0d2efe3716703bfa87c7331d0bb935a0124f7a0b477730c285c5f91d4c927ed254a854f2f
SSDEEP 12288:BtGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWQ:BNnQ/tbw/2Mkjy6Fr7g0oQ
TLSH
T1F35523697924F98BFA1706F54C8281829B7F0EC6BFD1A38F7B4C1128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 36a62ab08dcac9b0e71fbd3301546804aa9ed139f193e84f035929c224800ca4
MD5 d696a38944e2c4ca565925933ba9629f
SHA1 fce9437c2f8b640d55caa61df0d5c07b7c16a3be
SHA512 58f6c128afd8b7da3f00537dd6d8e5482451f0ce3dfaa43f4418cfb52342e6293964bf528942759cca0bbdd8e1a96ce8462829e61034db75d6f37ce407e1c042
SSDEEP 24576:acP4mcvIjkGOxhKP2l71nNKbrh/8KBVnQ/tbw/2Mkjy6Fr7g0or:FP4m4IpOO67W8KXQ/lFTjN4
TLSH
T13E65AE2DABDC0096D0BB917485658A4AFAB1742A2F3286CB1160933C7F77EE54F35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 9deaf1e984870109aeb3c60b8050704cd1ea0b09afaba6e1cfcaa0bdc1b8fa78
MD5 31a80c0bdf2b5f6121be652138582f90
SHA1 496f0794cb61cafe78a58385ca203b660b116e4e
SHA512 4e06e8b1ea5589ffd74da4158ada935378195254b8cbff098a4c2138adb03b9b214899bbcb66f8fede6e0ff283a97f633ac85baa284cdee7fcffedb405a0f1e2
SSDEEP 12288:Zssf9GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWA:xdnQ/tbw/2Mkjy6Fr7g0oA
TLSH
T1E565F119E29852E9D02E5275CB828641B3373C9597E1D3CB67C0F53E0F7A2905EEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

~st0E5922D1.xml

Path C:\Users\Admin\AppData\Local\Temp\~st0E5922D1.xml
Size 1KB
SHA256 c09a52a5d07b6f82d23348c7600c18c266a27d6cfcde36f64f80b8300887362d
MD5 1f5773679929aa8027ca1650ec042a6c
SHA1 06c57b2de46d83847c2a44123b4a46fb1cc2a973
SHA512 dfed3168c1779661a1d1dd3c81eae0f5c07cc69667e2b7aecc6b4e6f94b9b0f4b97296bf62684f3defd8c8c34adf0ef7850c4dfc4a940611a1301ba02c369a71
TLSH
T13E219043ABFD221EF1F7AF9CAAB9941259B6FCA44C24D42D00B00A0D0531D71C9B1B3B
MD5 SHA1 SHA512 TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 d973b611ca353b1814a2829b887ba6d4853a7b7016ef09e35aee3dff18af1a71
MD5 e7df84bf1a038a1e8753c8ff7b009b5a
SHA1 7b2be71167b627919e180fc71b5585d5df86f5c2
SHA512 7e91b041f3a6cb2fc0f7d5395e17244319e5819c72b6519c559734c9090e368ac2bb58d804916c80e071beed261f12ce1547f8f3d2f8a19b982c751586d25279
SSDEEP 12288:IdGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW8:I9nQ/tbw/2Mkjy6Fr7g0o8
TLSH
T1045523296768F94BFA3B06B05892C151673F0EC5BF90D38FBB08222D957C3D41EAA745
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 8a4ebd851ac950d0027df773a2e56aed09d083c46695c2ed80688c5e373f6f82
MD5 5622bdb26106dd16ff60dda9494c555b
SHA1 dbedb6ce934dd08e409189f2c50e9cb353d52cd1
SHA512 518c463feb6075413181f13ccf09ce33c36fd813185b5e7493830cdbff4394f1b72ca8ce63affef364053186fad0fd2a6ec7faed5aa50ec0fb5d43af6e7fa273
SSDEEP 49152:Ka0h2GEkuAe73q3pp46zwwQ7Q/lFTjN4:Ka0hNYG4JwfLm
TLSH
T1D3859E1E67EC82B5D0BAD278C9A6814BE6B2B4261B3156CF1150853D3F37EE44D3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 0aa365f77b64dbb38ae5c6a2e01177833d30a7494e6ee577d5dbea02c3e20e09
MD5 ba604ac86d8ba222f4651178695b5193
SHA1 98184c2302b53e6d1b029dad5d52500dfe70b25b
SHA512 6ec93aaf41e521f00e9ab7977aec4714355b197ec7e3b3971887119e18921cc36fa80b491acb90c6820047ad72e2561f0110b50b035253061f981c036b64fc5e
SSDEEP 12288:/hbHjfXYGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW0:/hbHjPYnQ/tbw/2Mkjy6Fr7g0o0
TLSH
T17055027D26AC30DAF63692BD88928546D7327C552B11A3DF2385423D4F3BBE40D7AB81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 9aec042be3aff6fce64fd755df2aaff9990ee26f443021e85051419d9b8b131b
MD5 1a81e5875d64c588b78b207af3a451a7
SHA1 f1a541e4720013bc77febc819c3eaf7520141cc3
SHA512 41d6103f736064ca20955221dd9419c0e56aa860b957916e4a4bc506753af95d79be831f1f4e4b5c0839ac775f8f9cb54f81205a3718cd2c58edee2b74bd93f5
SSDEEP 24576:t3YgnJcRTk4yti+R5dBR/gnQ/tbw/2Mkjy6Fr7g0o2:tIgnaTk46pBR/gQ/lFTjN4
TLSH
T1B445BF2DF2B910B9D8AAD236450147B5FB71782D1F209BCB0170C538AF1AEE85E39F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 ec1e3ca8fec6797a2a0a8241749206faa312efa7ccd8e19f1301d6b329da4314
MD5 102e4dbbdf72cd00a4f07aaf15cfed83
SHA1 c4f5e1f50a25c3d3ec5062f9bed07c8c7a54d834
SHA512 beba838153c7c18d5d24422f2e561856914957fb7d6c0719459bf26ab7d95913b83a328f9f4947bf5f0bde8b5e5cc5fc7dcfe40c15fc6777b7639bc3141b92f2
SSDEEP 12288:OJGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWH:OZnQ/tbw/2Mkjy6Fr7g0oH
TLSH
T17F5523696614F98BFA2B06F54C838146673B0EC17FA193CF7B48212D967D3D41AFA780
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.6MB
SHA256 60a50cd9874319d57588bd203531d48140570e9ddff336c433da494e23f12fa9
MD5 c82f63f5903daaf81d4cc4ef0648abe1
SHA1 7b2e36a52f4f94835315a94650516e913d51de6b
SHA512 cf7d0b038050cbb9ec78cb7ffb6325c5c39b70b2bbf0b2c5a7c96ac0b555fc3685a58e3f95213df56586136a0ea8253072eda7ccb088338e684eb6b2cbc0c6cc
SSDEEP 12288:4Ob4A4LWOsvAYFTGGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWO:VwL3UTmnQ/tbw/2Mkjy6Fr7g0oO
TLSH
T1B375F155F7A450F9E92B817CC8A28616E372789D1764E7DF03A84A691F333E14E3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 a8b3ee2e651abb98fb49aedfac616554c3f433b59f76db145a98ad7f4590a989
MD5 aae9d522329a0bc39e853c989b3fa747
SHA1 32551340bdb8d615cf70f16ef3bd532fb4e9d7c8
SHA512 c1c18e57cff4efeb7f569cd69f2fd25e1d22a017e589e3115eb7b59a5e2ca87fc0ef5c85c8849f548adb9dad89a8fd5a144ff64f1c6cef8db8cbe532690c3a9a
SSDEEP 12288:QpFtCOSGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWr:5OSnQ/tbw/2Mkjy6Fr7g0or
TLSH
T11355022D36EC60E6E536527C89838209D37278961B6253DF0780817E5F7BBF85C7AB81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 1c10bc60f8321bafd0888e8c27e4e377e9fb98426bbffbd33779bf60af93b37f
MD5 2949187b7f5052137af89ac45d55d13a
SHA1 a5e22ced9cef6355c734cc8570cd0429c9301cd3
SHA512 a5e103a398e791cfe44bd8b215721ff48ccaf1ebd4f82734266e45f3b5f687ba5f656b13adc35639484326142c58550c723b47a6f13fbeed8027aa0ceb8b0576
SSDEEP 24576:67NM9YqZqmWMUkPjZM48Mv6bEhsNnQ/tbw/2Mkjy6Fr7g0oT:67cBWMpPjN8DbEh4Q/lFTjN4
TLSH
T197659E2E6BAC81D5D577D13DC9E28206F6B2B4611B318ACF1152833E6F37AE44E36721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 63bcf1a7a3eb14ce88153b00aaaa9e81202627b360953a427f69f4bda915ca59
MD5 9a80bc043d7f61ef2c444deb11dab6bf
SHA1 24a1776719d2524803384a92b833941e78cadacb
SHA512 37e72c3486565dc66b40e12533479a30665f2b56cbe61b6d771bd87c2b37631119a5aee47d1789de1687ebd6f672da31fa0da4b6289e39d4bd5f9b7fcc484975
SSDEEP 24576:7W6BApg2YuyuNDYTabvcdvNYf8km1PnQ/tbw/2Mkjy6Fr7g0o2:7F2YuHNETovAvNYf8kmtQ/lFTjN4
TLSH
T15C857E6927ED80A4E0BBD27D45B7D246FAB2B8511B3056CF0255862E1F33AF44D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 34db6b8832fc67dd231c97b9713180af752717e0cafb9ce3e71f5f793bdbdc11
MD5 3ec558765e88237a313d4450238479eb
SHA1 9409ea45df71b1d1ba40423459efa7dde67ecb2a
SHA512 36656daaad50c0493079b70077c05fa82930b6d22d25def2d4d394d26c7e57d58bfa11377c958e0e5ac358eecf8335ff21c20d6d810e0a20dcfec09904b0cc06
SSDEEP 24576:wAFs06+Omlf3NXEbTo+nQ/tbw/2Mkjy6Fr7g0ou:FFs060lVXubQ/lFTjN4
TLSH
T1CA65AF2F66AC00D5E07ED17D8997C91AF7B1746307255ACB0260863E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 25d93b669f77d334a463007ad6b8e7810a31fd74b971d61f04b3e0e140070515
MD5 0211c33e9438adda0d5931e581a61c05
SHA1 f68363cf833fd12b661a110c4d977e8c54dd6731
SHA512 9cb762884cac54c680eec0a86bdaffeadb081b503d16316269805264a3f173b41e64f64c3e74e113bedd4f6c23769086c32ef14ff5f411a0d6fe918ad703878b
SSDEEP 12288:3CJnJ5D3VkrqzxNGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW0:SJnJ5D3WabnQ/tbw/2Mkjy6Fr7g0o0
TLSH
T12475D03DD2A810E9E477C2B4815A1746FF72386D2F226ACB28A4D5357F22FE05979F04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 59d4c27c069208c881d6ddeba8b7d937ded79b23eeba4d47ba9bed2b5c911137
MD5 e83276d8bddc6bc641ea3af446b688e6
SHA1 68f5da126517bf8ced427ad5fd1d8b628a3162f9
SHA512 fdb0931e110ba0faf05f4d1e1ab2b2392b80c8294388e4292e6c9da292de3c49253bb5a755abb1dcc5de48845706dcc6a996d21bedba42e77104775152adce37
SSDEEP 24576:lEPghm6/7IIXdwcXrif7qQncjlP65i3VugnQ/tbw/2Mkjy6Fr7g0o+:yg06DIKdwc+eQnSt65aVRQ/lFTjN4
TLSH
T1DF955C16B7EA5294E8B3CAB1C96291169B327C509B34F7DF0AC0C92E1E33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 96a46a3a59ab67baa55e8ea98b570b403587cf2d15a8ff2f1941d36b8ad04ae6
MD5 43157333ea6c8730c3583add9bf73ac5
SHA1 1e225c82cab719bd504453474fb94379c4a8d1af
SHA512 f6824c7ece52487b2fdc532d1eb7555ab32d16cd2bd302d5136d8791c4edd566dbc4ec0c7bf8bc17977f091e4ac8935ceef7a533aea7d3db904b9988a09f631b
SSDEEP 12288:nEP3RSnGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWR:sSHnQ/tbw/2Mkjy6Fr7g0oR
TLSH
T1EB55126D37ACB0EAE52A517D84918145D373F4A16B5267EF2680823D4F3B7E81E3DB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.4MB
SHA256 da82cecccd6cd6a2e815e15a91d7abd9b6ac0b74fd6aac68bf4504c0574ffe13
MD5 c12ad321a64acba9566877b9d4e559d1
SHA1 99bc9e7127183116b1eeca5ed900bc3d4f9b860d
SHA512 8d3fd045ec723144f1d191d292f6dfc203c38fb3cf7231b3c5ab79cfd18066ad1a7e9003a12a7270305a503ae290667457ec42e547292482c4419b6cbb5d9088
SSDEEP 12288:pjkyIGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWz:pIyInQ/tbw/2Mkjy6Fr7g0oz
TLSH
T1D96513186398F4CAFA7A06788DA381919B367C506F2193DF6280F23E9F3A3D45D75B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 ee6e5fb5fe3b944d613addf2a6deed470fa7291de826bdd3d0610847e8eba781
MD5 a2c66b81ef97dd298b8cabe3d04b5c5a
SHA1 baf23e33e85514a7ace09d6594df105a4bf911b7
SHA512 620457bdc6168a666fcc83e033c5138ef54a95280b488b2a20c7641b899967c79005e3d3de259dda698320a84ddec28a6edf4d805a9892dc0252db19fd3bad36
SSDEEP 12288:x0CGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWz:eCnQ/tbw/2Mkjy6Fr7g0oz
TLSH
T10F55236C2625F89BFE2706F448928542973B0DC17F9167EF36886239CB7D3D416B6B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 7a385812b1a1ec5b0ddafd612bee54c81b1cf112e47a0868e9674aa0d5dc4d2b
MD5 c187c50053731dc9e5e2d676385e1aa1
SHA1 1d3056e7c67462c72d4e6d387350704a3ef81ccb
SHA512 cf2a1b5bfeaf2c43a89569495f2fc6bfe4ead41ef21e953877dd52daf99639a6571f124f35d0aec4e030c9ea783e3fc9d4cd9a230b3b6c01124b113db8e9dcf1
SSDEEP 24576:zQ9MxZKdcz9dw3lnQ/tbw/2Mkjy6Fr7g0om:zVKZlQ/lFTjN4
TLSH
T1A3558D2DABE9199AE177D27594A240C3A633B4311B31D6CF2448D03D4D7BEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 61f675cdb79a623f4c7e44fec55764cbf9f11ee5d032d2d3623f83d0eb114e7c
MD5 b00e2010b5260ce3ff369b5872416cd7
SHA1 377c37dec9361d02a53702bc99a151fc7f92dbac
SHA512 1dea20abd5095198d97c81128d1cf014c8c7fb244d476f1e45738f443e96dcd0e4bd5b4488a8cbd4ba40254af3ffea6cd2afbbdb1b390a49581849043438d54d
SSDEEP 12288:nyoKo20Rple9p0GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW5:nyocSApUnQ/tbw/2Mkjy6Fr7g0o5
TLSH
T10465E01FBB6990A2E136813C88818745E773B4706B6257CB6681C33D8F77AE87D39B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 ad817d05e90b505bb19e1da09072ca9143eb70fb8b54926dcb9fa4bfeb25feea
MD5 bac83593f26d4ae1def54f34fa1704bd
SHA1 85199351bdd1f5dedbb587c4c7477e7e8cec3c48
SHA512 ca0914eadccb86140cee8d83250060856f09dd501ec4ea3f6b3037919dbd7db5213c4ce23e2c24eadbbb427a781481f6e060a08b597f42afac4497e9e7b86c4d
SSDEEP 49152:aWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKUQ/lFTjN4:c0zuNIxLm
TLSH
T1E8A57C3DA2BC00A9D8AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 ad0728e5b360584f8e364466ccbac5227a5101b0338230216344f6907f962090
MD5 6d9de8ce29137055a9bde7ff7d032182
SHA1 eedf2859f995d313a0a8632e50981c1e74ec99d2
SHA512 c25f45d77ac779d36daf8929566a17f776bf529f3698118d19f1f28041447cf3ddc35109b126dc66e5b8f369bd73eb8a6205aafb5a49cfc40b2c7efc33adc618
SSDEEP 24576:E1QT7EcpfxR+N5AWAz3ooiYtjMqbHnQ/tbw/2Mkjy6Fr7g0oV:5TDxR+N5YzTfjMyQ/lFTjN4
TLSH
T15B55B02EA7F855E9D17E86798A23C502FB727861033193CB42A0C17E1E7B5D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.5MB
SHA256 639778c4838ca75dc68dd105f49892102ea6f9275ef75651941c7507c52bbf53
MD5 deb7e7f30fd957bcc092da01b5050965
SHA1 717481f740312a129798dee27beb5686f29f8041
SHA512 f5ccd2e9ecb01decf62960d3eb3ed9e567dc5e39e48ce39d3ac0d76f4becc5bb3b8730b6d24b968848587ae3f90c1fd91d175293664323e0b3520a2e961925ac
SSDEEP 24576:eTMdOz0FFS+1mSLznQ/tbw/2Mkjy6Fr7g0oZ:q0K+1mSLzQ/lFTjN4
TLSH
T19275E17E636D14E5E53BC27D9A438906E67334620322A6DB0690C17D2F6BFE4397EB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.3MB
SHA256 0a146888da4fa90941df00ea527ba59fc88506e9b82bb2ec35352174f7ea1c0c
MD5 90dc018e8c4c82fb73e82845ff8a0936
SHA1 4f406a31644ce3f58fa6cf5224682ddcf1dc3e8d
SHA512 cf06c5c04065ac6e45995fe8b1eae3983fec7081c1b3230ddfeecf32b62e354b0907577f364ae575c23dce46f2a24522c94ceda2c47ea1c4f92d69c33f51036b
SSDEEP 12288:V4TGGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWd:omnQ/tbw/2Mkjy6Fr7g0od
TLSH
T1A255122D23E8B4DAF93752B48962414697327CA2276167FF36C4C23E8F3A3D44979B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/724-107-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/724-290-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/724-113-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/1292-294-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/1404-62-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/1404-50-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/1404-56-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/1404-60-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/1420-131-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/1476-292-0x0000000140000000-0x000000014018D000-memory.dmp

Download

memory/1524-288-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/1524-361-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/1964-392-0x000001992FF20000-0x000001992FF30000-memory.dmp

Download

memory/1964-394-0x000001992FF20000-0x000001992FF30000-memory.dmp

Download

memory/1964-389-0x000001992FF20000-0x000001992FF30000-memory.dmp

Download

memory/1964-390-0x000001992FF20000-0x000001992FF30000-memory.dmp

Download

memory/1964-391-0x000001992FF20000-0x000001992FF30000-memory.dmp

Download

memory/1964-393-0x000001992FF20000-0x000001992FF30000-memory.dmp

Download

memory/1964-395-0x000001992FF20000-0x000001992FF30000-memory.dmp

Download

memory/1964-396-0x000001992FF20000-0x000001992FF30000-memory.dmp

Download

memory/1964-397-0x000001992FF20000-0x000001992FF30000-memory.dmp

Download

memory/1964-370-0x000001992FF20000-0x000001992FF30000-memory.dmp

Download

memory/1964-371-0x000001992FF20000-0x000001992FF30000-memory.dmp

Download

memory/1964-375-0x000001992FF20000-0x000001992FF30000-memory.dmp

Download

memory/1964-374-0x000001992FF20000-0x000001992FF30000-memory.dmp

Download

memory/1964-376-0x000001992FF20000-0x000001992FF30000-memory.dmp

Download

memory/1964-385-0x000001992FF20000-0x000001992FF30000-memory.dmp

Download

memory/1964-383-0x000001992FF20000-0x000001992FF30000-memory.dmp

Download

memory/1964-382-0x000001992FF20000-0x000001992FF30000-memory.dmp

Download

memory/1964-384-0x000001992FF20000-0x000001992FF30000-memory.dmp

Download

memory/1964-381-0x000001992FF20000-0x000001992FF30000-memory.dmp

Download

memory/1964-380-0x000001992FF20000-0x000001992FF30000-memory.dmp

Download

memory/1964-379-0x000001992FF20000-0x000001992FF30000-memory.dmp

Download

memory/1964-378-0x000001992FF20000-0x000001992FF30000-memory.dmp

Download

memory/1964-377-0x000001992FF20000-0x000001992FF30000-memory.dmp

Download

memory/1964-373-0x000001992FF20000-0x000001992FF30000-memory.dmp

Download

memory/1964-372-0x000001992FF20000-0x000001992FF30000-memory.dmp

Download

memory/1964-386-0x000001992FCE0000-0x000001992FEE6000-memory.dmp

Download

memory/1964-409-0x000001992FF20000-0x000001992FF30000-memory.dmp

Download

memory/1964-408-0x000001992FF20000-0x000001992FF30000-memory.dmp

Download

memory/1964-407-0x000001992FF20000-0x000001992FF30000-memory.dmp

Download

memory/1964-406-0x000001992FF20000-0x000001992FF30000-memory.dmp

Download

memory/1964-405-0x000001992FF20000-0x000001992FF30000-memory.dmp

Download

memory/1964-404-0x000001992FF20000-0x000001992FF30000-memory.dmp

Download

memory/1964-403-0x000001992FF20000-0x000001992FF30000-memory.dmp

Download

memory/1964-402-0x000001992FF20000-0x000001992FF30000-memory.dmp

Download

memory/1964-401-0x000001992FF20000-0x000001992FF30000-memory.dmp

Download

memory/1964-400-0x000001992FF20000-0x000001992FF30000-memory.dmp

Download

memory/1964-399-0x000001992FF20000-0x000001992FF30000-memory.dmp

Download

memory/1964-398-0x000001992FF20000-0x000001992FF30000-memory.dmp

Download

memory/2168-296-0x0000000140000000-0x0000000140171000-memory.dmp

Download

memory/2380-283-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2380-40-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2380-46-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2524-311-0x0000000140000000-0x0000000140164000-memory.dmp

Download

memory/2824-74-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/2824-68-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/2824-284-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/2948-331-0x0000000140000000-0x000000014034B000-memory.dmp

Download

memory/2948-320-0x0000000001FE0000-0x0000000002040000-memory.dmp

Download

memory/2948-326-0x0000000001FE0000-0x0000000002040000-memory.dmp

Download

memory/2948-328-0x0000000140000000-0x000000014034B000-memory.dmp

Download

memory/3024-295-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/3160-369-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/3160-182-0x0000000009E60000-0x0000000009E68000-memory.dmp

Download

memory/3160-162-0x0000000001A20000-0x0000000001A30000-memory.dmp

Download

memory/3160-309-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/3160-146-0x0000000001770000-0x0000000001780000-memory.dmp

Download

memory/3160-365-0x000000000CE80000-0x000000000CE88000-memory.dmp

Download

memory/3344-360-0x0000000140000000-0x000000014034B000-memory.dmp

Download

memory/3344-8-0x0000000140000000-0x000000014034B000-memory.dmp

Download

memory/3344-0-0x0000000001EC0000-0x0000000001F20000-memory.dmp

Download

memory/3344-367-0x0000000001EC0000-0x0000000001F20000-memory.dmp

Download

memory/3344-9-0x0000000001EC0000-0x0000000001F20000-memory.dmp

Download

memory/3928-63-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4132-291-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/4132-124-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/4132-118-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/4300-289-0x0000000140000000-0x0000000140141000-memory.dmp

Download

memory/4324-293-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4624-84-0x00000000004F0000-0x0000000000550000-memory.dmp

Download

memory/4624-78-0x00000000004F0000-0x0000000000550000-memory.dmp

Download

memory/4624-285-0x0000000140000000-0x0000000140156000-memory.dmp

Download

memory/4700-368-0x0000000140000000-0x0000000140155000-memory.dmp

Download

memory/4700-15-0x0000000140000000-0x0000000140155000-memory.dmp

Download

memory/4848-91-0x0000000000860000-0x00000000008C6000-memory.dmp

Download

memory/4848-96-0x0000000000860000-0x00000000008C6000-memory.dmp

Download

memory/4848-286-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/4896-23-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/4896-281-0x0000000140000000-0x0000000140154000-memory.dmp

Download

memory/4896-17-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/5028-282-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5028-36-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/5028-30-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/5100-287-0x0000000140000000-0x0000000140140000-memory.dmp

Download