077f3c050fea8228b3f8e786dc21fe6ecb00003783b8a943d335500beacf818c

Analysis

max time kernel
150s
max time network
154s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
25/04/2026, 02:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
Size 1.4MB
Sample260425-c94dhsds51
SHA256 077f3c050fea8228b3f8e786dc21fe6ecb00003783b8a943d335500beacf818c
MD5 e48834dc81cb4e365ea1e5db6cb8e4b5
SHA1 03d42f2dd5f36d266749c6e212e226245279a38b
SHA512 fdf7b9366c5cbf937cd60d480ea6736f378bf5375a4027ff2551b59fb81dc0c50c01fac9763025838da77451ee380b958c994dde51a4d4a63a53efc4add89c17
SSDEEP 12288:t0EhwdbTlXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:zKdHlsqjnhMgeiCl7G0nehbGZpbD
TLSH
T19E65F196625420EAD0237574945FD32FA7737C6B4B20AA3B135C7F6A5F332409E29B32
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
2724	alg.exe
3256	DiagnosticsHub.StandardCollector.Service.exe
2788	fxssvc.exe
72	elevation_service.exe
2840	elevation_service.exe
1168	maintenanceservice.exe
3532	msdtc.exe
2212	OSE.EXE
1380	PerceptionSimulationService.exe
5112	perfhost.exe
612	locator.exe
864	SensorDataService.exe
5400	snmptrap.exe
5304	spectrum.exe
5540	ssh-agent.exe
5616	TieringEngineService.exe
2240	AgentService.exe
1228	vds.exe
1632	vssvc.exe
4828	wbengine.exe
3116	WmiApSrv.exe
5988	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\e:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe

Drops file in System32 directory 35 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	spectrum.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	alg.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\{17A6A947-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db	spectrum.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	alg.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	alg.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	alg.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\cfe59615cd1bad80.bin	alg.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_164875\java.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_164875\java.exe	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	alg.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.txt\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raw	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raw\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000be2d21ee5dd4dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9933 = "MPEG-4 Audio"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dib	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ico	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.crw\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000031f225ee5dd4dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
3352	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
3352	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
3352	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
3352	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
3352	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
3352	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
3352	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
3352	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
3352	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
3352	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
3352	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
3352	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
3352	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
3352	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
3352	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
3352	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
3352	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
3352	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
3352	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
3352	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
3352	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
3352	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
3352	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
3352	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
3352	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
3352	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
3352	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
3352	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
3352	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
3352	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
3352	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
3352	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
3352	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
3352	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
3352	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3352	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
660	Process not Found
660	Process not Found

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3352	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
Token: SeAuditPrivilege	2788	fxssvc.exe
Token: SeRestorePrivilege	5616	TieringEngineService.exe
Token: SeManageVolumePrivilege	5616	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	2240	AgentService.exe
Token: SeBackupPrivilege	1632	vssvc.exe
Token: SeRestorePrivilege	1632	vssvc.exe
Token: SeAuditPrivilege	1632	vssvc.exe
Token: SeBackupPrivilege	4828	wbengine.exe
Token: SeRestorePrivilege	4828	wbengine.exe
Token: SeSecurityPrivilege	4828	wbengine.exe
Token: 33	5988	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5988	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5988	SearchIndexer.exe
Token: SeDebugPrivilege	3352	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
Token: SeDebugPrivilege	3352	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
Token: SeDebugPrivilege	3352	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
Token: SeDebugPrivilege	3352	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
Token: SeDebugPrivilege	3352	2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
Token: SeDebugPrivilege	2724	alg.exe
Token: SeDebugPrivilege	2724	alg.exe
Token: SeDebugPrivilege	2724	alg.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5988 wrote to memory of 2768	5988	SearchIndexer.exe	105
PID 5988 wrote to memory of 3284	5988	SearchIndexer.exe	106
PID 5988 wrote to memory of 2052	5988	SearchIndexer.exe	107

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-24_e48834dc81cb4e365ea1e5db6cb8e4b5_icedid_njrat_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:3352

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2724

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:3256

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:5052

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2788

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:72

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2840

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1168

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:3532

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2212

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1380

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:5112

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:612

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:864

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:5400

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5304

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5540

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5616

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:5608

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2240

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:1228

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1632

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4828

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:3116

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5988
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2768
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2688 2808 924 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3284
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2852 2848 924 {85EE815A-7738-4808-A14A-3AD87E32A3BF}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2052

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 4b7d2897c3ffe7fdaf467475a94759afceaf9907a461fe580220d3eb57d0dd8f
MD5 e479fc68b049b511a6e8a3b6ea2ee1da
SHA1 b8e1392b9dd38b789deafa1cdfa8565f0f0a3b90
SHA512 99f1d27362cc0290a24f9d879b939990324fd2d93561cba6188de54bfc67010d5a59f82fe8ce7b16d97998d8e04a04c6b5447eb54161d717b15ed3a2af3fb36a
SSDEEP 49152:sb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnbDmg27RnWGj:W3q6sjB4D527BWG
TLSH
T143D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 81af12b5c6811b3dca38bf177a0509d9762446422e438d45758b0dc2024f9487
MD5 7914bdc04a590ac5e6b0315e2bbda89e
SHA1 9aa0a759469a600edafbd46bb28293b54e78d944
SHA512 36cbc0692e55ed4156e8ea963bb929451248b89715bbb778280fed5ea8867a1d1588e8ed324c5a843e4966fc099628bfd3cffdf3fdd97187d07566bba2c92a7a
SSDEEP 24576:iXYfDtczAAsqjnhMgeiCl7G0nehbGZpbD:ptcJDmg27RnWGj
TLSH
T1B865F129B3D408F9EC67817CC9A2C516EA337C554760E68B03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 edea5324118e0e230279c96360aec3326399089362e0028f9a5b4a7ba91a855a
MD5 47bf8a415371e178908222deef5e6101
SHA1 e3fe4413c0069ba95c289eda89a2c4e440eb69f1
SHA512 fcbef05cc3cdc15b4075824223fa47345d688c7f19d66c776085b8cb2f16eb0529dfefc402291de397e8fa01588d0fdbaca2efe7963889aad95d9b57fa5f2287
SSDEEP 24576:b0Le5ji0hmxxrM/sqjnhMgeiCl7G0nehbGZpbD:bPji0Aj+Dmg27RnWGj
TLSH
T1A3859E26F6748335D073C0B9C5D2A68EED7230865B3089CB4286D77C7E676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 8719cdeeed0168ebcfbe5faa3e94cac1cccda7438b42a52323e79acf40037efd
MD5 16a7c5acd4069ddcf927fc6c325c7e8b
SHA1 4df1735fa3cc16b7bcc306b92845888cf041bfc0
SHA512 1137ef09886b682c5b6f2fd0a54cbb0e2494860f95909ab80c7fc634cee1fef6585c05cd8609b933e99c09f098767ddb632daf16fa1d76c90a2f1b249bcfb321
SSDEEP 24576:Fa7/ezSC6vUyD/aqgrvWn6q8wyuFsqjnhMgeiCl7G0nehbGZpbD:M/ezSC6vUzPveHjyCDmg27RnWGj
TLSH
T13E755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 95588540dbab3da14641ea8a86de32bac6593d1a18504919eeae96bf79d84dce
MD5 3873ca0fc9160437f1ede28de11bda55
SHA1 62d33d77ec7473bd61a580e45b3df9a70c55a7f2
SHA512 8689b8b84b5a92c8181012e114d2aa99aab0e4bf4635bd3b24e80cbfe54412c322c892570f29ba9db522fbabe607325744fcde86af1e90581bfd32f1ef88ab1f
SSDEEP 24576:2VbqPb88hv/l+Y8sqjnhMgeiCl7G0nehbGZpbD:2VO88hXl+xDmg27RnWGj
TLSH
T13E559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 85da4f3b548913c4adf184e2875b8bea0b9fa7ac55947e8ddab45e0ff63b7d5d
MD5 22978a56972acf7b7572d80cd2c46884
SHA1 99f5e277beadb22cee5cd7647356141018d27953
SHA512 a5fa017fedeba549268b452cfe67c3677ffa42f75ff95f0b847ef3abf4577056d057f7e547d84b0633a4b079547130b6fe11e82f075415d7c594dd53bdb28b13
SSDEEP 12288:1LgUXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:1L7sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1FF4523BF964C50CAEB7608B5C3E9F11EAC137E56982008536A637DFDE6B5458CB39023
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 dd440ec53068e5f3355c53ea5a9a05d2bd9b4a2c7ebb9e70d51445d47cadf6c7
MD5 11ac4ad5a496689afc7d56c3c37b62fb
SHA1 8f9cef12916cde0df81721d8b18b631e7473b4c0
SHA512 13b356f73d030f958dd2d74907b50e44c33ca4af15d8003abca141b88dafb42a9a95893e747575580fc2269259ab00ee5642a9ada332f1da7829ab090aeb9f15
SSDEEP 12288:3eBNUbTVO86UnUXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:3JIUUsqjnhMgeiCl7G0nehbGZpbD
TLSH
T19465CF7BEE28FCD2C27A4DB95791C600E76278314F21A3CBE165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 d4304534e8b6b2c4d26e6c0b392ba7dbef79adde394dc9a6cf02ffa21ab6d2b2
MD5 9bc8c804abdeab03680d12a07553b259
SHA1 bab793e35bfc8b3ea096fc200b0876753b215e2c
SHA512 139a0632c93814a542153a2d01568246c492d0d5499cda7af15eb8282d4b7297dce809592d5c69b181f60a8da9d91f074179f16dd300fb0aefc3bca54fdbfaa3
SSDEEP 49152:hQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THL:hQvGAdlCEL8c/DRNw5CpD527BWG
TLSH
T131266C656BF880F5E0A7E178897AC572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 582268008ca4413753cd3ea8dfbb4e99c3862f57c93e05bc89d793730de1fe6b
MD5 1c12d00ad8adc20e7f89ba9dbf898406
SHA1 143a775ee1d6769e2c9dd6cbadde271c530b2d92
SHA512 fb5f15ddd1b22090dbb4b3e00f9f49ea61a11902e2aa9537e019fe9a056cfe665778a0fc3c8d5c475d8de04497d14266eddf7bd432c8fdda6803b41ecea37868
SSDEEP 12288:LAwSfxL/2Dc3RDLLmt0LDQewsAjNUXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQK:00ewsAjasqjnhMgeiCl7G0nehbGZpbD
TLSH
T18075E031FA74E036C77B0DB60B36D71A182D7A204F6119C3E3E89D9E99702D12776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 c9641b8c531c02481a48f44e6abe33adefb4803a4df444b9a180adb88c72babf
MD5 f27df192ac2aac8c731519431fa84b71
SHA1 70345fd0bf11c019e0d0e0b63223fd8e3f64dc1b
SHA512 d8a6020139387221f923bc5c39eb60fe437178edd79ee83509e29b7d538562e038886dfb2e2333dbe2d77344a438263f3aacb4c1878fc090b083ed95ace00496
SSDEEP 196608:FUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHGVQBWG:FUEtQevvqc2W1cpV2tI32ZB
TLSH
T167474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 491c0fbdd3f6cf492b9f22f55c148a32fde7322c1dbbe3e1cab5795aec66b2ca
MD5 9bc13afb4932f1eb09dd4e9af75cd19e
SHA1 3c112f83ea15c2665eba50556771b332d75229e8
SHA512 bd387b68b75d4d4a3b2eb9dbd5227fe6abeadbaf8c9e6111b2d1a0cf362f0626df9892853a16bc6b67b52962e726e921e70c7c10d224d4a80cdf539c48b4b023
SSDEEP 49152:vCbRquA/m2yL5zTfFiV+XenmE3/zODmg27RnWGj:ooquVjnm9D527BWG
TLSH
T100D58D1976B8C1E4D1F6C77886A2C647F37178154B309BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 bcf24ffd0356c448286d3ddf10ff9d3b731565f535ba3dd9e830d05e3acb1d79
MD5 3526918306430002f6404390ddaa515d
SHA1 c6beb71623c2eca913f1d47cdfa8cc10694e4f5e
SHA512 6de79daf23ac5b1f694db254e557338cd25fc768b61eedae9fa02a0671b883fcc8d601b4ad31c485e211679548ac783569e352baea1e65e2c6df03ec1c306874
SSDEEP 24576:7AhGL3IFoiwtA5l7S53ZsqjnhMgeiCl7G0nehbGZpbD:7AMUFoiq5tDmg27RnWGj
TLSH
T1DC359D81E7F951D4F5B3AAB899B69171E976BCAA5E30C20F2160D11F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 b4720dcec9a63ade371595eeb171a3d9a22f98639189923fe5eea20cd61f51c2
MD5 5d3704dca932cea42dd905834254a8b1
SHA1 7bf0b62fecbc8587bd8a50e35adce610673678db
SHA512 5baac866188a8555ac75593113493165617f0763e2cb3a77876a49fc2ce7dead0e49e09eda9e8f656bef05eefe9fe56a00d2d6aaccbc6b00d49b1499081ae6be
SSDEEP 12288:Vmw5HEjsChNVBFgl0WDm+CKUXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83i:Qwu4OWOsqjnhMgeiCl7G0nehbGZpbD
TLSH
T10A65F15A72A80CF9E9674539C697D136F7B3BC122A20D71F1760C65B6F33260AE2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 7cb8c54ba0ea09472e5b0c4e86a500fb604f6931f481e51b44aba056ca155dac
MD5 2b643fd86260ff1a3bcf8bbf14738d86
SHA1 ac5dd5e6c53ce4eb9b948c77637aaf18276ea858
SHA512 eb5a0d0d115eda00bd8de0076f931ddf7b9e1c4658e104b97076d699788f148bb1c2fb2d2ee368500e197bcc1ad095fcfae485141a23dd475229ccc3e4382a2c
SSDEEP 12288:+eZ1Iy9UXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:jZu3sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1095512AA239820FAE1A3417CC5E5D609E7337C62673003CF166656AA6F739D44E39733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 e275e048ab9be6e8ccaf7444b05798faf06d027fb61f2adbcb9f8da0acafec32
MD5 a34c109e46bf0f5ec0b709bd86333c55
SHA1 42abf4237fd2d76fbb7718061e5a99e547080003
SHA512 aa2273bf2e6e3b55dca05a9b70f44c078688fb119a4dd72bc0c685d3f9032287a7f719f4a1aef1a7237a22deca79f34ea4109f17252115f34a8e71b64fca02ed
SSDEEP 98304:1QRQyi36YOcPbLvw2gAf+PN3kD527BWG:MQyiKa/X+PN0VQBWG
TLSH
T144667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 9a088be93826699972bbc643fc2b25833cc2e5aff90bf3380b0a42167ca205ef
MD5 916fa7b4029ddb10489c1b0a58d77895
SHA1 3bb84d78f34240edfec60820750bba2933e84709
SHA512 6a1feda4d2d9f8007f7ac71fb1cf208fa103bec3b1cd183f35bdfa897099cdfb13ebb5f3df0f03ad9fe8be06090ecb23b49cf866211c6bb6c431af57d46b1c55
SSDEEP 98304:KQRQyi36YOcPbLvw2gAf+PN3kD527BWG:hQyiKa/X+PN0VQBWG
TLSH
T1CB667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 3b54315ac4b419d8e12fb7a1f0d547b5c98b4e2d777641a8ff891c6c355e110f
MD5 9b3d8206cf7c38613aca2a1a223f51da
SHA1 1cd126353e21d232b1d1d865a729fdd73c7fc86a
SHA512 7399130de4f39f7a5c7c5a3f9fdda01c28ae2875c140441acb0ca9410898157653e71804c135a9b8b2294de93c06b22f0f62a953e19153cbed2ff9cdbb0af412
SSDEEP 24576:rwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0HsqjnhMgeiCl7Ge:D68Qg55nhceWu7PNU3/+Dmg27RnWGj
TLSH
T1EFB55933B2F60099C44DE1769F4A873196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 91e7fcf50736f5d2ea2d9abeb5454666139ec0f29cf0d189804741266df111a1
MD5 6a3cef9cc47041e2cfb44c3a66a4ab58
SHA1 b3301b5f1aa48da406a2cc4c84e730c1fd30ed0d
SHA512 1fef07c579e4027524a8787525a45eff449330d383bebab2c4bf920891aaa460d89e77fa716cf9e786fb3d51d9559077602a0bd2e43b92bfbe950eadbcac3685
SSDEEP 98304:9y5112gYy5azzVvt69nLKnhZvD527BWG:gLIHEWhVVQBWG
TLSH
T191167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 89e615d85aaf67e38d92a2312b60438f66fa747c9ac8997b5048ade2db39cb05
MD5 ebece426e293ca09f072c3b05ace645e
SHA1 b306f0feb7e667f2b5e6e1ff380f47a02c3d2642
SHA512 1883794aeece38543306efbf9d774fd05e37b0339bc8b5812867b287931ea978594643900ea269001b543a7f6ecd7524f81aa9c8afe8c4a19e85a8c18960a4a3
SSDEEP 49152:cB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glMDmg27RnWGj:2u6Jmdxd2dMD527BWG
TLSH
T1E3D59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 4db4b89f080b7f668032e2bef1cd0932b8fc12da7d65774d809a5ee6f7a10b3a
MD5 d6ee0a374874d37403565d390391d4d4
SHA1 dabaadf55510c5eea690b947bd818d0d1df64433
SHA512 2f9bb6d585948df839e84c1b6ccff8f14d56445d73ae110f454e5b1cda3829fd461cfb5c5e1c2a8813b7e4580807a5218f3e8f1ef8c6386a478174dd6c3b5cf7
SSDEEP 49152:X1hpsNoJpF1A63U44CwH7R4xQDmg27RnWGj:XmifPWR9D527BWG
TLSH
T18CB5BE13F2D801E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 cc995649f05662e555ba946a76ae162f283060e5c0293aa42971040bac418963
MD5 0d957751a137a2edf47b196464701373
SHA1 8fae939e2623c339767653d0fb63d55954c8e925
SHA512 1f95f98eb75f5a289372679d94f725f4782473c5ac435b2f2e1de07c4bfd1430b727465effc17a1a7096169b86ba8816139a57cdb3760668157c4058c26af532
SSDEEP 49152:WSuZQIY0Be2KcRVtOnks6NMHqLDmg27RnWGj:45dKii61LD527BWG
TLSH
T1B2C5BE13F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 7c2ba93c850c9561860153a30b2dfb1922840ae0976baa991b1a180b05bee4b8
MD5 c0a983c6f699650c1c00bbba51562695
SHA1 4d6f48f3aa2acc07d50f2d01bca266a0714dc8db
SHA512 5be3ae518cfa6d79bbd057fc396a79662fc6de82f475c49d41046db9f79f1d742b3d848d92994ec71955869bc43a46f1c8348dcf08e0dbc75738409c38bafc96
SSDEEP 49152:XhtSn8EApI0fig3giDn0AP5w8Dmg27RnWGj:GX2imphhD527BWG
TLSH
T1BC95BE13F2D900E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 4582f17312625cf5baf603e8b6a68281c07a34f9243d5ab8e887ba52a8421d38
MD5 147f317ceee4d3acd50f2ce803464174
SHA1 09f456d565b8028415d36b6bac3325bd15312333
SHA512 89c4231766c3f837a325e8fc1e56ffb9bc45a04eb5c5507fea3773295300dc89bf1adeaa35fa57c4052a98c823155ac622a8d956c8660b4a9d2f6c1ee9e25ae9
SSDEEP 12288:3IUXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:3zsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1514523BF955C41CAE52648B5C3E5F10DAC073E5BE92004937A9B7CB9FBB14984B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 7217517c3f38fc2afbc9c660435d65634b5577b59bd010e7167ad13093a027f1
MD5 1edc0c53473e38ef8e0447ef58224835
SHA1 57b95a59abe5bca0b7ba1fe7b85ff68a1eb87336
SHA512 027b51806a39d826bf7a55f39918c7314125cd4e6253cf3e39750323ee06453681b74046456be7e719182de51ad7071ad830ca28efacfc2a235871919992d855
SSDEEP 12288:TRUXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:TWsqjnhMgeiCl7G0nehbGZpbD
TLSH
T14A4523BE955C41CAE52648B5C3E5F10DAC073E6BE92004937A9B7CBAFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 797c614fa17145f79a348e2cd2053722a42d2f67ab54a31855088517cd8f9777
MD5 0e33f211e76b0b2927b21ee16ee7035d
SHA1 a0d43c25e5dd62e555e30ab65b4c8461fa3d5933
SHA512 744168b705d94eca9b5ac6d467c98dfd7f8f56629b41d724dcfed6046f9ad45266623ef7e091cc4965e341f8ebc7ee6da6dbba22d31ac9cc47b3c22aaa5d8b01
SSDEEP 12288:UPUXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:UMsqjnhMgeiCl7G0nehbGZpbD
TLSH
T12F4523BE965C41CBE52608B5C3E5F14DAC073E5BE9200493BA9B7CB9FBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 7f8c795e233e6e7a696e10ec0f2a3bc00a96111a0750db0bc320082e58cf06ad
MD5 b1edeb1764b920b5b537311397fd660d
SHA1 801f7090fbf2fce0f3077adcf2f6643cc3b4109d
SHA512 40f1c44436c15ffee360bd94c553217b25b02392d34f7a083d14e4ae4e5cd2c7ed82e28361ef6f96588eab1b852d1e524bf5c0080f1eea21703fc64249ca9aef
SSDEEP 12288:XVGUXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:TsqjnhMgeiCl7G0nehbGZpbD
TLSH
T19A45236F675C01C6D83285B4C2E5E11DE8237D96EB3005DB6B532CBE9FB16944F38A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 ec0d393033b53817baa6aa9d71061860ce4f03b86e5e6ffb8417ac2350900d8b
MD5 33d127fb60f8b9a6999c4828ea56e69f
SHA1 dd737f52461d63314cabd19cce42a1c426568edb
SHA512 f868f684ed3f8a87f433fe71caa6253f897e54e67eb71a7280e32ac89bff6b4c3f88c674ad7d113fec88ca23a8ac45714f5e29220fc03ed730490f3b116d827a
SSDEEP 12288:E+UXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:EhsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1304523BE955C41CAE52608B5C3E5F14DAC073E6BE92004937A9B7CB9FBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 819d3498d506ca33ae93cce737564c53d96a9449913bed4ddd01111570b47ca2
MD5 f01c8138698e1e978eb56573352887f6
SHA1 c11a3e675854802420d30dd3fac9f01f3497b664
SHA512 2ab2418765244cd00ae9dff36f21c722ecead54144eef01faea9d8e93e9b615609e92322c2bfaa6e4ed67187d39d98a73434f00eb0c4b5c06271ee13ab1eb279
SSDEEP 12288:+1UXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:+ysqjnhMgeiCl7G0nehbGZpbD
TLSH
T1DB4523BE965C41CBE52648B5C3E5F10DAC073E5BE92004937A9B7CBAFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 f627d384a0be6e15d5faddd20e2163aa5b677fb054c2325e236b517ecb043881
MD5 977fb3249c38f7ae21e2edd94d2c557a
SHA1 c5d9cb59d75cd0af793b033f665a88c1a1865ce3
SHA512 7fd09c4d2e7588813f5810242dfcf676db75b4a0dabf5734e73b12329e103ae16e78dd03d73bb53517831bbc85c50ca364b0198ba01a49b909ecd68eb9bf5544
SSDEEP 12288:CJUXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:CesqjnhMgeiCl7G0nehbGZpbD
TLSH
T1AF4523BF965C41CAE62604B5C3E5F11DAC073E6BE92004937A5B7CB9FBB14684B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 46931d72cb808137b6552e4346d973773a50644629051b3670ee8516bf9f042e
MD5 09bf6412e9fecd12689f3c2cc2d3c6c0
SHA1 e6ff334ba91cc3808866a6ca272fffb512d20708
SHA512 d1a40d7eb2e07ca62f1ff7d8b2bbc8c275c85b79f44fc3f749524eddd8dc0a06faa15abc9ce4d9fdb1ae5cf9327eaf6a7755b23b7edb06bf70be44bc7a3f88c2
SSDEEP 24576:tZMRzFVSO2sqjnhMgeiCl7G0nehbGZpbD:tZMRzfmDmg27RnWGj
TLSH
T1B16501A9B35418F8EC63813EC965D90AD5B27C5A0B70C61F13A4366B5F733A00D3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 c9c5e690cb97694bcc86d522a7b68febc5a0adaefacc4ddc665060090eea7791
MD5 26e7e4ea7c20f4a842a82608d08a4fa0
SHA1 5fc650ac971de3382d2995ecf3cc4329bf7d4731
SHA512 ab86af1949959f98b4c02af22059ca36944cba65233cb1b38a4389d1d0826b8dfaf40a9c6d16e8115f70f2fba9fe87196907b4126f725dbba2e9d3d133770c4c
SSDEEP 12288:VkUXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:VnsqjnhMgeiCl7G0nehbGZpbD
TLSH
T16A4523BF955C41CAE62608B5C3E5E15DAC073E5BE92004837A9B7CBDFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 268165f88cc16e596d8aa835893e3c9a548a39f00b420baa05d5e3012b10be2e
MD5 39350a5ffd5c61abfdd8cbee26c41794
SHA1 5e8d63d8805c6dd2828fd6f45d939318b0e62d49
SHA512 93daedf61d49a4ab89e6a19431c1aa9cb9608a7f346fafe8268d343894c4d60ce143021a0d796938bed15c33e3e6b5a609de42c01335cf3f478a94f0928ffd07
SSDEEP 12288:QQUXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:QrsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D44523BF965C41CAEA2604B5C3E5F11DAC073E5BE92004837A5B7CB9FBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 c4789d30f7111acc232743934cdd9f58a8f0ebe58a2d0e7690b0f95b7d6df481
MD5 e92d27a097536820c0c88fa337d63589
SHA1 404e82c83878651d2170b2f66e0d18731ab2aaf3
SHA512 308e048e2a5a61bca69e3304fd97b11caf3470b42973445727bd4720874d83e7b829d73cc3f4c5eb86c95eebe25c3396901a4c77f5310ea1b9ea4e032b715a24
SSDEEP 12288:yyPz5L89UXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:vzyKsqjnhMgeiCl7G0nehbGZpbD
TLSH
T15455125B73A430F9D1378178C5A29A06F7327C3647204A9F17A406BA6F736908E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 c090170d14e6f51e05001e6c30dd17a372724d4ab46c9006b454f023b6cb4a88
MD5 590b59a7e68f887906ffae5c299dc3d9
SHA1 60de64864640646799a5ea16fd7b58111ed95edb
SHA512 2f8cfc97cf36ad76b4273e0b7a29f57c13fbd2b30d7054a5eeba93dfabc7160d2e123c81ddf6131af671d2dde48fbf0af1ae743fa0e952570959e2f1f0becebc
SSDEEP 12288:UkUXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:UnsqjnhMgeiCl7G0nehbGZpbD
TLSH
T10E4523BF955C41CAE52608B5C3E5E15DAC073E5BE9200483BA9B7CBDFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 6a7587bdb762f6532cb2516c25b95c2a31e54f22a291590c987a4ef519484198
MD5 6c81b6f15ae86ffbeafbf06ad6726309
SHA1 d1cbee5389cd520dab178d4fab97db8d3e004105
SHA512 4f4d7f388ed921f1c1a52479552c30faa78de795343b0f758eda9026948e8b3ec08e3cee67394093ed406c312c56e4acb557d36f14ed02bd43a563b9b60e0bfb
SSDEEP 12288:VkUXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:VnsqjnhMgeiCl7G0nehbGZpbD
TLSH
T17C4523BF955C41CAE52608B5C3E5E15DAC073E6BE92004837A9B7CBDFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 4c52ff4fb74c5c4af70cda5c0774abc4ea3c296d1645a339d10247c3cafdb219
MD5 a8ea6d646b61d80f9ae832807b21b5b3
SHA1 1bea55dc197acd9690d8138e44c9b4b80df22368
SHA512 60c3347818152c02274502e4b40898f28a48a616b7e4459562b10a80260aee17c0488c147b141cdddef2bc44eae571425009a18e11ffec422236ad1bf938aab1
SSDEEP 24576:xCU3pvPDv4Ex1hfe7i8WVq2lIGU8lrtGUJLPuwvAIsqjnhMgeiCl7G0nehbGZpbD:xCUZPTY+8Wg2lIL8lrIUJLWw1Dmg27RN
TLSH
T15965AE1EA3DC0896D4BB81358A51CA06EB32782E1B3196CF2160C77D6F67ED54E39F06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 ba07167b98db75805815e1d2dbf69e882608b0be795235e390a1e3183178f96a
MD5 fb1f3224eee61c53a24454705759c205
SHA1 3b56c129786526f39697fd30b4c5019818b36e2e
SHA512 4ea0b1f3b8908dab1d77245ea5b227ca9184c5208f1896498556127a55c1ab9fde2c670117970c5e403c41981d5bd891c0e899a35d2cdf458e3d75aad441235d
SSDEEP 12288:Nbsf0UXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:o3sqjnhMgeiCl7G0nehbGZpbD
TLSH
T16055015AD29802D8C06E6179C3969605F7333C2687E093CB67D1F87E1F766908EF9A13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 82864ad700bdd3ddb5dc4d55e72bad6bdeab37df31fc55f827b68ed8887bdf28
MD5 6ce3d725c73055d7bffecae3e89b4535
SHA1 fd917e7665c43de6258c898e6273035234d476b7
SHA512 0075aa0654946a5475a6d489cf7b0a1663b1f84785ea06367ebd08cfa0b0d8c40048b6507380ecb9a7319e806636af81b3a526976b0c43c0e3c00dd51c6e9052
SSDEEP 12288:0vUXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:0ssqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C645237AD34C518AE57649B482EAF12D681B7E6A9F2004C3B94338FDF6B18D48F38517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 a9ef836ed069e66d8ec8a855cefdb28c19b4128bf41a0a88e92e6292857f5dfc
MD5 986db5608e922ffaefded635b914c03b
SHA1 11674812b343f913e9d360b08e0ca9595843d4ed
SHA512 f89a2c5b318f8abcc31f40f0ec357be223572bab9ca04419cfdbe5aff83fdca33981568ee0d9bbee4ee3ee03bb1d596ebd77a6f18460ba2acc4bed18b5a1313d
SSDEEP 24576:K8RMyNoSFw1d+rC4vrmRcGPiQEaiPnMRTC6sqjnhMgeiCl7G0nehbGZpbD:7RZwQCyiHiQEaiPnMDDmg27RnWGj
TLSH
T1CF85B01E62DC42A5E0BAD278CDA78407E6B27816573197CF1291C27D1F27DF48E3AB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 7db82584cea557aeeb710136315207cf36ee214216d36f839854577d57d767be
MD5 8cf98b10ba766007c935aaa1bf163486
SHA1 aa6db77a0659c84ff7ceadb179fe1384b0aa44c1
SHA512 e6193325f30dbf39c95920f9f5aeadebe2419d3f6dfa9b6586eba4ed5dd38910f7b7c928ceb1bf7998c736033d1b801f6c15529da6710a85bfd10279ff90124b
SSDEEP 12288:VbxA1U7KfUXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kw:VbxA1UGcsqjnhMgeiCl7G0nehbGZpbD
TLSH
T19B55123E62AC10E5E176917D86D2C10AD7327C26672053DF21D282BE5F37EE84D39E42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 0fd23577cce28b0e939af90559b3a05aadbb0fbc97e1d94d3be7a4bdf2f7275e
MD5 b0c21614ba421f5f3f792206e8169492
SHA1 84307ccb4601c57aaf2e635b6c6d23dc9f92c9cf
SHA512 8075f3b538f7062f829cf62876291359131c6299cded3479030b3bada945e440ad8484c845bafecd5b483909acea643ffed92ce3d306de4f2fcc683215028d78
SSDEEP 24576:4jsmP0yHaqrVqHra44KDzMsrnpsqjnhMgeiCl7G0nehbGZpbD:4jRP0yHfVqzlAsrntDmg27RnWGj
TLSH
T17F45AF2EF2B910F9D4AAD136454147B5BB71782D1F209AC70170C634AF0AEE89F39F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 6e8402c11afbae3bd654aad98561cd06107bed0dc488911920e78e2ff03bb8db
MD5 c571edb67f48234211cff4cda177737d
SHA1 0a22163ca209dd6df76a9a65f5980519027eca4f
SHA512 930c38f3c73eb4cbffa73572d99f8e63e83079e22f8e3a1d409dfe5dcb07461168d75f6b72875129a405fac3f9a907548d4a0aa22c13b2d3facdf0b595098d80
SSDEEP 12288:kVUXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:kSsqjnhMgeiCl7G0nehbGZpbD
TLSH
T13D4523BE924C51CAE93649B5C3E5E11DA8073E669B2004C379977CFEEBB54D84B38423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.5MB
SHA256 7237ba4b06b0d3aa2a0c4820d4845c57411741b2d4b926ed207e8c0e120ca217
MD5 a8a17b5c0443e01dfd60ecb69764baeb
SHA1 305d55941540f01879193ba9fc6ffb849b0dc8da
SHA512 4296b6579a23bc2527404a527ee32427b8b731843c5664b52eed34fde7af4007f0ab2188b5f8dbcd90e7516aed5ed63e207d3441485ce34fa4672cd6eec51f56
SSDEEP 12288:EObfA4LWO+vAYFTLUXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/npp:pbLBUTAsqjnhMgeiCl7G0nehbGZpbD
TLSH
T172750159E79800F9E87B813CC5A2D616E672785D0720E7DF03A94AA91F637E04F3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 75496afcf82de03e26d3ae2416a79c4f19a4d4eef51f8135c0523393286ab788
MD5 c963a5c9e87f9ae82a308dea2667c030
SHA1 c9122f0a27e32d7de4ec36a421c3ed247deea55b
SHA512 1b6abbcc2d887bb742d91ef7c3d15b390bcf6d536136824b0b609a77f177a9e44c57424df43e164c60e3dbddc3f2f57c915a03b283e8ec857ea0a6a479b2cef7
SSDEEP 12288:N70Vm9IYNvUyBpYUXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9L:qpYNHtsqjnhMgeiCl7G0nehbGZpbD
TLSH
T10765E12FA2AC08E5E57B9179CAC2C209F5737866171192CF15B082BE1F17EE8BD39741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 12be7b19b6dae4e9aae8fe240dbdedd07e11c5e8164b55a26caf62d963b38b6a
MD5 c6b55f078af97836080ea2f04cfd4ab3
SHA1 522ef56126ad6ef96395fb10c38d0c7a1855805d
SHA512 8080770d31301148e157a1a00c147958ca66d35251c676ca771657c50fc00ccfcea19fc2cfc173faf22c6e4b6455a72c26d486d850dd261729e63d2abda727ba
SSDEEP 24576:2nXoJjNYH84VVSNAApoEmP66aspcrcHBjSSKHPWdQwPF3hJ8ssmOc+XLxu+x7uKt:2nXoJJYH84VVS6AmEOJas+cHBjSSKHPJ
TLSH
T10165BF6EA2BC04D8D5BBD17DC5C28506F5B278621331C6CF026182BA7F27AF55E39B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 91c43fdc2ad6e099dac704dfc0d49e1caff53d74e36418956dee00fc523fe843
MD5 168e259bafcbbc6109e1799b7738c2de
SHA1 f181c574eebff4ef9b7bae54dd35fc504500e703
SHA512 df1a7aa06faad23b7cd0611bbe44b532bc8bbdfe52587fe41fc72c1a8bca1be176cec5a8e01e40cb7cb164cba849ead9480bf3ffeb745dfd7f9bca389898ca68
SSDEEP 24576:Vv7Xbxd9Tuycf8M/TYlSuxrr2PCbsqjnhMgeiCl7G0nehbGZpbD:VDLL9TuJ0M/TYj2P2Dmg27RnWGj
TLSH
T126858D5EA2EC42D8E07BD6BD85B79046FAB2B855173081CF1291856E1F23BF05D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.3MB
SHA256 1b9dc11b4d66cba2f5f3bf3054673fffcef46bdc38260a861f08ba35f11afcb0
MD5 7830a917553b91d8894fcb43a07b4947
SHA1 9cda34c89ba7b90eca70a455f7b22eb18713595d
SHA512 ec082209d63cc0f925c7e039c378b33f88f8b5616468ccc14ce4becbfda69cc31dec24647ca5c5b8da3ff9fceeaa8cc8978b185f9baba881a80eb15c0b543cbc
SSDEEP 24576:SegJgpwJOmPOHWAKk8ZguIGyPsxr5Vin10wAsqjnhMgeiCl7G0nehbGZpbD:SngOJOmPOHz8Dmg27RnWGj
TLSH
T15A55CF3FA7BC15D5E03EC17DCA928916F6B1782603255ACF05A0827E5F1BEE42E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 f53610880329d982be3bd9607ef7ecaafd07a9417677429a1c273c4d1fc9a41a
MD5 4a3b3f2d8acca555aba79d01cb4a73e9
SHA1 7a2466667305402fa449bc77c828734516f0e6d7
SHA512 6555388d1478378da429d3a96407dc1f4c22cf5845947167b7bf74e21aee89bb71ba89a4272f7c3488a9f2e671dffd045fe9ab49d4cb675263e5a69962ad4184
SSDEEP 24576:hLJnJiTk3R3waE4JrOysqjnhMgeiCl7G0nehbGZpbD:hLJnJK8R304l9Dmg27RnWGj
TLSH
T1E775E13DD2A810E8D477C2B4825A5756FE32387D2B2169CB29B4D4353F12FE09A39F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 99dfe661c94a55a9dbb703ebd22e3e6e99b638c26595d35284314e60926c99db
MD5 f85c0154d05b144870f0459d6c081ff6
SHA1 aed5c5822d9c98d3337f016b13a5dc1b6d83de82
SHA512 486e502d86b8596331a9e51b2f4676884409f6718b0de9005969da64195a3ed33b9a77ecb885ceaa8aca8d92bce396a9f0fd58c6e8df839bc7db6ec4a4bd0658
SSDEEP 49152:29mqCzDScAZmlvTcFg8Ph6yDmg27RnWGj:YxD527BWG
TLSH
T1C8955C15F7EB5298E8B3C9F1C96694159A337C409B34F7EF0A80CA6A1E32BD1D538B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 d00191d0fc18773289382fb73ce48df03a10d2aaa60b5bf9501b9cc8d3925e6e
MD5 ca32d6ad806a2d5fef54b2c01ec268fe
SHA1 b3ccf5a29fa9102ce05436fdbe65cf7a8f516943
SHA512 810ca02043e2b6861e8b8e72b9fb1f0e19f307dd9b6da730a6b45605e0778645feae49d85e8163f40cc87b62daacfbbd3f3798cadcd20134766153d3c7b0d585
SSDEEP 24576:0lYJeXm5jUuEwsqjnhMgeiCl7G0nehbGZpbD:0lYJeXmRUuEsDmg27RnWGj
TLSH
T1D35512AE669C30E5E13A8079C2E2C508E633B876571017EF55E0D5BE9F679E40F38E41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.3MB
SHA256 b09ec93dd954d91345f296a08264d387da6c9585778d61055f673f530eebf969
MD5 02bab50bd81c80b3e8182a99216ff568
SHA1 441ad8522044a02a5fb19ea40ed190ec17b2879b
SHA512 f6bfd8c6a392c6c1d843137593a464a70264ff96fe2e62c288a64fc8984748b03d033781d1b4257aa09be5048d51795631e66f48a9efa9fd3ee63236d11d104c
SSDEEP 12288:Rmu6kyWUXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:R7tyJsqjnhMgeiCl7G0nehbGZpbD
TLSH
T102552219639860D9EA760978C6A3C158DD367C219F2002DF65E1FA3FAF726D48E34B13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 cf1aa5f609feabe6d99b863437155aa9069e50cb0cda5857fa2f939c008a8735
MD5 a9553b7df10387e5c9a1350040568b97
SHA1 990fa5661c54eba547a150963b69897137a842db
SHA512 8349cb652bf5259725f0c790b484cb7fa7c743b7667d16500bb0bc5bd6b5acd5e1bd7ccabedea36aaa0f3e13d9a47020b018bd74dfdd04800d7a896e716419c2
SSDEEP 12288:FPLUXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ZAsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1CE4523BE525C61CAD93244B4C2A5E10DA8173E76AB2014E779E3F8BDEBB54D44B38C13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 ad05d33a91978fb853f7e68510b846382d4b9e61a350721882d015b3457e4c98
MD5 cb3b713a2392549581a5a1fdb1c1c99f
SHA1 c43a3702258ef239f56583ff55c6aac699ac5363
SHA512 168afdce07cf50557491250201608dd1686182ac17703535e0aa172d8e866bb5db62f1eb762b0ffeaba44a562644563b876725a907db1298ad86cb068dfd291b
SSDEEP 24576:3C+TyQIu93VAumZr7jmXsqjnhMgeiCl7G0nehbGZpbD:3/TfIq+YrDmg27RnWGj
TLSH
T1A1558D2DA7E91DCAE276C575C9A34493E933B872137186CF2044C07D499EEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 a81de7191d5775ee1f09a2434f8721aa8314d3996dd2c7c4cb0b78d33e38155d
MD5 1da30343a1dd4f3ebdc4c8a367b12588
SHA1 bc0b886712ea183b6a67b05a82b43f04a18c1f1a
SHA512 23dccaf755ceaa43390f76a39fdb925900799b4ecbe79144ac7a9970d5ed29d1d3b6481948e55cdac4fb4ab2c35e3c3adf58aca84929ef5719d9673d6a877d5d
SSDEEP 12288:CcyrWOstaa3kcs3UXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9L:zLQikZksqjnhMgeiCl7G0nehbGZpbD
TLSH
T19F65F11FB3AE0095E0A7817CC8858116FA737875571163DF02A1CBBD5BA75E8BE38B42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 0b888adca1550c7d6c0a6ed2064e0e7f812da52731e0ca0feb2e1e5cfc775ef2
MD5 4d0a4f8e3b63654dac9eb3fa548d809d
SHA1 882f478b024ff1e5b43a102b04c2e6847ef93744
SHA512 3ce0fe13c072df07a792fe4469f1a22c48758e31f3fe68f54c6daf53dfe3cc3b87d4be8f8767d7aa8ec179e8184c7f07577510d202d2857e25f6819816f5c0ea
SSDEEP 49152:npJFwrPpGyqWo6cbT2TZ8maJO35NPHXogsS7Q78ZGAvL9vnF35LWAPNDmg27RnWm:spC7b4+80GTkKD527BWG
TLSH
T111A57C3DE2B810ADD8AAC375C5461665EE71382E3F2015DB11B0C578BF1AEF19A38F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 7e28cf9cbaf6d8dccc0f5f27ce13f7dbdbbfe754c58b3bee590d8bbe80d7d93f
MD5 38faefdbc8289cccfa9308458a59a320
SHA1 b9dd6518bf5d96e21c53e25cdc243d0c07f07782
SHA512 c1e2269442c6fb3f62d3362caf56d4899116f3ad27ff5be96b5474fa56ffafb12f763e8254e209dfc7f608d6fcf00f022eed3f2194117004cf63ac6a708c38b2
SSDEEP 24576:6SAwJPE1IDAo+4Kt+l4413JUQBsqjnhMgeiCl7G0nehbGZpbD:6qPCIo4Kol4vQVDmg27RnWGj
TLSH
T12455BF2AA7F946E5E17ACBB4C663C601FB737822133163CF5290857E0E169E85E39F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.6MB
SHA256 be7047138246dde0697697b0ae2b0158057ead7d3d736e58a4418e83023b925c
MD5 23d8284eacf6d36bc50e095d47a579bf
SHA1 402fa7ff6e35dd0c84a9010fe0799a3d1c75799b
SHA512 92366abc2559802201cb132b3ca0a166cf552df52c95ce3e48da6cbcd51a6be0ee997dc186be1747f19f611e47bbe4fce44c5c4acb20e2714248b7e0994e537f
SSDEEP 24576:IyLXPLcw94txsqjnhMgeiCl7G0nehbGZpbD:Iy7PoXtFDmg27RnWGj
TLSH
T13475D03ED76C04E5E47AC27CC2A3C506F6723CAD033166CB19A495792F6BEE46939B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StructuredQuerySchema.bin

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin
Size 414KB
SHA256 e67e330837a6b2f6d5f76815e7235a512b54b1c90f2ad62a3e9d142ae6939c8d
MD5 16b9618962f5623ca791a1366eee5708
SHA1 f0d257511952f075b2a0ec7d8e8730c3e464461a
SHA512 18e1d5a105b87fc72df94645685f5a8d3f593df2d3a9b8652b3b4a4ceaf92d3c7a67b0c08847186149dd608428cae8f1b3bc844bc7aacfc9e3219da823ca2fe2
SSDEEP 12288:vMUC7+vlk3n61mSkplXZ5RwmF9n4w/TSD:vXhl6V/i
TLSH
T124945F36BF88CB22C59A15748897C01A2E30A7C49E04CF6B73DC513CFA576685FBA359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.4MB
SHA256 35470f8b87948bdf064d55d66ffdb0d9bdbf447c7bf8257d297750ffe2f2060b
MD5 5e449b651b9d19b2b2b2d4f82af7882b
SHA1 1ed2288329538f33d7eae46acb5352fc9db9dfa0
SHA512 e1b58b33309df5769591df54117f76b53c69af2c0b7733f180d16a092945ecaf698a45bf96d93651cad3141a0aca05ba5dcaa3c96a927bbfcb0f9b564b34dd81
SSDEEP 12288:H9lyvj3IkxjbBzHUXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9L:HWv8qjp0sqjnhMgeiCl7G0nehbGZpbD
TLSH
T10E65126E529820D9E43A4674C2A6D12994337C77173459EF75C5E8BF8B31AC0CA3EF22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/72-56-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/72-164-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/72-50-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/72-59-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/612-138-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/612-132-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/612-141-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/612-265-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/864-467-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/864-153-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/864-469-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/864-149-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/864-143-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/864-276-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/1168-83-0x0000000001AE0000-0x0000000001B40000-memory.dmp

Download

memory/1168-78-0x0000000001AE0000-0x0000000001B40000-memory.dmp

Download

memory/1168-85-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/1168-72-0x0000000001AE0000-0x0000000001B40000-memory.dmp

Download

memory/1168-82-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/1228-466-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/1228-224-0x0000000000AF0000-0x0000000000B50000-memory.dmp

Download

memory/1228-218-0x0000000000AF0000-0x0000000000B50000-memory.dmp

Download

memory/1228-229-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/1380-121-0x0000000000BD0000-0x0000000000C30000-memory.dmp

Download

memory/1380-115-0x0000000000BD0000-0x0000000000C30000-memory.dmp

Download

memory/1380-240-0x0000000140000000-0x0000000140209000-memory.dmp

Download

memory/1380-124-0x0000000140000000-0x0000000140209000-memory.dmp

Download

memory/1632-241-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/1632-237-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/1632-470-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/1632-231-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/2212-109-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/2212-113-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/2212-103-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/2212-228-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/2240-215-0x0000000000670000-0x00000000006D0000-memory.dmp

Download

memory/2240-203-0x0000000000670000-0x00000000006D0000-memory.dmp

Download

memory/2240-227-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/2240-213-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/2240-210-0x0000000000670000-0x00000000006D0000-memory.dmp

Download

memory/2724-22-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/2724-21-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/2724-14-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/2724-112-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/2788-86-0x0000000000E00000-0x0000000000E60000-memory.dmp

Download

memory/2788-40-0x0000000000E00000-0x0000000000E60000-memory.dmp

Download

memory/2788-88-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/2788-39-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/2788-46-0x0000000000E00000-0x0000000000E60000-memory.dmp

Download

memory/2840-61-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/2840-67-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/2840-175-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2840-70-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3116-266-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/3116-255-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/3116-473-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/3116-261-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/3256-36-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/3256-27-0x00000000004D0000-0x0000000000530000-memory.dmp

Download

memory/3256-37-0x00000000004D0000-0x0000000000530000-memory.dmp

Download

memory/3284-494-0x0000013E76B80000-0x0000013E76B90000-memory.dmp

Download

memory/3284-493-0x0000013E76B80000-0x0000013E76B90000-memory.dmp

Download

memory/3284-481-0x0000013E76B80000-0x0000013E76B90000-memory.dmp

Download

memory/3284-482-0x0000013E76B80000-0x0000013E76B90000-memory.dmp

Download

memory/3284-484-0x0000013E76B80000-0x0000013E76B90000-memory.dmp

Download

memory/3284-483-0x0000013E76B80000-0x0000013E76B90000-memory.dmp

Download

memory/3284-485-0x0000013E76B80000-0x0000013E76B90000-memory.dmp

Download

memory/3284-486-0x0000013E76B80000-0x0000013E76B90000-memory.dmp

Download

memory/3284-487-0x0000013E76B80000-0x0000013E76B90000-memory.dmp

Download

memory/3284-480-0x0000013E76B80000-0x0000013E76B90000-memory.dmp

Download

memory/3284-492-0x0000013E76B80000-0x0000013E76B90000-memory.dmp

Download

memory/3284-491-0x0000013E76B80000-0x0000013E76B90000-memory.dmp

Download

memory/3284-490-0x0000013E76B80000-0x0000013E76B90000-memory.dmp

Download

memory/3284-489-0x0000013E76B80000-0x0000013E76B90000-memory.dmp

Download

memory/3284-488-0x0000013E76B80000-0x0000013E76B90000-memory.dmp

Download

memory/3352-80-0x0000000140000000-0x00000001402CB000-memory.dmp

Download

memory/3352-0-0x0000000002150000-0x00000000021B0000-memory.dmp

Download

memory/3352-9-0x0000000002150000-0x00000000021B0000-memory.dmp

Download

memory/3352-8-0x0000000140000000-0x00000001402CB000-memory.dmp

Download

memory/3532-92-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/3532-98-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/3532-212-0x0000000140000000-0x00000001401F9000-memory.dmp

Download

memory/3532-91-0x0000000140000000-0x00000001401F9000-memory.dmp

Download

memory/4828-249-0x00000000010F0000-0x0000000001150000-memory.dmp

Download

memory/4828-243-0x00000000010F0000-0x0000000001150000-memory.dmp

Download

memory/4828-253-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4828-472-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4828-471-0x0000000000700000-0x0000000000B6C000-memory.dmp

Download

memory/5112-252-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/5112-130-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/5304-384-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/5304-167-0x0000000000550000-0x00000000005B0000-memory.dmp

Download

memory/5304-173-0x0000000000550000-0x00000000005B0000-memory.dmp

Download

memory/5304-176-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/5400-165-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/5400-161-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/5400-327-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/5540-181-0x0000000000DE0000-0x0000000000E40000-memory.dmp

Download

memory/5540-190-0x0000000140000000-0x0000000140241000-memory.dmp

Download

memory/5540-187-0x0000000000DE0000-0x0000000000E40000-memory.dmp

Download

memory/5616-201-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/5616-192-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/5616-465-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/5616-198-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/5988-268-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/5988-318-0x000000000A5A0000-0x000000000A5A8000-memory.dmp

Download

memory/5988-277-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5988-302-0x0000000001F60000-0x0000000001F70000-memory.dmp

Download

memory/5988-274-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/5988-286-0x0000000001CB0000-0x0000000001CC0000-memory.dmp

Download

memory/5988-478-0x000000000BE20000-0x000000000BE28000-memory.dmp

Download

memory/5988-474-0x0000000140000000-0x0000000140172000-memory.dmp

Download