077f3c050fea8228b3f8e786dc21fe6ecb00003783b8a943d335500beacf818c

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/04/2026, 02:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
Size 1.4MB
Sample260425-c94dhsds51
SHA256 077f3c050fea8228b3f8e786dc21fe6ecb00003783b8a943d335500beacf818c
MD5 e48834dc81cb4e365ea1e5db6cb8e4b5
SHA1 03d42f2dd5f36d266749c6e212e226245279a38b
SHA512 fdf7b9366c5cbf937cd60d480ea6736f378bf5375a4027ff2551b59fb81dc0c50c01fac9763025838da77451ee380b958c994dde51a4d4a63a53efc4add89c17
SSDEEP 12288:t0EhwdbTlXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:zKdHlsqjnhMgeiCl7G0nehbGZpbD
TLSH
T19E65F196625420EAD0237574945FD32FA7737C6B4B20AA3B135C7F6A5F332409E29B32
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
4556	alg.exe
452	DiagnosticsHub.StandardCollector.Service.exe
2684	fxssvc.exe
3704	elevation_service.exe
2532	elevation_service.exe
3376	maintenanceservice.exe
1832	msdtc.exe
5836	OSE.EXE
3800	PerceptionSimulationService.exe
3336	perfhost.exe
2308	locator.exe
2100	SensorDataService.exe
3724	snmptrap.exe
1836	spectrum.exe
2084	ssh-agent.exe
3244	TieringEngineService.exe
2092	AgentService.exe
5304	vds.exe
5748	vssvc.exe
5132	wbengine.exe
5296	WmiApSrv.exe
1404	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 31 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\fa477b35958e99e9.bin	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	alg.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	alg.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	alg.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	alg.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	alg.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	alg.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000059ad5ce25dd4dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008632c3e25dd4dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000473a28e25dd4dc01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f958e9e25dd4dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d16110e25dd4dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000da4a5ae25dd4dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f443f5e25dd4dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
4240	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
4240	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
4240	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
4240	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
4240	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
4240	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
4240	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
4240	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
4240	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
4240	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
4240	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
4240	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
4240	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
4240	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
4240	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
4240	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
4240	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
4240	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
4240	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
4240	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
4240	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
4240	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
4240	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
4240	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
4240	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
4240	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
4240	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
4240	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
4240	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
4240	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
4240	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
4240	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
4240	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
4240	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
4240	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4240	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
656	Process not Found
656	Process not Found

Suspicious use of AdjustPrivilegeToken 45 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4240	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
Token: SeAuditPrivilege	2684	fxssvc.exe
Token: SeRestorePrivilege	3244	TieringEngineService.exe
Token: SeManageVolumePrivilege	3244	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	2092	AgentService.exe
Token: SeBackupPrivilege	5748	vssvc.exe
Token: SeRestorePrivilege	5748	vssvc.exe
Token: SeAuditPrivilege	5748	vssvc.exe
Token: SeBackupPrivilege	5132	wbengine.exe
Token: SeRestorePrivilege	5132	wbengine.exe
Token: SeSecurityPrivilege	5132	wbengine.exe
Token: 33	1404	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1404	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1404	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1404	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1404	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1404	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1404	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1404	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1404	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1404	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1404	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1404	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1404	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1404	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1404	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1404	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1404	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1404	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1404	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1404	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1404	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1404	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1404	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1404	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1404	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1404	SearchIndexer.exe
Token: SeDebugPrivilege	4240	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
Token: SeDebugPrivilege	4240	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
Token: SeDebugPrivilege	4240	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
Token: SeDebugPrivilege	4240	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
Token: SeDebugPrivilege	4240	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
Token: SeDebugPrivilege	4556	alg.exe
Token: SeDebugPrivilege	4556	alg.exe
Token: SeDebugPrivilege	4556	alg.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1404 wrote to memory of 1396	1404	SearchIndexer.exe	109
PID 1404 wrote to memory of 3612	1404	SearchIndexer.exe	110

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:4240

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4556

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:452

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:404

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2684

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3704

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2532

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3376

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:1832

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5836

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3800

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:3336

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:2308

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2100

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:3724

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1836

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2084

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:1364

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3244

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2092

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:5304

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5748

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5132

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:5296

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1404
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1396
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
  2⤵
  - Modifies data under HKEY_USERS
  PID:3612

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 3210d82429e019d6dc6bba109da406c48073d80cd336429dffb7656eb7de5f57
MD5 e64383ac20f90ff3ff7decf24b8d796a
SHA1 012f11f7c2d9b82b5a0cbed7c2bcbe9b248475b4
SHA512 4fb2b4715acd25485f5c3247266b988aec3a64305aed1a2b10284895908c249bb17887a6d4b9e3b1b207e192628c4ee5aa813da895f6c2bab50459860bef8034
SSDEEP 49152:1b+632BuPkFKRrdE6ohvstBhuXjfS4LWxnSDmg27RnWGj:L3q6sjBZD527BWG
TLSH
T17ED59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 2fe66ac7a7ceb67788d20a0bd1594b5be64a102a2f46f9175d89a20f246f7ec2
MD5 b23a4fd491a0502590457f49fe3118f7
SHA1 35311891c0d1098394aef3f6555481bb747cf5a8
SHA512 75275ed98894c71a79cc6afbcea39bf2ec4f664af5cc5636dcb117d188b081ad12eeda65483cfc74a76e763008c399850f94271ad5b0a28597ace56eb4ab6248
SSDEEP 24576:bXYfDtczAZsqjnhMgeiCl7G0nehbGZpbD:+tcYDmg27RnWGj
TLSH
T190650129B3D408F9EC67817CC9A2C515EA337C554760E68B03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 e5856165a57d593331b9bdb910899b69e4d5298fc5f11d90ff61860f0b3ae0bb
MD5 809a21adca9db60faeb1f52c4e674aca
SHA1 cd6504d34e2472f66b7bf6d2ac283d7472cd88d8
SHA512 8370c1560a3747aa1b85fa5de1a7a27aca2131214123fc3b652635d781da882f60a1a3322631696d814877895fbfbb0fb2341a5f21bcb7f937f5860fa683aa05
SSDEEP 24576:K0Le5ji0hmxxrMGsqjnhMgeiCl7G0nehbGZpbD:KPji0AjHDmg27RnWGj
TLSH
T111859E26F6748335D073C0B9C5D2A68EED7230865B3089CB4286D77C7E676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 15dfe4cccb928292658ba0cc53e16c511c3c4e108ce416a44c1821f70ffce638
MD5 c5938174b413c0580b3eee25a476b07d
SHA1 8356acf0324cd223b6568a41e15230d23a7a0a04
SHA512 a4f5d01e59cd6ec9c25351dbda6fbd4c3bc1f96cc853fa3b7217ef79a576de5658cca29388d456eaa8d19e1b169b46653f37ecf28f5d660c1755a7cd3274c84d
SSDEEP 24576:da7/ezSC6vUyD/aqgrvWn6q8wyu8sqjnhMgeiCl7G0nehbGZpbD:U/ezSC6vUzPveHjyrDmg27RnWGj
TLSH
T1D8755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 ffa03457c84a0bb58cc921fb7c6fb0d559ace2650c542d94dcac3b65300dd261
MD5 260576ddca3dcf186151f0d7ea6cd6da
SHA1 b846d6a5fea5683add1b5598e36e8972b8d4f23e
SHA512 ed44eaa4af63e0665a709556aeb1eaa660521ad3bf1733ae01770b791dd7fdba7df870e1140acb1b3bc97ce8317d79e4a65e34169b47ad4ddae53425867367b3
SSDEEP 24576:QVbqPb88hv/l+Y1sqjnhMgeiCl7G0nehbGZpbD:QVO88hXl+wDmg27RnWGj
TLSH
T1DA559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 370124561ef797c51b96fb1f691a5c678c86310124a1b34ccf544cb3591ee7ed
MD5 1cae17e94ac31c95eef03d2b85972729
SHA1 7519756fbb5d312dc24660f1df1383f64473127d
SHA512 da7589c2a98a8b410dc9bd483df0628c4b227f56427598c4d74273f6736c598f745f993c71302f59b6cb795afb48e9955d8fc46e2079597750d2de0fa290c8a8
SSDEEP 12288:uLCXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:uLCsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1794523BF964C50CAEB7608B5C3E9F11EAC137E56982008536A637CFDE6B5458CB39023
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 f002b97bf513a8402cb39d00cbab431f1f655f5200e517da867713035898630b
MD5 b5e96d252a4853f8a4bac50e2f3c1605
SHA1 729b208dd09cb49e5552c815d6a17096449c6490
SHA512 bbbc94d41088deb2929aa04f344811cf600d0d741907f12d8ba9db727ebc2e57210c4e5ab55d749adb879f257389ee7ea800ca0002a2d8faa3b936524eafca2a
SSDEEP 12288:2eBNUbTVO86U9Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:2JIU9sqjnhMgeiCl7G0nehbGZpbD
TLSH
T13665CF7BEE28FCD2C27A8DB95791C600E76278314F2193CBE165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 a1523c1a193c03c77a84ebf410850d44fac6ead4ed5d0f8a4b13e5d38f0b9544
MD5 a296b8ea990d49ecc267cbf817c5e0b9
SHA1 0c52b4a6a461643f66ccf4da83020c49a5d61689
SHA512 60db5447bdefec8ab6af811825e40e954d984388bec2ef5c51c8ee3dea9e1f3c9160ef97acaf9a6b724a1ca441a3970f42e156e1c715bd186f209cc2bebaa9e4
SSDEEP 49152:9QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THU:9QvGAdlCEL8c/DRNw5C4D527BWG
TLSH
T10D266C656BF880F5E0A7E178897AC572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 b891de084e6fb6320455639f0c7787f8975d5155e5aa171457c2758d2f479de8
MD5 883196038877c2edf23d60383371ae24
SHA1 1437baa3224383b3c7c517647518e9bd9fb8f127
SHA512 c985bb45f1d7eca30b99ad24f7a8c393fa4912b270e75aad7974952cf217d70d559f35d98a393ebd2ad6390dbb28f2752c225c42c45499438b1f9182741a122e
SSDEEP 12288:KAwSfxL/2Dc3RDLLmt0LDQewsAjTXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:f0ewsAjTsqjnhMgeiCl7G0nehbGZpbD
TLSH
T14775E031FA74E036C77B0DB60B36D71A182D7A204F6119C3E3E89D9E99702D12776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 c8b6829024684b3a660cbd4ed7e0637a0fdcee1b4e50eaf7334d4595daec0e0b
MD5 2cfc10429b97704b289511f9d61758ed
SHA1 e03cf091eeae2ebbc440b83be707c67cb0ab3928
SHA512 cc4a1c191e0893c5645db15bead0e75e561ecae4170cc13cff1e4933dbdbae92ce2f36e330dd3bfa295ce1e8e37bdbed00c81696293d17f3469e2752baf6e5f2
SSDEEP 196608:BUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHfVQBWG:BUEtQevvqc2W1cpV2tI32WB
TLSH
T15A474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 a7ab198eb035059b7d403a9d4587fdfb53a6b1b28200a3a961dcee58a205663a
MD5 c084099a43e108e4a426db819e48f22b
SHA1 3fb901ae9fa52468931af8e4090886dbeaf684f2
SHA512 056594237aaf8a6083a4e94b790825c8b452bef5b0cd15ad36ecd2edf8369c83caac05e2b1d6c8935b4aeb5740588c9894972692b307773217a8f43881002404
SSDEEP 49152:oCbRquA/m2yL5zTfFiV+XenmE3/z3Dmg27RnWGj:BoquVjnm8D527BWG
TLSH
T1E5D58D1976B8C1E4D1F6C77886A2C647F37178154B309BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 6049bf882029bce150e1a68e77beb59f917034475d44bbb3a400f1fba837a308
MD5 715e4305ed235743c7d45ca59d459dc2
SHA1 19a6fb8e28cbb52c1c1df0fb66b04839278529fd
SHA512 6c595c912413082017a7eb52481f18ea4c61f328d440cb289dc110eb9655a71d2d7d225bfb483c9ac41843e056ed1abf57c0587686a0a5883ad3b7e71dd88d53
SSDEEP 24576:2AhGL3IFoiwtA5l7S53gsqjnhMgeiCl7G0nehbGZpbD:2AMUFoiq5MDmg27RnWGj
TLSH
T182359D81E7F951D4F5B3AAB899B69171E976BCAA5E30C20F2160D11F1E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 0582fb3ab201ce8b7a8741e104e7c4e8f32941a60ffe31c93177c98cc869ef0b
MD5 da23e90fe8e0d8e1810e56135059bf61
SHA1 12e07ee237835b9ce8dd3f361a728b66a4663b39
SHA512 ab256d5582a070b92cd870a01136838205d34c9902e63f9df21be2fecbeb5a6f1e633fddb772ab94b80c0f21454b884209b1a4dbf4221fa3a443f611ac5d0470
SSDEEP 12288:Cmw5HEjsChNVBFgl0WDm+CcXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:bwu4OW3sqjnhMgeiCl7G0nehbGZpbD
TLSH
T13865F15A72A80CF9E9674539C697D136F7B3BC122A20D71F1760C65B6F33260AE2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 d9caa5da7025df1621d033c63c3368b6e9ed562ec73a3f108e64e366a8bd2a0d
MD5 a61bcce2109927bf9d4d60196ea00aa7
SHA1 29caf1c9d9a380a66a1fccca93b03082873b16be
SHA512 2cab929612ddff9ce7237d6329b83b96cf086c1c8857f7de006200516ca5327f24651355e81edafea5b862edcc954ad10c489723519ba6b34431eb4bff4374b1
SSDEEP 12288:/eZ1IyjXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:mZuOsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E65512AE239820FAE163417CC5E5D609E7337C62673043CF16665AAA6F739C44E39723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 a9b58fc6d2b1c458b0756b80123d25e704af4531013d7b10ca2b9d303bc4eb01
MD5 d8806a0b81b363693b0c214e8b0a7dd9
SHA1 67298c2bd665d1d68822b8db69c3fe5412d5b515
SHA512 d0406fa007aaaf3ea94a2b74e4db0c2b90e72bd9989691c05464de32ea5d93a5b83baf73d915b9317184a1497e21f3294f4d3713ebf713370015d637082f65a5
SSDEEP 98304:mQRQyi36YOcPbLvw2gAf+PN31D527BWG:NQyiKa/X+PNlVQBWG
TLSH
T1C7667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 a6150dd0a5b5a73ab09619af83cacad9c5b4517745dd212f23b2d89879e49092
MD5 28e033e2848c10c17a1823fa7e51961b
SHA1 d62fc5d018e0a92a6a4ccdb54261a307f65b784d
SHA512 f269d2aac65ab9e6885fbca8f2438d61bc43e17e6f1427e13f36cc86b18b65e2559f241d43aec8062cc171ed044d433a620a3646ce5334246ea3b3870fa6c965
SSDEEP 98304:aQRQyi36YOcPbLvw2gAf+PN31D527BWG:RQyiKa/X+PNlVQBWG
TLSH
T1EB667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 1a26f20b57f60e0ad38566795df91bc954b03f14996c41f997808c5972733f12
MD5 2bc38bdbffafbed82c5ee9c3ee707bc8
SHA1 33f7969d1feb76094dbf84245bd0b1b556bcf5db
SHA512 54e6f30c3de36c4f7d71821a6907b21b4cb7922939fd6c077aa2215165b69c9c2bdcf1938c605f79627a831bb40cca3e96cdc9282505e7fc1acee324b7b3a0d3
SSDEEP 24576:swvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0+sqjnhMgeiCl7Ge:S68Qg55nhceWu7PNU3/HDmg27RnWGj
TLSH
T1F1B55933B2F60099C44DE1769F4A873196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 78e993d491e90c6f1bc46f26ed5d4d9e207d267f4877f5eaa34d049d0565516d
MD5 3cc703e4f395878db55ddb1444e7e7f4
SHA1 f436f7e3b3a37e48585974cfba1ca1570de425e4
SHA512 215653dba7b1462c7542c05b65a9b944e989c1b1323347b14fcbe30c34706a3f2d7ab606b0b5e55bff85f5d64f4d61aa6fd896f376a4cb2a8d8b76eabfd1ebd8
SSDEEP 98304:jy5112gYy5azzVvt69nLKnhZGD527BWG:+LIHEWhEVQBWG
TLSH
T12B167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 4040ffcf2f65924468b261e58b4ed98666c1d10d4bc4edb678c632ee7e01a048
MD5 fa6656d4772f667f955fadf231b4d1ac
SHA1 3ed51111ad71bf804695f709e981bb6702149b3c
SHA512 48db40c65e3f13d7fb070bef6345150bade6759a494e5647cba032bc6c013ec6bd923b7d71f1815c2d890896e88d02f877a9198c78d522ea6583ce987006e939
SSDEEP 49152:UB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glNDmg27RnWGj:Ou6Jmdxd2dND527BWG
TLSH
T166D59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 1e005971d6955f8f0fd176b6b58f3e0a13f2b638ce7c22dd69d5017bdb57d499
MD5 00a3fdd9b869ea50ede537c1cf3585fa
SHA1 4bc2b24d8c2588bc7bb958298180b7a58697a130
SHA512 fa07b672aca086cd052e4fbc8668291c71c1dd231066819e1967d942337e3d4a8e22c31733399734e93c414083b1901b4c33f84cd9698d2a91503e5c47a70f05
SSDEEP 49152:I1hpsNoJpF1A63U44CwH7R4xBDmg27RnWGj:ImifPWR8D527BWG
TLSH
T14DB5BE13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 c2576745544c875ec9a0c225b6e3021e70fbc48e89d85345b4753e379bc81972
MD5 2b35c26eaf3b27f793faf16394528f5c
SHA1 9a2012b108f399f061a5a4b754d133af86e94fef
SHA512 ff65a9dafde2d6fdfcd2096759780d76656e6b31be4c1eed8fe6c3f37c6d2b3e9807bdc0a373972d786a47234941ab420a5b2952b91259df95f9fadf5a3b1411
SSDEEP 49152:ZSuZQIY0Be2KcRVtOnks6NMHqiDmg27RnWGj:35dKii61iD527BWG
TLSH
T1FBC5BE13F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 0457360bcc10403aae1601b604b637df7537e57b86885f06f3a4b4f9289ce7c8
MD5 a3927e6b6623857f0383eb61c2aa44d1
SHA1 dfe1d7815b6df8b03213cbd4c1fed1986380fad8
SHA512 a224b2e42ccb71c9f6ed03828b39cf4aad78b37eebfe25550159261625f72f8ab20ffa2c2f0e078fdaee7e28b20aad63d35d05b83ff81f4115304fbb4cf80b09
SSDEEP 49152:ZhtSn8EApI0fig3giDn0AP5wdDmg27RnWGj:oX2imphAD527BWG
TLSH
T11095BE13F2D900E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 a3dbce99bcf6e6c3e9570be2bbd0679cbdec64a0405612b1bbbe12e568dfee67
MD5 7b0fce51c121659b2b9fb0cf8d921c55
SHA1 4542bd4d96dc872ec2af5ac09e123180baf435a3
SHA512 752a43fac3bc9628fa92b84a531f599a573923811d5a6dbe30d6d3be9bee80ab00eb2749d7af281e0f17ac2aa717840c0cb78e8ff75d6b76a022c77e8610ffb2
SSDEEP 12288:HKXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:HKsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1584523BE965C41CAE52648B5C3E5F10DAC073E5BE92004937A977CBDFBB24584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 f4073313d28b235da43fd542844e927afbb415715fd4537c72dd013998528b22
MD5 e08659316c032ceb669576ff036472ce
SHA1 b47e1f78e154a84bf89282100b0664d43b967b84
SHA512 fd67242fdaef8b4cf97da96ce4c16015f123d3045adb52175b6accdb3d10e012428c20705f500a531c3552988cf1885a37847c943a72df7153999558f730b0ce
SSDEEP 12288:zvXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:zvsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A74523BEA65C41CBE52648B5C3E5F10DAC073E5BE92004937A977CBAFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 4cddd950fd8a167d81e0bfd7f9a1fe2049d7571663a2230775bebdc760e5f0be
MD5 e4ed404d121f1f86b05a0821f76558e0
SHA1 8338e201ac09364c359d6c9c38d82b8c6fbe76ae
SHA512 9d2c6d217ca006845393c76618c1c08f135b0d8fe46b26351281cccfb02348fbdea28f38484b830df23370da08fe94c26b55ef22266fa343e49050a908ce3575
SSDEEP 12288:wlXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:wlsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1EF4523BE965C41CBE52608B5C3E5F14DAC073E5BE9200493BA977CBDFAB14584B38463
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 12da8bd8cd824966fd231e89ec5d7bf7d550c50f1b8bf69b45721ae3e310e4e8
MD5 a9592497d3c888e65a11418cb5d7573c
SHA1 8aadbf4641c7e9409d25376c0d78a1349e97c26d
SHA512 c57ba8185208df57ca94794615d084577469d988c02d01461ac08ce819a5b73f6cb15b27aeaa4fbdc307b43e29ec8558362cf944a4c33e0ec34c41503b44ebd6
SSDEEP 12288:HVAXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:asqjnhMgeiCl7G0nehbGZpbD
TLSH
T19F45236F675C00C6D83285B5C2F5E11DE8237D96EB3005DB6B532CAE9FB16944F38A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 e7d83163debbf1d0c763608f08c080d3c657ec0b96619a04cff0941e81059b65
MD5 f76d16418e4d21d892ac23755a42556f
SHA1 68d1b2cc2ae0569db91f205135a5656a170d3166
SHA512 a85db470cfadecd464cdf2cd73bdf53ffc637a22f9e564d9ccc5830c29052dfdbe2ca28777875f9e33e7513c5c0fea6cfb88eee7864c605c8a9e28ec14fb1dc1
SSDEEP 12288:M4Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:M4sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1414523BE965C41CBE52608B5C3E6F14DAC073E5BE92004937A9B7CBDFBB14584B38462
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 1dc108003417945134dd399d775308353262efd04c4d811375fbb969cca85ca1
MD5 b8e4d11a8c365e1afb46719604ff30c1
SHA1 dd0f7ef139a7cce3b6255d2028fb4eb858f968a2
SHA512 9d637fefddb207ae893ea4151d57f1f4b194a088cebdb938b24be33639b777ff9bd1af6ff8e6140b1c8f367c243b65221677ba8a6c3f30f497e6895659d4ae5a
SSDEEP 12288:e7Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:e7sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1AB4523BEA65C41CBE52648B5C3E5F10DAC073E5BE92004937A977CBAFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 8980cf07c8a9db3ad67258b5f360573e201a0d55583f18c1bb837b0cc9547eee
MD5 4aaeeb2bd24d9ab6f2da2acaf721fda1
SHA1 ec723df8b0b688fa1e8044b97c74a5208bbb44a9
SHA512 d9743592fc822de75636066b92db470b605d8a30bcce1115f72d9bba867090a96d6cab885e93e05623f2cf89e31f91f257ab1269deddbd5ec01c0959f20dc5ff
SSDEEP 12288:+nXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:+nsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1364523BE965C41CBE52604B5C3E5F11DAC073E5BE9200493BAA77CB9FBB14684B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 adfba09f1187fad8819e9d3ee453e39d91c0ac656076359f0750746ac5e9e2db
MD5 9542dd2bb2dababdfe8812ddbcf95edb
SHA1 2f8686b9663fe758b97d6c65378ff6c42df3a1dd
SHA512 9d2e107583faf8d465ee6e576e3b884ded6a9b7e067c1adb314a5c12a30fa663a4615c86d7386b96ea9e8ded007f8272bb0dd8c2b782f4a8d6229a3e41d63b9d
SSDEEP 24576:dZMRzFVSOPsqjnhMgeiCl7G0nehbGZpbD:dZMRzf/Dmg27RnWGj
TLSH
T1726501A9B35418F8EC63813EC965D90AD5B27C5A0B70C61F13A4366A5F733A00D3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 9e325d11e52f58d7e37b1ea5750439b463190d409a4b5db8e42f40cff9d2cc6f
MD5 bb6860ffd35713f74188f472320b3a09
SHA1 a3840e081907e790cb087bc60ef20628d35f13a3
SHA512 325b67859612cd2d72d9a49b47369aea0ac398d75501d73c7a1df2de467175db9f3d736280b42d2674aaf65997a1ebcbe02b0a1f442b85d1b341f6dea71637a7
SSDEEP 12288:keXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:kesqjnhMgeiCl7G0nehbGZpbD
TLSH
T1344523BF965C41CAE52608B5C3E5F14DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 4d62538be11afcebecf036b5d4c2b36e0f51055b008bbf553eacfaa561ae05d4
MD5 639ab43ebf3cb0036f66eb4c6dc778b7
SHA1 fda938a5dbf34482358d18fbf3450b6f43e25d52
SHA512 da3611dbfd271b3f4ba8fc64dc61566147bc00a1078756c050e0411ef7aef4254a59e588b31e269f123670ac0f91aba90481f765948d2819741b19c6effaee7e
SSDEEP 12288:mSXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:mSsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C14523BFA65C41CAE52604B5C3E5F10DAC073E5BE92004837A9B7CBEFAB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 e45de2e97b7c1e05f184f88bb2b3bb630ba43cba5f19cbf4b224ffe66c0bb11a
MD5 591f4ee85b55b60b3af5f9be21d8314b
SHA1 762291a2c820be64d60e71dc01d9929476f5fa49
SHA512 be27cfeae74d87d808d9ad24a39a85a6831a165fa59815de8de4c6370bba87f89dc1697c0f0d70a0e16662a44634b1296ef19335412f5dd963d2b5d54cb390d5
SSDEEP 12288:OyPz5L8jXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:TzyjsqjnhMgeiCl7G0nehbGZpbD
TLSH
T16F55125B73A530F9D1378178C5A29A06F7337C3647204A9F17A506BA6F736908E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 026cebeae5d36a8edc8947d32aaa0cd5f6b44acc8beab4bdd38db425c0a63142
MD5 e3339c997e05d7f1055179d431393de6
SHA1 0123be72f05024c24a886ab460fd68525ac38851
SHA512 0474b58be7a8cf3ed070c182f82e385ce851f402e238a0af5f47e74a008eb78c20abe20e82735fde7122ceffee9693e150eb0deabfa4edc1f6407a252cc33ca3
SSDEEP 12288:xeXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:xesqjnhMgeiCl7G0nehbGZpbD
TLSH
T11D4523BF965C41CAE52608B5C3E5F15DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 086725e8e39921743dacadce48ea8dd297005abe4ad448245f41dfb53cb32933
MD5 1d3f9856d0538fbfbb62851aee1fe5b5
SHA1 5422bfdf61b5e2fb8f4046a10989ebac08547000
SHA512 de56c3050de2bdfa0093de0941f82f477b5bbe8adef22ccab0e5265e09ef87be2e889760dc8ca837379f34f517f1bcea3746eebc02f15dfb7a5451f185c6de11
SSDEEP 12288:ZeXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ZesqjnhMgeiCl7G0nehbGZpbD
TLSH
T1974523BFA55C41CAE52608B5C3E5F15DAC073E5BE92004837A9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 7aa55f85b9bffa172f999a8591c89690d4727322e4eb394b3318a8b99845ceed
MD5 de53fc30615d640c7e28c0f48e708b76
SHA1 c9cc827eb6906e7178f1d8137abb187f434efe91
SHA512 9cbc5e3072d8184ba2e4515e4b01b23365998761eee1b2d927293f7fa33139f50a8dc7160ab240fd478e7413525ab360dda86dbd6bc34bc692ce439475c63580
SSDEEP 12288:DyPz5L8jXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:uzyjsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F155125B73A530F9D1378178C5A29A06F7327C3647204A9F17A506BA6F736908E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 7bfe91fc794f827897f73313c224acc72f63b574a7ed22779f95cabdf463308f
MD5 5ba4cc1d8300ccaa981458814af08828
SHA1 6cfcc8b49382316c32873df4a19a03631c5caf04
SHA512 9f5bc7ed36d5bd85206d35a9cc42fb1acb0f7334aee8e1c0782084ae8f84578e0640f588d7593919a2ba549554bd572295545d6a3b2e6a9b14c08438ba5a0587
SSDEEP 24576:ncP4mcvIjkGOxhKP2l71SNKbrh/8KB2sqjnhMgeiCl7G0nehbGZpbD:cP4m4IpOO67N8K4Dmg27RnWGj
TLSH
T15065BE2DABDC0096D0BB917886658A49FAB1742A1F3286CB1160933D7F77EE44F35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 eba75ad622db5a688eaec5cfe681ee24c8509c4d81ae64b988e2f13c3aa09c31
MD5 dce863a3a5dc24a87ac740869aa3a7a5
SHA1 cd605c2dcdaaace8300e5efbe46c7406d97c7f32
SHA512 88ae5681dcad523352bbb7e7cd452334090deabab1d72c8d6bd7ea24f3ff6c39cfd6033793afce0edb52a872afa70bd21a60c835ea21e7c914df4d40db5ee7fd
SSDEEP 12288:absfOXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:xOsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1BC55015AD29802D8C06E6179C3969605F7333C2697E093CB67D1F87E1F766908EF9A03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 7374a90cd0291d63314257c092470026cbd935b0dd722051c6c0308f90f87d05
MD5 8f2446799ddcda8dd70253bad1133c57
SHA1 45f27732a591d78b02f67b98956f6d994d95e86f
SHA512 d8a8443e32bc18d7970bfe3e8994667d3b28a2f902aa9f7cc2e8bcb5a0f877df24c465eedcfa7607e57650471866a2f1cb39d6ddb8d408e54840c5f07e6a070c
SSDEEP 12288:juXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:jusqjnhMgeiCl7G0nehbGZpbD
TLSH
T17845237FD35C518BE57609B082E9E12D681B3E6A9E204483BA473CFDB6B08948F38517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 168020a599f3e307f2c9ae58a01ab9235c858212ddc5f8cb6ac13e469ee1ea2a
MD5 dbe548a15ff3ccf521fd51d35a21a2d0
SHA1 b51e2a9e555e7f9527c76625cf251cc055ff665a
SHA512 19d5d48c4887b0a4e03be62426d8ac9b2418622b68a75c7be762cd9aa2708a90d66a3ce9276de4a5ee0d1caf44807e383902b5b3cb2b0f31807167da65267784
SSDEEP 49152:ua0h2GEkuAe73q3pp46zwwQkDmg27RnWGj:ua0hNYG4JwfD527BWG
TLSH
T15185AF1E67EC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37DE84E3DB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 f26faa5cb686433203be8183c7dfe0eba83fb1cd5802ecfe3164b757b37c3a85
MD5 91e6dde885fca60f845b47fef74a285f
SHA1 0c5ea2eb0809f82a733e268232078b7e483c1cf8
SHA512 0b380a4b4e76a32bbd0dd1700e260d4f500d8f87d4ebcb8d0f0db14f3b4eb530b9a20c80b3e5a92e0d7ded32c942f85b50befab10d1362735f8d387de727640d
SSDEEP 12288:5hbHjfXfXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:5hbHjPfsqjnhMgeiCl7G0nehbGZpbD
TLSH
T10555127E12AC20D9E57291BD8296D10AD632BC261B2053EF23D281BE5F37DE44D39F52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 5c3af93b60d0770d0b2653a3faf0184e7909b204161345cc5e9ab99bc0d7c8be
MD5 aa4a79ae76a68132642dcc5212669550
SHA1 976b2ee3b2bd05da2f0c2eb8b861a2671a7859af
SHA512 98d545fe3f632e9865eff9f8fc5b7c13847c13e390ff4130c06e5276deffc18936c0fff4deb70787883a2d0519e1c8ebe2f0edc21286ec91860c14c75a80ebd2
SSDEEP 24576:i3YgnJcRTk4yti+R5dpR/3sqjnhMgeiCl7G0nehbGZpbD:iIgnaTk46ppR/LDmg27RnWGj
TLSH
T1CB45BF2EF2B910B9D8A6D136450147B5FB71782D1F209AC70170C538AF1AEE85F39F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 2a009502815c894f62c8e38f89d01378ea0cf4c8de7675d722b490456314fe58
MD5 df4e19cfabc0018e44d8ee353aabad69
SHA1 fc4be9afc2cae1d29936c1644296924148359f2c
SHA512 b465962a5e39c203bb14910893a055a15609deb524152f14e52785ca6fab5d92458bc89f72401b343b9da41a3303403854e6838f322b1d42b8384b1397b29f9a
SSDEEP 12288:oiXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:oisqjnhMgeiCl7G0nehbGZpbD
TLSH
T18B4523BE924C51CAD93649F5C3E6E11DA8073E56AB2004D379A77CBDE7B18E84B38413
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.5MB
SHA256 38b1b2e2ffc43ce414518f3b5c7ad30925f7f21d24f5f2b6e0685e38f6b3dadc
MD5 ff486217bef1d085410a262f8285b9e9
SHA1 8a746de3af2db965d8370d4ec5b96ef45112e02f
SHA512 047bda29dbb8283149bff21d974df0fd5a49e979b96a92e8c7c2b2df1d39f2f7fb145f21ab339b01e248f91e3a9aec2591f11ef79094ad5b2214e961218ac494
SSDEEP 12288:GObfA4LWOsvAYFTZXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9L:vbL3UTZsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A0750159F79800F9E87B813CC5A2D616E672785D0720E7DF03A94AA91F637E04E3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 c0a42714fb59cdadaddf9206ff73f32a7526b253ecdfcbeeabb0597e3a96b5c0
MD5 869141a4afd90c3446fceb62b8dddd6f
SHA1 73efd17caf96bfd0365bede13ed9c22fe0b5c319
SHA512 f83b2021de30fc632c318f7561a93cff18cf8e1f225528fc3214b967f665ecca7535870b115f4eb807a311a15a9a54bfce928ab0c9324e2aaf0f9f0a0e01d4f9
SSDEEP 12288:BpFtIOdXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:AOdsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C755022E33EC10E9E536917C8692D20DD6327C660B2117DF06D184BE5FA3EF85D39A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 ebb9f009ec33f57ecd23aa366d60de7668961d6663b839492ea63e5b6e1d3572
MD5 d8e9f54360437b8c5f88f05ed2eb1e1a
SHA1 de4868d0b46fee87ce48a975293174361446be2a
SHA512 ece573f2b7cb5cfbd2b440620f7c2ea2e2a49c7e541866cdbafe087a399daf7481cef462aeeb3039243987720e14236752581058f6b190f0207d30f4cde73899
SSDEEP 24576:r7NM9YmZqmWMUkPjZM48Mv6bEhsesqjnhMgeiCl7G0nehbGZpbD:r7cBWMpPjN8DbEhjDmg27RnWGj
TLSH
T13D659E2E6BAC81D5D577D13DC9E28206F6B2B4611B318ACB1162833E7F37AE44E35721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 361a822b4893cac0886b128a22e1b51c3d4e9ceef339989ac95b557bd00960a3
MD5 aaeb158f8d817803ba2c3256220b796d
SHA1 2f0cb7e8b4aa11d686bcbacc9cfa45cf7d01aea1
SHA512 8e250352ac354279bd58c1147e5bc7961bebcd1d95ec6515e6ba7d00ecc97f9df50cc9499a04d9c53af6a2ca93ccbd6e89e1a48112322530326cd6b584881487
SSDEEP 24576:OW6BApg2YuyuNDYTabvcRvNYf8km1UsqjnhMgeiCl7G0nehbGZpbD:OF2YuHNETovcvNYf8kmSDmg27RnWGj
TLSH
T1A7857E6A27ED80A4E0BBD27D85B6D246F9B2B8511B3055CF0255862E1F33AF44D3DB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 e7dd16d6aa44561f07ef96b1031c7d1c8001395147c7d8a207575332843e6f66
MD5 9d263c3a5a0cea0047cb6b311ce1381f
SHA1 cff6225bd16d91a0c7707a32c35f57974fcdf145
SHA512 a6ce82cda04058aa1527d21402a4fbebca5ddfc6394ba869cac9686c4322e01fcba5dbee0e5bf57b42ea8636092eb4f4bbbd79e9e435e452e74ffbf8437fc953
SSDEEP 24576:DAFs06+OmlfkNXEbToBsqjnhMgeiCl7G0nehbGZpbD:MFs060lwXuEDmg27RnWGj
TLSH
T15065AF3F62AC00D5D07ED17D8A97C91AF6B1746307255ACB0260867E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 980c6ef6aec79f0dd7ce4da791cce82613ec0dcd650baa1999cb12f43e5de1b1
MD5 4c3717369594265d1038c1e12da45264
SHA1 f424f0101ce74a0d701fc3798599f45b0ad438ae
SHA512 dcd9f99dbac9819427f985f46f21104d5a177dd07d4d9949c30c04c472f23abfd48dfb3a8338e82d7c7103163d5ed152047477a2ed55dc9e2f0933880dd09504
SSDEEP 24576:IJnJ5D3WtYsqjnhMgeiCl7G0nehbGZpbD:IJnJ5DGtEDmg27RnWGj
TLSH
T1AF75E13DD2A810E8D4B7C2B4829A5746FE72383D2F2169C728B4D5357F12EE09A79F14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 7f9b8c5926d3bc9ece3526c061167563b468751d866765282c9d5c616f9fbbeb
MD5 f6b7ca1e41a0b088e1951d91e9d4c468
SHA1 ba46ca8680dfeaf9a2c1c7d0b8bfec0d85e16aef
SHA512 1be1a3ca82ca0d22c56ba040dd2b271ed8af48d86a51baa34207842a014cc892a18397be2d84894138fd3715b5c9e943eeb661c1ec591a7b17a933ac27da609c
SSDEEP 24576:iEPohm6/7IIXdwcXrif7qQncjlP65i3Vu3sqjnhMgeiCl7G0nehbGZpbD:Vo06DIKdwc+eQnSt65aVeDmg27RnWGj
TLSH
T1B6955C16B7EA5294E8B3CAB1C962A1159B327C509B34F7DF0AC0C92E1D33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 a054d2a0f5f3b1c9573970d8a4684ebeb3f8f77d8bbfd0ad4042795aaae41539
MD5 d3aa040e3d28947f5c0ee457c1e42f1b
SHA1 a5425503266a5f71ed79769e02d401bb624bdaa0
SHA512 6744b0647e0e60b66d8e9e4183da40c65e9fb9391b09b47746855bcbe305a78f59687883e81977268c0248bbb64385e23522e6659528e8e8e49ae455efd4b066
SSDEEP 12288:HEP3RrcXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:MrcsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1EA55126E679C60DAD536907D8291C209D733F4716B2127EF26A2C57E8F739E80E3CA11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.3MB
SHA256 9d75c47b046bb352eec8e41709cc5a3815d598c064ea0a3af9ff9291f1f4450e
MD5 46d60d890f5728db883bf9bf179b6c2c
SHA1 839c586e91b1d5dd9ef158dc6131828af564ed83
SHA512 f5b4d83faed56889aa52bb630a1ebc6e6841f38f39f69d152d36c03ed0061a4d4b7e0f31491e5266a1172be3c5d0a48e3d19f7bf1b370a57e70794e021addd62
SSDEEP 12288:VjkyvXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:VIyvsqjnhMgeiCl7G0nehbGZpbD
TLSH
T147551219639C60C9EA760578C6B3D1589C32BC319F2046DF6591FA3EAF72BD48E34B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 2c9cc62dc2ad33ecc14282917be3b1885038b9da53b6627753c24543b9baf532
MD5 7f962bafe9bc5da0e9a954ef47643b3c
SHA1 17fd1562135b83635524eba68d30ec7bf624b286
SHA512 e72e06146e7f5244b93de3e3671d2f687ea5a7738c338191cf94d982c4128705a089846be6878e17aad829d097461952e9f6e6bff1d492a77d5d0f7d724d94d9
SSDEEP 12288:LFtXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:JtsqjnhMgeiCl7G0nehbGZpbD
TLSH
T11C45237E525C60CAE93645B8C3E5E61D98133D366B2014E739E3BCBDEBB24D44B39812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 b8f2cf507ca077e10450653782509c443c54ca8dd7393d831c06dc156b6d308d
MD5 24ec23e790faa39c0219624423596477
SHA1 d445d543ebb719bee477bf9d77897cb256398ee7
SHA512 4f50855feaa135427b96ea9aefa3432466a3a6efeccfa118aecc4ed41f9a846b82fe8fa9a710d4087e81f9140e26e05a12ebcc64248bd6e8d93b65c3811e6ff3
SSDEEP 24576:KQ9MxZKdcz97w3msqjnhMgeiCl7G0nehbGZpbD:KVKXqDmg27RnWGj
TLSH
T1A6558C2DABE9058AE177D27595A250C3A633B4311B31D6CF2448D03D4D7BEE8AE78F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 fc966116ee5a168bc9fff4780c831621554f61259e776be4ad4fcef2b1183c65
MD5 e371f6cf472db2e8a646f8a5328f03a2
SHA1 2dd5ea11cba7b4bec31240648e2e68e70e332580
SHA512 2ed6abfc4ec39a1b973cb3a17282440ee01627be3fd0acd051d4011154749a0474b5eb2a7db930406d284f23d3e2439685077f20befde0178be093f73be380ed
SSDEEP 12288:ZyoKo2HRple9pTXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:ZyocxApTsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1EA65E01FB76D40E2E176813C8985C249E673B4315B2157CB6692C73D8F639E8BE38B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 7e0c9f87e9a5c67e15c7d933cd79a1225b2db0c1da003932eb82ff7813dbab0f
MD5 543b517ce61c84a26e45593451b838d8
SHA1 e51fc15f7e0163606f7baf8bbfb9e97d78cb414a
SHA512 7fdce4bd60939130b882ea891a735831627dd147378147d256183ab69ce4af461ce3c9432f75be0c6d245fdbc210bfcaa75acf001dda1d27c8bcab7c59140a63
SSDEEP 49152:IWcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIKXDmg27RnWGj:q0zuNIbD527BWG
TLSH
T1A7A57B3DA2BC00A9D8AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 0380aae18e23f85f77e8ff28333d0fdcd68de39a53bfebf724c60aa51e785555
MD5 4a0a3e227520c2ff73ff9ca0d982f945
SHA1 596a76bd17384a32c3971510e4c224820e614d2d
SHA512 c820ad464cca217027eb9c12e35b700ff0855e254d8e2a0cb70cb5674bd37d886c5628d629d722322a5e71a6311d2b15f1caaf0279bac2b217c46d0a596acb4f
SSDEEP 24576:V1QT7EcpfxR+N5AWAz3ooiYujMqbcsqjnhMgeiCl7G0nehbGZpbD:QTDxR+N5YzT4jMhDmg27RnWGj
TLSH
T1C855B02EA7F815E9D17E85798B23C506FA727821033193CB42A0C17E1F6B9D85E7AF11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.5MB
SHA256 230c07c774d599aedd820387c2bb3bd1ef07745e1663456348392b766bf2f1a3
MD5 25f13b91f5c50c293ff6200ade920049
SHA1 1a0fb3a52011bda3c3449c3c5294709672d292cd
SHA512 8c110c53878eb31c065fc684464238d2613b9db07a49e6531e2f1f7a28b2682c3e919269c8ec67955c916239b29d7ca4cacfa9d94bbe7ddf29d7a37858bc1b3e
SSDEEP 24576:PTMdOz0FFS+bmSLAsqjnhMgeiCl7G0nehbGZpbD:N0K+bmSL8Dmg27RnWGj
TLSH
T16875E17EA36D14E5E47BC27DC653C90AE9733862032166DB0690C0B97F97EE47A39B40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.2MB
SHA256 e530cf20c3779a399e771ab53263615a44d4c71530cfdeff6282bdd36b62d37b
MD5 18df7c0a895c8a6372574e9c79c7b1f1
SHA1 e402c2e453b461d51c615bb86539319b4a117caf
SHA512 ba679a7e6ad3bf041eef69713837bd6fbec0dbe88a1a0f18c9708775352b6365f5026302fc6d409b846f0fcbdaddeca260ec53f6725e091b5896be452e31dab9
SSDEEP 12288:s47ZXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:7ZsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F855126E63EC20D9E4325574C6B6D1099832BC36272015FF39E1D9BE9F729D48A38B13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/452-35-0x0000000000680000-0x00000000006E0000-memory.dmp

Download

memory/452-34-0x0000000140000000-0x00000001401E8000-memory.dmp

Download

memory/452-26-0x0000000000680000-0x00000000006E0000-memory.dmp

Download

memory/1404-578-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/1404-450-0x000000000BD50000-0x000000000BD58000-memory.dmp

Download

memory/1404-240-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/1404-246-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/1404-381-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/1404-384-0x000000000A1F0000-0x000000000A1F8000-memory.dmp

Download

memory/1404-339-0x0000000001B00000-0x0000000001B10000-memory.dmp

Download

memory/1404-355-0x0000000001DB0000-0x0000000001DC0000-memory.dmp

Download

memory/1832-94-0x0000000000850000-0x00000000008B0000-memory.dmp

Download

memory/1832-88-0x0000000000850000-0x00000000008B0000-memory.dmp

Download

memory/1832-382-0x0000000140000000-0x00000001401F8000-memory.dmp

Download

memory/1836-161-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/1836-155-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/1836-374-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/2084-166-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/2084-172-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/2084-375-0x0000000140000000-0x0000000140241000-memory.dmp

Download

memory/2092-186-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/2092-192-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/2092-197-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/2092-195-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/2100-504-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2100-140-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/2100-134-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/2100-372-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2308-371-0x0000000140000000-0x00000001401D4000-memory.dmp

Download

memory/2308-130-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/2308-124-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/2532-512-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2532-70-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2532-66-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2532-60-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2684-84-0x0000000000DA0000-0x0000000000E00000-memory.dmp

Download

memory/2684-39-0x0000000000DA0000-0x0000000000E00000-memory.dmp

Download

memory/2684-38-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/2684-86-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/2684-45-0x0000000000DA0000-0x0000000000E00000-memory.dmp

Download

memory/3244-182-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/3244-376-0x0000000140000000-0x0000000140221000-memory.dmp

Download

memory/3244-176-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/3336-338-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/3376-336-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/3376-82-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/3376-78-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/3376-72-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/3612-462-0x00000182799D0000-0x00000182799E0000-memory.dmp

Download

memory/3612-456-0x00000182799D0000-0x00000182799E0000-memory.dmp

Download

memory/3612-467-0x00000182799D0000-0x00000182799E0000-memory.dmp

Download

memory/3612-466-0x00000182799D0000-0x00000182799E0000-memory.dmp

Download

memory/3612-464-0x00000182799D0000-0x00000182799E0000-memory.dmp

Download

memory/3612-461-0x00000182799D0000-0x00000182799E0000-memory.dmp

Download

memory/3612-459-0x00000182799D0000-0x00000182799E0000-memory.dmp

Download

memory/3612-465-0x00000182799D0000-0x00000182799E0000-memory.dmp

Download

memory/3612-453-0x00000182799D0000-0x00000182799E0000-memory.dmp

Download

memory/3612-457-0x00000182799D0000-0x00000182799E0000-memory.dmp

Download

memory/3612-452-0x00000182799D0000-0x00000182799E0000-memory.dmp

Download

memory/3612-454-0x00000182799D0000-0x00000182799E0000-memory.dmp

Download

memory/3612-463-0x00000182799D0000-0x00000182799E0000-memory.dmp

Download

memory/3612-460-0x00000182799D0000-0x00000182799E0000-memory.dmp

Download

memory/3612-458-0x00000182799D0000-0x00000182799E0000-memory.dmp

Download

memory/3612-455-0x00000182799D0000-0x00000182799E0000-memory.dmp

Download

memory/3704-56-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/3704-50-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/3704-507-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3704-49-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3724-151-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/3724-373-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/3724-145-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/3800-337-0x0000000140000000-0x00000001401EA000-memory.dmp

Download

memory/3800-109-0x00000000004F0000-0x0000000000550000-memory.dmp

Download

memory/3800-115-0x00000000004F0000-0x0000000000550000-memory.dmp

Download

memory/4240-69-0x0000000140000000-0x00000001402CB000-memory.dmp

Download

memory/4240-0-0x0000000002120000-0x0000000002180000-memory.dmp

Download

memory/4240-8-0x0000000140000000-0x00000001402CB000-memory.dmp

Download

memory/4240-9-0x0000000002120000-0x0000000002180000-memory.dmp

Download

memory/4556-19-0x0000000000550000-0x00000000005B0000-memory.dmp

Download

memory/4556-21-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/4556-13-0x0000000000550000-0x00000000005B0000-memory.dmp

Download

memory/4556-435-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/5132-379-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/5132-225-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/5132-219-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/5296-235-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/5296-577-0x0000000140000000-0x0000000140205000-memory.dmp

Download

memory/5296-229-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/5296-380-0x0000000140000000-0x0000000140205000-memory.dmp

Download

memory/5304-205-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/5304-377-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/5304-199-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/5748-378-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/5748-215-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/5836-105-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/5836-383-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/5836-99-0x0000000000730000-0x0000000000790000-memory.dmp

Download