00ba47fbaddcf9d2053e19f193fa4617da4a8cd2111a57c9fafda24768efa520

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
26/04/2026, 07:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-26_4183e5f0103a7677cb937a0fd33518ee_icedid_njrat_vidar.exe
Size 747KB
Sample260426-js983aat2x
SHA256 00ba47fbaddcf9d2053e19f193fa4617da4a8cd2111a57c9fafda24768efa520
MD5 4183e5f0103a7677cb937a0fd33518ee
SHA1 06f42ba78e74c37bec3c36929d4a82a04375052b
SHA512 3ee55af8254dbb12af7c3ee22959ca620ae6c8f67e50e7405108e69d21983baa6412b99cdfb75af7029aeb31d829fe77f102609043d31c8399332248be08a259
SSDEEP 12288:F0EhwdbTc7d0NxksRpWE9FRHSfNm1wgbIxnBw7dzE+e3gxZC6LgjigDy5fdv8fW+:bKdHcCks7WE9F5pwg8zmdqQjC60jiHkU
TLSH
T199F4F192725024DAE5237235985FD72F97B27C6B4B20A63B134C7F2B1E36290AD19F31
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
1528	alg.exe
3148	DiagnosticsHub.StandardCollector.Service.exe
3892	fxssvc.exe
2844	elevation_service.exe
2336	elevation_service.exe
3748	maintenanceservice.exe
892	msdtc.exe
4280	OSE.EXE
3340	PerceptionSimulationService.exe
1372	perfhost.exe
1236	locator.exe
4124	SensorDataService.exe
4876	snmptrap.exe
1432	spectrum.exe
2288	ssh-agent.exe
2400	TieringEngineService.exe
2432	AgentService.exe
3172	vds.exe
2956	vssvc.exe
1676	wbengine.exe
1056	WmiApSrv.exe
3108	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\e:	SearchIndexer.exe

Drops file in System32 directory 35 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-04-26_4183e5f0103a7677cb937a0fd33518ee_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-04-26_4183e5f0103a7677cb937a0fd33518ee_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	alg.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	alg.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-04-26_4183e5f0103a7677cb937a0fd33518ee_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-04-26_4183e5f0103a7677cb937a0fd33518ee_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-04-26_4183e5f0103a7677cb937a0fd33518ee_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-04-26_4183e5f0103a7677cb937a0fd33518ee_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	alg.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-04-26_4183e5f0103a7677cb937a0fd33518ee_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	spectrum.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-04-26_4183e5f0103a7677cb937a0fd33518ee_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-04-26_4183e5f0103a7677cb937a0fd33518ee_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-04-26_4183e5f0103a7677cb937a0fd33518ee_icedid_njrat_vidar.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-04-26_4183e5f0103a7677cb937a0fd33518ee_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	alg.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\9810d0487932a944.bin	alg.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-04-26_4183e5f0103a7677cb937a0fd33518ee_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-04-26_4183e5f0103a7677cb937a0fd33518ee_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	alg.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-04-26_4183e5f0103a7677cb937a0fd33518ee_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-04-26_4183e5f0103a7677cb937a0fd33518ee_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-04-26_4183e5f0103a7677cb937a0fd33518ee_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-04-26_4183e5f0103a7677cb937a0fd33518ee_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-04-26_4183e5f0103a7677cb937a0fd33518ee_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-04-26_4183e5f0103a7677cb937a0fd33518ee_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-04-26_4183e5f0103a7677cb937a0fd33518ee_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-04-26_4183e5f0103a7677cb937a0fd33518ee_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-04-26_4183e5f0103a7677cb937a0fd33518ee_icedid_njrat_vidar.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\{17A6A947-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db	spectrum.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	2026-04-26_4183e5f0103a7677cb937a0fd33518ee_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	2026-04-26_4183e5f0103a7677cb937a0fd33518ee_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	2026-04-26_4183e5f0103a7677cb937a0fd33518ee_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	2026-04-26_4183e5f0103a7677cb937a0fd33518ee_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	alg.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-04-26_4183e5f0103a7677cb937a0fd33518ee_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-04-26_4183e5f0103a7677cb937a0fd33518ee_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	2026-04-26_4183e5f0103a7677cb937a0fd33518ee_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	2026-04-26_4183e5f0103a7677cb937a0fd33518ee_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	2026-04-26_4183e5f0103a7677cb937a0fd33518ee_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-04-26_4183e5f0103a7677cb937a0fd33518ee_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-04-26_4183e5f0103a7677cb937a0fd33518ee_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-04-26_4183e5f0103a7677cb937a0fd33518ee_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-04-26_4183e5f0103a7677cb937a0fd33518ee_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_163328\javaw.exe	2026-04-26_4183e5f0103a7677cb937a0fd33518ee_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-04-26_4183e5f0103a7677cb937a0fd33518ee_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-04-26_4183e5f0103a7677cb937a0fd33518ee_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-04-26_4183e5f0103a7677cb937a0fd33518ee_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	2026-04-26_4183e5f0103a7677cb937a0fd33518ee_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	2026-04-26_4183e5f0103a7677cb937a0fd33518ee_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-04-26_4183e5f0103a7677cb937a0fd33518ee_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	2026-04-26_4183e5f0103a7677cb937a0fd33518ee_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	2026-04-26_4183e5f0103a7677cb937a0fd33518ee_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-04-26_4183e5f0103a7677cb937a0fd33518ee_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-04-26_4183e5f0103a7677cb937a0fd33518ee_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-04-26_4183e5f0103a7677cb937a0fd33518ee_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	2026-04-26_4183e5f0103a7677cb937a0fd33518ee_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	2026-04-26_4183e5f0103a7677cb937a0fd33518ee_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-04-26_4183e5f0103a7677cb937a0fd33518ee_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	2026-04-26_4183e5f0103a7677cb937a0fd33518ee_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	2026-04-26_4183e5f0103a7677cb937a0fd33518ee_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-04-26_4183e5f0103a7677cb937a0fd33518ee_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-04-26_4183e5f0103a7677cb937a0fd33518ee_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	2026-04-26_4183e5f0103a7677cb937a0fd33518ee_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	alg.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-04-26_4183e5f0103a7677cb937a0fd33518ee_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9926 = "M3U file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tiff\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpe\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9933 = "MPEG-4 Audio"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dib\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b268d85552d5dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wdp\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpeg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003a3ff05552d5dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpeg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000f0b5a5552d5dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002096445552d5dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.txt	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wdp	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
3680	2026-04-26_4183e5f0103a7677cb937a0fd33518ee_icedid_njrat_vidar.exe
3680	2026-04-26_4183e5f0103a7677cb937a0fd33518ee_icedid_njrat_vidar.exe
3680	2026-04-26_4183e5f0103a7677cb937a0fd33518ee_icedid_njrat_vidar.exe
3680	2026-04-26_4183e5f0103a7677cb937a0fd33518ee_icedid_njrat_vidar.exe
3680	2026-04-26_4183e5f0103a7677cb937a0fd33518ee_icedid_njrat_vidar.exe
3680	2026-04-26_4183e5f0103a7677cb937a0fd33518ee_icedid_njrat_vidar.exe
3680	2026-04-26_4183e5f0103a7677cb937a0fd33518ee_icedid_njrat_vidar.exe
3680	2026-04-26_4183e5f0103a7677cb937a0fd33518ee_icedid_njrat_vidar.exe
3680	2026-04-26_4183e5f0103a7677cb937a0fd33518ee_icedid_njrat_vidar.exe
3680	2026-04-26_4183e5f0103a7677cb937a0fd33518ee_icedid_njrat_vidar.exe
3680	2026-04-26_4183e5f0103a7677cb937a0fd33518ee_icedid_njrat_vidar.exe
3680	2026-04-26_4183e5f0103a7677cb937a0fd33518ee_icedid_njrat_vidar.exe
3680	2026-04-26_4183e5f0103a7677cb937a0fd33518ee_icedid_njrat_vidar.exe
3680	2026-04-26_4183e5f0103a7677cb937a0fd33518ee_icedid_njrat_vidar.exe
3680	2026-04-26_4183e5f0103a7677cb937a0fd33518ee_icedid_njrat_vidar.exe
3680	2026-04-26_4183e5f0103a7677cb937a0fd33518ee_icedid_njrat_vidar.exe
3680	2026-04-26_4183e5f0103a7677cb937a0fd33518ee_icedid_njrat_vidar.exe
3680	2026-04-26_4183e5f0103a7677cb937a0fd33518ee_icedid_njrat_vidar.exe
3680	2026-04-26_4183e5f0103a7677cb937a0fd33518ee_icedid_njrat_vidar.exe
3680	2026-04-26_4183e5f0103a7677cb937a0fd33518ee_icedid_njrat_vidar.exe
3680	2026-04-26_4183e5f0103a7677cb937a0fd33518ee_icedid_njrat_vidar.exe
3680	2026-04-26_4183e5f0103a7677cb937a0fd33518ee_icedid_njrat_vidar.exe
3680	2026-04-26_4183e5f0103a7677cb937a0fd33518ee_icedid_njrat_vidar.exe
3680	2026-04-26_4183e5f0103a7677cb937a0fd33518ee_icedid_njrat_vidar.exe
3680	2026-04-26_4183e5f0103a7677cb937a0fd33518ee_icedid_njrat_vidar.exe
3680	2026-04-26_4183e5f0103a7677cb937a0fd33518ee_icedid_njrat_vidar.exe
3680	2026-04-26_4183e5f0103a7677cb937a0fd33518ee_icedid_njrat_vidar.exe
3680	2026-04-26_4183e5f0103a7677cb937a0fd33518ee_icedid_njrat_vidar.exe
3680	2026-04-26_4183e5f0103a7677cb937a0fd33518ee_icedid_njrat_vidar.exe
3680	2026-04-26_4183e5f0103a7677cb937a0fd33518ee_icedid_njrat_vidar.exe
3680	2026-04-26_4183e5f0103a7677cb937a0fd33518ee_icedid_njrat_vidar.exe
3680	2026-04-26_4183e5f0103a7677cb937a0fd33518ee_icedid_njrat_vidar.exe
3680	2026-04-26_4183e5f0103a7677cb937a0fd33518ee_icedid_njrat_vidar.exe
3680	2026-04-26_4183e5f0103a7677cb937a0fd33518ee_icedid_njrat_vidar.exe
3680	2026-04-26_4183e5f0103a7677cb937a0fd33518ee_icedid_njrat_vidar.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3680	2026-04-26_4183e5f0103a7677cb937a0fd33518ee_icedid_njrat_vidar.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
680	Process not Found
680	Process not Found

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3680	2026-04-26_4183e5f0103a7677cb937a0fd33518ee_icedid_njrat_vidar.exe
Token: SeAuditPrivilege	3892	fxssvc.exe
Token: SeRestorePrivilege	2400	TieringEngineService.exe
Token: SeManageVolumePrivilege	2400	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	2432	AgentService.exe
Token: SeBackupPrivilege	2956	vssvc.exe
Token: SeRestorePrivilege	2956	vssvc.exe
Token: SeAuditPrivilege	2956	vssvc.exe
Token: SeBackupPrivilege	1676	wbengine.exe
Token: SeRestorePrivilege	1676	wbengine.exe
Token: SeSecurityPrivilege	1676	wbengine.exe
Token: 33	3108	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3108	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3108	SearchIndexer.exe
Token: SeDebugPrivilege	3680	2026-04-26_4183e5f0103a7677cb937a0fd33518ee_icedid_njrat_vidar.exe
Token: SeDebugPrivilege	3680	2026-04-26_4183e5f0103a7677cb937a0fd33518ee_icedid_njrat_vidar.exe
Token: SeDebugPrivilege	3680	2026-04-26_4183e5f0103a7677cb937a0fd33518ee_icedid_njrat_vidar.exe
Token: SeDebugPrivilege	3680	2026-04-26_4183e5f0103a7677cb937a0fd33518ee_icedid_njrat_vidar.exe
Token: SeDebugPrivilege	3680	2026-04-26_4183e5f0103a7677cb937a0fd33518ee_icedid_njrat_vidar.exe
Token: SeDebugPrivilege	1528	alg.exe
Token: SeDebugPrivilege	1528	alg.exe
Token: SeDebugPrivilege	1528	alg.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3108 wrote to memory of 2480	3108	SearchIndexer.exe	104
PID 3108 wrote to memory of 2320	3108	SearchIndexer.exe	105
PID 3108 wrote to memory of 572	3108	SearchIndexer.exe	106

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-04-26_4183e5f0103a7677cb937a0fd33518ee_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-26_4183e5f0103a7677cb937a0fd33518ee_icedid_njrat_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:3680

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1528

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:3148

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:3952

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3892

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2844

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2336

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3748

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:892

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4280

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3340

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:1372

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:1236

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4124

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:4876

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1432

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2288

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:2424

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2400

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2432

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:3172

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2956

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1676

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:1056

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3108
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2480
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 1664 1628 924 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2320
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 1924 3008 924 {85EE815A-7738-4808-A14A-3AD87E32A3BF}
  2⤵
  PID:572

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 be14427ba57ad565f69f57d03408252d298540cc1b3d00541189319c6b7590c9
MD5 4dd9b363cff6cac23852cbfa55757e48
SHA1 692c2aebc2a8a12da9c6f122075658d70fd8331e
SHA512 4bd2d885f9033e2587f1df2ebe633d388cb77d84fdb76be9e55fff03bd16ae5b507f27bb081771703be81e1c18e99267a135d08b69b73015368bd4bb45cba60d
SSDEEP 49152:1b+632BuPkFKRrdE6ohvstBhuXjfS4LWxn4Cks7R9L58UqFJjskU:L3q6sjB3C17DVqFJU
TLSH
T112D59D03F2D900E9E06AD178D7469533E9A2BC890B34B6DF0780B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 3f100ea8a60a13b6743a6f643284ad473d2a7fc6ac4d46cd6380901e7441fc06
MD5 3045b4c41326a907d38d4be3dd82a607
SHA1 ec67fae4af7dee844eb2d25fad6a90f14f5880bc
SHA512 5038a60f3fe6ab8148161dcbae0b1d3ae587d8aa7833437c45e28eafd420b7506d41d8198d7606cf426f408e5b78fd8ac531293ad0fd91d35d35e5f354dd5506
SSDEEP 24576:FXYfDtczADCks7WE9F5pwg8zmdqQjC60jiHkU:QtcKCks7R9L58UqFJjskU
TLSH
T16105F124B3D508FAED67823DC8A28515EA737C514BA4E78B03D4992A1F333D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 2cd62a87be651ab0b7d5f38d2d9a1f5a11ad36f307078d32b13989763d921a57
MD5 d2d032807cd9b76dc01463219364232e
SHA1 1819379a1ae93248bc5cdfba795c247393d2f310
SHA512 41c0c96c53dab7715aba01dced2f6b723a75594fc17d69b8fef5224896ab6f18d1b214d329df86f57fbf0b5636b2ef993ef43056d8e2d3cfede00ca2fb90e575
SSDEEP 24576:+0Le5ji0hmxxrMACks7WE9F5pwg8zmdqQjC60jiHkU:+Pji0Aj5Cks7R9L58UqFJjskU
TLSH
T1EC359E66F6748731D073C0B9C5D2A69EED7130825B308ACB4285D77C3E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 0c3f529876ceeb0e0b2507a285f06b46f81d739617ee52d8939bd34e4ce0e570
MD5 e7b1a845691737f5293ac1154d572b99
SHA1 e428803524b0843f5542d4de89e7e8599c03faf4
SHA512 b8fef5ba217f0734c4d0b46cd3916273f64a5277cbd5e4dc5089db91fc813c528e1ccb6a4f7e97d2c46f42e9d66a75018459fd9302739abdffb23323d60a1a65
SSDEEP 24576:Ha7/ezSC6vUyD/aqgrvWn6q8wyu6Cks7WE9F5pwg8zmdqQjC60jiHkU:K/ezSC6vUzPveHjy1Cks7R9L58UqFJjI
TLSH
T129755C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 681fa26d7012798b2fdd442a0921203724050d5dbe19f4a9d5dfe55bb734f585
MD5 cd35c9b9edede85aea6ecbeb1b17faff
SHA1 4cdb10d325843c752509c1b6df0c47ec4eb034bf
SHA512 073be6101308f14bb1283c3714fe2ed1a8f17d454f01b480a402bafd7ca03649ce8025658edcbc0d8ff364be170a1a8855fc5c870b3b19cc43b43f4d8c776a5a
SSDEEP 24576:XVbqPb88hv/l+YnCks7WE9F5pwg8zmdqQjC60jiHkU:XVO88hXl+yCks7R9L58UqFJjskU
TLSH
T17C559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C3E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 d030c078c03d39c61167e1a4311c0cc2808dba6eedc6f9e05d686f577aa6e6e4
MD5 04452d618e0dd41bf01147801eb8b081
SHA1 9fbfee82aaaae33402b78871133b6d48abdd4e14
SHA512 9438e18b2f8d6ffc00be2303f3e89b5b890ebc4368d9f4613df85b68f8a641576925673509fe01f75f8db6a295fffc93c5275806f2a39ac4dc7e20cd52147682
SSDEEP 12288:RLk7d0NxksRpWE9FRHSfNm1wgbIxnBw7dzE+e3gxZC6LgjigDy5fdv8fWi+B:RLkCks7WE9F5pwg8zmdqQjC60jiHkU
TLSH
T186C423B0B7562C83FF06023699DBBBDA49A17E60DC885913E5C0BE3F2C781E5E485D46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 b2a7b2bb1d8faa5a90748517d11b93a04f16db7311af4acd9f8266c5cdaad7c4
MD5 5edb21b2dbdd47bf3a9430e0d1492bdc
SHA1 f05e6a35ba4215665ee03ee3680850b6dec3fd06
SHA512 e4abaabb078eef59f66cfa6303c75d20bd14b5f42e2a80946afd7a7cc1013a5a05e64a1642734c196719d42b3d48e3d9224ec7fe93d52bc15eda8d2e3ce7a904
SSDEEP 24576:UJIUvCks7WE9F5pwg8zmdqQjC60jiHkU:UJIUvCks7R9L58UqFJjskU
TLSH
T16E05CF7BEE28FCD2C67A8D795A91C740D7B278304F51A3CBE164820E9E235E05E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 494271421875b06b6177aab7506b843654bf4e8d5d6184af31d00cd2d6623d59
MD5 b6b7c1f7f6a4a80febd145ff3acfe6e6
SHA1 eaea8d2f3e6bbe1d3e877efa3efa83fbed3362a8
SHA512 d70627a1fe7609c12fdfb06ee6f58aa48d093e17071588c15e63a0f454ebf218651ce488f3cc7273e509ae8349fa86f1c27929dcfa6587358ac14dda200efeeb
SSDEEP 49152:ZQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3TH+:ZQvGAdlCEL8c/DRNw5CqC17DVqFJU
TLSH
T1F2267D656BF880F5E1A7E138897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 0dbe4be10c44506d08b0f4d51b06ee31b2ef41aa3243dcc34e2127d94a709c15
MD5 ad5b5157ad3088956572c2a2bc2ecc8b
SHA1 0162356af639cbf5df5cedb41a52e11b86756222
SHA512 9c73ec07a0ca44d25aa87ed5ba82ac5056ed9cd2f689db00316e453d182eb408d770bf06be44e3633f162fb354706f8731f9c4864f693b794ec83e4ad76bb770
SSDEEP 24576:a0ewsAjpCks7WE9F5pwg8zmdqQjC60jiHkU:7ljpCks7R9L58UqFJjskU
TLSH
T11415E030FA75E432C77B0DB21B66D716186C7A204F911AC3E3E89E9E59342D22376E17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 bd03bc8d1b1ad61aedda9ca1cfc64e76efca8f413433d44cc95246dcb14e9802
MD5 97dc0b80ce964467211b7e47ffda3113
SHA1 f450116fc1131e59a3ebd396571cf3990ea1af30
SHA512 17d95e9a0eea02dbd4fcd89ab1911a94d115ba8428245a893ef617a7d77487a321444e58b1fe136999555770f9e1ba2bca801130b6f975c5007d30f935e7d155
SSDEEP 196608:aUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHhiD4bU:aUEtQevvqc2W1cpV2tI32hi2U
TLSH
T179474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 7f576cf0844531220023ef1ae311e29ba41478c119cd4a3996cfe7a1a96b3717
MD5 3b7f5ee6aedd88ce469ecb6bad13d606
SHA1 b8fca63bbbf79c3720304481a4f48f2471bad345
SHA512 0ef5fba287d7f104ef160a9771ffccb5f1512ecff3ec13e0e43c76cee379c95243fda9d2dc9a989dc7a193eee5c320ad907babcf4825c3d8756159e15084edcc
SSDEEP 49152:qCbRquA/m2yL5zTfFiV+XenmE3/zJCks7R9L58UqFJjskU:foquVjnmGC17DVqFJU
TLSH
T145D58D1976B8C1E4D1F6C77886A2C647F37178154B30ABEF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 1034b60eee6fd62ba7af3a1936dedce92e473a91df3e6aa0d4b912793cc5eb9f
MD5 6cf35488a127b764e69599ec2c38ac78
SHA1 ea5721086c41e46d3824375ccb0b4b54b394b48e
SHA512 daf57c3993c35fc1ca73b34a58129bac5c8eff082d14fa98e44f1fffbd53e4de87dd777e9186344e0a578f5bc1b2e873f7ca3ac4754f9931888031e922b70793
SSDEEP 24576:6AhGL3IFoiwtA5l7S53mCks7WE9F5pwg8zmdqQjC60jiHkU:6AMUFoiq52Cks7R9L58UqFJjskU
TLSH
T1D235AD80E7F955D4F5B3AA7899B69171EAB6BCA65E30C20F2150D11F0E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 39ff5de50a8d7c766974bb452d456e63135e02cd787aa87b76f4d057f5625b4d
MD5 13e07847299450c45692f3ace5bc86ca
SHA1 0fd74deeadb3a89cec10078e3c4fb29e909e82a6
SHA512 7983a7414b7c394c4704cc5c602b19c2e076c0213b10f71c8223530abbe567368207981e28bcf1a3d22302d0aa3583f5ba6631e69606d483670405bbd9e83e1d
SSDEEP 24576:Iwu4OWVCks7WE9F5pwg8zmdqQjC60jiHkU:IwvOCCks7R9L58UqFJjskU
TLSH
T1F405F14573A51CFAEA6782398597D136E7F2BC012A25DB1F1390C61B2F37361AD2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 18dcb77839cc6eb7619710eaddf750a59dcde6830a09b26d7f20121dde4f73bc
MD5 b644fbcd648bcfd49b49e4848af14626
SHA1 67f736c56fe8a4687bcabb0991c8634f2dce749c
SHA512 9cf9ad5eeab83635d4bb3589c529ed761bd0563267e80f358324d8cabb66897904338d68f971bc13c600dad53c4a787d92eb62c2415750ffefe40e8c6edb5ff7
SSDEEP 12288:DeZ1IyZ7d0NxksRpWE9FRHSfNm1wgbIxnBw7dzE+e3gxZC6LgjigDy5fdv8fWi+/:SZuoCks7WE9F5pwg8zmdqQjC60jiHkU
TLSH
T169E412A533D434F6E7534239CCE6A745C7B27C626B7543CF1280662B2E32AD16D39B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 fd1dc8fc859250d5ffe9f9b3e632059e0dcca094b2a9e1c78e8775927892f84f
MD5 175cfc8db41b87c7c2bb233b6ccde730
SHA1 ef840e14c3aa9ed21d5a78f05f06f610262d25a3
SHA512 2a6d6657d04f9806cc59247e0d9cad2db780228bb83b1137ffdf50798300023990df2e3fe65f5073cdfcefd57f91a3bca98f12f9c45aa483738eb1ae9f4a5f36
SSDEEP 98304:zQRQyi36YOcPbLvw2gAf+PN3LC17DVqFJU:iQyiKa/X+PNbiD4bU
TLSH
T156667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 bea4ca86000cc974a405d1ed9806ec26e25468fc82e9e88d3ba612dc8b2fbcf4
MD5 ac867f35858d2d240cd7791348118a2d
SHA1 fa8eb3ea60f35273a9ae55cddfac7e0c532dc382
SHA512 c358c36f123c6a6252ac0c33a2d91acc6af15303d211d8a3ff7193d2369243b8dd92b7fbdc6d77a5d3036abd20674bd8c7127439edf4afa4cbc43f1bbb087579
SSDEEP 98304:rQRQyi36YOcPbLvw2gAf+PN3LC17DVqFJU:aQyiKa/X+PNbiD4bU
TLSH
T141667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 8556372c92537bdba003b0f10cceeb21614776ba88065f3f95994bde718b8f96
MD5 e13aec50b89808a220b441157a2db385
SHA1 97f9121c9457a307687c9acd74750a4288a81f9d
SHA512 46e3b72a704ca3209f4e141ac289e885f042fa2c249d7e2ec9bd330023caeddf2023b22159fded7136d55da43d37541c76e0882d294ea51818e23d28df51bedc
SSDEEP 49152:668Qg55nhceWu7PNU3/5Cks7R9L58UqFJjskU:othLRc/5C17DVqFJU
TLSH
T1D3B54933B2F60099C44DE1769F4A972196D27C71CFE0E3DB8541721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 d2223dd822b0da6b6cb369c1cf5ae26f7896fb0b21fcef08a094872b9daf3514
MD5 651d966d48a092ea61ac497e07d92c89
SHA1 d410d2f596ab51625008e1d6304fa780b1e22b2d
SHA512 84cdf54c74b5382cfcc9d309d4638c42e6a55c6919fa68c5c30efbe35639debcec7f569bd53132c287a12f873cbb92873a285d1089140631e7ce15983d252455
SSDEEP 98304:Ry5112gYy5azzVvt69nLKnhZkC17DVqFJU:sLIHEWheiD4bU
TLSH
T1DB167B13F29900E8D05DD179878A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 f69c34ffa73bb2c32deee6fc19fc4974fdb48286886de97a692e282b741b4906
MD5 567934517f7886939bf5e8a05f9e8385
SHA1 f0439592e59b52d01a1852c663417c95e157a102
SHA512 ccce636ad8b00158c1756aff08156336df2bc28e97662e8a93192a22348786442e6acff65069ccedec689cd2b4144d2beab306414dfa84d1083b6376a4e36efd
SSDEEP 49152:WB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glTCks7R9L58UqFJjskU:ku6Jmdxd2dTC17DVqFJU
TLSH
T148D59D13F1DA01E8D05ED578974AA233EA62BC490B34B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 715280f4f4e72ccb51cc8937111b20250c52b1ac4ba9c0025227608376325973
MD5 e81fa0f49b6ffd3b989f995b7477dead
SHA1 e6e785b8897cb7b726e9a87726113fd9b56b033b
SHA512 a5d788f2402810f1f64f42c8dddbd0742b65d6aedce5966e85e2095333cfa0c5c282db5c2bcdd23c64b5dec0c89915b335e449858f82b24f6efbeb34af3ec190
SSDEEP 49152:D1hpsNoJpF1A63U44CwH7R4xPCks7R9L58UqFJjskU:DmifPWRGC17DVqFJU
TLSH
T115B5BE13F2D900E8D05ED17887569632EA62BC460B34B6DF0A90B7961F7BBE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 ee3586fac9c7366bc896f90625fb40d329136adee0f9143d9d486ee9a6ca7c7e
MD5 f00934d3405d3323fcb6d6067ffd23b8
SHA1 8571c9f8c39e30f8b4c777e5e707bfacc423ed8d
SHA512 56b18dbe92f99eb46effe8b5c18cf2f02db8ce7e95303d35f0cceb7238489c0637049aef4756920972424d71ce402850ea6d383b04edda9cb50a457c8fac49bd
SSDEEP 49152:qSuZQIY0Be2KcRVtOnks6NMHqoCks7R9L58UqFJjskU:05dKii61oC17DVqFJU
TLSH
T169C5BE13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 26128aae2c4a69046bdfba207169dd925220248bfd2357bd1f79ae014e34f0fc
MD5 d9e9970c7e9d08710a7f624e6a9b3b7b
SHA1 90914a36b625c2c76c557922c251154afeaff65f
SHA512 08da58299ebc66aebb68ff76898fa079148565927cb7972f7cf33e7cf94e723f0bf482dfff19302f36ea8530c22e1270beeafc5615a533bbd5127eba859355d6
SSDEEP 49152:mhtSn8EApI0fig3giDn0AP5wDCks7R9L58UqFJjskU:nX2imphiC17DVqFJU
TLSH
T17095BE13F2D900E8D05ED178C7468632E962BC150B39BAEF0A90B7561E7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 da5637de05300527567f77afedc40a0e7e3f80e81fc10e39ce02289f4434c373
MD5 0c391528b68302b035a2840df1eb3fec
SHA1 2f990ecf624a66783352ac6e9c7c9475c1e897ee
SHA512 bc3139a9eeec0acbf40ac5aa32b0455a03db939031bb8a9751f9b64f4c1f38c66b3667904e36f2f6e479f3a558d2eb1ef4034a263e1a0804a7ae78a6bc7c45cf
SSDEEP 12288:iM7d0NxksRpWE9FRHSfNm1wgbIxnBw7dzE+e3gxZC6LgjigDy5fdv8fWi+S:iMCks7WE9F5pwg8zmdqQjC60jiHkU
TLSH
T107C423A0B6872C83FF05433289D7B7D949E47E61ED895513F6C4B93B2C782E8B488D85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 bdeaa65bbd8b32d6c9457db54076aedc7a9cd751392efd38e87ff0bfeab4cfc9
MD5 ee4df261fb5e4124ef11c7099fc676e0
SHA1 5ed27d3f0aff6b970d21afec586d292c13e87785
SHA512 b723d454825ab66b538264247b0f06d96ec5a8caf86c7036ea4d2229c3a05c1a4a3f45e458955ff4e23c76136ef6038f1aef3e2b05542c4b133563636d37d365
SSDEEP 12288:kt7d0NxksRpWE9FRHSfNm1wgbIxnBw7dzE+e3gxZC6LgjigDy5fdv8fWi+S:ktCks7WE9F5pwg8zmdqQjC60jiHkU
TLSH
T114C423B0B6971C83FF05423289C7B7D949A07E62ED895513F6C4B93B3C782E8B489D85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 2fe86fe7fb856dd79ddfe7d1410929c954017fc2d9529f0e590192bba7bb6b5b
MD5 3f11f3453e0b6b48c21303cda464f714
SHA1 66c62e2dbcc27178296d5fe2600b9c511443a9b3
SHA512 c283766dd91e296d2c07e9612ff5a792f6053d7d580faad9909dcf31e1fb796f5419996c1016d07d2aed11d2a0e0d6a84fcb72780b3c5b288745db06e425951d
SSDEEP 12288:y37d0NxksRpWE9FRHSfNm1wgbIxnBw7dzE+e3gxZC6LgjigDy5fdv8fWi+S:y3Cks7WE9F5pwg8zmdqQjC60jiHkU
TLSH
T13FC423A0B6971C83FF05423689C7B7D949E07E62ED895513F6C4B93B3C782E8B488D85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 1e77b262e5282726276a37b8e6ecd624bfce716fb22e9e8ea826ad676eb3eb91
MD5 b59e466e162c12e00428d69328516a7a
SHA1 a5be32128cce54e2fa56cd2be8306b85dde74f62
SHA512 a687204d57a3a501bf7c56ee60de43deda9e5f3e6489fe656184847adca51fc8a23759872251ca531dec22ca0fb36e9d000f235579a20f16a7988834b56e192e
SSDEEP 12288:nVG7d0NxksRpWE9FRHSfNm1wgbIxnBw7dzE+e3gxZC6LgjigDy5fdv8fWi+l:cCks7WE9F5pwg8zmdqQjC60jiHkU
TLSH
T15BD423A0739B18C3FF068335C8D7B7958AF17DA1EE55561BE680792B1C703E4B868E81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 adb6a227b8ba4c6dc04e3e5202d568c650b5a35901bcb92cf604b298c0d5d80d
MD5 3885c5776fd7e6ce09f6b4595f97a6fa
SHA1 3f04d749867f2e124e0b63934cc461680a5e18a3
SHA512 3adc7cdd32869ef470c0c639e31246212fe4f234a6f586534e75a692a9a8e0afc79403bd237cf02e6356880005df7dcba1aa379d10699bd06e6529cc858af20e
SSDEEP 12288:3+7d0NxksRpWE9FRHSfNm1wgbIxnBw7dzE+e3gxZC6LgjigDy5fdv8fWi+Y:3+Cks7WE9F5pwg8zmdqQjC60jiHkU
TLSH
T102C423A0B6971C83FF05423689C7B7D949E07E62ED895513F6C4B93B2C782F8B488D85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 2b92a98764d3cf4d27fa7d380752c20d7b7d08735787b1dc55c887b90a9122b9
MD5 959c9cf9f55ee6e5f6e1a66a66fdced5
SHA1 b0e071fc132dc1f4dcd47ec6c2a1445add93b080
SHA512 b473a47e3f1a673932d162c923399834fd6f5a5c25d954c88eb296feb31bcf645ed87802f4d1f117a5cae4f190dea9b0089714bd123083f4f2d07744285612a0
SSDEEP 12288:PR7d0NxksRpWE9FRHSfNm1wgbIxnBw7dzE+e3gxZC6LgjigDy5fdv8fWi+Y:PRCks7WE9F5pwg8zmdqQjC60jiHkU
TLSH
T17BC423A0B6971C83FF05423289D7B7D949A07E62ED895513F6C4B93B3C782F8B488D85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 eb1c8b5ea415f3478d532a2a7cd694fd8609714e45f2dbfea7a0ca7334dc23b0
MD5 fb73f5e1bc9261d7d4e8002103e93af8
SHA1 09052eb0cc535fa3e2dbdd61efa194d455f0c82f
SHA512 27421f82bf23f17e31fcf685f417f5c3b5549574c1525fab6d8dbcab2beb98b6c64fb5d45d52602c453a1b2588f3442bd23a61978206d0e7491ef22e00ca256b
SSDEEP 12288:Vl7d0NxksRpWE9FRHSfNm1wgbIxnBw7dzE+e3gxZC6LgjigDy5fdv8fWi+Z:VlCks7WE9F5pwg8zmdqQjC60jiHkU
TLSH
T110C423B0B6871C83FF05423689CAB7D949A47E61ED895513F6C4B93B3C782F8B488D85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 97b1ee1d2ff8f9efbfb840e4bfb28375accc7f1a25acd67586b62b48e25895f3
MD5 9cccbb0b8e7061d4b839e12c380be619
SHA1 90e6440d44e58663974d380c958f19abda36a447
SHA512 b8fd198b2b9403c0e28daa5b2865c4c4a4c7d53b06246f7179e4074e302eaf66084c74963cb422f657e48c262b662c140fb231ebdfc210967583e2a5640e1ea1
SSDEEP 24576:XZMRzFVSONCks7WE9F5pwg8zmdqQjC60jiHkU:XZMRzfBCks7R9L58UqFJjskU
TLSH
T1C60501A4B3901CF5ED67823EC9569A46D6B27C164B60C61F13E4362B1F333A11C2EF96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 1d13ed36e0bf57e005eee18b7bd1eab196ef1c54b0a61f358b4d3e16d2b630f0
MD5 8f719a1b4566f7f76ca30eabeb246658
SHA1 5d56b11507f2f9cf0135dcf2ad01a7eee3fbc60f
SHA512 af1e76135cf99f571ca099165eab9536cff62c3b0a13f5f62235a3d5dece3d9c0688796aafd2f78c28829ade172912e2224f312be1cc171708555f6c4998aa0d
SSDEEP 12288:gY7d0NxksRpWE9FRHSfNm1wgbIxnBw7dzE+e3gxZC6LgjigDy5fdv8fWi+F:gYCks7WE9F5pwg8zmdqQjC60jiHkU
TLSH
T1F9C423A0B6971C83FF05023689C7B7D949E47E61ED895513F6C8B93B3C782E8B488D85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 78df4b6dcda74b0a008c85c24df08b2782b64fc7fedadcc5351a98c3ab68582e
MD5 7bdab33207eec984cfaaae3768a61e75
SHA1 63e43a708f6bc5258a1083e509c80830cbd96d30
SHA512 dd4c8f3c93e54f64b904f8d79d77a963a591ed501d1e62a940f7cfae626b89facc948f6540935fff86ac3850e927b50773a3167217ee125df88ee6c01a31dc39
SSDEEP 12288:rU7d0NxksRpWE9FRHSfNm1wgbIxnBw7dzE+e3gxZC6LgjigDy5fdv8fWi+I:rUCks7WE9F5pwg8zmdqQjC60jiHkU
TLSH
T122C423B0B6971C83FF05423689C7B7D949A47E61ED895113F6C8B93B3C782E8B488D85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 1902d228554c1495c539ad5279b609a62f5e1da855095c6446707866b797d444
MD5 1b4448cc896a629894de571613d5916a
SHA1 2e978dc10a5a50eb54f1483f7e276dbacbdcc0e3
SHA512 3ae1008e95fa40adcbefafdb69ac50a3f7231232d21ed580497006ca27bcbd9432b6a782165c6a8c6639e815c3f85783e9fbbfcefa7419cb5215be551cf7d5e3
SSDEEP 12288:tyPz5L8Z7d0NxksRpWE9FRHSfNm1wgbIxnBw7dzE+e3gxZC6LgjigDy5fdv8fWiv:EzyZCks7WE9F5pwg8zmdqQjC60jiHkU
TLSH
T1AFF4125373A230F6E6268235C8925B46E7B17C324B648A5F5784573B2E372E09D3EF60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 0f66aefeba03f40f8a260a0598ad7ec1f21fb7896526d7e7049f70a046da0b22
MD5 7b959bfbf45b2bc7a6c6429caccf8b22
SHA1 8b98c060355213d9cc042d01edd58985babd157e
SHA512 29e5bb48bfefc902d853bb605af5d6356daa1e27b82570b53b2d7cf70fb7b452d4d10d7b612ad860aea9f953a74655e2dfb9c4fb26ea516f7c913a897e3968d5
SSDEEP 12288:OY7d0NxksRpWE9FRHSfNm1wgbIxnBw7dzE+e3gxZC6LgjigDy5fdv8fWi+d:OYCks7WE9F5pwg8zmdqQjC60jiHkU
TLSH
T141C423A0B6871C83FF05423689C7B7D949E47E61ED895513F6C4B93B3C781E8B488D85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 d0511cfd1249b17a5cbd69fe9c396267463bf41c480f3a8eb630bece675f400b
MD5 16a83e23cb606382884f001d5b41fb44
SHA1 063f3944b8ef9029046888f834ee37c3a8447221
SHA512 44e2f41218e06b082077100026ee58ec00b5acfc12ea376e32564f7e6a172231dd47f0b5c7a1f3e1bd1cb0406457465b01a840834abc7f59ee87f47d12c8c3ae
SSDEEP 12288:wY7d0NxksRpWE9FRHSfNm1wgbIxnBw7dzE+e3gxZC6LgjigDy5fdv8fWi+d:wYCks7WE9F5pwg8zmdqQjC60jiHkU
TLSH
T10CC423A0B6872C83FF05023689C7B7D949E47E62ED895513F6C4B93B3C781E8B488D85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 4dbaef82d7fd760d2474736948df9b1b7f5aba1e2b65ca238fc3abdd6c686219
MD5 0e10a0a9739f65191a2f9412aeeea96e
SHA1 98d5b00867737e4e40bdb7e9af7a9ffa8a4ca3a6
SHA512 4ac1c8122f89572bf37a2de77f14758523cb91357fa90ce6728d0de62c68e020687e5d0a833bb819ae97b5844b5a9a7943ef25057f9447d9e378f150e368333f
SSDEEP 24576:sCU3pvPDv4Ex1hfe7i8WVq2lIGU8lrtGUJLPuwvAbCks7WE9F5pwg8zmdqQjC60U:sCUZPTY+8Wg2lIL8lrIUJLWw+Cks7R9t
TLSH
T16B65BE1DA3DC0896D4BB81358A518A06EB727C2E1B22D6CF2160C73D2F67EE55E35F06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 2285373576cdfb3a6109f3f97f1f35efb3192f8f1d6f4f7e43c251e2bd6cf6aa
MD5 bc8446d69119d9aa21ff87d51ffaa2bd
SHA1 ab9e6458aea55594eb3e86d693146dc8cc91df6f
SHA512 dff830d3c9406dda0fafe1f68a5d386fd395bb198cea778c7dffa7b0a6a12c31453069c6fdca2d05d2d3b21732c91522c2cb36b58d34a564f6b6d4f7ed374658
SSDEEP 12288:Kbsfo7d0NxksRpWE9FRHSfNm1wgbIxnBw7dzE+e3gxZC6LgjigDy5fdv8fWi+i:hoCks7WE9F5pwg8zmdqQjC60jiHkU
TLSH
T1F6E40155E29801D5D51E6235CB869A81B7737C218BE1D3CB62C0F93E1F792D0ADE9B03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 21905729b5b7894304a36452a52560f4faa603d13572c880db2d6c521121f08c
MD5 13240aa8e7b0d3a1a97972c90941a64a
SHA1 bb8919bbffcf967f8d50dd4355c3c8342ef6ee79
SHA512 a3f0bb9b30ff0da8280ee36ef70f10b692cda96ea3940c77babac3b0b577c078c03713e9aa6ec5d919795ead461a5188cdfe3fc5b6546bc3b3905f58a3dd285b
SSDEEP 12288:FX7d0NxksRpWE9FRHSfNm1wgbIxnBw7dzE+e3gxZC6LgjigDy5fdv8fWi+6:FXCks7WE9F5pwg8zmdqQjC60jiHkU
TLSH
T1B5D423A0F38A2C83FF1A533144DBF7A505697E60DF489583F5847A2B28785E4ECB4E46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 5e13c205f951b9ecbd0c54ac8cc673fbde4fde565ac00023d6b26593a91db04c
MD5 38f52282900dcafb7795fdbaf45c9714
SHA1 3b42673425071da65dfbb03fdd4145786510777f
SHA512 1097efb232d4f745e766c0be550324903ef40967ea4a8f759a169fddc5fb875c3d7f2c5a281a0760575a44e73521defeee79bd0fe11e458c1d8fe86184b087bc
SSDEEP 49152:+RZwQCyiHiQEaiPnMgCks7R9L58UqFJjskU:U9xPP9C17DVqFJU
TLSH
T15085BF1E62DC46A5E0BAD278CDA74407E6B27816473197CF1190C27E1E27EF49E3AB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 676KB
SHA256 f93df85ed3f02d32dbf4cfa2e966a430e5e10f83310b88214e26404956d2c590
MD5 a3fafcc3b8efe8024a38f466c3b879a7
SHA1 ab25780ec28e1c0d00267ba13229eab104b6ccf0
SHA512 d1d5e75fca347e9f5fa776118d471dff88bbe32d34c92e237b25a490d47b2c9bbe7e9aae18a120c70e2f0c3e7fcdb63c1ef53082ac4af8372d684acabc4fd0b3
SSDEEP 12288:DbxA1U7KH7d0NxksRpWE9FRHSfNm1wgbIxnBw7dzE+e3gxZC6LgjigDy5fdv8fW2:DbxA1UGHCks7WE9F5pwg8zmdqQjC60jI
TLSH
T169E4127D629D28E2F666923D89D69206C7717C225B1493DF60C0D23F1F3AAE4AC35F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 10af1f575421ca7d08c779025f3031776325eafd5ebd3dc6bcfe6257534369ad
MD5 b87940a764b2add8131348b61c0b209e
SHA1 973f0bafb8640843273ae63db8fad11607f8fc23
SHA512 a9e629e9ae50fe66a5fcca008ca7405bb1b1d5eba0953e0f2a792c069a37a46cfb41b83fb327f01dac79c6e184d9c670aa4323059e3ba52ee2e49064978f3c10
SSDEEP 24576:QjsmP0yHaqrVqHra44KDzMsrn2Cks7WE9F5pwg8zmdqQjC60jiHkU:QjRP0yHfVqzlAsrn2Cks7R9L58UqFJjI
TLSH
T1C745AF2EF2B910F9D8AAD136454107B5AB71782D1F209AC70170C635AF0AEE89F35F5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 596KB
SHA256 be2ccc936552c68f637634b7e42356c62ce0ef2341915fe5ed8106109db428e0
MD5 543b587f1de7fb7851905b9f90d41011
SHA1 c0df2fdd66b84fcfe5623bd7e7d75c615a8bb644
SHA512 8dedfaa58c499eda4b15e45a5a4751ff1480bcd8ef16fcd4e4749cfc85da68a5ea7eaf6cbc6e955cc7094577760413938b6e0a6be7fe0eb5976ed6c044f13bb5
SSDEEP 12288:bx7d0NxksRpWE9FRHSfNm1wgbIxnBw7dzE+e3gxZC6LgjigDy5fdv8fWi+Y:bxCks7WE9F5pwg8zmdqQjC60jiHkU
TLSH
T17AD423E0B2472C83FF05433649C6B7D949A07E21DF895653B4C4B93B2C782E9A8B5D85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 940KB
SHA256 fb29dbd699a7dde3107bb8015278a764744ee4b1482947a11a55c5cc9f6de7e2
MD5 34e670de1b828c13bbd70f5b110cef8c
SHA1 e37cf804129aec94f1e0579e8821b3e916cc930f
SHA512 6a7c97356b7c8cdc05dffc58812d4accd865d6a6b154729cf83897e1424c2c25e7d8515fbb02329d815bf56cc2b2ea3bb1f2ef53026c91e52cc75d311d5b63ee
SSDEEP 24576:cbLBUTDCks7WE9F5pwg8zmdqQjC60jiHkU:cbLBUvCks7R9L58UqFJjskU
TLSH
T138250154F79504F5ED2B823CC9A79A16D6B2B85D0764E7DF03988B261E233E14E3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 800KB
SHA256 e790e1a6c3fa5e91549b06d1a51b28212d6ca47619ed6ecb6d7954484fd90509
MD5 3c40fe0bcbe4058f144df83abe10643d
SHA1 41a4cafd8a52193803895cbd71a28ee9ae314014
SHA512 eea981052da7a99d052b0c02577769e25bda2e33865bf88901f11b325710e2cd3b90d2a2453964015ba079ef249152901592e888e350131f8ab5d0823435c0d3
SSDEEP 24576:XpYNHSCks7WE9F5pwg8zmdqQjC60jiHkU:XpYtSCks7R9L58UqFJjskU
TLSH
T18305F22E629D1CD5E63B917D8AC38649F2727862175192CF05E0C27E1E27EE8BC3DB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 6e5d9aba00b37a36c95631ed0f9a5c6f13fd3af043a2e771e261a35be7050dcc
MD5 0ea0e2006b1c298ab2a0cd038b7487da
SHA1 113f3211c81690da743a34d9df8f405df5162714
SHA512 27d1cf82dd2856148047be9c869902afb21155a00220f7eace2e76edb7fae3a6dc325dbd333e01ef8b1597dcb676c26689f42da12e05eb599963ef7c00a6aba0
SSDEEP 24576:knXoJjNYH84VVSNAApoEmP66aspcrcHBjSSKHPWdQwPF3hJ8ssmOc+XLxu+x7uKw:knXoJJYH84VVS6AmEOJas+cHBjSSKHP
TLSH
T1E165BFADA2BC04D9D5BBD17DC5C25506F5B178621331C6CF026082BA3F27AF5AE39B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 511d7a519ed03df306958f708f1594f06d01ad1c9db581aced503030b987d0cf
MD5 9359822c963eefb83d576a7262aff807
SHA1 16928cedf8410a2e3113bebdc4cf567198dde702
SHA512 31e9c5634557269660d7ecdf0ee0d062f6e1478320e485431ab07bbb69681f2bba2686fdbf5bffde4ed934539be38ad9a615a7962692f5d4d56df563b0ce573a
SSDEEP 49152:WDLL9TuJ0M/TYj2PRCks7R9L58UqFJjskU:19C17DVqFJU
TLSH
T1BF858C5EA3EC42D4E47BD6BD85A79146FAB2B855273081CF0290856E1F23BF05D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.3MB
SHA256 957e908be13e380e3dca39297333f121cc3bc30ed0184f2ba8dc55a706cf1de8
MD5 358f2d359f44dcd290c5b5cea7486f25
SHA1 3d1babc94652d3239008b41de771b86686815ac3
SHA512 554e0deb032929b1688f1306f15d25fd1b7226f4be255991751ac5d0c86fa25285757afa2b8cc7de9ead6b37e3ca52c7a3f88e92de3ce2c5fdbe526b2723a80f
SSDEEP 24576:6egJgpwJOmPOHWAKk8ZguIGyPsxr5Vin10wDCks7WE9F5pwg8zmdqQjC60jiHkU:6ngOJOmPOHzDCks7R9L58UqFJjskU
TLSH
T11655BF3FB7BC15D5E03EC17D8A968916F6B1782613255ACF0190827E1F2BEE46E39B01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 904KB
SHA256 50b10389556e8579c82d19df1b392ce4e713ee1c574c2c372e5d393cabc4413c
MD5 ffa85c1fcba1d77fa1899e625b441e60
SHA1 2d27db317375498b9705c2343b08548304e8816d
SHA512 a5324b736da64ac88db4ef58f8e6983b5a0475dfd190a8b0ce0a56acf5a522d3cebf2e13c403765a5ca1b5bfcafa7548061ce3067da383d873975c715cc18b10
SSDEEP 24576:FLJnJiTk3R3waE4JrORCks7WE9F5pwg8zmdqQjC60jiHkU:FLJnJK8R304lGCks7R9L58UqFJjskU
TLSH
T19C15D03CD2A810E9E477C2B4815A2756FF31386C2F2569CB69A4D5353F12FE0A979F08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 0a118c065bc3282890240d45490f31a24c380255d172ce68b24751e316548ef7
MD5 922615fbd0e8a1da748135ed7f6afd8f
SHA1 cc8a5e788857e9ff77cced85cd629df420957419
SHA512 e4b1cd1897532e254e4010c0aa0fba8dc82321e2c1553fc09580c1ebe0ce07ca61ec98ebca2e801e80c81afb8d028012d164d0430b6887053a8be28400942b7a
SSDEEP 49152:L9mqCzDScAZmlvTcFg8Ph6lCks7R9L58UqFJjskU:PyC17DVqFJU
TLSH
T150955C15F7EB5298E8B3CAF1C96294159B327C409B34F7DF4A80CA6A1E32BD1D538B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 676KB
SHA256 9f3462aa6f02dad69c8497b3c87b7295f6e1d217933c7677e3b3b74c2d5e5790
MD5 2bc88a7e826fb90f56d2160e3ea042fc
SHA1 9f2690af9bc8d3d14432bf0e9c98157a4663d96d
SHA512 0fc566e74f1700fed218ded7a9b574bae2b06f63cae8314f96db258f67e1ebfbda0b91456da6cf4535385dc6f9dfcb42869aba311d7529d0593d0fc5905e0a5c
SSDEEP 12288:qlYJeXm5nkEUuEz7d0NxksRpWE9FRHSfNm1wgbIxnBw7dzE+e3gxZC6LgjigDy5y:qlYJeXm5jUuEzCks7WE9F5pwg8zmdqQL
TLSH
T101E412AC769D34E2F61E813989D29A44D3B1F8715B4163EFA1C0D13F0E76AE56D38E80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 732KB
SHA256 ee20efe2becdc221ff2dbc9bbcc12081f63ec6f96ea33b295450f5262b805bac
MD5 b47eeee7ffe9d53edd36c82852e49aee
SHA1 8cd1534e2ec33922dce43635b67581189c217804
SHA512 3085f309af89ae08d05ccb5401cc26d008a3f0d95c45bea99cb2ec148a496392ab2331d400bb0ae679805405f61f3637b3fcb61af9009431bb0c5a1c01174fd9
SSDEEP 12288:Imu6kyW7d0NxksRpWE9FRHSfNm1wgbIxnBw7dzE+e3gxZC6LgjigDy5fdv8fWi+H:I7tyWCks7WE9F5pwg8zmdqQjC60jiHkU
TLSH
T1BAF41250739528D6FB6A0639C9A392948E75BC209F1453DFA1C0FA3F2E357E4A874F42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 604KB
SHA256 bd8acba2bd7a843b25ae76eaf5565ed3713be33bec9556625346b9ab5dfbe691
MD5 4ac9694b842d702d709ed43c10a4f7ad
SHA1 131e7de40edc4c567500edc80bcef9dcfe768357
SHA512 4a0559a106e9f54f2df92126801e8964087ed9c662ff75b4cd7e89604bb1e53c82abbfb896bd633d939c81485fc0674b47f3aed15a5cfc81e09b2c0e7a8423fc
SSDEEP 12288:ZPD7d0NxksRpWE9FRHSfNm1wgbIxnBw7dzE+e3gxZC6LgjigDy5fdv8fWi+x:dDCks7WE9F5pwg8zmdqQjC60jiHkU
TLSH
T10AD423A4B2973883FF06423584DBB7D545B07E30EF486567B4C0F93B2D782E5A8A4D85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 3cdf5b7bf9a241809b2fdf67d372545953f7fcb6715803d912580450e875878d
MD5 ef4c37f903fd3a91a3848949b2d3352d
SHA1 4911ffc23b96dbb0330e5887bccc7c585186a53c
SHA512 e0836af0e38dbc8827ee52cbad96e86f81376608fcc9a83a6829d875987ec999c59227c29d0aa2fcbfd744c8383667a45976f7a1c64a49953bb155e885d97882
SSDEEP 24576:IC+TyQIu93VAumZr7jmICks7WE9F5pwg8zmdqQjC60jiHkU:I/TfIq+YICks7R9L58UqFJjskU
TLSH
T115559D1DA7E91DCAE276C675C8A34493EA33B872177186CF2044C07D499EEE8AE74F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 768KB
SHA256 d75743cb9bf96578f13a19399e18fcbdade281bf7dfeb91f77e7c8fd43be60d0
MD5 487746d913de113b3479c1156dbbd2f8
SHA1 b3fdb3e3b0282c8a7ec2f6891031a65ec9ba0174
SHA512 d7ae20983b9e92898864c6e0ea0fb8f640822411f8864ebc18c3042982f1bb7161b36601531ce39796446f88f74883c04d333ddd6c1926246aa8191d21c1f39c
SSDEEP 12288:9cyrWOstaa3kcs/7d0NxksRpWE9FRHSfNm1wgbIxnBw7dzE+e3gxZC6LgjigDy5m:4LQikZ/Cks7WE9F5pwg8zmdqQjC60jiZ
TLSH
T189F4F11EB3AB1096E567823C88864256F6B378305B1263DF52D0C73E1EA75E9BD38F41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 f5ff173d1a57f15a229847b2f68234261bb2a8e06544fc58eb95e7e631263098
MD5 e8dcaee098c00390be829acebc2b2d5d
SHA1 e8e0155d85885d446af2e1837f550e4e172e3f48
SHA512 b8b328616b416a57aea9f5c879ce107b3e9ccb4fbcf00ff54c668e299f0e48fdddb5b7d4fb099c1763de75020ed189157338c788525bb2216c3991c0a227264c
SSDEEP 49152:MpJFwrPpGyqWo6cbT2TZ8maJO35NPHXogsS7Q78ZGAvL9vnF35LWAPWCks7R9L5P:NpC7b4+80GTkdC17DVqFJU
TLSH
T13AA57C3DE2B810ADD9AAC375C5461665EE71382E3F2015DB01B0C578BF1AEF19A38F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 72fc94e71d6352e4c62cb2993efdaa3c9ce9ba33e2fdf63329879878bca61154
MD5 49091d186727a863aa12f1aea2a9b1ec
SHA1 77764247dd7fdf9350111e3ccd5833c8d33d7a80
SHA512 fd106d50c59b0b8c9f277f81be3f146e4dba4a0d50cc92ca31bd26b5765eb5214819790c1461df4563972ba2005ef10e4316c7e31bd66087bdb8a28b08fa48e8
SSDEEP 24576:JSAwJPE1IDAo+4Kt+l4413JUQeCks7WE9F5pwg8zmdqQjC60jiHkU:JqPCIo4Kol4vQeCks7R9L58UqFJjskU
TLSH
T14255B02AB7F956E5E17AC774C663C601FB727822133163CF9290813E0E169E89E79F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 956KB
SHA256 7a165aa6350ac9c1ec078f18eb208248281a063fbe7614be0ca4fefc1e562183
MD5 863df69551ad79d3906be96bee5c5e09
SHA1 21574114c5baab10186e360e90d8ada8190ac459
SHA512 474d0a7ba0a4c5f8f7ffda6c03c102e09b8f641b7e48c103741a681e8b5760e7911f4fc9d72d09a3723188df0c7c3f2a41cbb57215dbb90f758af82080c28c24
SSDEEP 24576:vyLXPLcw94tOCks7WE9F5pwg8zmdqQjC60jiHkU:vy7PoXtOCks7R9L58UqFJjskU
TLSH
T1F725E03DE66D08E5E57AC27CC6A38906F6723CAD032166CB15D0917A1F6BEF46939F00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StructuredQuerySchema.bin

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin
Size 414KB
SHA256 e67e330837a6b2f6d5f76815e7235a512b54b1c90f2ad62a3e9d142ae6939c8d
MD5 16b9618962f5623ca791a1366eee5708
SHA1 f0d257511952f075b2a0ec7d8e8730c3e464461a
SHA512 18e1d5a105b87fc72df94645685f5a8d3f593df2d3a9b8652b3b4a4ceaf92d3c7a67b0c08847186149dd608428cae8f1b3bc844bc7aacfc9e3219da823ca2fe2
SSDEEP 12288:vMUC7+vlk3n61mSkplXZ5RwmF9n4w/TSD:vXhl6V/i
TLSH
T124945F36BF88CB22C59A15748897C01A2E30A7C49E04CF6B73DC513CFA576685FBA359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 744KB
SHA256 139e95ac5cfe99d65ebe8a77024072922ea66b24d17459caa6b77628712fba3a
MD5 7ada1680199d875fe1aa18b6acf4a43c
SHA1 d3969d0ea5a7039633fef8770f0e21e9053c5aae
SHA512 1ad0c3fd2dabcb3119171788ec80fddd6c453c843c397a84a4d7274b0d9ec41365f926e78812e6d8371218bac99fd705e8daa03dffd821426d26d22fb1031a74
SSDEEP 12288:h9lyvj3IkxjbBzP7d0NxksRpWE9FRHSfNm1wgbIxnBw7dzE+e3gxZC6LgjigDy5k:hWv8qjpPCks7WE9F5pwg8zmdqQjC60jI
TLSH
T127F4126D62D428C6FA294334D5A7926580B1BD725B68AAFF70C4E93B0F346D0E43EF01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/892-273-0x0000000140000000-0x00000001400BA000-memory.dmp

Download

memory/892-90-0x0000000000E30000-0x0000000000E90000-memory.dmp

Download

memory/892-96-0x0000000000E30000-0x0000000000E90000-memory.dmp

Download

memory/1056-270-0x0000000140000000-0x00000001400C2000-memory.dmp

Download

memory/1056-460-0x0000000140000000-0x00000001400C2000-memory.dmp

Download

memory/1056-239-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/1236-132-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/1236-261-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/1236-126-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/1372-260-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/1432-264-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/1432-163-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/1528-423-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/1528-14-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/1528-22-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/1528-13-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/1676-229-0x0000000000BD0000-0x0000000000C30000-memory.dmp

Download

memory/1676-269-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/1676-223-0x0000000000BD0000-0x0000000000C30000-memory.dmp

Download

memory/2288-265-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/2288-175-0x0000000000E00000-0x0000000000E60000-memory.dmp

Download

memory/2288-169-0x0000000000E00000-0x0000000000E60000-memory.dmp

Download

memory/2320-475-0x000002401E960000-0x000002401E970000-memory.dmp

Download

memory/2320-470-0x000002401E960000-0x000002401E970000-memory.dmp

Download

memory/2320-476-0x000002401E960000-0x000002401E970000-memory.dmp

Download

memory/2320-474-0x000002401E960000-0x000002401E970000-memory.dmp

Download

memory/2320-477-0x000002401E960000-0x000002401E970000-memory.dmp

Download

memory/2320-478-0x000002401E960000-0x000002401E970000-memory.dmp

Download

memory/2320-479-0x000002401E960000-0x000002401E970000-memory.dmp

Download

memory/2320-464-0x000002401E960000-0x000002401E970000-memory.dmp

Download

memory/2320-471-0x000002401E960000-0x000002401E970000-memory.dmp

Download

memory/2320-472-0x000002401E960000-0x000002401E970000-memory.dmp

Download

memory/2320-473-0x000002401E960000-0x000002401E970000-memory.dmp

Download

memory/2320-481-0x000002401E960000-0x000002401E970000-memory.dmp

Download

memory/2320-469-0x000002401E960000-0x000002401E970000-memory.dmp

Download

memory/2320-468-0x000002401E960000-0x000002401E970000-memory.dmp

Download

memory/2320-467-0x000002401E960000-0x000002401E970000-memory.dmp

Download

memory/2320-480-0x000002401E960000-0x000002401E970000-memory.dmp

Download

memory/2320-483-0x000002401E960000-0x000002401E970000-memory.dmp

Download

memory/2320-484-0x000002401E960000-0x000002401E970000-memory.dmp

Download

memory/2320-482-0x000002401E960000-0x000002401E970000-memory.dmp

Download

memory/2320-466-0x000002401E960000-0x000002401E970000-memory.dmp

Download

memory/2320-465-0x000002401E960000-0x000002401E970000-memory.dmp

Download

memory/2336-455-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2336-62-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/2336-81-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2336-68-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/2400-266-0x0000000140000000-0x00000001400E3000-memory.dmp

Download

memory/2400-185-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/2400-179-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/2432-199-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/2432-201-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/2432-195-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/2844-57-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2844-59-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2844-454-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2844-51-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2956-219-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/2956-268-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/2956-459-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/3108-275-0x0000000001C30000-0x0000000001C40000-memory.dmp

Download

memory/3108-250-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/3108-244-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/3108-291-0x0000000001EE0000-0x0000000001EF0000-memory.dmp

Download

memory/3108-309-0x000000000A520000-0x000000000A528000-memory.dmp

Download

memory/3108-271-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3108-461-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3148-35-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/3148-36-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/3148-27-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/3172-203-0x0000000000BC0000-0x0000000000C20000-memory.dmp

Download

memory/3172-267-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/3172-209-0x0000000000BC0000-0x0000000000C20000-memory.dmp

Download

memory/3340-111-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/3340-307-0x0000000140000000-0x00000001400CA000-memory.dmp

Download

memory/3340-117-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/3680-9-0x0000000000590000-0x00000000005F0000-memory.dmp

Download

memory/3680-0-0x0000000140000000-0x000000014018C000-memory.dmp

Download

memory/3680-272-0x0000000140000000-0x000000014018C000-memory.dmp

Download

memory/3680-1-0x0000000000590000-0x00000000005F0000-memory.dmp

Download

memory/3748-72-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/3748-78-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/3748-83-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/3748-85-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/3892-86-0x0000000000DF0000-0x0000000000E50000-memory.dmp

Download

memory/3892-39-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/3892-88-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/3892-40-0x0000000000DF0000-0x0000000000E50000-memory.dmp

Download

memory/3892-48-0x0000000000DF0000-0x0000000000E50000-memory.dmp

Download

memory/4124-136-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/4124-262-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/4124-142-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/4124-458-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/4124-456-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/4280-107-0x0000000000850000-0x00000000008B0000-memory.dmp

Download

memory/4280-274-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/4280-101-0x0000000000850000-0x00000000008B0000-memory.dmp

Download

memory/4876-263-0x0000000140000000-0x0000000140098000-memory.dmp

Download

memory/4876-153-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/4876-147-0x0000000000780000-0x00000000007E0000-memory.dmp

Download